6.18.21-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.18.21-rc1 review
This is the start of the stable review cycle for the 6.18.21 release. There are 309 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2026 16:16:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.21-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.21-rc1
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Hao-Yu Yang <[email protected]>
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
Peter Zijlstra <[email protected]>
futex: Require sys_futex_requeue() to have identical flags
Biju Das <[email protected]>
irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common()
David Howells <[email protected]>
netfs: Fix the handling of stream->front by removing it
GuoHan Zhao <[email protected]>
xen/privcmd: unregister xenstore notifier on module exit
Filipe Manana <[email protected]>
btrfs: fix lost error when running device stats on multiple devices fs
Shin'ichiro Kawasaki <[email protected]>
btrfs: fix leak of kobject name for sub-group space_info
Mark Harmstone <[email protected]>
btrfs: fix super block offset in error message in btrfs_validate_super()
David Howells <[email protected]>
netfs: Fix read abandonment during retry
Christian Brauner <[email protected]>
selftests/mount_setattr: increase tmpfs size for idmapped mount tests
Tomi Valkeinen <[email protected]>
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
Tuo Li <[email protected]>
dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
Deepanshu Kartikey <[email protected]>
netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
Deepanshu Kartikey <[email protected]>
netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
Alexander Stein <[email protected]>
dmaengine: xilinx: xdma: Fix regmap init error handling
LUO Haowen <[email protected]>
dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA.
Felix Gu <[email protected]>
phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix leaking event log memory
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix freeing the allocated ida too late
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix memory leak when a wq is reset
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix not releasing workqueue on .release()
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix possible invalid memory access after FLR
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix crash when the event log is disabled
Lorenzo Stoakes (Oracle) <[email protected]>
mm/mseal: update VMA end correctly on merge
Werner Kasselman <[email protected]>
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
Jinjiang Tu <[email protected]>
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
Josh Law <[email protected]>
mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure
SeongJae Park <[email protected]>
mm/damon/core: avoid use of half-online-committed context
SeongJae Park <[email protected]>
mm/damon/stat: monitor all System RAM resources
Yang Wang <[email protected]>
drm/amd/pm: fix amdgpu_irq enabled counter unbalanced on smu v11.0
Benno Lossin <[email protected]>
rust: pin-init: internal: init: document load-bearing fact of field accessors
Peter Zijlstra <[email protected]>
unwind_user/x86: Fix arch=um build
Hari Bathini <[email protected]>
powerpc64/bpf: do not increment tailcall count when prog is NULL
Markus Niebel <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
Theodore Ts'o <[email protected]>
ext4: always drain queued discard work in ext4_mb_release()
Baokun Li <[email protected]>
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
Theodore Ts'o <[email protected]>
ext4: handle wraparound when searching for blocks for indirect mapped blocks
Zqiang <[email protected]>
ext4: fix the might_sleep() warnings in kvfree()
Jiayuan Chen <[email protected]>
ext4: fix use-after-free in update_super_work when racing with umount
Helen Koike <[email protected]>
ext4: reject mount if bigalloc with s_first_data_block != 0
Ye Bin <[email protected]>
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
Edward Adam Davis <[email protected]>
ext4: avoid infinite loops caused by residual data
Tejas Bharambe <[email protected]>
ext4: validate p_idx bounds in ext4_ext_correct_indexes
Ye Bin <[email protected]>
ext4: test if inode's all dirty pages are submitted to disk
Li Chen <[email protected]>
ext4: publish jinode after initialization
Yuto Ohnuki <[email protected]>
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Jan Kara <[email protected]>
ext4: make recently_deleted() properly work with lazy itable initialization
Jan Kara <[email protected]>
ext4: fix fsync(2) for nojournal mode
Zhang Yi <[email protected]>
ext4: do not check fast symlink during orphan recovery
Jan Kara <[email protected]>
ext4: fix stale xarray tags after writeback
Deepanshu Kartikey <[email protected]>
ext4: convert inline data to extents when truncate exceeds inline size
Simon Weber <[email protected]>
ext4: fix journal credit check when setting fscrypt context
Darrick J. Wong <[email protected]>
xfs: remove file_path tracepoint data
Darrick J. Wong <[email protected]>
xfs: don't irele after failing to iget in xfs_attri_recover_work
Long Li <[email protected]>
xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
hongao <[email protected]>
xfs: scrub: unlock dquot before early return in quota scrub
Yuto Ohnuki <[email protected]>
xfs: avoid dereferencing log items after push callbacks
Yuto Ohnuki <[email protected]>
xfs: save ailp before dropping the AIL lock in push callbacks
Yuto Ohnuki <[email protected]>
xfs: stop reclaim before pushing AIL during unmount
Max Boone <[email protected]>
mm/pagewalk: fix race between concurrent split and refault
Josh Law <[email protected]>
mm/damon/sysfs: check contexts->nr in repeat_call_fn
Josh Law <[email protected]>
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
Asad Kamal <[email protected]>
drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6
Huacai Chen <[email protected]>
LoongArch: KVM: Handle the case that EIOINTC's coremap is empty
Huacai Chen <[email protected]>
LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
Huacai Chen <[email protected]>
LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
Xi Ruoyao <[email protected]>
LoongArch: vDSO: Emit GNU_EH_FRAME correctly
Li Jun <[email protected]>
LoongArch: Fix missing NULL checks for kstrdup()
Ville Syrjälä <[email protected]>
drm/i915: Unlink NV12 planes earlier
Ville Syrjälä <[email protected]>
drm/i915: Order OP vs. timeout correctly in __wait_for()
Imre Deak <[email protected]>
drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state
Alex Hung <[email protected]>
drm/amd/display: Fix drm_edid leak in amdgpu_dm
Eric Huang <[email protected]>
drm/amdgpu: prevent immediate PASID reuse case
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Protect the driver specific lists
Joy Zou <[email protected]>
dmaengine: fsl-edma: fix channel parameter config for fixed channel requests
Stefan Eichenberger <[email protected]>
i2c: imx: ensure no clock is generated after last read
Stefan Eichenberger <[email protected]>
i2c: imx: fix i2c issue when reading multiple messages
Davidlohr Bueso <[email protected]>
futex: Clear stale exiting pointer in futex_lock_pi() retry path
Pratap Nirujogi <[email protected]>
i2c: designware: amdisp: Fix resume-probe race condition issue
Jassi Brar <[email protected]>
irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
Milos Nikic <[email protected]>
jbd2: gracefully abort on checkpointing state corruptions
Sean Christopherson <[email protected]>
KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE
Sean Christopherson <[email protected]>
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Kevin Hao <[email protected]>
net: macb: Use dev_consume_skb_any() to free TX SKBs
Kevin Hao <[email protected]>
net: macb: Protect access to net_device::ip_ptr with RCU lock
Kevin Hao <[email protected]>
net: macb: Move devm_{free,request}_irq() out of spin lock area
Greg Kroah-Hartman <[email protected]>
scsi: ses: Handle positive SCSI error from ses_recv_diag()
Tyllis Xu <[email protected]>
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
Amir Goldstein <[email protected]>
ovl: fix wrong detection of 32bit inode numbers
Fei Lv <[email protected]>
ovl: make fsync after metadata copy-up opt-in mount option
Abel Vesa <[email protected]>
phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
Nikunj A Dadhania <[email protected]>
x86/fred: Fix early boot failures on SEV-ES/SNP guests
Borislav Petkov (AMD) <[email protected]>
x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
Nikunj A Dadhania <[email protected]>
x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
Joanne Koong <[email protected]>
writeback: don't block sync for filesystems with no data integrity guarantees
Zhan Xusheng <[email protected]>
alarmtimer: Fix argument order in alarm_timer_forward()
Jiucheng Xu <[email protected]>
erofs: add GFP_NOIO in the bio completion if needed
xietangxin <[email protected]>
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Zubin Mithra <[email protected]>
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
Paul Moses <[email protected]>
xfrm: iptfs: only publish mode_data after clone setup
Roshan Kumar <[email protected]>
xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
Yuchan Nam <[email protected]>
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
Sanman Pradhan <[email protected]>
hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
Sanman Pradhan <[email protected]>
hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read
Marc Zyngier <[email protected]>
KVM: arm64: Discard PC update state on vcpu reset
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Correct locked bit width
Abhijit Gangurde <[email protected]>
RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()
Srinivas Pandruvada <[email protected]>
thermal: intel: int340x: soc_slider: Set offset only for balanced mode
Charles Mirabile <[email protected]>
kbuild: Delete .builtin-dtbs.S when running make clean
Viresh Kumar <[email protected]>
cpufreq: conservative: Reset requested_freq on limits change
Marc Kleine-Budde <[email protected]>
can: netlink: can_changelink(): add missing error handling to call can_ctrlmode_changelink()
Oliver Hartkopp <[email protected]>
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
Ali Norouzi <[email protected]>
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
Peter Ujfalusi <[email protected]>
ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
Guangshuo Li <[email protected]>
ASoC: sma1307: fix double free of devm_kzalloc() memory
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd934x: fix typo in dt parsing
Alexey Nepomnyashih <[email protected]>
ALSA: firewire-lib: fix uninitialized local variable
Zhang Heng <[email protected]>
ALSA: hda/realtek: add quirk for ASUS Strix G16 G615JMR
Mario Limonciello <[email protected]>
Revert "ALSA: hda/intel: Add MSI X870E Tomahawk to denylist"
Hyunwoo Kim <[email protected]>
ksmbd: do not expire session on binding failure
Werner Kasselman <[email protected]>
ksmbd: fix memory leaks and NULL deref in smb2_lock()
Namjae Jeon <[email protected]>
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
Namjae Jeon <[email protected]>
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
Matthew Auld <[email protected]>
drm/xe: always keep track of remap prev/next
Luo Haiyang <[email protected]>
tracing: Fix potential deadlock in cpu hotplug with osnoise
Vasily Gorbik <[email protected]>
s390/entry: Scrub r12 register on kernel entry
Vasily Gorbik <[email protected]>
s390/barrier: Make array_index_mask_nospec() __always_inline
Greg Kroah-Hartman <[email protected]>
s390/syscalls: Add spectre boundary for syscall dispatch table
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP
Marc Kleine-Budde <[email protected]>
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix clock leak on PLL lock failure
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
Marc Buerg <[email protected]>
sysctl: fix uninitialized variable in proc_do_large_bitmap
Guenter Roeck <[email protected]>
hwmon: (pmbus/core) Protect regulator operations with mutex
Guenter Roeck <[email protected]>
hwmon: (pmbus) Introduce the concept of "write-only" attributes
Guenter Roeck <[email protected]>
hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
Sanman Pradhan <[email protected]>
hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
Weiming Shi <[email protected]>
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
Danilo Krummrich <[email protected]>
spi: use generic driver_override infrastructure
Matt Roper <[email protected]>
drm/xe: Implement recent spec updates to Wa_16025250150
Alice Ryhl <[email protected]>
rust: regulator: do not assume that regulator_get() returns non-null
Jihed Chaibi <[email protected]>
ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match
Yussuf Khalil <[email protected]>
drm/amd/display: Do not skip unrelated mode changes in DSC validation
Felix Gu <[email protected]>
spi: meson-spicc: Fix double-put in remove path
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix the device initialization
Felix Gu <[email protected]>
spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
Youngjun Park <[email protected]>
PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()
Alberto Garcia <[email protected]>
PM: hibernate: Drain trailing zero pages on userspace restore
Samasth Norway Ananda <[email protected]>
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
Luca Leonardo Scorcia <[email protected]>
drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
Mike Rapoport (Microsoft) <[email protected]>
x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
Yihang Li <[email protected]>
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
Shengjiu Wang <[email protected]>
ASoC: fsl: imx-card: initialize playback_only and capture_only
Shiraz Saleem <[email protected]>
RDMA/irdma: Harden depth calculation functions
Tatyana Nikolova <[email protected]>
RDMA/irdma: Return EINVAL for invalid arp index error
Anil Samal <[email protected]>
RDMA/irdma: Fix deadlock during netdev reset with active connections
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
Ivan Barrera <[email protected]>
RDMA/irdma: Clean up unnecessary dereference of event->cm_node
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
Tatyana Nikolova <[email protected]>
RDMA/irdma: Update ibqp state to error if QP is already in error state
Jacob Moroni <[email protected]>
RDMA/irdma: Initialize free_qp completion before using it
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP
Ethan Tidmore <[email protected]>
RDMA/efa: Fix possible deadlock
Chuck Lever <[email protected]>
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
Sean Rhodes <[email protected]>
ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
Andy Shevchenko <[email protected]>
regmap: Synchronize cache for the page selector
Yonatan Nachum <[email protected]>
RDMA/efa: Fix use of completion ctx after free
Yonatan Nachum <[email protected]>
RDMA/efa: Improve admin completion context state machine
Yonatan Nachum <[email protected]>
RDMA/efa: Check stored completion CTX command ID with received one
Paolo Valerio <[email protected]>
net: macb: use the current queue number for stats
David Carlier <[email protected]>
netfilter: ctnetlink: use netlink policy range checks
Weiming Shi <[email protected]>
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: revisit array resize logic
Ren Wei <[email protected]>
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Weiming Shi <[email protected]>
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Chuck Lever <[email protected]>
tls: Purge async_hold in tls_decrypt_async_wait()
Pengpeng Hou <[email protected]>
Bluetooth: btusb: clamp SCO altsetting table indices
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not tracking outstanding TX ident
Cen Zhang <[email protected]>
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
Zhang Chen <[email protected]>
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
Miguel Ojeda <[email protected]>
dma-mapping: add missing inline for dma_free_attrs
Sabrina Dubroca <[email protected]>
rtnetlink: fix leak of SRCU struct in rtnl_link_register
Thangaraj Samynathan <[email protected]>
net: lan743x: fix duplex configuration in mac_link_up
Jiayuan Chen <[email protected]>
team: fix header_ops type confusion with non-Ethernet ports
Xuan Zhuo <[email protected]>
virtio-net: correct hdr_len handling for tunnel gso
Xuan Zhuo <[email protected]>
virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN
Wei Fang <[email protected]>
net: enetc: fix the output issue of 'ethtool --show-ring'
Martin KaFai Lau <[email protected]>
udp: Fix wildcard bind conflict check when using hash2
Qingfang Deng <[email protected]>
net: airoha: add RCU lock around dev_fill_forward_path
Yochai Eisenrich <[email protected]>
net: fix fanout UAF in packet_release() via NETDEV_UP race
Kuniyuki Iwashima <[email protected]>
ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
Kuniyuki Iwashima <[email protected]>
ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
Kohei Enju <[email protected]>
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
Petr Oros <[email protected]>
ice: use ice_update_eth_stats() for representor stats
Petr Oros <[email protected]>
ice: fix inverted ready check for VF representors
David McFarland <[email protected]>
platform/x86: intel-hid: disable wakeup_mode during hibernation
Alok Tiwari <[email protected]>
platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
Nathan Chancellor <[email protected]>
platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head
Li RongQing <[email protected]>
platform/x86: ISST: Check HWP support before MSR access
Justin Chen <[email protected]>
net: bcmasp: fix double disable of clk
Justin Chen <[email protected]>
net: bcmasp: fix double free of WoL irq
Justin Chen <[email protected]>
net: bcmasp: streamline early exit in probe
Sabrina Dubroca <[email protected]>
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
Sabrina Dubroca <[email protected]>
rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size
Qi Tang <[email protected]>
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
Yang Yang <[email protected]>
openvswitch: validate MPLS set/set_masked payload length
Yang Yang <[email protected]>
openvswitch: defer tunnel netdev_put to RCU release
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid releasing netdev before teardown completes
Jakub Kicinski <[email protected]>
nfc: nci: fix circular locking dependency in nci_close_device
Mohammad Heib <[email protected]>
ionic: fix persistent MAC address override on PF
Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Helen Koike <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Anas Iqbal <[email protected]>
Bluetooth: hci_ll: Fix firmware leak on error path
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
Hyunwoo Kim <[email protected]>
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Minseo Park <[email protected]>
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
Amelie Delaunay <[email protected]>
pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC
Oliver Hartkopp <[email protected]>
can: statistics: add missing atomic access in hot path
Sheng Yong <[email protected]>
erofs: set fileio bio failed in short read case
Shigeru Yoshida <[email protected]>
dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
Eric Dumazet <[email protected]>
af_key: validate families in pfkey_send_migrate()
Minwoo Ra <[email protected]>
xfrm: prevent policy_hthresh.work from racing with netns teardown
Hyunwoo Kim <[email protected]>
xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
Dmitry Torokhov <[email protected]>
pinctrl: renesas: rza1: Normalize return value of gpio_get()
Fernando Fernandez Mancera <[email protected]>
xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
Felix Gu <[email protected]>
pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
Sabrina Dubroca <[email protected]>
esp: fix skb leak with espintcp and async crypto
Sabrina Dubroca <[email protected]>
xfrm: call xdo_dev_state_delete during state update
Sabrina Dubroca <[email protected]>
xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
Sabrina Dubroca <[email protected]>
xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
Peter Yin <[email protected]>
i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
Zhang Heng <[email protected]>
ALSA: hda/realtek: add quirk for ASUS UM6702RC
Alan Borzeszkowski <[email protected]>
spi: intel-pci: Add support for Nova Lake mobile SPI flash
Jie Deng <[email protected]>
usb: core: new quirk to handle devices with zero configurations
Yang Wang <[email protected]>
drm/amdgpu: fix gpu idle power consumption issue for gfx v12
Chaitanya Kulkarni <[email protected]>
nvmet: move async event work off nvmet-wq
Josh Poimboeuf <[email protected]>
objtool: Handle Clang RSP musical chairs
Uzair Mughal <[email protected]>
ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
Zhang Heng <[email protected]>
ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone
Liucheng Lu <[email protected]>
ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
Hari Bathini <[email protected]>
powerpc64/ftrace: fix OOL stub count with clang
Boris Burkov <[email protected]>
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
zhidao su <[email protected]>
sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
Günther Noack <[email protected]>
HID: apple: avoid memory leak in apple_report_fixup()
Eduard Zingerman <[email protected]>
bpf: Fix u32/s32 bounds when ranges cross min/max boundary
Simon Trimmer <[email protected]>
ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts
Maarten Lankhorst <[email protected]>
drm/ttm/tests: Fix build failure on PREEMPT_RT
wangdicheng <[email protected]>
ALSA: hda/senary: Ensure EAPD is enabled during init
Nilay Shroff <[email protected]>
block: break pcpu_alloc_mutex dependency on freeze_lock
Isaac J. Manjarres <[email protected]>
dma-buf: Include ioctl.h in UAPI header
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
Sheetal <[email protected]>
ALSA: hda/hdmi: Add Tegra238 HDA codec device ID
Oliver Freyermuth <[email protected]>
ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU
Florian Fuchs <[email protected]>
scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
Shuming Fan <[email protected]>
ASoC: rt1321: fix DMIC ch2/3 mask issue
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
Ihor Solodrai <[email protected]>
module: Fix kernel panic when a symbol st_shndx is out of bounds
Denis Benato <[email protected]>
HID: asus: add xg mobile 2023 external hardware support
Romain Sioen <[email protected]>
HID: mcp2221: cancel last I2C command on read error
Antheas Kapenekakis <[email protected]>
platform/x86: oxpec: Add support for OneXPlayer X1 Air
Antheas Kapenekakis <[email protected]>
platform/x86: oxpec: Add support for Aokzoe A2 Pro
Thomas Weißschuh <[email protected]>
kbuild: install-extmod-build: Package resolve_btfids if necessary
Valentin Spreckels <[email protected]>
net: usb: r8152: add TRENDnet TUC-ET2G
Antheas Kapenekakis <[email protected]>
platform/x86: oxpec: Add support for OneXPlayer X1z
Takashi Iwai <[email protected]>
HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
Antheas Kapenekakis <[email protected]>
platform/x86: oxpec: Add support for OneXPlayer APEX
Zhang Lixu <[email protected]>
HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs
Günther Noack <[email protected]>
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
Julius Lehmann <[email protected]>
HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
Keith Busch <[email protected]>
nvme-pci: ensure we're polling a polled queue
Hans de Goede <[email protected]>
platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
Leif Skunberg <[email protected]>
platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support
Daniel Hodges <[email protected]>
nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
Keith Busch <[email protected]>
nvme-pci: cap queue creation to used queues
Peter Metz <[email protected]>
platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
Günther Noack <[email protected]>
HID: asus: avoid memory leak in asus_report_fixup()
Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support
Xuewen Yan <[email protected]>
tracing: Revert "tracing: Remove pid in task_rename tracing output"
Daniel Wade <[email protected]>
bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
Jenny Guanni Qu <[email protected]>
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
Ihor Solodrai <[email protected]>
bpf: Fix exception exit lock checking for subprogs
Cui Chao <[email protected]>
cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Release module BTF IDR before module unload
Danilo Krummrich <[email protected]>
driver core: platform: use generic driver_override infrastructure
Danilo Krummrich <[email protected]>
driver core: generalize driver_override in struct device
Danilo Krummrich <[email protected]>
sh: platform_early: remove pdev->driver_override check
Danilo Krummrich <[email protected]>
hwmon: axi-fan: don't use driver_override as IRQ name
Smita Koralahalli <[email protected]>
cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
Janosch Frank <[email protected]>
s390/mm: Add missing secure storage access fixups for donated memory
Peter Zijlstra <[email protected]>
perf: Make sure to use pmu_ctx->pmu for groups
Peter Zijlstra <[email protected]>
x86/perf: Make sure to program the counter value for stopped events on migration
Sachin Kumar <[email protected]>
bpf: Fix constant blinding for PROBE_MEM32 stores
Yazhou Tang <[email protected]>
bpf: Reset register ID for BPF_END value tracking
Alison Schofield <[email protected]>
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../devicetree/bindings/sound/st,stm32-sai.yaml | 2 +- Documentation/filesystems/overlayfs.rst | 50 +++ Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 6 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++ arch/arm64/kvm/reset.c | 14 + arch/loongarch/include/asm/linkage.h | 36 ++ arch/loongarch/include/asm/sigframe.h | 9 + arch/loongarch/kernel/asm-offsets.c | 2 + arch/loongarch/kernel/env.c | 7 +- arch/loongarch/kernel/signal.c | 6 +- arch/loongarch/kvm/intc/eiointc.c | 2 +- arch/loongarch/kvm/vcpu.c | 3 + arch/loongarch/pci/pci.c | 80 ++++ arch/loongarch/vdso/Makefile | 4 +- arch/loongarch/vdso/sigreturn.S | 6 +- arch/powerpc/net/bpf_jit_comp64.c | 23 +- arch/powerpc/tools/ftrace-gen-ool-stubs.sh | 4 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/entry.S | 3 + arch/s390/kernel/syscall.c | 5 +- arch/s390/mm/fault.c | 11 +- arch/sh/drivers/platform_early.c | 4 - arch/x86/coco/sev/noinstr.c | 6 + arch/x86/entry/entry_fred.c | 14 + arch/x86/events/core.c | 4 +- arch/x86/include/asm/unwind_user.h | 4 + arch/x86/kernel/cpu/common.c | 20 +- arch/x86/kvm/mmu/mmu.c | 17 +- arch/x86/platform/efi/quirks.c | 2 +- block/blk-mq.c | 45 ++- drivers/acpi/ec.c | 2 + drivers/base/bus.c | 43 ++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 +++ drivers/base/platform.c | 37 +- drivers/base/regmap/regmap.c | 30 +- drivers/bluetooth/btintel.c | 11 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/bus/simple-pm-bus.c | 4 +- drivers/clk/imx/clk-scu.c | 3 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 3 + drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cxl/core/hdm.c | 25 +- drivers/cxl/core/port.c | 8 +- drivers/cxl/pmem.c | 2 +- drivers/dma/dw-edma/dw-hdma-v0-core.c | 6 +- drivers/dma/fsl-edma-main.c | 26 +- drivers/dma/idxd/cdev.c | 8 +- drivers/dma/idxd/device.c | 6 +- drivers/dma/idxd/init.c | 4 +- drivers/dma/idxd/submit.c | 2 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 ++-- drivers/dma/xilinx/xdma.c | 4 +- drivers/dma/xilinx/xilinx_dma.c | 46 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c | 45 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 7 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 +- drivers/gpu/drm/i915/display/intel_display.c | 8 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.c | 20 +- drivers/gpu/drm/i915/display/intel_dp_tunnel.h | 11 +- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/gpu/drm/i915/display/intel_plane.c | 11 +- drivers/gpu/drm/i915/i915_wait_util.h | 2 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 9 +- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 4 +- drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_pt.c | 12 +- drivers/gpu/drm/xe/xe_vm.c | 22 +- drivers/gpu/drm/xe/xe_vm_types.h | 4 + drivers/gpu/drm/xe/xe_wa.c | 3 +- drivers/hid/hid-apple.c | 7 +- drivers/hid/hid-asus.c | 18 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 12 + drivers/hwmon/adm1177.c | 54 +-- drivers/hwmon/axi-fan-control.c | 2 +- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/ina233.c | 3 +- drivers/hwmon/pmbus/isl68137.c | 21 +- drivers/hwmon/pmbus/pmbus_core.c | 192 ++++++++-- drivers/i2c/busses/i2c-designware-amdisp.c | 11 +- drivers/i2c/busses/i2c-imx.c | 51 ++- drivers/i3c/master/dw-i3c-master.c | 2 + drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/efa/efa_com.c | 175 ++++----- drivers/infiniband/hw/ionic/ionic_controlpath.c | 4 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/uk.c | 39 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/irqchip/irq-renesas-rzv2h.c | 2 +- drivers/media/mc/mc-request.c | 5 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/net/can/dev/netlink.c | 4 +- drivers/net/ethernet/airoha/airoha_ppe.c | 2 + drivers/net/ethernet/broadcom/asp2/bcmasp.c | 66 ++-- drivers/net/ethernet/cadence/macb_main.c | 41 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 31 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 5 +- drivers/net/ethernet/microchip/lan743x_main.c | 5 + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/team/team_core.c | 65 +++- drivers/net/tun_vnet.h | 2 +- drivers/net/usb/r8152.c | 1 + drivers/net/virtio_net.c | 7 +- drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 11 +- drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/core.c | 14 +- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/rdma.c | 1 + drivers/phy/qualcomm/phy-qcom-qmp-ufs.c | 3 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/pinctrl/renesas/pinctrl-rza1.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzt2h.c | 1 + drivers/pinctrl/stm32/Kconfig | 1 + drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/hp/hp-wmi.c | 8 + drivers/platform/x86/intel/hid.c | 23 +- .../x86/intel/speed_select_if/isst_tpmi_core.c | 5 +- drivers/platform/x86/lenovo/wmi-gamezone.c | 2 - drivers/platform/x86/oxpec.c | 30 +- drivers/platform/x86/touchscreen_dmi.c | 18 + drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 + drivers/scsi/scsi_devinfo.c | 2 +- drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-meson-spicc.c | 2 - drivers/spi/spi-sn-f-ospi.c | 17 +- drivers/spi/spi.c | 19 +- .../int340x_thermal/processor_thermal_soc_slider.c | 8 +- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 5 + drivers/virt/coco/tdx-guest/tdx-guest.c | 12 +- drivers/xen/privcmd.c | 3 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/volumes.c | 5 +- fs/erofs/fileio.c | 6 +- fs/erofs/zdata.c | 3 + fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 23 +- fs/ext4/fast_commit.c | 17 +- fs/ext4/fsync.c | 16 +- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 10 +- fs/ext4/inode.c | 75 +++- fs/ext4/mballoc.c | 30 +- fs/ext4/page-io.c | 10 +- fs/ext4/super.c | 16 +- fs/ext4/sysfs.c | 10 +- fs/fs-writeback.c | 18 +- fs/fuse/file.c | 4 +- fs/fuse/inode.c | 1 + fs/jbd2/checkpoint.c | 15 +- fs/netfs/buffered_read.c | 3 +- fs/netfs/direct_read.c | 3 +- fs/netfs/direct_write.c | 15 +- fs/netfs/iterator.c | 43 +++ fs/netfs/read_collect.c | 4 +- fs/netfs/read_retry.c | 5 +- fs/netfs/read_single.c | 1 - fs/netfs/write_collect.c | 4 +- fs/netfs/write_issue.c | 3 +- fs/overlayfs/copy_up.c | 6 +- fs/overlayfs/overlayfs.h | 21 ++ fs/overlayfs/ovl_entry.h | 7 +- fs/overlayfs/params.c | 33 +- fs/overlayfs/super.c | 2 +- fs/overlayfs/util.c | 5 +- fs/smb/server/oplock.c | 72 ++-- fs/smb/server/smb2pdu.c | 73 ++-- fs/xfs/scrub/quota.c | 4 +- fs/xfs/scrub/trace.h | 12 +- fs/xfs/xfs_attr_item.c | 5 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.h | 47 ++- fs/xfs/xfs_trans_ail.c | 26 +- include/linux/damon.h | 6 + include/linux/device.h | 54 +++ include/linux/device/bus.h | 4 + include/linux/dma-mapping.h | 4 +- include/linux/fs.h | 1 + include/linux/mempolicy.h | 1 + include/linux/netfs.h | 1 - include/linux/pagemap.h | 11 - include/linux/platform_device.h | 5 - include/linux/spi/spi.h | 5 - include/linux/swapops.h | 27 +- include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/linux/virtio_net.h | 53 ++- include/net/bluetooth/l2cap.h | 2 +- include/net/inet_hashtables.h | 14 + include/net/ip6_fib.h | 21 +- include/sound/cs35l56.h | 1 + include/trace/events/netfs.h | 8 +- include/trace/events/task.h | 7 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + kernel/bpf/btf.c | 24 +- kernel/bpf/core.c | 43 ++- kernel/bpf/verifier.c | 36 +- kernel/dma/swiotlb.c | 21 +- kernel/events/core.c | 19 +- kernel/futex/core.c | 2 +- kernel/futex/pi.c | 3 +- kernel/futex/syscalls.c | 8 + kernel/module/main.c | 7 + kernel/power/main.c | 2 +- kernel/power/snapshot.c | 11 + kernel/sched/ext.c | 2 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_osnoise.c | 10 +- mm/damon/core.c | 8 + mm/damon/stat.c | 36 +- mm/damon/sysfs.c | 10 +- mm/mempolicy.c | 10 +- mm/mseal.c | 5 +- mm/pagewalk.c | 25 +- net/bluetooth/l2cap_core.c | 103 +++-- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 2 +- net/bluetooth/sco.c | 10 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/isotp.c | 24 +- net/can/proc.c | 3 +- net/core/rtnetlink.c | 28 +- net/ipv4/esp4.c | 9 +- net/ipv4/inet_connection_sock.c | 20 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/esp6.c | 9 +- net/ipv6/ip6_fib.c | 15 +- net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/route.c | 2 +- net/key/af_key.c | 19 +- net/netfilter/nf_conntrack_expect.c | 4 + net/netfilter/nf_conntrack_netlink.c | 16 +- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 14 +- net/netfilter/nfnetlink_log.c | 8 +- net/netfilter/nft_set_rbtree.c | 92 ++++- net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-netdev.c | 11 +- net/packet/af_packet.c | 1 + net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/xfrm/xfrm_iptfs.c | 17 +- net/xfrm/xfrm_nat_keepalive.c | 2 +- net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_state.c | 1 + net/xfrm/xfrm_user.c | 7 +- rust/kernel/regulator.rs | 33 +- rust/pin-init/src/macros.rs | 16 + scripts/package/install-extmod-build | 4 + sound/firewire/amdtp-stream.c | 2 +- sound/hda/codecs/hdmi/tegrahdmi.c | 1 + sound/hda/codecs/realtek/alc269.c | 42 ++- sound/hda/codecs/realtek/alc662.c | 9 + sound/hda/codecs/senarytech.c | 5 + sound/hda/controllers/intel.c | 1 - sound/soc/amd/acp/amd-acp63-acpi-match.c | 413 +++++++++++++++++++++ sound/soc/codecs/adau1372.c | 34 +- sound/soc/codecs/cs35l56-shared.c | 16 +- sound/soc/codecs/cs35l56.c | 8 + sound/soc/codecs/rt1320-sdw.c | 5 +- sound/soc/codecs/sma1307.c | 6 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/fsl/imx-card.c | 2 + sound/soc/intel/boards/sof_sdw.c | 8 + sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/soc/samsung/i2s.c | 6 +- sound/soc/sof/ipc4-topology.c | 2 +- sound/usb/quirks.c | 2 + tools/objtool/arch/x86/decode.c | 68 ++-- tools/objtool/check.c | 14 + .../testing/selftests/bpf/prog_tests/reg_bounds.c | 62 +++- .../testing/selftests/bpf/progs/exceptions_fail.c | 9 +- .../selftests/mount_setattr/mount_setattr_test.c | 2 +- 316 files changed, 3581 insertions(+), 1178 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/309 cxl/port: Fix use after free of parent_port in cxl_detach_ep()
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit 19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4 ]
cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing:
First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this:
[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
[]mutex_unlock+0xd/0x20
[]cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20
[]devres_release_all+0xa8/0xe0
[]device_unbind_cleanup+0xd/0xa0
[]really_probe+0x1a6/0x3e0
Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep().
Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port.
Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep().
This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present.
--- drivers/cxl/core/port.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cxl/core/port.c +6 -2
@@ -553,10 +553,13 @@ static void cxl_port_release(struct device *dev)xa_destroy (&port->dports);xa_destroy (&port->regions);ida_free (&cxl_port_ida, port->id); -if (is_cxl_root (port)) + +if (is_cxl_root (port)) {kfree (to_cxl_root (port)); -else + }else { +put_device (dev->parent);kfree (port); + } } static ssize_t decoders_committed_show(struct device *dev,
@@ -722,6 +725,7 @@ static struct cxl_port *cxl_port_alloc(struct device *uport_dev,struct cxl_port *iter; dev->parent = &parent_port->dev; +get_device (dev->parent); port->depth = parent_port->depth +1 ; port->parent_dport = parent_dport;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/309 bpf: Reset register ID for BPF_END value tracking
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazhou Tang <[email protected]>
[ Upstream commit a3125bc01884431d30d731461634c8295b6f0529 ]
When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar ID with another register (e.g., after an r1 = r0 assignment), this tie must be broken.
Currently, the verifier misses resetting dst_reg->id to 0 for BPF_END. Consequently, if a conditional jump checks the swapped register, the verifier incorrectly propagates the learned bounds to the linked register, leading to false confidence in the linked register's value and potentially allowing out-of-bounds memory accesses.
Fix this by explicitly resetting dst_reg->id to 0 in the BPF_END case to break the scalar tie, similar to how BPF_NEG handles it via __mark_reg_known.
--- kernel/bpf/verifier.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/bpf/verifier.c +7 -0
@@ -15431,6 +15431,13 @@ static void scalar_byte_swap(struct bpf_reg_state *dst_reg, struct bpf_insn *ins/* Apply bswap if alu64 or switch between big-endian and little-endian machines */ bool need_bswap = alu64 || (to_le == is_big_endian); +/* +* If the register is mutated, manually reset its scalar ID to break +* any existing ties and avoid incorrect bounds propagation. +*/ +if (need_bswap || insn->imm ==16 || insn->imm ==32 ) + dst_reg->id =0 ; +if (need_bswap) {if (insn->imm ==16 ) dst_reg->var_off =tnum_bswap16 (dst_reg->var_off);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/309 bpf: Fix constant blinding for PROBE_MEM32 stores
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Kumar <[email protected]>
[ Upstream commit 2321a9596d2260310267622e0ad8fbfa6f95378f ]
BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unblinded into JIT-compiled native code when bpf_jit_harden >= 1.
The root cause is that convert_ctx_accesses() rewrites BPF_ST|BPF_MEM to BPF_ST|BPF_PROBE_MEM32 for arena pointer stores during verification, before bpf_jit_blind_constants() runs during JIT compilation. The blinding switch only matches BPF_ST|BPF_MEM (mode 0x60), not BPF_ST|BPF_PROBE_MEM32 (mode 0xa0). The instruction falls through unblinded.
Add BPF_ST|BPF_PROBE_MEM32 cases to bpf_jit_blind_insn() alongside the existing BPF_ST|BPF_MEM cases. The blinding transformation is identical:
load the blinded immediate into BPF_REG_AX via mov+xor, then convert the immediate store to a register store (BPF_STX).
The rewritten STX instruction must preserve the BPF_PROBE_MEM32 mode so the architecture JIT emits the correct arena addressing (R12-based on x86-64). Cannot use the BPF_STX_MEM() macro here because it hardcodes BPF_MEM mode; construct the instruction directly instead.
--- kernel/bpf/core.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
kernel/bpf/core.c +21 -0
@@ -1403,6 +1403,27 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from, *to++ =BPF_ALU64_IMM (BPF_XOR ,BPF_REG_AX , imm_rnd); *to++ =BPF_STX_MEM (from->code, from->dst_reg,BPF_REG_AX , from->off);break ; + +case BPF_ST |BPF_PROBE_MEM32 |BPF_DW : +case BPF_ST |BPF_PROBE_MEM32 |BPF_W : +case BPF_ST |BPF_PROBE_MEM32 |BPF_H : +case BPF_ST |BPF_PROBE_MEM32 |BPF_B : + *to++ =BPF_ALU64_IMM (BPF_MOV ,BPF_REG_AX , imm_rnd ^ + from->imm); + *to++ =BPF_ALU64_IMM (BPF_XOR ,BPF_REG_AX , imm_rnd); +/* +* Cannot use BPF_STX_MEM() macro here as it +* hardcodes BPF_MEM mode, losing PROBE_MEM32 +* and breaking arena addressing in the JIT. +*/ + *to++ = (struct bpf_insn ) { + .code =BPF_STX |BPF_PROBE_MEM32 | +BPF_SIZE (from->code), + .dst_reg = from->dst_reg, + .src_reg =BPF_REG_AX , + .off = from->off, + }; +break ; } out:return to - to_buff;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/309 x86/perf: Make sure to program the counter value for stopped events on migration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit f1cac6ac62d28a9a57b17f51ac5795bf250c12d3 ]
Both Mi Dapeng and Ian Rogers noted that not everything that sets HES_STOPPED is required to EF_UPDATE. Specifically the 'step 1' loop of rescheduling explicitly does EF_UPDATE to ensure the counter value is read.
However, then 'step 2' simply leaves the new counter uninitialized when HES_STOPPED, even though, as noted above, the thing that stopped them might not be aware it needs to EF_RELOAD -- since it didn't EF_UPDATE on stop.
One such location that is affected is throttling, throttle does pmu->stop(, 0); and unthrottle does pmu->start(, 0); possibly restarting an uninitialized counter.
--- arch/x86/events/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/events/core.c +3 -1
@@ -1361,8 +1361,10 @@ static void x86_pmu_enable(struct pmu *pmu) cpuc->events[hwc->idx] = event; -if (hwc->state &PERF_HES_ARCH ) +if (hwc->state &PERF_HES_ARCH ) { +static_call (x86_pmu_set_period)(event);continue ; + }/* * if cpuc->enabled = 0, then no wrmsr as
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/309 perf: Make sure to use pmu_ctx->pmu for groups
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 4b9ce671960627b2505b3f64742544ae9801df97 ]
Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back.
This *should* be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu.
Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.
Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case.
--- kernel/events/core.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
kernel/events/core.c +8 -11
@@ -4671,7 +4671,7 @@ static void __perf_event_read(void *info)struct perf_event *sub, *event = data->event;struct perf_event_context *ctx = event->ctx;struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context); -struct pmu *pmu = event->pmu; +struct pmu *pmu;/* * If this is a task context, we need to check whether it is
@@ -4683,7 +4683,7 @@ static void __perf_event_read(void *info)if (ctx->task && cpuctx->task_ctx != ctx)return ; -raw_spin_lock (&ctx->lock); +guard (raw_spinlock)(&ctx->lock);ctx_time_update_event (ctx, event);perf_event_update_time (event);
@@ -4691,25 +4691,22 @@ static void __perf_event_read(void *info)perf_event_update_sibling_time (event);if (event->state !=PERF_EVENT_STATE_ACTIVE ) - goto unlock; +return ;if (!data->group) { - pmu->read (event); +perf_pmu_read (event); data->ret =0 ; - goto unlock; +return ; } + pmu = event->pmu_ctx->pmu; pmu->start_txn (pmu,PERF_PMU_TXN_READ ); - pmu->read (event); - +perf_pmu_read (event);for_each_sibling_event (sub, event)perf_pmu_read (sub); data->ret = pmu->commit_txn (pmu); - -unlock: -raw_spin_unlock (&ctx->lock); }static inline u64 perf_event_count (struct perf_event *event,bool self)
@@ -14390,7 +14387,7 @@ inherit_event(struct perf_event *parent_event,get_ctx (child_ctx); child_event->ctx = child_ctx; - pmu_ctx =find_get_pmu_context (child_event->pmu, child_ctx, child_event); + pmu_ctx =find_get_pmu_context (parent_event->pmu_ctx->pmu, child_ctx, child_event);if (IS_ERR (pmu_ctx)) {free_event (child_event);return ERR_CAST (pmu_ctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/309 s390/mm: Add missing secure storage access fixups for donated memory
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janosch Frank <[email protected]>
[ Upstream commit b00be77302d7ec4ad0367bb236494fce7172b730 ]
There are special cases where secure storage access exceptions happen in a kernel context for pages that don't have the PG_arch_1 bit set. That bit is set for non-exported guest secure storage (memory) but is absent on storage donated to the Ultravisor since the kernel isn't allowed to export donated pages.
Prior to this patch we would try to export the page by calling arch_make_folio_accessible() which would instantly return since the arch bit is absent signifying that the page was already exported and no further action is necessary. This leads to secure storage access exception loops which can never be resolved.
With this patch we unconditionally try to export and if that fails we fixup.
--- arch/s390/mm/fault.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/s390/mm/fault.c +9 -2
@@ -436,10 +436,17 @@ void do_secure_storage_access(struct pt_regs *regs) folio =phys_to_folio (addr);if (unlikely (!folio_try_get (folio)))return ; - rc =arch_make_folio_accessible (folio); + rc =uv_convert_from_secure (folio_to_phys (folio)); +if (!rc) +clear_bit (PG_arch_1, &folio->flags.f);folio_put (folio); +/* +* There are some valid fixup types for kernel +* accesses to donated secure memory. zeropad is one +* of them. +*/ if (rc) -BUG (); +return handle_fault_error_nolock (regs,0 ); }else {if (faulthandler_disabled ())return handle_fault_error_nolock (regs,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/309 cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Smita Koralahalli <[email protected]>
[ Upstream commit 75cea0776de502f2a1be5ca02d37c586dc81887e ]
Check the global CXL_HDM_DECODER_ENABLE bit instead of looping over per-decoder COMMITTED bits to determine whether to fall back to DVSEC range emulation. When the HDM decoder capability is globally enabled, ignore DVSEC range registers regardless of individual decoder commit state.
should_emulate_decoders() currently loops over per-decoder COMMITTED bits, which leads to an incorrect DVSEC fallback when those bits are zero. One way to trigger this is to destroy a region and bounce the memdev:
cxl disable-region region0
cxl destroy-region region0
cxl disable-memdev mem0
cxl enable-memdev mem0
Region teardown zeroes the HDM decoder registers including the committed bits. The subsequent memdev re-probe finds uncommitted decoders and falls back to DVSEC emulation, even though HDM remains globally enabled.
Observed failures:
should_emulate_decoders: cxl_port endpoint6: decoder6.0: committed: 0 base: 0x0_00000000 size: 0x0_00000000
devm_cxl_setup_hdm: cxl_port endpoint6: Fallback map 1 range register
..
devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region0 __construct_region: cxl_pci 0000:e1:00.0: mem1:decoder6.0:
__construct_region region0 res: [mem 0x850000000-0x284fffffff flags 0x200] iw: 1 ig: 4096 cxl region0: pci0000:e0:port1 cxl_port_setup_targets expected iw: 1 ig: 4096 ..
cxl region0: pci0000:e0:port1 cxl_port_setup_targets got iw: 1 ig: 256 state: disabled .. cxl_port endpoint6: failed to attach decoder6.0 to region0: -6
..
devm_cxl_add_region: cxl_acpi ACPI0017:00: decoder0.0: created region4
alloc_hpa: cxl region4: HPA allocation error (-34) ..
--- drivers/cxl/core/hdm.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-)
drivers/cxl/core/hdm.c +9 -16
@@ -94,7 +94,6 @@ static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)struct cxl_hdm *cxlhdm;void __iomem *hdm;u32 ctrl; -int i;if (!info)return false;
@@ -113,22 +112,16 @@ static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)return false;/* -* If any decoders are committed already, there should not be any -* emulated DVSEC decoders. +* If HDM decoders are globally enabled, do not fall back to DVSEC +* range emulation. Zeroed decoder registers after region teardown +* do not imply absence of HDM capability. +* +* Falling back to DVSEC here would treat the decoder as AUTO and +* may incorrectly latch default interleave settings. */ -for (i =0 ; i < cxlhdm->decoder_count; i++) { - ctrl =readl (hdm +CXL_HDM_DECODER0_CTRL_OFFSET (i)); -dev_dbg (&info->port->dev, -"decoder%d.%d: committed: %ld base: %#x_%.8x size: %#x_%.8x\n" , - info->port->id, i, -FIELD_GET (CXL_HDM_DECODER0_CTRL_COMMITTED , ctrl), -readl (hdm +CXL_HDM_DECODER0_BASE_HIGH_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_BASE_LOW_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_SIZE_HIGH_OFFSET (i)), -readl (hdm +CXL_HDM_DECODER0_SIZE_LOW_OFFSET (i))); -if (FIELD_GET (CXL_HDM_DECODER0_CTRL_COMMITTED , ctrl)) -return false; - } + ctrl =readl (hdm +CXL_HDM_DECODER_CTRL_OFFSET ); +if (ctrl &CXL_HDM_DECODER_ENABLE ) +return false;return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/309 hwmon: axi-fan: dont use driver_override as IRQ name
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit 813bbc4d33d2ca5b0da63e70ae13b60874f20d37 ]
Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).
--- drivers/hwmon/axi-fan-control.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/axi-fan-control.c +1 -1
@@ -507,7 +507,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) ret =devm_request_threaded_irq (&pdev->dev, ctl->irq,NULL , axi_fan_control_irq_handler,IRQF_ONESHOT |IRQF_TRIGGER_HIGH , - pdev->driver_override, ctl); +NULL , ctl);if (ret)return dev_err_probe (&pdev->dev, ret,"failed to request an irq\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/309 sh: platform_early: remove pdev->driver_override check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit c5f60e3f07b6609562d21efda878e83ce8860728 ]
In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check.
This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check.
--- arch/sh/drivers/platform_early.c | 4 ---- 1 file changed, 4 deletions(-)
arch/sh/drivers/platform_early.c +0 -4
@@ -26,10 +26,6 @@ static int platform_match(struct device *dev, struct device_driver *drv)struct platform_device *pdev =to_platform_device (dev);struct platform_driver *pdrv =to_platform_driver (drv); -/* When driver_override is set, only bind to the matching driver */ -if (pdev->driver_override) -return !strcmp (pdev->driver_override, drv->name); -/* Then try to match against the id table */ if (pdrv->id_table)return platform_match_id (pdrv->id_table, pdev) !=NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/309 driver core: generalize driver_override in struct device
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit cb3d1049f4ea77d5ad93f17d8ac1f2ed4da70501 ]
Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices.
All of them seem to be prone to the bug described in [1].
While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall.
Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally.
In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and generalize the sysfs store() and show() callbacks via a driver_override feature flag in struct bus_type.
Until all busses have migrated, keep driver_set_override() in place.
Note that we can't use the device lock for the reasons described in [2].
[ Use dev->bus instead of sp->bus for consistency; fix commit message to
refer to the struct bus_type's driver_override feature flag. - Danilo ]
Stable-dep-of: 2b38efc05bf7 ("driver core: platform: use generic driver_override infrastructure")
--- drivers/base/bus.c | 43 ++++++++++++++++++++++++++- drivers/base/core.c | 2 ++ drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++++++++++ include/linux/device.h | 54 ++++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 +++ 5 files changed, 162 insertions(+), 1 deletion(-)
drivers/base/bus.c +42 -1
@@ -466,6 +466,36 @@ int bus_for_each_drv(const struct bus_type *bus, struct device_driver *start, }EXPORT_SYMBOL_GPL (bus_for_each_drv); +static ssize_t driver_override_store (struct device *dev, +struct device_attribute *attr, +const char *buf,size_t count) +{ +int ret; + + ret =__device_set_driver_override (dev, buf, count); +if (ret) +return ret; + +return count; +} + +static ssize_t driver_override_show (struct device *dev, +struct device_attribute *attr,char *buf) +{ +guard (spinlock)(&dev->driver_override.lock); +return sysfs_emit (buf,"%s\n" , dev->driver_override.name); +} +static DEVICE_ATTR_RW (driver_override); + +static struct attribute *driver_override_dev_attrs[] = { + &dev_attr_driver_override.attr, +NULL , +}; + +static const struct attribute_group driver_override_dev_group = { + .attrs = driver_override_dev_attrs, +}; +/** * bus_add_device - add device to bus * @dev: device being added
@@ -499,9 +529,15 @@ int bus_add_device(struct device *dev)if (error) goto out_put; +if (dev->bus->driver_override) { + error =device_add_group (dev, &driver_override_dev_group); +if (error) + goto out_groups; + } + error =sysfs_create_link (&sp->devices_kset->kobj, &dev->kobj,dev_name (dev));if (error) - goto out_groups; + goto out_override; error =sysfs_create_link (&dev->kobj, &sp->subsys.kobj,"subsystem" );if (error)
@@ -512,6 +548,9 @@ int bus_add_device(struct device *dev) out_subsys:sysfs_remove_link (&sp->devices_kset->kobj,dev_name (dev)); +out_override: +if (dev->bus->driver_override) +device_remove_group (dev, &driver_override_dev_group); out_groups:device_remove_groups (dev, sp->bus->dev_groups); out_put:
@@ -570,6 +609,8 @@ void bus_remove_device(struct device *dev)sysfs_remove_link (&dev->kobj,"subsystem" );sysfs_remove_link (&sp->devices_kset->kobj,dev_name (dev)); +if (dev->bus->driver_override) +device_remove_group (dev, &driver_override_dev_group);device_remove_groups (dev, dev->bus->dev_groups);if (klist_node_attached (&dev->p->knode_bus))klist_del (&dev->p->knode_bus);
drivers/base/core.c +2 -0
@@ -2556,6 +2556,7 @@ static void device_release(struct kobject *kobj)devres_release_all (dev);kfree (dev->dma_range_map); +kfree (dev->driver_override.name);if (dev->release) dev->release (dev);
@@ -3159,6 +3160,7 @@ void device_initialize(struct device *dev)kobject_init (&dev->kobj, &device_ktype);INIT_LIST_HEAD (&dev->dma_pools);mutex_init (&dev->mutex); +spin_lock_init (&dev->driver_override.lock);lockdep_set_novalidate_class (&dev->mutex);spin_lock_init (&dev->devres_lock);INIT_LIST_HEAD (&dev->devres_head);
drivers/base/dd.c +60 -0
66 lines not on this page · raw message
include/linux/device.h +54 -0
72 lines not on this page · raw message
include/linux/device/bus.h +4 -0
@@ -63,6 +63,9 @@ struct fwnode_handle;* this bus. * @pm: Power management operations of this bus, callback the specific * device driver's pm-ops. +* @driver_override: Set to true if this bus supports the driver_override +* mechanism, which allows userspace to force a specific +* driver to bind to a device via a sysfs attribute. * @need_parent_lock: When probing or removing a device on this bus, the * device core should lock the device's parent. *
@@ -104,6 +107,7 @@ struct bus_type {const struct dev_pm_ops *pm; +bool driver_override;bool need_parent_lock; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/309 driver core: platform: use generic driver_override infrastructure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d ]
When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock held is intentional. [1]
--- drivers/base/platform.c | 37 +++++---------------------------- drivers/bus/simple-pm-bus.c | 4 ++-- drivers/clk/imx/clk-scu.c | 3 +-- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++---- include/linux/platform_device.h | 5 ----- sound/soc/samsung/i2s.c | 6 +++--- 6 files changed, 13 insertions(+), 48 deletions(-)
drivers/base/platform.c +5 -32
@@ -562,7 +562,6 @@ static void platform_device_release(struct device *dev)kfree (pa->pdev.dev.platform_data);kfree (pa->pdev.mfd_cell);kfree (pa->pdev.resource); -kfree (pa->pdev.driver_override);kfree (pa); }
@@ -1265,38 +1264,9 @@ static ssize_t numa_node_show(struct device *dev, }static DEVICE_ATTR_RO (numa_node); -static ssize_t driver_override_show (struct device *dev, -struct device_attribute *attr,char *buf) -{ -struct platform_device *pdev =to_platform_device (dev); -ssize_t len; - -device_lock (dev); - len =sysfs_emit (buf,"%s\n" , pdev->driver_override); -device_unlock (dev); - -return len; -} - -static ssize_t driver_override_store (struct device *dev, -struct device_attribute *attr, -const char *buf,size_t count) -{ -struct platform_device *pdev =to_platform_device (dev); -int ret; - - ret =driver_set_override (dev, &pdev->driver_override, buf, count); -if (ret) -return ret; - -return count; -} -static DEVICE_ATTR_RW (driver_override); -static struct attribute *platform_dev_attrs[] = { &dev_attr_modalias.attr, &dev_attr_numa_node.attr, - &dev_attr_driver_override.attr,NULL , };
@@ -1336,10 +1306,12 @@ static int platform_match(struct device *dev, const struct device_driver *drv) {struct platform_device *pdev =to_platform_device (dev);struct platform_driver *pdrv =to_platform_driver (drv); +int ret;/* When driver_override is set, only bind to the matching driver */ -if (pdev->driver_override) -return !strcmp (pdev->driver_override, drv->name); + ret =device_match_driver_override (dev, drv); +if (ret >=0 ) +return ret;/* Attempt an OF style match first */ if (of_driver_match_device (dev, drv))
@@ -1475,6 +1447,7 @@ static const struct dev_pm_ops platform_dev_pm_ops = {const struct bus_type platform_bus_type = { .name ="platform" , .dev_groups = platform_dev_groups, + .driver_override = true, .match = platform_match, .uevent = platform_uevent, .probe = platform_probe,
drivers/bus/simple-pm-bus.c +2 -2
@@ -36,7 +36,7 @@ static int simple_pm_bus_probe(struct platform_device *pdev)* that's not listed in simple_pm_bus_of_match. We don't want to do any * of the simple-pm-bus tasks for these devices, so return early. */ -if (pdev->driver_override) +if (device_has_driver_override (&pdev->dev))return 0 ; match =of_match_device (dev->driver->of_match_table, dev);
@@ -78,7 +78,7 @@ static void simple_pm_bus_remove(struct platform_device *pdev) {const void *data =of_device_get_match_data (&pdev->dev); -if (pdev->driver_override || data) +if (device_has_driver_override (&pdev->dev) || data)return ;dev_dbg (&pdev->dev,"%s\n" , __func__);
drivers/clk/imx/clk-scu.c +1 -2
@@ -696,8 +696,7 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,if (ret) goto put_device; - ret =driver_set_override (&pdev->dev, &pdev->driver_override, -"imx-scu-clk" ,strlen ("imx-scu-clk" )); + ret =device_set_driver_override (&pdev->dev,"imx-scu-clk" );if (ret) goto put_device;
drivers/slimbus/qcom-ngd-ctrl.c +2 -4
@@ -1539,10 +1539,8 @@ static int of_qcom_slim_ngd_register(struct device *parent, ngd->id = id; ngd->pdev->dev.parent = parent; - ret =driver_set_override (&ngd->pdev->dev, - &ngd->pdev->driver_override, -QCOM_SLIM_NGD_DRV_NAME , -strlen (QCOM_SLIM_NGD_DRV_NAME )); + ret =device_set_driver_override (&ngd->pdev->dev, +QCOM_SLIM_NGD_DRV_NAME );if (ret) {platform_device_put (ngd->pdev);kfree (ngd);
include/linux/platform_device.h +0 -5
@@ -31,11 +31,6 @@ struct platform_device {struct resource *resource;const struct platform_device_id *id_entry; -/* -* Driver name to force a match. Do not set directly, because core -* frees it. Use driver_set_override() to set or clear it. -*/ -const char *driver_override;/* MFD cell pointer */ struct mfd_cell *mfd_cell;
sound/soc/samsung/i2s.c +3 -3
@@ -1360,10 +1360,10 @@ static int i2s_create_secondary_device(struct samsung_i2s_priv *priv)if (!pdev_sec)return -ENOMEM ; - pdev_sec->driver_override =kstrdup ("samsung-i2s" ,GFP_KERNEL ); -if (!pdev_sec->driver_override) { + ret =device_set_driver_override (&pdev_sec->dev,"samsung-i2s" ); +if (ret) {platform_device_put (pdev_sec); -return -ENOMEM ; +return ret; } ret =platform_device_add (pdev_sec);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/309 bpf: Release module BTF IDR before module unload
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 ]
Gregory reported in [0] that the global_map_resize test when run in repeatedly ends up failing during program load. This stems from the fact that BTF reference has not dropped to zero after the previous run's module is unloaded, and the older module's BTF is still discoverable and visible. Later, in libbpf, load_module_btfs() will find the ID for this stale BTF, open its fd, and then it will be used during program load where later steps taking module reference using btf_try_get_module() fail since the underlying module for the BTF is gone.
Logically, once a module is unloaded, it's associated BTF artifacts should become hidden. The BTF object inside the kernel may still remain alive as long its reference counts are alive, but it should no longer be discoverable.
To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case for the module unload to free the BTF associated IDR entry, and disable its discovery once module unload returns to user space. If a race happens during unload, the outcome is non-deterministic anyway. However, user space should be able to rely on the guarantee that once it has synchronously established a successful module unload, no more stale artifacts associated with this module can be obtained subsequently.
Note that we must be careful to not invoke btf_free_id() in btf_put() when btf_is_module() is true now. There could be a window where the module unload drops a non-terminal reference, frees the IDR, but the same ID gets reused and the second unconditional btf_free_id() ends up releasing an unrelated entry.
To avoid a special case for btf_is_module() case, set btf->id to zero to make btf_free_id() idempotent, such that we can unconditionally invoke it from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is an invalid IDR, the idr_remove() should be a noop.
Note that we can be sure that by the time we reach final btf_put() for btf_is_module() case, the btf_free_id() is already done, since the module itself holds the BTF reference, and it will call this function for the BTF before dropping its own reference.
[0]: https://lore.kernel.org/bpf/[email protected]
--- kernel/bpf/btf.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +20 -4
@@ -1676,7 +1676,16 @@ static void btf_free_id(struct btf *btf)* of the _bh() version. */ spin_lock_irqsave (&btf_idr_lock, flags); -idr_remove (&btf_idr, btf->id); +if (btf->id) { +idr_remove (&btf_idr, btf->id); +/* +* Clear the id here to make this function idempotent, since it will get +* called a couple of times for module BTFs: on module unload, and then +* the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use +* 0 as sentinel value. +*/ +WRITE_ONCE (btf->id,0 ); + }spin_unlock_irqrestore (&btf_idr_lock, flags); }
@@ -7995,7 +8004,7 @@ static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp) {const struct btf *btf = filp->private_data; -seq_printf (m,"btf_id:\t%u\n" , btf->id); +seq_printf (m,"btf_id:\t%u\n" ,READ_ONCE (btf->id)); }#endif
@@ -8077,7 +8086,7 @@ int btf_get_info_by_fd(const struct btf *btf,if (copy_from_user (&info, uinfo, info_copy))return -EFAULT ; - info.id = btf->id; + info.id =READ_ONCE (btf->id); ubtf =u64_to_user_ptr (info.btf); btf_copy =min_t (u32, btf->data_size, info.btf_size);if (copy_to_user (ubtf, btf->data, btf_copy))
@@ -8140,7 +8149,7 @@ int btf_get_fd_by_id(u32 id)u32 btf_obj_id (const struct btf *btf) { -return btf->id; +return READ_ONCE (btf->id); }bool btf_is_kernel (const struct btf *btf)
@@ -8262,6 +8271,13 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,if (btf_mod->module != module)continue ; +/* +* For modules, we do the freeing of BTF IDR as soon as +* module goes away to disable BTF discovery, since the +* btf_try_get_module() on such BTFs will fail. This may +* be called again on btf_put(), but it's ok to do so. +*/ +btf_free_id (btf_mod->btf);list_del (&btf_mod->list);if (btf_mod->sysfs_attr)sysfs_remove_bin_file (btf_kobj, btf_mod->sysfs_attr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/309 cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cui Chao <[email protected]>
[ Upstream commit be5c5280cf2b20e363dc8e2a424dd200a29b1c77 ]
During the cxl_acpi probe process, it checks whether the cxl_nvb device and driver have been attached. Currently, the startup priority of the cxl_pmem driver is lower than that of the cxl_acpi driver. At this point, the cxl_nvb driver has not yet been registered on the cxl_bus, causing the attachment check to fail. This results in a failure to add the root nvdimm bridge, leading to a cxl_acpi probe failure and ultimately affecting the subsequent loading of cxl drivers. As a consequence, only one mem device object exists on the cxl_bus, while the cxl_port device objects and decoder device objects are missing.
The solution is to raise the startup priority of cxl_pmem to be higher than that of cxl_acpi, ensuring that the cxl_pmem driver is registered before the aforementioned attachment check occurs.
--- drivers/cxl/pmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cxl/pmem.c +1 -1
@@ -554,7 +554,7 @@ static __exit void cxl_pmem_exit(void)MODULE_DESCRIPTION ("CXL PMEM: Persistent Memory Support" );MODULE_LICENSE ("GPL v2" ); -module_init (cxl_pmem_init); +subsys_initcall (cxl_pmem_init);module_exit (cxl_pmem_exit);MODULE_IMPORT_NS ("CXL" );MODULE_ALIAS_CXL (CXL_DEVICE_NVDIMM_BRIDGE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/309 bpf: Fix exception exit lock checking for subprogs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ihor Solodrai <[email protected]>
[ Upstream commit 6c2128505f61b504c79a20b89596feba61388112 ]
process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false in cases when bpf_throw() is called from a static subprog. This makes check_resource_leak() to skip validation of active_rcu_locks, active_preempt_locks, and active_irq_id on exception exits from subprogs.
At runtime bpf_throw() unwinds the stack via ORC without releasing any user-acquired locks, which may cause various issues as the result.
Fix by setting check_lock = true for exception exits regardless of curframe, since exceptions bypass all intermediate frame cleanup. Update the error message prefix to "bpf_throw" for exception exits to distinguish them from normal BPF_EXIT.
Fix reject_subprog_with_rcu_read_lock test which was previously passing for the wrong reason. Test program returned directly from the subprog call without closing the RCU section, so the error was triggered by the unclosed RCU lock on normal exit, not by bpf_throw. Update __msg annotations for affected tests to match the new "bpf_throw" error prefix.
The spin_lock case is not affected because they are already checked [1] at the call site in do_check_insn() before bpf_throw can run.
--- kernel/bpf/verifier.c | 3 ++- tools/testing/selftests/bpf/progs/exceptions_fail.c | 9 ++++++--- 2 files changed, 8 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +2 -1
@@ -19955,7 +19955,8 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env,* state when it exits. */ int err =check_resource_leak (env, exception_exit, - !env->cur_state->curframe, + exception_exit || !env->cur_state->curframe, + exception_exit ?"bpf_throw" :"BPF_EXIT instruction in main prog" );if (err)return err;
tools/testing/selftests/bpf/progs/exceptions_fail.c +6 -3
@@ -8,6 +8,7 @@#include "bpf_experimental.h" extern void bpf_rcu_read_lock(void) __ksym; +extern void bpf_rcu_read_unlock(void) __ksym;#define private (name) SEC(".bss." #name) __hidden __attribute__((aligned(8)))
@@ -131,7 +132,7 @@ int reject_subprog_with_lock(void *ctx) } SEC("?tc") -__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region") +__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region") int reject_with_rcu_read_lock(void *ctx) {bpf_rcu_read_lock ();
@@ -147,11 +148,13 @@ __noinline static int throwing_subprog(struct __sk_buff *ctx) } SEC("?tc") -__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region") +__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region") int reject_subprog_with_rcu_read_lock(void *ctx) {bpf_rcu_read_lock (); -return throwing_subprog (ctx); +throwing_subprog (ctx); +bpf_rcu_read_unlock (); +return 0 ; }static bool rbless (struct bpf_rb_node *n1,const struct bpf_rb_node *n2)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/309 bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <[email protected]>
[ Upstream commit c77b30bd1dcb61f66c640ff7d2757816210c7cb0 ]
The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result.
The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access.
Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.
s32 is the only affected case -- the s64 division/modulo handlers do not use abs().
--- kernel/bpf/core.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
kernel/bpf/core.c +14 -8
@@ -1717,6 +1717,12 @@ bool bpf_opcode_in_insntable(u8 code) }#ifndef CONFIG_BPF_JIT_ALWAYS_ON +/* Absolute value of s32 without undefined behavior for S32_MIN */ +static u32 abs_s32 (s32 x) +{ +return x >=0 ? (u32 )x : -(u32 )x; +} +/** * ___bpf_prog_run - run eBPF program on a given context * @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
@@ -1881,8 +1887,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST =do_div (AX , (u32 )SRC );break ;case 1 : -AX =abs ((s32 )DST ); -AX =do_div (AX ,abs ((s32 )SRC )); +AX =abs_s32 ((s32 )DST ); +AX =do_div (AX ,abs_s32 ((s32 )SRC ));if ((s32 )DST <0 )DST = (u32)-AX ;else
@@ -1909,8 +1915,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST =do_div (AX , (u32 )IMM );break ;case 1 : -AX =abs ((s32 )DST ); -AX =do_div (AX ,abs ((s32 )IMM )); +AX =abs_s32 ((s32 )DST ); +AX =do_div (AX ,abs_s32 ((s32 )IMM ));if ((s32 )DST <0 )DST = (u32)-AX ;else
@@ -1936,8 +1942,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST = (u32 )AX ;break ;case 1 : -AX =abs ((s32 )DST ); -do_div (AX ,abs ((s32 )SRC )); +AX =abs_s32 ((s32 )DST ); +do_div (AX ,abs_s32 ((s32 )SRC ));if (((s32 )DST <0 ) == ((s32 )SRC <0 ))DST = (u32 )AX ;else
@@ -1963,8 +1969,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)DST = (u32 )AX ;break ;case 1 : -AX =abs ((s32 )DST ); -do_div (AX ,abs ((s32 )IMM )); +AX =abs_s32 ((s32 )DST ); +do_div (AX ,abs_s32 ((s32 )IMM ));if (((s32 )DST <0 ) == ((s32 )IMM <0 ))DST = (u32 )AX ;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/309 bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wade <[email protected]>
[ Upstream commit c845894ebd6fb43226b3118d6b017942550910c5 ]
maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range [-1, 0], it forks the verifier state: the pushed path gets dst = 0, the current path gets dst = -1.
For BPF_AND this is correct: 0 & K == 0. For BPF_OR this is wrong: 0 | K == K, not 0.
The pushed path therefore tracks dst as 0 when the runtime value is K, producing an exploitable verifier/runtime divergence that allows out-of-bounds map access.
Fix this by passing env->insn_idx (instead of env->insn_idx + 1) to push_stack(), so the pushed path re-executes the ALU instruction with dst = 0 and naturally computes the correct result for any opcode.
--- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/verifier.c +1 -1
@@ -15512,7 +15512,7 @@ static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *inselse return 0 ; - branch =push_stack (env, env->insn_idx +1 , env->insn_idx, false); + branch =push_stack (env, env->insn_idx, env->insn_idx, false);if (IS_ERR (branch))return PTR_ERR (branch);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/309 tracing: Revert "tracing: Remove pid in task_rename tracing output"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuewen Yan <[email protected]>
[ Upstream commit a6f22e50c7d51aa225c392c62c33f0fae11f734d ]
This reverts commit e3f6a42272e028c46695acc83fc7d7c42f2750ad.
The commit says that the tracepoint only deals with the current task, however the following case is not current task:
comm_write() {
p = get_proc_task(inode);
if (!p)
return -ESRCH;
if (same_thread_group(current, p))
set_task_comm(p, buffer);
}where set_task_comm() calls __set_task_comm() which records the update of p and not current.
So revert the patch to show pid.
--- include/trace/events/task.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
include/trace/events/task.h +5 -2
@@ -38,19 +38,22 @@ TRACE_EVENT(task_rename, TP_ARGS(task, comm),TP_STRUCT__entry ( +__field (pid_t ,pid )__array ( char, oldcomm,TASK_COMM_LEN )__array ( char, newcomm,TASK_COMM_LEN )__field ( short, oom_score_adj) ),TP_fast_assign ( + __entry->pid = task->pid;memcpy (entry->oldcomm, task->comm,TASK_COMM_LEN );strscpy (entry->newcomm, comm,TASK_COMM_LEN ); __entry->oom_score_adj = task->signal->oom_score_adj; ), -TP_printk ("oldcomm=%s newcomm=%s oom_score_adj=%hd" , - __entry->oldcomm, __entry->newcomm, __entry->oom_score_adj) +TP_printk ("pid=%d oldcomm=%s newcomm=%s oom_score_adj=%hd" , + __entry->pid, __entry->oldcomm, + __entry->newcomm, __entry->oom_score_adj) );/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/309 platform/x86: hp-wmi: Add Omen 16-wf0xxx fan and thermal support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <[email protected]>
[ Upstream commit 13fa3aaf02edaad9b41fc61d7f6326d2b6a4bf80 ]
The HP Omen 16-wf0xxx (board ID: 8BAB) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to HP Omen 16-wf1xxx, board ID: 8C78).
Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params.
Testing on HP Omen 16-wf0xxx confirmed that platform profile is registered successfully and fan RPMs are readable and controllable.
--- drivers/platform/x86/hp/hp-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/hp/hp-wmi.c +4 -0
@@ -154,6 +154,10 @@ static const char * const victus_thermal_profile_boards[] = {/* DMI Board names of Victus 16-r and Victus 16-s laptops */ static const struct dmi_system_id victus_s_thermal_profile_boards[]__initconst = { + { + .matches = {DMI_MATCH (DMI_BOARD_NAME ,"8BAB" ) }, + .driver_data = (void *)&omen_v1_thermal_params, + }, { .matches = {DMI_MATCH (DMI_BOARD_NAME ,"8BBE" ) }, .driver_data = (void *)&victus_s_thermal_params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/309 HID: asus: avoid memory leak in asus_report_fixup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]
The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed.
The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer.
Also fix a harmless out-of-bounds read by copying only the original descriptor size.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -1305,14 +1305,21 @@ static const __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if (*rsize == rsize_orig && rdesc[offs] ==0x09 && rdesc[offs +1 ] ==0x76 ) { - *rsize = rsize_orig +1 ; - rdesc =kmemdup (rdesc, *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; +__u8 *new_rdesc; + + new_rdesc =devm_kzalloc (&hdev->dev, rsize_orig +1 , +GFP_KERNEL ); +if (!new_rdesc) +return rdesc;hid_info (hdev,"Fixing up %s keyb report descriptor\n" , drvdata->quirks &QUIRK_T100CHI ?"T100CHI" :"T90CHI" ); + +memcpy (new_rdesc, rdesc, rsize_orig); + *rsize = rsize_orig +1 ; + rdesc = new_rdesc; +memmove (rdesc + offs +4 , rdesc + offs +2 ,12 ); rdesc[offs] =0x19 ; rdesc[offs +1 ] =0x00 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/309 platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Metz <[email protected]>
[ Upstream commit 6b3fa0615cd8432148581de62a52f83847af3d70 ]
The Dell 14 Plus 2-in-1 (model DB04250) requires the VGBS allow list entry to correctly enable the tablet mode switch. Without this, the chassis state is not reported, and the hinge rotation only emits unknown scancodes.
Verified on Dell 14 Plus 2-in-1 DB04250.
--- drivers/platform/x86/intel/hid.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/intel/hid.c +6 -0
@@ -189,6 +189,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell 14 Plus 2-in-1 DB04250"), + }, + }, { } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/309 nvme-pci: cap queue creation to used queues
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 4735b510a00fb2d4ac9e8d21a8c9552cb281f585 ]
If the user reduces the special queue count at runtime and resets the controller, we need to reduce the number of queues and interrupts requested accordingly rather than start with the pre-allocated queue count.
--- drivers/nvme/host/pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +7 -1
@@ -2707,7 +2707,13 @@ static int nvme_setup_io_queues(struct nvme_dev *dev) dev->nr_write_queues = write_queues; dev->nr_poll_queues = poll_queues; - nr_io_queues = dev->nr_allocated_queues -1 ; +/* +* The initial number of allocated queue slots may be too large if the +* user reduced the special queue parameters. Cap the value to the +* number we need for this round. +*/ + nr_io_queues =min (nvme_max_io_queues (dev), + dev->nr_allocated_queues -1 ); result =nvme_set_queue_count (&dev->ctrl, &nr_io_queues);if (result <0 )return result;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/309 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
[ Upstream commit 0a1fc2f301529ac75aec0ce80d5ab9d9e4dc4b16 ]
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain authentication key material for NVMe-oF. Use kfree_sensitive() instead of kfree() in nvmf_free_options() to ensure secrets are zeroed before the memory is freed, preventing recovery from freed pages.
--- drivers/nvme/host/fabrics.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/fabrics.c +2 -2
@@ -1290,8 +1290,8 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)kfree (opts->subsysnqn);kfree (opts->host_traddr);kfree (opts->host_iface); -kfree (opts->dhchap_secret); -kfree (opts->dhchap_ctrl_secret); +kfree_sensitive (opts->dhchap_secret); +kfree_sensitive (opts->dhchap_ctrl_secret);kfree (opts); }EXPORT_SYMBOL_GPL (nvmf_free_options);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/309 platform/x86: hp-wmi: Add Omen 16-xd0xxx fan and thermal support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <[email protected]>
[ Upstream commit 3c99a545b372c77b5d39715968a141f523eccbf2 ]
The HP Omen 16-xd0xxx (board ID: 8BCD) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile (similar to HP Omen 16-wf1xxx, board ID: 8C78).
Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params.
Testing on HP Omen 16-xd0xxx confirmed that platform profile is registered successfully and fan RPMs are readable and controllable.
--- drivers/platform/x86/hp/hp-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/hp/hp-wmi.c +4 -0
@@ -162,6 +162,10 @@ static const struct dmi_system_id victus_s_thermal_profile_boards[] __initconst .matches = { DMI_MATCH(DMI_BOARD_NAME, "8BBE") }, .driver_data = (void *)&victus_s_thermal_params, }, + { + .matches = { DMI_MATCH(DMI_BOARD_NAME, "8BCD") }, + .driver_data = (void *)&omen_v1_thermal_params, + }, { .matches = { DMI_MATCH(DMI_BOARD_NAME, "8BD4") }, .driver_data = (void *)&victus_s_thermal_params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/309 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leif Skunberg <[email protected]>
[ Upstream commit b38d478dad79e61e8a65931021bdfd7a71741212 ]
The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down buttons that are handled through the intel-hid 5-button array interface. The firmware does not advertise 5-button array support via HEBC, so the driver relies on a DMI allowlist to enable it.
Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the volume buttons work out of the box.
--- drivers/platform/x86/intel/hid.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/intel/hid.c +7 -0
@@ -135,6 +135,13 @@ static const struct dmi_system_id button_array_table[] = { DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"), }, }, + { + .ident = "Lenovo ThinkPad X1 Fold 16 Gen 1", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Fold 16 Gen 1"), + }, + }, { .ident ="Microsoft Surface Go 3" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/309 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7d87ed70fc95482c12edf9493c249b6413be485e ]
The touchscreen on the SUPI S10 tablet reports inverted Y coordinates, causing touch input to be mirrored vertically relative to the display.
Add a quirk to set the "touchscreen-inverted-y" boolean device-property on the touchscreen device, so that the goodix_ts driver will fixup the coordinates.
--- drivers/platform/x86/touchscreen_dmi.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +18 -0
@@ -410,6 +410,16 @@ static const struct ts_dmi_data gdix1002_upside_down_data = { .properties = gdix1001_upside_down_props, }; +static const struct property_entry gdix1001_y_inverted_props[] = { +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), + { } +}; + +static const struct ts_dmi_data gdix1001_y_inverted_data = { + .acpi_name ="GDIX1001" , + .properties = gdix1001_y_inverted_props, +}; +static const struct property_entry gp_electronic_t701_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,960 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,640 ),
@@ -1658,6 +1668,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"), }, }, + { +/* SUPI S10 */ + .driver_data = (void *)&gdix1001_y_inverted_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"SUPI" ), + DMI_MATCH(DMI_PRODUCT_NAME, "S10"), + }, + }, {/* Techbite Arc 11.6 */ .driver_data = (void *)&techbite_arc_11_6_data,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/309 nvme-pci: ensure were polling a polled queue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -1430,7 +1430,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)struct nvme_queue *nvmeq = hctx->driver_data;bool found; -if (!nvme_cqe_pending (nvmeq)) +if (!test_bit (NVMEQ_POLLED , &nvmeq->flags) || + !nvme_cqe_pending (nvmeq))return 0 ;spin_lock (&nvmeq->cq_poll_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/309 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Lehmann <[email protected]>
[ Upstream commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b ]
Battery reporting does not work for the Apple Magic Trackpad 2 if it is connected via USB. The current hid descriptor fixup code checks for a hid descriptor length of exactly 83 bytes. If the hid descriptor is larger, which is the case for newer apple mice, the fixup is not applied.
This fix checks for hid descriptor sizes greater/equal 83 bytes which applies the fixup for newer devices as well.
--- drivers/hid/hid-magicmouse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-magicmouse.c +1 -1
@@ -990,7 +990,7 @@ static const __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if ((is_usb_magicmouse2 (hdev->vendor, hdev->product) ||is_usb_magictrackpad2 (hdev->vendor, hdev->product)) && - *rsize ==83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) { + *rsize >=83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) {hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/309 HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c ]
The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-magicmouse.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-magicmouse.c +1 -3
@@ -994,9 +994,7 @@ static const __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/309 HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <[email protected]>
[ Upstream commit 22f8bcec5aeb05104b3eaa950cb5a345e95f0aa8 ]
Add device IDs of Nova Lake-H and Nova Lake-S into ishtp support list.
--- drivers/hid/intel-ish-hid/ipc/hw-ish.h | 2 ++ drivers/hid/intel-ish-hid/ipc/pci-ish.c | 12 ++++++++++++ 2 files changed, 14 insertions(+)
drivers/hid/intel-ish-hid/ipc/hw-ish.h +2 -0
@@ -39,6 +39,8 @@#define PCI_DEVICE_ID_INTEL_ISH_PTL_H 0xE345#define PCI_DEVICE_ID_INTEL_ISH_PTL_P 0xE445#define PCI_DEVICE_ID_INTEL_ISH_WCL 0x4D45 +#define PCI_DEVICE_ID_INTEL_ISH_NVL_H 0xD354 +#define PCI_DEVICE_ID_INTEL_ISH_NVL_S 0x6E78#define REVISION_ID_CHT_A0 0x6#define REVISION_ID_CHT_Ax_SI 0x0
drivers/hid/intel-ish-hid/ipc/pci-ish.c +12 -0
@@ -28,11 +28,15 @@ enum ishtp_driver_data_index {ISHTP_DRIVER_DATA_LNL_M ,ISHTP_DRIVER_DATA_PTL ,ISHTP_DRIVER_DATA_WCL , +ISHTP_DRIVER_DATA_NVL_H , + ISHTP_DRIVER_DATA_NVL_S, };#define ISH_FW_GEN_LNL_M "lnlm"#define ISH_FW_GEN_PTL "ptl"#define ISH_FW_GEN_WCL "wcl" +#define ISH_FW_GEN_NVL_H "nvlh" +#define ISH_FW_GEN_NVL_S "nvls"#define ISH_FIRMWARE_PATH (gen) "intel/ish/ish_" gen ".bin"#define ISH_FIRMWARE_PATH_ALL "intel/ish/ish_*.bin"
@@ -47,6 +51,12 @@ static struct ishtp_driver_data ishtp_driver_data[] = { [ISHTP_DRIVER_DATA_WCL ] = { .fw_generation =ISH_FW_GEN_WCL , }, + [ISHTP_DRIVER_DATA_NVL_H ] = { + .fw_generation =ISH_FW_GEN_NVL_H , + }, + [ISHTP_DRIVER_DATA_NVL_S ] = { + .fw_generation =ISH_FW_GEN_NVL_S , + }, };static const struct pci_device_id ish_pci_tbl[] = {
@@ -76,6 +86,8 @@ static const struct pci_device_id ish_pci_tbl[] = { {PCI_DEVICE_DATA(INTEL, ISH_PTL_H, ISHTP_DRIVER_DATA_PTL)}, {PCI_DEVICE_DATA(INTEL, ISH_PTL_P, ISHTP_DRIVER_DATA_PTL)}, {PCI_DEVICE_DATA(INTEL, ISH_WCL, ISHTP_DRIVER_DATA_WCL)}, + {PCI_DEVICE_DATA(INTEL, ISH_NVL_H, ISHTP_DRIVER_DATA_NVL_H)}, + {PCI_DEVICE_DATA(INTEL, ISH_NVL_S, ISHTP_DRIVER_DATA_NVL_S)}, {} };MODULE_DEVICE_TABLE (pci, ish_pci_tbl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/309 platform/x86: oxpec: Add support for OneXPlayer APEX
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit 3385ea97c14d271dcb0c6e6fcf16972f819eecd8 ]
OneXPlayer Apex is a new Strix Halo handheld. It uses the same registers as the OneXPlayer Fly devices. Add a quirk for it to the oxpec driver.
--- drivers/platform/x86/oxpec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/x86/oxpec.c +8 -1
@@ -13,7 +13,7 @@* * Copyright (C) 2022 Joaquín I. Aramendía <[email protected]> * Copyright (C) 2024 Derek J. Clark <[email protected]> -* Copyright (C) 2025 Antheas Kapenekakis <[email protected]> +* Copyright (C) 2025-2026 Antheas Kapenekakis <[email protected]> */ #include <linux/acpi.h>
@@ -208,6 +208,13 @@ static const struct dmi_system_id dmi_table[] = { }, .driver_data = (void *)oxp_2, }, + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ONE-NETBOOK" ), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER APEX"), + }, + .driver_data = (void *)oxp_fly, + }, { .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/309 HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7c698de0dc5daa1e1a5fd1f0c6aa1b6bb2f5d867 ]
EPOMAKER TH87 has the very same ID as Apple Aluminum keyboard (05ac:024f) although it doesn't work as expected in compatible way.
Put three entries to the non-apple keyboards list to exclude this
device: one for BT ("TH87"), one for USB ("HFD Epomaker TH87") and one for dongle ("2.4G Wireless Receiver").
--- drivers/hid/hid-apple.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-apple.c +3 -0
@@ -365,6 +365,9 @@ static const struct apple_non_apple_keyboard non_apple_keyboards[] = { { "A3R" }, { "hfd.cn" }, { "WKB603" }, + { "TH87" }, /* EPOMAKER TH87 BT mode */ + { "HFD Epomaker TH87" }, /* EPOMAKER TH87 USB mode */ + { "2.4G Wireless Receiver" }, /* EPOMAKER TH87 dongle */ };static bool apple_is_non_apple_keyboard (struct hid_device *hdev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/309 platform/x86: oxpec: Add support for OneXPlayer X1z
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit 4049c46edb5d44c0de045f6f504371705dd603dd ]
X1z is a variant of OneXPlayer X1 A with 8840U. It seems that only one user has this one. Add a quirk for it to the oxpec driver.
--- drivers/platform/x86/oxpec.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/oxpec.c +7 -0
@@ -285,6 +285,13 @@ static const struct dmi_system_id dmi_table[] = { }, .driver_data = (void *)oxp_mini_amd_pro, }, + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ONE-NETBOOK" ), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1z"), + }, + .driver_data = (void *)oxp_x1, + }, { .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/309 net: usb: r8152: add TRENDnet TUC-ET2G
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Spreckels <[email protected]>
[ Upstream commit 15fba71533bcdfaa8eeba69a5a5a2927afdf664a ]
The TRENDnet TUC-ET2G is a RTL8156 based usb ethernet adapter. Add its vendor and product IDs.
--- drivers/net/usb/r8152.c | 1 + include/linux/usb/r8152.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/usb/r8152.c +1 -0
@@ -10061,6 +10061,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, + { USB_DEVICE(VENDOR_ID_TRENDNET, 0xe02b) }, {} };
include/linux/usb/r8152.h +1 -0
@@ -32,6 +32,7 @@#define VENDOR_ID_DLINK 0x2001#define VENDOR_ID_DELL 0x413c#define VENDOR_ID_ASUS 0x0b05 +#define VENDOR_ID_TRENDNET 0x20f4#if IS_REACHABLE (CONFIG_USB_RTL8152 )extern u8 rtl8152_get_version (struct usb_interface *intf);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/309 kbuild: install-extmod-build: Package resolve_btfids if necessary
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 459cb3c054c2352bb321648744b620259a716b60 ]
When CONFIG_DEBUG_INFO_BTF_MODULES is enabled and vmlinux is available, Makefile.modfinal and gen-btf.sh will try to use resolve_btfids on the module .ko. install-extmod-build currently does not package resolve_btfids, so that step fails.
Package resolve_btfids if it may be used.
--- scripts/package/install-extmod-build | 4 ++++ 1 file changed, 4 insertions(+)
scripts/package/install-extmod-build +4 -0
@@ -32,6 +32,10 @@ mkdir -p "${destdir}" echo tools/objtool/objtool fi + if is_enabled CONFIG_DEBUG_INFO_BTF_MODULES; then + echo tools/bpf/resolve_btfids/resolve_btfids + fi + echo Module.symvers echo "arch/${SRCARCH}/include/generated" echo include/config/auto.conf
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/309 platform/x86: oxpec: Add support for Aokzoe A2 Pro
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit cd0883055b04586770dab43c64159348bf480a3e ]
Aokzoe A2 Pro is an older device that the oxpec driver is missing the quirk for. It has the same behavior as the AOKZOE A1 devices. Add a quirk for it to the oxpec driver.
--- drivers/platform/x86/oxpec.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/oxpec.c +7 -0
@@ -124,6 +124,13 @@ static const struct dmi_system_id dmi_table[] = { }, .driver_data = (void *)aok_zoe_a1, }, + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AOKZOE" ), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "AOKZOE A2 Pro"), + }, + .driver_data = (void *)aok_zoe_a1, + }, { .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "AOKZOE"),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/309 platform/x86: oxpec: Add support for OneXPlayer X1 Air
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit 2a3b4a8c10a64a62c4243007139d253dc1324dfd ]
X1 Air is an X1 variant with a newer Intel chipset. It uses the same registers as the X1. Add a quirk for it to the oxpec driver.
--- drivers/platform/x86/oxpec.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/oxpec.c +7 -0
@@ -313,6 +313,13 @@ static const struct dmi_system_id dmi_table[] = { }, .driver_data = (void *)oxp_x1, }, + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"ONE-NETBOOK" ), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1Air"), + }, + .driver_data = (void *)oxp_x1, + }, { .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/309 HID: mcp2221: cancel last I2C command on read error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Sioen <[email protected]>
[ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]
When an I2C SMBus read operation fails, the MCP2221 internal state machine may not reset correctly, causing subsequent transactions to fail.
By adding a short delay and explicitly cancelling the last command, we ensure the device is ready for the next operation.
Fix an issue where i2cdetect was not able to detect all devices correctly on the bus.
--- drivers/hid/hid-mcp2221.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-mcp2221.c +2 -0
@@ -353,6 +353,8 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp,usleep_range (90 ,100 ); retries++; }else { +usleep_range (980 ,1000 ); +mcp_cancel_last_cmd (mcp);return ret; } }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/309 HID: asus: add xg mobile 2023 external hardware support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Benato <[email protected]>
[ Upstream commit 377f8e788945d45b012ed9cfc35ca56c02e86cd8 ]
XG mobile stations have the 0x5a endpoint and has to be initialized:
add them to hid-asus.
--- drivers/hid/hid-asus.c | 3 +++ drivers/hid/hid-ids.h | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-asus.c +3 -0
@@ -1403,6 +1403,9 @@ static const struct hid_device_id asus_devices[] = { {HID_USB_DEVICE (USB_VENDOR_ID_ASUSTEK ,USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X ), QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, +USB_DEVICE_ID_ASUSTEK_XGM_2023 ), + }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD ), QUIRK_ROG_CLAYMORE_II_KEYBOARD },
drivers/hid/hid-ids.h +1 -0
@@ -229,6 +229,7 @@#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c#define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b#define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869 +#define USB_DEVICE_ID_ASUSTEK_XGM_2023 0x1a9a#define USB_VENDOR_ID_ATEN 0x0557#define USB_DEVICE_ID_ATEN_UC100KM 0x2004
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/309 module: Fix kernel panic when a symbol st_shndx is out of bounds
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ihor Solodrai <[email protected]>
[ Upstream commit f9d69d5e7bde2295eb7488a56f094ac8f5383b92 ]
The module loader doesn't check for bounds of the ELF section index in simplify_symbols():
for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;
switch (sym[i].st_shndx) {
case SHN_COMMON:
[...]
default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:
BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception
This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted.
Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it.
This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1].
[1] https://lore.kernel.org/linux-modules/[email protected]/
--- kernel/module/main.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/module/main.c +7 -0
@@ -1568,6 +1568,13 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)break ;default : +if (sym[i].st_shndx >= info->hdr->e_shnum) { +pr_err ("%s: Symbol %s has an invalid section index %u (max %u)\n" , + mod->name, name, sym[i].st_shndx, info->hdr->e_shnum -1 ); + ret = -ENOEXEC ; +break ; + } +/* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long )mod_percpu (mod);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/309 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_set_reg() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check by using regmap_update_bits_check() with the underlying regmap, this is more clearly and simply correct than trying to verify that one of the generic ops is exactly equivalent to this one.
--- sound/soc/fsl/fsl_easrc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_easrc.c +6 -3
@@ -93,14 +93,17 @@ static int fsl_easrc_set_reg(struct snd_kcontrol *kcontrol,struct snd_soc_component *component =snd_kcontrol_chip (kcontrol);struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value; +struct fsl_asrc *easrc =snd_soc_component_get_drvdata (component);unsigned int regval = ucontrol->value.integer.value[0 ]; +bool changed;int ret; - ret =snd_soc_component_write (component, mc->regbase, regval); -if (ret <0 ) + ret =regmap_update_bits_check (easrc->regmap, mc->regbase, +GENMASK (31 ,0 ), regval, &changed); +if (ret !=0 )return ret; -return 0 ; +return changed; }#define SOC_SINGLE_REG_RW (xname, xreg) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/309 scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit dbd53975ed4132d161b6a97ebe785a262380182d ]
The driver retains reset history even after the IOC has successfully reached the READY state. That leaves stale reset information active during normal operation and can mislead recovery and diagnostics. In addition, if the IOC becomes READY just as the ready timeout loop exits, the driver still follows the failure path and may retry or report failure incorrectly.
Clear reset history once READY is confirmed so driver state matches actual IOC status. After the timeout loop, recheck the IOC state and treat READY as success instead of failing.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_fw.c +10 -0
@@ -1530,6 +1530,7 @@ static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc)ioc_info (mrioc,"successfully transitioned to %s state\n" ,mpi3mr_iocstate_name (ioc_state)); +mpi3mr_clear_reset_history (mrioc);return 0 ; } ioc_status =readl (&mrioc->sysif_regs->ioc_status);
@@ -1549,6 +1550,15 @@ static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) elapsed_time_sec =jiffies_to_msecs (jiffies - start_time)/1000 ; }while (elapsed_time_sec < mrioc->ready_timeout); + ioc_state =mpi3mr_get_iocstate (mrioc); +if (ioc_state ==MRIOC_STATE_READY ) { +ioc_info (mrioc, +"successfully transitioned to %s state after %llu seconds\n" , +mpi3mr_iocstate_name (ioc_state), elapsed_time_sec); +mpi3mr_clear_reset_history (mrioc); +return 0 ; + } + out_failed: elapsed_time_sec =jiffies_to_msecs (jiffies - start_time)/1000 ;if ((retry <2 ) && (elapsed_time_sec < (mrioc->ready_timeout -60 ))) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/309 ASoC: rt1321: fix DMIC ch2/3 mask issue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit 986841dcad257615a6e3f89231bb38e1f3506b77 ]
This patch fixed the DMIC ch2/3 mask missing problem.
--- sound/soc/codecs/rt1320-sdw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/rt1320-sdw.c +3 -2
@@ -1455,7 +1455,7 @@ static int rt1320_sdw_hw_params(struct snd_pcm_substream *substream,struct sdw_port_config port_config;struct sdw_port_config dmic_port_config[2 ];struct sdw_stream_runtime *sdw_stream; -int retval; +int retval, num_channels;unsigned int sampling_rate;dev_dbg (dai->dev,"%s %s" , __func__, dai->name);
@@ -1487,7 +1487,8 @@ static int rt1320_sdw_hw_params(struct snd_pcm_substream *substream, dmic_port_config[1 ].num =10 ;break ;case RT1321_DEV_ID : - dmic_port_config[0 ].ch_mask =BIT (0 ) |BIT (1 ); + num_channels =params_channels (params); + dmic_port_config[0 ].ch_mask =GENMASK (num_channels -1 ,0 ); dmic_port_config[0 ].num =8 ;break ;default :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/309 scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
[ Upstream commit 80bf3b28d32b431f84f244a8469488eb6d96afbb ]
The Iomega ZIP 100 (Z100P2) can't process IO Advice Hints Grouping mode page query. It immediately switches to the status phase 0xb8 after receiving the subpage code 0x05 of MODE_SENSE_10 command, which fails imm_out() and turns into DID_ERROR of this command, which leads to unusable device. This was tested with an Iomega ZIP 100 (Z100P2) connected with a StarTech PEX1P2 AX99100 PCIe parallel port card.
Prior to this fix, Test Unit Ready fails and the drive can't be used:
IMM: returned SCSI status b8
sd 7:0:6:0: [sdh] Test Unit Ready failed: Result: hostbyte=0x01 driverbyte=DRIVER_OK
--- drivers/scsi/scsi_devinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_devinfo.c +1 -1
@@ -190,7 +190,7 @@ static struct { {"IBM", "2076", NULL, BLIST_NO_VPD_SIZE}, {"IBM", "2105", NULL, BLIST_RETRY_HWERROR}, {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN}, - {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN}, + {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN | BLIST_SKIP_IO_HINTS}, {"IOMEGA", "Io20S *F", NULL, BLIST_KEY}, {"INSITE", "Floptical F*8I", NULL, BLIST_KEY}, {"INSITE", "I325VM", NULL, BLIST_KEY},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/309 ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Freyermuth <[email protected]>
[ Upstream commit 70eddf6a0a3fc6d3ab6f77251676da97cc7f12ae ]
This adds the necessary quirk for the Alienware 18 Area 51 (2025). Complements commit 1b03391d073d ("ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCC SKU").
--- sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/intel/boards/sof_sdw.c +8 -0
@@ -749,6 +749,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(SOC_SDW_CODEC_SPKR), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Alienware" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"0CCD" ) + }, + .driver_data = (void *)(SOC_SDW_CODEC_SPKR), + }, /* Pantherlake devices*/ { .callback = sof_sdw_quirk_cb,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/309 ALSA: hda/hdmi: Add Tegra238 HDA codec device ID
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <[email protected]>
[ Upstream commit 5f4338e5633dc034a81000b2516a78cfb51c601d ]
Add Tegra238 HDA codec device in hda_device_id list.
--- sound/hda/codecs/hdmi/tegrahdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/hdmi/tegrahdmi.c +1 -0
@@ -299,6 +299,7 @@ static const struct hda_device_id snd_hda_id_tegrahdmi[] = {HDA_CODEC_ID_MODEL (0x10de002f ,"Tegra194 HDMI/DP2" ,MODEL_TEGRA ),HDA_CODEC_ID_MODEL (0x10de0030 ,"Tegra194 HDMI/DP3" ,MODEL_TEGRA ),HDA_CODEC_ID_MODEL (0x10de0031 ,"Tegra234 HDMI/DP" ,MODEL_TEGRA234 ), +HDA_CODEC_ID_MODEL (0x10de0032 ,"Tegra238 HDMI/DP" ,MODEL_TEGRA234 ),HDA_CODEC_ID_MODEL (0x10de0033 ,"SoC 33 HDMI/DP" ,MODEL_TEGRA234 ),HDA_CODEC_ID_MODEL (0x10de0034 ,"Tegra264 HDMI/DP" ,MODEL_TEGRA234 ), HDA_CODEC_ID_MODEL(0x10de0035, "SoC 35 HDMI/DP", MODEL_TEGRA234),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/309 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_iec958_put_bits() unconditionally returns 0, causing ALSA to not generate any change events. This is detected by mixer-test with large numbers of messages in the form:
No event generated for Context 3 IEC958 CS5 Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0
Add a suitable check.
--- sound/soc/fsl/fsl_easrc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_easrc.c +4 -1
@@ -52,10 +52,13 @@ static int fsl_easrc_iec958_put_bits(struct snd_kcontrol *kcontrol,struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value;unsigned int regval = ucontrol->value.integer.value[0 ]; +int ret; + + ret = (easrc_priv->bps_iec958[mc->regbase] != regval); easrc_priv->bps_iec958[mc->regbase] = regval; -return 0 ; +return ret; } static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/309 ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 9351cf3fd92dc1349bb75f2f7f7324607dcf596f ]
Move the ASP register patches to a separate struct and apply this from the ASP DAI probe() function so that the registers are only patched if the DAI is part of a DAI link.
Some systems use the ASP as a special-purpose interconnect and on these systems the ASP registers are configured by a third party (the firmware, the BIOS, or another device using the amp's secondary host control interface).
If the machine driver does not hook up the ASP DAI then the ASP registers must be omitted from the patch to prevent overwriting the third party configuration.
If the machine driver includes the ASP DAI in a DAI link, this implies that the machine driver and higher components (such as alsa-ucm) are taking ownership of the ASP. In this case the ASP registers are patched to known defaults and the machine driver should configure the ASP.
--- include/sound/cs35l56.h | 1 + sound/soc/codecs/cs35l56-shared.c | 16 +++++++++++++++- sound/soc/codecs/cs35l56.c | 8 ++++++++ 3 files changed, 24 insertions(+), 1 deletion(-)
include/sound/cs35l56.h +1 -0
@@ -344,6 +344,7 @@ extern const struct cirrus_amp_cal_controls cs35l56_calibration_controls;extern const char *const cs35l56_tx_input_texts[CS35L56_NUM_INPUT_SRC ];extern const unsigned int cs35l56_tx_input_values[CS35L56_NUM_INPUT_SRC ]; +int cs35l56_set_asp_patch (struct cs35l56_base *cs35l56_base);int cs35l56_set_patch (struct cs35l56_base *cs35l56_base);int cs35l56_mbox_send (struct cs35l56_base *cs35l56_base,unsigned int command);int cs35l56_firmware_shutdown (struct cs35l56_base *cs35l56_base);
sound/soc/codecs/cs35l56-shared.c +15 -1
@@ -16,7 +16,7 @@#include "cs35l56.h" -static const struct reg_sequence cs35l56_patch[] = { +static const struct reg_sequence cs35l56_asp_patch[] = {/* * Firmware can change these to non-defaults to satisfy SDCA. * Ensure that they are at known defaults.
@@ -33,6 +33,20 @@ static const struct reg_sequence cs35l56_patch[] = { { CS35L56_ASP1TX2_INPUT, 0x00000000 }, { CS35L56_ASP1TX3_INPUT, 0x00000000 }, { CS35L56_ASP1TX4_INPUT, 0x00000000 }, +}; + +int cs35l56_set_asp_patch (struct cs35l56_base *cs35l56_base) +{ +return regmap_register_patch (cs35l56_base->regmap, cs35l56_asp_patch, +ARRAY_SIZE (cs35l56_asp_patch)); +} +EXPORT_SYMBOL_NS_GPL (cs35l56_set_asp_patch,"SND_SOC_CS35L56_SHARED" ); + +static const struct reg_sequence cs35l56_patch[] = { +/* +* Firmware can change these to non-defaults to satisfy SDCA. +* Ensure that they are at known defaults. +*/ {CS35L56_SWIRE_DP3_CH1_INPUT ,0x00000018 }, {CS35L56_SWIRE_DP3_CH2_INPUT ,0x00000019 }, { CS35L56_SWIRE_DP3_CH3_INPUT, 0x00000029 },
sound/soc/codecs/cs35l56.c +8 -0
@@ -324,6 +324,13 @@ static int cs35l56_dsp_event(struct snd_soc_dapm_widget *w,return wm_adsp_event (w, kcontrol, event); } +static int cs35l56_asp_dai_probe (struct snd_soc_dai *codec_dai) +{ +struct cs35l56_private *cs35l56 =snd_soc_component_get_drvdata (codec_dai->component); + +return cs35l56_set_asp_patch (&cs35l56->base); +} +static int cs35l56_asp_dai_set_fmt (struct snd_soc_dai *codec_dai,unsigned int fmt) {struct cs35l56_private *cs35l56 =snd_soc_component_get_drvdata (codec_dai->component);
@@ -528,6 +535,7 @@ static int cs35l56_asp_dai_set_sysclk(struct snd_soc_dai *dai, }static const struct snd_soc_dai_ops cs35l56_ops = { + .probe = cs35l56_asp_dai_probe, .set_fmt = cs35l56_asp_dai_set_fmt, .set_tdm_slot = cs35l56_asp_dai_set_tdm_slot, .hw_params = cs35l56_asp_dai_hw_params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/309 dma-buf: Include ioctl.h in UAPI header
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <[email protected]>
[ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]
include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define its ioctl commands. However, it does not include ioctl.h itself. So, if userspace source code tries to include the dma-buf.h file without including ioctl.h, it can result in build failures.
Therefore, include ioctl.h in the dma-buf UAPI header.
--- include/uapi/linux/dma-buf.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/dma-buf.h +1 -0
@@ -20,6 +20,7 @@#ifndef _DMA_BUF_UAPI_H_#define _DMA_BUF_UAPI_H_ +#include <linux/ioctl.h> #include <linux/types.h> /**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/309 block: break pcpu_alloc_mutex dependency on freeze_lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
[ Upstream commit 539d1b47e935e8384977dd7e5cec370c08b7a644 ]
While nr_hw_update allocates tagset tags it acquires ->pcpu_alloc_mutex after ->freeze_lock is acquired or queue is frozen. This potentially creates a circular dependency involving ->fs_reclaim if reclaim is triggered simultaneously in a code path which first acquires ->pcpu_ alloc_mutex. As the queue is already frozen while nr_hw_queue update allocates tagsets, the reclaim can't forward progress and thus it could cause a potential deadlock as reported in lockdep splat[1].
Fix this by pre-allocating tagset tags before we freeze queue during nr_hw_queue update. Later the allocated tagset tags could be safely installed and used after queue is frozen.
--- block/blk-mq.c | 45 ++++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-)
block/blk-mq.c +30 -15
@@ -4747,38 +4747,45 @@ static void blk_mq_update_queue_map(struct blk_mq_tag_set *set) } } -static int blk_mq_realloc_tag_set_tags (struct blk_mq_tag_set *set, -int new_nr_hw_queues) +static struct blk_mq_tags **blk_mq_prealloc_tag_set_tags ( +struct blk_mq_tag_set *set, +int new_nr_hw_queues) {struct blk_mq_tags **new_tags;int i;if (set->nr_hw_queues >= new_nr_hw_queues) - goto done; +return NULL ; new_tags =kcalloc_node (new_nr_hw_queues,sizeof (struct blk_mq_tags *),GFP_KERNEL , set->numa_node);if (!new_tags) -return -ENOMEM ; +return ERR_PTR (-ENOMEM );if (set->tags)memcpy (new_tags, set->tags, set->nr_hw_queues *sizeof (*set->tags)); -kfree (set->tags); - set->tags = new_tags;for (i = set->nr_hw_queues; i < new_nr_hw_queues; i++) { -if (!__blk_mq_alloc_map_and_rqs (set, i)) { -while (--i >= set->nr_hw_queues) -__blk_mq_free_map_and_rqs (set, i); -return -ENOMEM ; +if (blk_mq_is_shared_tags (set->flags)) { + new_tags[i] = set->shared_tags; + }else { + new_tags[i] =blk_mq_alloc_map_and_rqs (set, i, + set->queue_depth); +if (!new_tags[i]) + goto out_unwind; }cond_resched (); } -done: - set->nr_hw_queues = new_nr_hw_queues; -return 0 ; +return new_tags; +out_unwind: +while (--i >= set->nr_hw_queues) { +if (!blk_mq_is_shared_tags (set->flags)) +blk_mq_free_map_and_rqs (set, new_tags[i], i); + } +kfree (new_tags); +return ERR_PTR (-ENOMEM ); }/*
@@ -5062,6 +5069,7 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,unsigned int memflags;int i;struct xarray elv_tbl; +struct blk_mq_tags **new_tags;bool queues_frozen = false;lockdep_assert_held (&set->tag_list_lock);
@@ -5096,11 +5104,18 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,if (blk_mq_elv_switch_none (q, &elv_tbl)) goto switch_back; + new_tags =blk_mq_prealloc_tag_set_tags (set, nr_hw_queues); +if (IS_ERR (new_tags)) + goto switch_back; +list_for_each_entry (q, &set->tag_list, tag_set_list)blk_mq_freeze_queue_nomemsave (q); queues_frozen = true; -if (blk_mq_realloc_tag_set_tags (set, nr_hw_queues) <0 ) - goto switch_back; +if (new_tags) { +kfree (set->tags); + set->tags = new_tags; + } + set->nr_hw_queues = nr_hw_queues; fallback:blk_mq_update_queue_map (set);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/309 ALSA: hda/senary: Ensure EAPD is enabled during init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangdicheng <[email protected]>
[ Upstream commit 7ae0d8f1abbbba6f98cac735145e1206927c67d9 ]
The driver sets spec->gen.own_eapd_ctl to take manual control of the EAPD (External Amplifier). However, senary_init does not turn on the EAPD, while senary_shutdown turns it off.
Since the generic driver skips EAPD handling when own_eapd_ctl is set, the EAPD remains off after initialization (e.g., after resume), leaving the codec in a non-functional state.
Explicitly call senary_auto_turn_eapd in senary_init to ensure the EAPD is enabled and the codec is functional.
--- sound/hda/codecs/senarytech.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/hda/codecs/senarytech.c +5 -0
@@ -25,6 +25,7 @@ struct senary_spec {/* extra EAPD pins */ unsigned int num_eapds;hda_nid_t eapds[4 ]; +bool dynamic_eapd;hda_nid_t mute_led_eapd;unsigned int parse_flags;/* flag for snd_hda_parse_pin_defcfg() */
@@ -131,8 +132,12 @@ static void senary_init_gpio_led(struct hda_codec *codec)static int senary_init (struct hda_codec *codec) { +struct senary_spec *spec = codec->spec; +snd_hda_gen_init (codec);senary_init_gpio_led (codec); +if (!spec->dynamic_eapd) +senary_auto_turn_eapd (codec, spec->num_eapds, spec->eapds, true);snd_hda_apply_fixup (codec,HDA_FIXUP_ACT_INIT );return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/309 drm/ttm/tests: Fix build failure on PREEMPT_RT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
[ Upstream commit a58d487fb1a52579d3c37544ea371da78ed70c45 ]
Fix a compile error in the kunit tests when CONFIG_PREEMPT_RT is enabled, and the normal mutex is converted into a rtmutex.
--- drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/ttm/tests/ttm_bo_test.c +2 -2
@@ -222,13 +222,13 @@ static void ttm_bo_reserve_interrupted(struct kunit *test)KUNIT_FAIL (test,"Couldn't create ttm bo reserve task\n" );/* Take a lock so the threaded reserve has to wait */ -mutex_lock (&bo->base.resv->lock.base); +dma_resv_lock (bo->base.resv,NULL );wake_up_process (task);msleep (20 ); err =kthread_stop (task); -mutex_unlock (&bo->base.resv->lock.base); +dma_resv_unlock (bo->base.resv);KUNIT_ASSERT_EQ (test, err, -ERESTARTSYS ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/309 ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <[email protected]>
[ Upstream commit fd13fc700e3e239826a46448bf7f01847dd26f5a ]
This adds some match entries for a few system configurations:
cs42l43 link 0 UID 0
cs35l56 link 1 UID 0
cs35l56 link 1 UID 1
cs35l56 link 1 UID 2
cs35l56 link 1 UID 3
cs42l45 link 1 UID 0
cs35l63 link 0 UID 0
cs35l63 link 0 UID 2
cs35l63 link 0 UID 4
cs35l63 link 0 UID 6
cs42l45 link 0 UID 0
cs35l63 link 1 UID 0
cs35l63 link 1 UID 1
cs42l45 link 0 UID 0
cs35l63 link 1 UID 1
cs35l63 link 1 UID 3
cs42l45 link 1 UID 0
cs35l63 link 0 UID 0
cs35l63 link 0 UID 1
cs42l43 link 1 UID 0
cs35l56 link 1 UID 0
cs35l56 link 1 UID 1
cs35l56 link 1 UID 2
cs35l56 link 1 UID 3
cs35l56 link 1 UID 0
cs35l56 link 1 UID 1
cs35l56 link 1 UID 2
cs35l56 link 1 UID 3
cs35l63 link 0 UID 0
cs35l63 link 0 UID 2
cs35l63 link 0 UID 4
cs35l63 link 0 UID 6
cs42l43 link 0 UID 1
cs42l43b link 0 UID 1
cs42l45 link 0 UID 0
cs42l45 link 1 UID 0
--- sound/soc/amd/acp/amd-acp63-acpi-match.c | 413 +++++++++++++++++++++++ 1 file changed, 413 insertions(+)
sound/soc/amd/acp/amd-acp63-acpi-match.c +413 -0
@@ -30,6 +30,20 @@ static const struct snd_soc_acpi_endpoint spk_r_endpoint = { .group_id = 1 }; +static const struct snd_soc_acpi_endpoint spk_2_endpoint = { + .num =0 , + .aggregated =1 , + .group_position =2 , + .group_id =1 +}; + +static const struct snd_soc_acpi_endpoint spk_3_endpoint = { + .num =0 , + .aggregated =1 , + .group_position =3 , + .group_id =1 +}; +static const struct snd_soc_acpi_adr_device rt711_rt1316_group_adr[] = { { .adr =0x000030025D071101ull ,
@@ -103,6 +117,345 @@ static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { } }; +static const struct snd_soc_acpi_endpoint cs42l43_endpoints[] = { + {/* Jack Playback Endpoint */ + .num =0 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, + {/* DMIC Capture Endpoint */ + .num =1 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, + {/* Jack Capture Endpoint */ + .num =2 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, + {/* Speaker Playback Endpoint */ + .num =3 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, +}; + +static const struct snd_soc_acpi_adr_device cs35l56x4_l1u3210_adr[] = { + { + .adr =0x00013301FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00013201FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, + { + .adr =0x00013101FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_2_endpoint, + .name_prefix ="AMP3" + }, + { + .adr =0x00013001FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_3_endpoint, + .name_prefix ="AMP4" + }, +}; + +static const struct snd_soc_acpi_adr_device cs35l63x2_l0u01_adr[] = { + { + .adr =0x00003001FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00003101FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, +}; + +static const struct snd_soc_acpi_adr_device cs35l63x2_l1u01_adr[] = { + { + .adr =0x00013001FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00013101FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, +}; + +static const struct snd_soc_acpi_adr_device cs35l63x2_l1u13_adr[] = { + { + .adr =0x00013101FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00013301FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, +}; + +static const struct snd_soc_acpi_adr_device cs35l63x4_l0u0246_adr[] = { + { + .adr =0x00003001FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00003201FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, + { + .adr =0x00003401FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_2_endpoint, + .name_prefix ="AMP3" + }, + { + .adr =0x00003601FA356301ull , + .num_endpoints =1 , + .endpoints = &spk_3_endpoint, + .name_prefix ="AMP4" + }, +}; + +static const struct snd_soc_acpi_adr_device cs42l43_l0u0_adr[] = { + { + .adr =0x00003001FA424301ull , + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints), + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l43" + } +}; + +static const struct snd_soc_acpi_adr_device cs42l43_l0u1_adr[] = { + { + .adr =0x00003101FA424301ull , + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints), + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l43" + } +}; + +static const struct snd_soc_acpi_adr_device cs42l43b_l0u1_adr[] = { + { + .adr =0x00003101FA2A3B01ull , + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints), + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l43" + } +}; + +static const struct snd_soc_acpi_adr_device cs42l43_l1u0_cs35l56x4_l1u0123_adr[] = { + { + .adr =0x00013001FA424301ull , + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints), + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l43" + }, + { + .adr =0x00013001FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_l_endpoint, + .name_prefix ="AMP1" + }, + { + .adr =0x00013101FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_r_endpoint, + .name_prefix ="AMP2" + }, + { + .adr =0x00013201FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_2_endpoint, + .name_prefix ="AMP3" + }, + { + .adr =0x00013301FA355601ull , + .num_endpoints =1 , + .endpoints = &spk_3_endpoint, + .name_prefix ="AMP4" + }, +}; + +static const struct snd_soc_acpi_adr_device cs42l45_l0u0_adr[] = { + { + .adr =0x00003001FA424501ull , +/* Re-use endpoints, but cs42l45 has no speaker */ + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints) -1 , + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l45" + } +}; + +static const struct snd_soc_acpi_adr_device cs42l45_l1u0_adr[] = { + { + .adr =0x00013001FA424501ull , +/* Re-use endpoints, but cs42l45 has no speaker */ + .num_endpoints =ARRAY_SIZE (cs42l43_endpoints) -1 , + .endpoints = cs42l43_endpoints, + .name_prefix ="cs42l45" + } +}; + +static const struct snd_soc_acpi_link_adr acp63_cs35l56x4_l1u3210[] = { + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs35l56x4_l1u3210_adr), + .adr_d = cs35l56x4_l1u3210_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs35l63x4_l0u0246[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs35l63x4_l0u0246_adr), + .adr_d = cs35l63x4_l0u0246_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l43_l0u1[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l43_l0u1_adr), + .adr_d = cs42l43_l0u1_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l43b_l0u1[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l43b_l0u1_adr), + .adr_d = cs42l43b_l0u1_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l43_l0u0_cs35l56x4_l1u3210[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l43_l0u0_adr), + .adr_d = cs42l43_l0u0_adr, + }, + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs35l56x4_l1u3210_adr), + .adr_d = cs35l56x4_l1u3210_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l43_l1u0_cs35l56x4_l1u0123[] = { + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs42l43_l1u0_cs35l56x4_l1u0123_adr), + .adr_d = cs42l43_l1u0_cs35l56x4_l1u0123_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l0u0[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l45_l0u0_adr), + .adr_d = cs42l45_l0u0_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l0u0_cs35l63x2_l1u01[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l45_l0u0_adr), + .adr_d = cs42l45_l0u0_adr, + }, + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs35l63x2_l1u01_adr), + .adr_d = cs35l63x2_l1u01_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l0u0_cs35l63x2_l1u13[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs42l45_l0u0_adr), + .adr_d = cs42l45_l0u0_adr, + }, + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs35l63x2_l1u13_adr), + .adr_d = cs35l63x2_l1u13_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l1u0[] = { + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs42l45_l1u0_adr), + .adr_d = cs42l45_l1u0_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l1u0_cs35l63x2_l0u01[] = { + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs42l45_l1u0_adr), + .adr_d = cs42l45_l1u0_adr, + }, + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs35l63x2_l0u01_adr), + .adr_d = cs35l63x2_l0u01_adr, + }, + {} +}; + +static const struct snd_soc_acpi_link_adr acp63_cs42l45_l1u0_cs35l63x4_l0u0246[] = { + { + .mask =BIT (1 ), + .num_adr =ARRAY_SIZE (cs42l45_l1u0_adr), + .adr_d = cs42l45_l1u0_adr, + }, + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (cs35l63x4_l0u0246_adr), + .adr_d = cs35l63x4_l0u0246_adr, + }, + {} +}; +static const struct snd_soc_acpi_link_adr acp63_rt722_only[] = { { .mask =BIT (0 ),
@@ -135,6 +488,66 @@ struct snd_soc_acpi_mach snd_soc_acpi_amd_acp63_sdw_machines[] = { .links = acp63_4_in_1_sdca, .drv_name = "amd_sdw", }, + { + .link_mask = BIT(0) | BIT(1), + .links = acp63_cs42l43_l0u0_cs35l56x4_l1u3210, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0) | BIT(1), + .links = acp63_cs42l45_l1u0_cs35l63x4_l0u0246, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0) | BIT(1), + .links = acp63_cs42l45_l0u0_cs35l63x2_l1u01, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0) | BIT(1), + .links = acp63_cs42l45_l0u0_cs35l63x2_l1u13, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0) | BIT(1), + .links = acp63_cs42l45_l1u0_cs35l63x2_l0u01, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(1), + .links = acp63_cs42l43_l1u0_cs35l56x4_l1u0123, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(1), + .links = acp63_cs35l56x4_l1u3210, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0), + .links = acp63_cs35l63x4_l0u0246, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0), + .links = acp63_cs42l43_l0u1, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0), + .links = acp63_cs42l43b_l0u1, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(0), + .links = acp63_cs42l45_l0u0, + .drv_name = "amd_sdw", + }, + { + .link_mask = BIT(1), + .links = acp63_cs42l45_l1u0, + .drv_name = "amd_sdw", + }, {}, }; EXPORT_SYMBOL(snd_soc_acpi_amd_acp63_sdw_machines);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/309 bpf: Fix u32/s32 bounds when ranges cross min/max boundary
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit fbc7aef517d8765e4c425d2792409bb9bf2e1f13 ]
Same as in __reg64_deduce_bounds(), refine s32/u32 ranges in __reg32_deduce_bounds() in the following situations:
- s32 range crosses U32_MAX/0 boundary, positive part of the s32 range overlaps with u32 range:
0 U32_MAX
| [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxx s32 range xxxxxxxxx] [xxxxxxx| 0 S32_MAX S32_MIN -1
- s32 range crosses U32_MAX/0 boundary, negative part of the s32 range overlaps with u32 range:
0 U32_MAX
| [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxxxxxx] [xxxxxxxxxxxx s32 range | 0 S32_MAX S32_MIN -1
- No refinement if ranges overlap in two intervals.
This helps for e.g. consider the following program:
call %[bpf_get_prandom_u32];
w0 &= 0xffffffff;
if w0 < 0x3 goto 1f; // on fall-through u32 range [3..U32_MAX] if w0 s> 0x1 goto 1f; // on fall-through s32 range [S32_MIN..1] if w0 s< 0x0 goto 1f; // range can be narrowed to [S32_MIN..-1]
r10 = 0;
1: ...;
The reg_bounds.c selftest is updated to incorporate identical logic, refinement based on non-overflowing range halves:
((x ∩ [0, smax]) ∩ (y ∩ [0, smax])) ∪
((x ∩ [smin,-1]) ∩ (y ∩ [smin,-1]))
--- kernel/bpf/verifier.c | 24 +++++++ .../selftests/bpf/prog_tests/reg_bounds.c | 62 +++++++++++++++++-- 2 files changed, 82 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +24 -0
@@ -2479,6 +2479,30 @@ static void __reg32_deduce_bounds(struct bpf_reg_state *reg)if ((u32 )reg->s32_min_value <= (u32 )reg->s32_max_value) { reg->u32_min_value =max_t (u32, reg->s32_min_value, reg->u32_min_value); reg->u32_max_value =min_t (u32, reg->s32_max_value, reg->u32_max_value); + }else { +if (reg->u32_max_value < (u32 )reg->s32_min_value) { +/* See __reg64_deduce_bounds() for detailed explanation. +* Refine ranges in the following situation: +* +* 0 U32_MAX +* | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | +* |----------------------------|----------------------------| +* |xxxxx s32 range xxxxxxxxx] [xxxxxxx| +* 0 S32_MAX S32_MIN -1 +*/ + reg->s32_min_value = (s32 )reg->u32_min_value; + reg->u32_max_value =min_t (u32, reg->u32_max_value, reg->s32_max_value); + }else if ((u32 )reg->s32_max_value < reg->u32_min_value) { +/* +* 0 U32_MAX +* | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] | +* |----------------------------|----------------------------| +* |xxxxxxxxx] [xxxxxxxxxxxx s32 range | +* 0 S32_MAX S32_MIN -1 +*/ + reg->s32_max_value = (s32 )reg->u32_max_value; + reg->u32_min_value =max_t (u32, reg->u32_min_value, reg->s32_min_value); + } } }
tools/testing/selftests/bpf/prog_tests/reg_bounds.c +58 -4
94 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/309 HID: apple: avoid memory leak in apple_report_fixup()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 239c15116d80f67d32f00acc34575f1a6b699613 ]
The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-apple.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-apple.c +1 -3
@@ -689,9 +689,7 @@ static const __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up Magic Keyboard battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/309 sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhidao su <[email protected]>
[ Upstream commit 7a8464555d2e5f038758bb19e72ab4710b79e9cd ]
bpf_iter_scx_dsq_new() reads dsq->seq via READ_ONCE() without holding any lock, making dsq->seq a lock-free concurrently accessed variable. However, dispatch_enqueue(), the sole writer of dsq->seq, uses a plain increment without the matching WRITE_ONCE() on the write side:
dsq->seq++;
^^^^^^^^^^^
plain write -- KCSAN data raceThe KCSAN documentation requires that if one accessor uses READ_ONCE() or WRITE_ONCE() on a variable to annotate lock-free access, all other accesses must also use the appropriate accessor. A plain write leaves the pair incomplete and will trigger KCSAN warnings.
Fix by using WRITE_ONCE() for the write side of the update:
WRITE_ONCE(dsq->seq, dsq->seq + 1);
This is consistent with bpf_iter_scx_dsq_new() and makes the concurrent access annotation complete and KCSAN-clean.
--- kernel/sched/ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
@@ -1019,7 +1019,7 @@ static void dispatch_enqueue(struct scx_sched *sch, struct scx_dispatch_q *dsq, }/* seq records the order tasks are queued, used by BPF DSQ iterator */ - dsq->seq++; +WRITE_ONCE (dsq->seq, dsq->seq +1 ); p->scx.dsq_seq = dsq->seq;dsq_mod_nr (dsq,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/309 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 5131fa077f9bb386a1b901bf5b247041f0ec8f80 ]
We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like:
drwxrwxrwt 1 root root 16 Jan 23 16:49 .
drwxr-xr-x 1 root root 24 Jan 23 16:48 ..
d????????? ? ? ? ? ? broken_subvol
and similarly stat-ing the file fails.
In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck.
dmesg contains a single notable error message reading:
"could not do orphan cleanup -2"
2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup().
btrfs_lookupbtrfs_lookup_dentrybtrfs_orphan_cleanup // prints that message and returns -ENOENT
After some detailed inspection of the internal state, it became clear that:
- there are no orphan items for the subvol
- the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc.
- the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later.
- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want.
i.e.,btrfs_lookup()
btrfs_lookup_dentry()
if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root)
test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N
...
prints "could not do orphan cleanup -2"
if (inode == ERR_PTR(-ENOENT))
inode = NULL;
return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume
btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit.
The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache.
The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive.
Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races)
Phase 1:
Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set
btrfs_mksubvol()
lookup_one_len()
__lookup_slow()
d_alloc_parallel()
__d_alloc() // d_lockref.count = 1
create_subvol(dentry)
// doesn't touch the bit..
d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.count == 1Phase 2:
Create a delayed iput for a file in the subvol but leave the subvol in state where its dentry can be evicted (d_lockref.count == 0)
T1 (task) T2 (writeback) T3 (OE workqueue)
write() // dirty pages
btrfs_writepages()
btrfs_run_delalloc_range()
cow_file_range()
btrfs_alloc_ordered_extent()
igrab() // i_count: 1 -> 2btrfs_unlink_inode()
btrfs_orphan_add()close()
__fput()
dput()
finish_dput()
__dentry_kill()
dentry_unlink_inode()
iput() // 2 -> 1
--parent->d_lockref.count // 1 -> 0; evictable
finish_ordered_fn()
btrfs_finish_ordered_io()
btrfs_put_ordered_extent()
btrfs_add_delayed_iput()Phase 3:
Once the delayed iput is pending and the subvol dentry is evictable, the shrinker can free it, causing the next lookup to go through btrfs_lookup() and call btrfs_orphan_cleanup() for the first time. If the cleaner kthread processes the delayed iput concurrently, the two race:
T1 (shrinker) T2 (cleaner kthread) T3 (lookup)
super_cache_scan()
prune_dcache_sb()
__dentry_kill()
// subvol dentry freed
btrfs_run_delayed_iputs()
iput() // i_count -> 0
evict() // sets I_FREEING
btrfs_evict_inode()
// truncation loop
btrfs_lookup()
btrfs_lookup_dentry()
btrfs_orphan_cleanup()
// first call (bit never set)
btrfs_iget()
// blocks on I_FREEING
btrfs_orphan_del()
// inode freed
// returns -ENOENT
btrfs_del_orphan_item()
// -ENOENT
// "could not do orphan cleanup -2"
d_splice_alias(NULL, dentry)
// negative dentry for valid subvolThe most straightforward fix is to ensure the invariant that a dentry for a subvolume can exist if and only if that subvolume has BTRFS_ROOT_ORPHAN_CLEANUP set on its root (and is known to have no orphans or ran btrfs_orphan_cleanup()).
--- fs/btrfs/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/btrfs/ioctl.c +7 -0
@@ -674,6 +674,13 @@ static noinline int create_subvol(struct mnt_idmap *idmap, goto out; } +/* +* Subvolumes have orphans cleaned on first dentry lookup. A new +* subvolume cannot have any orphans, so we should set the bit before we +* add the subvolume dentry to the dentry cache, so that it is in the +* same state as a subvolume after first lookup. +*/ +set_bit (BTRFS_ROOT_ORPHAN_CLEANUP , &new_root->state);d_instantiate_new (dentry, new_inode_args.inode); new_inode_args.inode =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/309 powerpc64/ftrace: fix OOL stub count with clang
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Bathini <[email protected]>
[ Upstream commit 875612a7745013a43c67493cb0583ee3f7476344 ]
The total number of out-of-line (OOL) stubs required for function tracing is determined using the following command:
$(OBJDUMP) -r -j __patchable_function_entries vmlinux.o
While this works correctly with GNU objdump, llvm-objdump does not list the expected relocation records for this section. Fix this by using the -d option and counting R_PPC64_ADDR64 relocation entries. This works as desired with both objdump and llvm-objdump.
--- arch/powerpc/tools/ftrace-gen-ool-stubs.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/tools/ftrace-gen-ool-stubs.sh +2 -2
@@ -15,9 +15,9 @@ if [ -z "$is_64bit" ]; then RELOCATION=R_PPC_ADDR32 fi -num_ool_stubs_total=$($objdump -r -j __patchable_function_entries "$vmlinux_o" | +num_ool_stubs_total=$($objdump -r -j __patchable_function_entries -d "$vmlinux_o" | grep -c "$RELOCATION") -num_ool_stubs_inittext=$($objdump -r -j __patchable_function_entries "$vmlinux_o" | +num_ool_stubs_inittext=$($objdump -r -j __patchable_function_entries -d "$vmlinux_o" | grep -e ".init.text" -e ".text.startup" | grep -c "$RELOCATION") num_ool_stubs_text=$((num_ool_stubs_total - num_ool_stubs_inittext))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/309 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liucheng Lu <[email protected]>
[ Upstream commit 178dd118c0f07fd63a9ed74cfbd8c31ae50e33af ]
HP Laptop 14s-dr5xxx with ALC236 codec does not handle the toggling of the mute LED.
This patch adds a quirk entry for subsystem ID 0x8a1f using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6792,6 +6792,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x89da ,"HP Spectre x360 14t-ea100" ,ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX ),SND_PCI_QUIRK (0x103c ,0x89e7 ,"HP Elite x2 G9" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8a0f ,"HP Pavilion 14-ec1xxx" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8a1f ,"HP Laptop 14s-dr5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a20 ,"HP Laptop 15s-fq5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a25 ,"HP Victus 16-d1xxx (MB 8A25)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ), SND_PCI_QUIRK(0x103c, 0x8a26, "HP Victus 16-d1xxx (MB 8A26)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/309 ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 56fbbe096a89ff4b52af78a21a4afd9d94bdcc80 ]
The BIOS of this machine has set 0x19 to mic, which needs to be set to headphone pin in order to work properly.
--- sound/hda/codecs/realtek/alc662.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/hda/codecs/realtek/alc662.c +9 -0
@@ -313,6 +313,7 @@ enum {ALC897_FIXUP_HEADSET_MIC_PIN2 ,ALC897_FIXUP_UNIS_H3C_X500S ,ALC897_FIXUP_HEADSET_MIC_PIN3 , + ALC897_FIXUP_H610M_HP_PIN, }; static const struct hda_fixup alc662_fixups[] = {
@@ -766,6 +767,13 @@ static const struct hda_fixup alc662_fixups[] = { { } }, }, + [ALC897_FIXUP_H610M_HP_PIN ] = { + .type =HDA_FIXUP_PINS , + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x0321403f },/* HP out */ + { } + }, + }, };static const struct hda_quirk alc662_fixup_tbl[] = {
@@ -815,6 +823,7 @@ static const struct hda_quirk alc662_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x8469 ,"ASUS mobo" ,ALC662_FIXUP_NO_JACK_DETECT ),SND_PCI_QUIRK (0x105b ,0x0cd6 ,"Foxconn" ,ALC662_FIXUP_ASUS_MODE2 ),SND_PCI_QUIRK (0x144d ,0xc051 ,"Samsung R720" ,ALC662_FIXUP_IDEAPAD ), +SND_PCI_QUIRK (0x1458 ,0xa194 ,"H610M H V2 DDR4" ,ALC897_FIXUP_H610M_HP_PIN ),SND_PCI_QUIRK (0x14cd ,0x5003 ,"USI" ,ALC662_FIXUP_USI_HEADSET_MODE ),SND_PCI_QUIRK (0x17aa ,0x1036 ,"Lenovo P520" ,ALC662_FIXUP_LENOVO_MULTI_CODECS ), SND_PCI_QUIRK(0x17aa, 0x1057, "Lenovo P360", ALC897_FIXUP_HEADSET_MIC_PIN),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/309 ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uzair Mughal <[email protected]>
[ Upstream commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 ]
The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288) does not report headset button press events. Headphone insertion is detected (SW_HEADPHONE_INSERT), but pressing the inline microphone button on a headset produces no input events.
Add a SND_PCI_QUIRK entry that maps this subsystem ID to ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables headset jack button detection through alc_fixup_headset_jack() and ThinkPad ACPI integration. This is the same fixup used by similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3).
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7323,6 +7323,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x224c ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x224d ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x225d ,"Thinkpad T480" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x17aa ,0x2288 ,"Thinkpad X390" ,ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x2292 ,"Thinkpad X1 Carbon 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x22be ,"Thinkpad X1 Carbon 8th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ), SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/309 objtool: Handle Clang RSP musical chairs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 7fdaa640c810cb42090a182c33f905bcc47a616a ]
For no apparent reason (possibly related to CONFIG_KMSAN), Clang can randomly pass the value of RSP to other registers and then back again to RSP. Handle that accordingly.
Fixes the following warnings:
drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: undefined stack state drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x165: unknown CFA base reg -1
--- tools/objtool/arch/x86/decode.c | 62 ++++++++++++--------------------- tools/objtool/check.c | 14 ++++++++ 2 files changed, 37 insertions(+), 39 deletions(-)
tools/objtool/arch/x86/decode.c +23 -39
@@ -340,52 +340,36 @@ int arch_decode_instruction(struct objtool_file *file, const struct section *secif (!rex_w)break ; -if (modrm_reg ==CFI_SP ) { - -if (mod_is_reg ()) { -/* mov %rsp, reg */ -ADD_OP (op) { - op->src.type =OP_SRC_REG ; - op->src.reg =CFI_SP ; - op->dest.type =OP_DEST_REG ; - op->dest.reg = modrm_rm; - } -break ; - - }else { -/* skip RIP relative displacement */ -if (is_RIP ()) -break ; - -/* skip nontrivial SIB */ -if (have_SIB ()) { - modrm_rm = sib_base; -if (sib_index !=CFI_SP ) -break ; - } - -/* mov %rsp, disp(%reg) */ -ADD_OP (op) { - op->src.type =OP_SRC_REG ; - op->src.reg =CFI_SP ; - op->dest.type =OP_DEST_REG_INDIRECT ; - op->dest.reg = modrm_rm; - op->dest.offset = ins.displacement.value; - } -break ; +if (mod_is_reg ()) { +/* mov reg, reg */ +ADD_OP (op) { + op->src.type =OP_SRC_REG ; + op->src.reg = modrm_reg; + op->dest.type =OP_DEST_REG ; + op->dest.reg = modrm_rm; } -break ; } -if (rm_is_reg (CFI_SP )) { +/* skip RIP relative displacement */ +if (is_RIP ()) +break ; -/* mov reg, %rsp */ +/* skip nontrivial SIB */ +if (have_SIB ()) { + modrm_rm = sib_base; +if (sib_index !=CFI_SP ) +break ; + } + +/* mov %rsp, disp(%reg) */ +if (modrm_reg ==CFI_SP ) {ADD_OP (op) { op->src.type =OP_SRC_REG ; - op->src.reg = modrm_reg; - op->dest.type =OP_DEST_REG ; - op->dest.reg =CFI_SP ; + op->src.reg =CFI_SP ; + op->dest.type =OP_DEST_REG_INDIRECT ; + op->dest.reg = modrm_rm; + op->dest.offset = ins.displacement.value; }break ; }
tools/objtool/check.c +14 -0
@@ -2902,6 +2902,20 @@ static int update_cfi_state(struct instruction *insn, cfi->stack_size +=8 ; } +else if (cfi->vals[op->src.reg].base ==CFI_CFA ) { +/* +* Clang RSP musical chairs: +* +* mov %rsp, %rdx [handled above] +* ... +* mov %rdx, %rbx [handled here] +* ... +* mov %rbx, %rsp [handled above] +*/ + cfi->vals[op->dest.reg].base =CFI_CFA ; + cfi->vals[op->dest.reg].offset = cfi->vals[op->src.reg].offset; + } +break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/309 nvmet: move async event work off nvmet-wq
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Kulkarni <[email protected]>
[ Upstream commit 2922e3507f6d5caa7f1d07f145e186fc6f317a4e ]
For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:-
A. Async event work queued on nvmet-wq (prior to disconnect):
nvmet_execute_async_event()
queue_work(nvmet_wq, &ctrl->async_event_work)
nvmet_add_async_event()
queue_work(nvmet_wq, &ctrl->async_event_work)
B. Full pre-work chain (RDMA CM path):
nvmet_rdma_cm_handler()
nvmet_rdma_queue_disconnect()
__nvmet_rdma_queue_disconnect()
queue_work(nvmet_wq, &queue->release_work)
process_one_work()
lock((wq_completion)nvmet-wq) <--------- 1st
nvmet_rdma_release_queue_work()C. Recursive path (same worker):
nvmet_rdma_release_queue_work()
nvmet_rdma_free_queue()
nvmet_sq_destroy()
nvmet_ctrl_put()
nvmet_ctrl_free()
flush_work(&ctrl->async_event_work)
__flush_work()
touch_wq_lockdep_map()
lock((wq_completion)nvmet-wq) <--------- 2ndLockdep splat:
============================================
WARNING: possible recursive locking detected
6.19.0-rc3nvme+ #14 Tainted: G N
--------------------------------------------
kworker/u192:42/44933 is trying to acquire lock:
ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90
but task is already holding lock:
ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660
3 locks held by kworker/u192:42/44933:
#0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530
Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390
Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.
--- drivers/nvme/target/admin-cmd.c | 2 +- drivers/nvme/target/core.c | 14 ++++++++++++-- drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/rdma.c | 1 + 4 files changed, 15 insertions(+), 3 deletions(-)
drivers/nvme/target/admin-cmd.c +1 -1
@@ -1586,7 +1586,7 @@ void nvmet_execute_async_event(struct nvmet_req *req) ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req;mutex_unlock (&ctrl->lock); -queue_work (nvmet_wq, &ctrl->async_event_work); +queue_work (nvmet_aen_wq, &ctrl->async_event_work); }void nvmet_execute_keep_alive (struct nvmet_req *req)
drivers/nvme/target/core.c +12 -2
@@ -26,6 +26,8 @@ static DEFINE_IDA(cntlid_ida);struct workqueue_struct *nvmet_wq;EXPORT_SYMBOL_GPL (nvmet_wq); +struct workqueue_struct *nvmet_aen_wq; +EXPORT_SYMBOL_GPL (nvmet_aen_wq);/* * This read/write semaphore is used to synchronize access to configuration
@@ -205,7 +207,7 @@ void nvmet_add_async_event(struct nvmet_ctrl *ctrl, u8 event_type,list_add_tail (&aen->entry, &ctrl->async_events);mutex_unlock (&ctrl->lock); -queue_work (nvmet_wq, &ctrl->async_event_work); +queue_work (nvmet_aen_wq, &ctrl->async_event_work); }static void nvmet_add_to_changed_ns_log (struct nvmet_ctrl *ctrl,__le32 nsid)
@@ -1957,9 +1959,14 @@ static int __init nvmet_init(void)if (!nvmet_wq) goto out_free_buffered_work_queue; + nvmet_aen_wq =alloc_workqueue ("nvmet-aen-wq" , +WQ_MEM_RECLAIM |WQ_UNBOUND ,0 ); +if (!nvmet_aen_wq) + goto out_free_nvmet_work_queue; + error =nvmet_init_debugfs ();if (error) - goto out_free_nvmet_work_queue; + goto out_free_nvmet_aen_work_queue; error =nvmet_init_discovery ();if (error)
@@ -1975,6 +1982,8 @@ static int __init nvmet_init(void)nvmet_exit_discovery (); out_exit_debugfs:nvmet_exit_debugfs (); +out_free_nvmet_aen_work_queue: +destroy_workqueue (nvmet_aen_wq); out_free_nvmet_work_queue:destroy_workqueue (nvmet_wq); out_free_buffered_work_queue:
@@ -1992,6 +2001,7 @@ static void __exit nvmet_exit(void)nvmet_exit_discovery ();nvmet_exit_debugfs ();ida_destroy (&cntlid_ida); +destroy_workqueue (nvmet_aen_wq);destroy_workqueue (nvmet_wq);destroy_workqueue (buffered_io_wq);destroy_workqueue (zbd_wq);
drivers/nvme/target/nvmet.h +1 -0
@@ -502,6 +502,7 @@ extern struct kmem_cache *nvmet_bvec_cache;extern struct workqueue_struct *buffered_io_wq;extern struct workqueue_struct *zbd_wq;extern struct workqueue_struct *nvmet_wq; +extern struct workqueue_struct *nvmet_aen_wq;static inline void nvmet_set_result (struct nvmet_req *req,u32 result) {
drivers/nvme/target/rdma.c +1 -0
@@ -2088,6 +2088,7 @@ static void nvmet_rdma_remove_one(struct ib_device *ib_device, void *client_datamutex_unlock (&nvmet_rdma_queue_mutex);flush_workqueue (nvmet_wq); +flush_workqueue (nvmet_aen_wq); }static struct ib_client nvmet_rdma_ib_client = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/309 drm/amdgpu: fix gpu idle power consumption issue for gfx v12
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit a6571045cf06c4aa749b4801382ae96650e2f0e1 ]
Older versions of the MES firmware may cause abnormal GPU power consumption. When performing inference tasks on the GPU (e.g., with Ollama using ROCm),
the GPU may show abnormal power consumption in idle state and incorrect GPU load information. This issue has been fixed in firmware version 0x8b and newer.
--- drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/mes_v12_0.c +4 -1
@@ -727,6 +727,9 @@ static int mes_v12_0_set_hw_resources(struct amdgpu_mes *mes, int pipe)int i;struct amdgpu_device *adev = mes->adev;union MESAPI_SET_HW_RESOURCES mes_set_hw_res_pkt; +uint32_t mes_rev = (pipe ==AMDGPU_MES_SCHED_PIPE ) ? + (mes->sched_version &AMDGPU_MES_VERSION_MASK ) : + (mes->kiq_version &AMDGPU_MES_VERSION_MASK );memset (&mes_set_hw_res_pkt,0 ,sizeof (mes_set_hw_res_pkt));
@@ -781,7 +784,7 @@ static int mes_v12_0_set_hw_resources(struct amdgpu_mes *mes, int pipe)* handling support, other queue will not use the oversubscribe timer. * handling mode - 0: disabled; 1: basic version; 2: basic+ version */ - mes_set_hw_res_pkt.oversubscription_timer =50 ; + mes_set_hw_res_pkt.oversubscription_timer = mes_rev <0x8b ?0 :50 ; mes_set_hw_res_pkt.unmapped_doorbell_handling =1 ;if (amdgpu_mes_log_enable) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/309 usb: core: new quirk to handle devices with zero configurations
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Deng <[email protected]>
[ Upstream commit 9f6a983cfa22ac662c86e60816d3a357d4b551e9 ]
Some USB devices incorrectly report bNumConfigurations as 0 in their device descriptor, which causes the USB core to reject them during enumeration.
logs:
usb 1-2: device descriptor read/64, error -71
usb 1-2: no configurations
usb 1-2: can't read configurations, error -22
However, these devices actually work correctly when treated as having a single configuration.
Add a new quirk USB_QUIRK_FORCE_ONE_CONFIG to handle such devices. When this quirk is set, assume the device has 1 configuration instead of failing with -EINVAL.
This quirk is applied to the device with VID:PID 5131:2007 which exhibits this behavior.
--- Documentation/admin-guide/kernel-parameters.txt | 3 +++ drivers/usb/core/config.c | 6 +++++- drivers/usb/core/quirks.c | 5 +++++ include/linux/usb/quirks.h | 3 +++ 4 files changed, 16 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +3 -0
@@ -7925,6 +7925,9 @@ p = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT (Reduce timeout of the SET_ADDRESS request from 5000 ms to 500 ms); + q = USB_QUIRK_FORCE_ONE_CONFIG (Device + claims zero configurations, + forcing to 1); Example: quirks=0781:5580:bk,0a5c:5834:gij usbhid.mousepoll=
drivers/usb/core/config.c +5 -1
@@ -927,7 +927,11 @@ int usb_get_configuration(struct usb_device *dev) dev->descriptor.bNumConfigurations = ncfg =USB_MAXCONFIG ; } -if (ncfg <1 ) { +if (ncfg <1 && dev->quirks &USB_QUIRK_FORCE_ONE_CONFIG ) { +dev_info (ddev,"Device claims zero configurations, forcing to 1\n" ); + dev->descriptor.bNumConfigurations =1 ; + ncfg =1 ; + }else if (ncfg <1 ) {dev_err (ddev,"no configurations\n" );return -EINVAL ; }
drivers/usb/core/quirks.c +5 -0
@@ -141,6 +141,8 @@ static int quirks_param_set(const char *value, const struct kernel_param *kp)case 'p' : flags |=USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT ;break ; +case 'q' : + flags |=USB_QUIRK_FORCE_ONE_CONFIG ;/* Ignore unrecognized flag characters */ } }
@@ -597,6 +599,9 @@ static const struct usb_device_id usb_quirk_list[] = {/* VCOM device */ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Noji-MCS SmartCard Reader */ + { USB_DEVICE(0x5131, 0x2007), .driver_info = USB_QUIRK_FORCE_ONE_CONFIG }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
include/linux/usb/quirks.h +3 -0
@@ -78,4 +78,7 @@/* skip BOS descriptor request */ #define USB_QUIRK_NO_BOS BIT(17) +/* Device claims zero configurations, forcing to 1 */ +#define USB_QUIRK_FORCE_ONE_CONFIG BIT(18) +#endif /* __LINUX_USB_QUIRKS_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/309 spi: intel-pci: Add support for Nova Lake mobile SPI flash
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <[email protected]>
[ Upstream commit 85b731ad4bbf6eb3fedf267ab00be3596f148432 ]
Add Intel Nova Lake PCD-H SPI serial flash PCI ID to the list of supported devices.
--- drivers/spi/spi-intel-pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-intel-pci.c +1 -0
@@ -96,6 +96,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xd323), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info }, { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info }, { },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/309 ALSA: hda/realtek: add quirk for ASUS UM6702RC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
[ Upstream commit 0d3429f12133c2ca47aa82ddab2342bc360c47d3 ]
The sound card of this machine cannot adjust the volume, it can only be 0 or 100%. The reason is that the DAC with pin 0x17 is connected to 0x06. Testing found that connecting 0x02 can fix this problem.
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -7104,6 +7104,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1e93 ,"ASUS ExpertBook B9403CVAR" ,ALC294_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x1eb3 ,"ASUS Ally RCLA72" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x1043 ,0x1ed3 ,"ASUS HN7306W" ,ALC287_FIXUP_CS35L41_I2C_2 ), +HDA_CODEC_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM6702RA/RC" ,ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1 ),SND_PCI_QUIRK (0x1043 ,0x1ee2 ,"ASUS UM6702RA/RC" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1c52 ,"ASUS Zephyrus G15 2022" ,ALC289_FIXUP_ASUS_GA401 ), SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/309 i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Yin <[email protected]>
[ Upstream commit f26ecaa0f0abfe5db173416214098a00d3b7db79 ]
The DesignWare I3C master driver creates a virtual I2C adapter to provide backward compatibility with I2C devices. However, the current implementation does not associate this virtual adapter with any Device Tree node.
Propagate the of_node from the I3C master platform device to the virtual I2C adapter's device structure. This ensures that standard I2C aliases are correctly resolved and bus numbering remains consistent.
--- drivers/i3c/master/dw-i3c-master.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/i3c/master/dw-i3c-master.c +2 -0
@@ -1596,6 +1596,8 @@ int dw_i3c_common_probe(struct dw_i3c_master *master, master->quirks = (unsigned long )device_get_match_data (&pdev->dev);INIT_WORK (&master->hj_work, dw_i3c_hj_work); + +device_set_of_node_from_dev (&master->base.i2c.dev, &pdev->dev); ret =i3c_master_register (&master->base, &pdev->dev, &dw_mipi_i3c_ops, false);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/309 xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit aa8a3f3c67235422a0c3608a8772f69ca3b7b63f ]
We're returning an error caused by invalid user input without setting an extack. Add one.
--- net/xfrm/xfrm_user.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +4 -1
@@ -1850,6 +1850,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, pcpu_num =nla_get_u32 (attrs[XFRMA_SA_PCPU ]);if (pcpu_num >=num_possible_cpus ()) { err = -EINVAL ; +NL_SET_ERR_MSG (extack,"pCPU number too big" ); goto out_noput; } }
@@ -3001,8 +3002,10 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,if (attrs[XFRMA_SA_PCPU ]) { x->pcpu_num =nla_get_u32 (attrs[XFRMA_SA_PCPU ]); err = -EINVAL ; -if (x->pcpu_num >=num_possible_cpus ()) +if (x->pcpu_num >=num_possible_cpus ()) { +NL_SET_ERR_MSG (extack,"pCPU number too big" ); goto free_state; + } } err =verify_newpolicy_info (&ua->policy, extack);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/309 xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit b57defcf8f109da5ba9cf59b2a736606faf3d846 ]
pcpu_num = 0 is a valid value. The marker for "unset pcpu_num" which makes copy_to_user_state_extra not add the XFRMA_SA_PCPU attribute is UINT_MAX.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -3676,7 +3676,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) }if (x->if_id) l +=nla_total_size (sizeof (x->if_id)); -if (x->pcpu_num) +if (x->pcpu_num !=UINT_MAX ) l +=nla_total_size (sizeof (x->pcpu_num));/* Must count x->lastused as it may become non-zero behind our back. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/309 xfrm: call xdo_dev_state_delete during state update
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 ]
When we update an SA, we construct a new state and call xdo_dev_state_add, but never insert it. The existing state is updated, then we immediately destroy the new state. Since we haven't added it, we don't go through the standard state delete code, and we're skipping removing it from the device (but xdo_dev_state_free will get called when we destroy the temporary state).
This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of offloaded SAs on failure.").
--- net/xfrm/xfrm_state.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_state.c +1 -0
@@ -2264,6 +2264,7 @@ int xfrm_state_update(struct xfrm_state *x) err =0 ; x->km.state =XFRM_STATE_DEAD ; +xfrm_dev_state_delete (x);__xfrm_state_put (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/309 esp: fix skb leak with espintcp and async crypto
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 ]
When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us.
With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.
--- net/ipv4/esp4.c | 9 ++++++--- net/ipv6/esp6.c | 9 ++++++--- 2 files changed, 12 insertions(+), 6 deletions(-)
net/ipv4/esp4.c +6 -3
@@ -235,10 +235,13 @@ static void esp_output_done(void *data, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
net/ipv6/esp6.c +6 -3
@@ -271,10 +271,13 @@ static void esp_output_done(void *data, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/309 pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit e825c79ef914bd55cf7c2476ddcfb2738eb689c3 ]
When calling of_parse_phandle_with_fixed_args(), the caller is responsible for calling of_node_put() to release the device node reference.
In rzt2h_gpio_register(), the driver fails to call of_node_put() to release the reference in of_args.np, which causes a memory leak.
Add the missing of_node_put() call to fix the leak.
--- drivers/pinctrl/renesas/pinctrl-rzt2h.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/renesas/pinctrl-rzt2h.c +1 -0
@@ -648,6 +648,7 @@ static int rzt2h_gpio_register(struct rzt2h_pinctrl *pctrl)if (ret)return dev_err_probe (dev, ret,"Unable to parse gpio-ranges\n" ); +of_node_put (of_args.np);if (of_args.args[0 ] !=0 || of_args.args[1 ] !=0 || of_args.args[2 ] != pctrl->data->n_port_pins) return dev_err_probe(dev, -EINVAL,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/309 xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 0b352f83cabfefdaafa806d6471f0eca117dc7d5 ]
In iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First a zero-copy approach is tried if it succeeds then newskb becomes non-linear.
When a subsequent fragment in the same datagram does not meet the fast-path conditions, a memory copy is performed. It calls skb_put() to append the data and as newskb is non-linear it triggers SKB_LINEAR_ASSERT check.
Oops: invalid opcode: 0000 [#1] SMP NOPTI [...] RIP: 0010:skb_put+0x3c/0x40 [...] Call Trace: <IRQ> iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs] iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs] iptfs_input+0x122/0x3e0 [xfrm_iptfs] xfrm_input+0x91e/0x1a50 xfrm4_esp_rcv+0x3a/0x110 ip_protocol_deliver_rcu+0x1d7/0x1f0 ip_local_deliver_finish+0xbe/0x1e0 __netif_receive_skb_core.constprop.0+0xb56/0x1120 __netif_receive_skb_list_core+0x133/0x2b0 netif_receive_skb_list_internal+0x1ff/0x3f0 napi_complete_done+0x81/0x220 virtnet_poll+0x9d6/0x116e [virtio_net] __napi_poll.constprop.0+0x2b/0x270 net_rx_action+0x162/0x360 handle_softirqs+0xdc/0x510 __irq_exit_rcu+0xe7/0x110 irq_exit_rcu+0xe/0x20 common_interrupt+0x85/0xa0 </IRQ> <TASK>
Fix this by checking if the skb is non-linear. If it is, linearize it by calling skb_linearize(). As the initial allocation of newskb originally reserved enough tailroom for the entire reassembled packet we do not need to check if we have enough tailroom or extend it.
--- net/xfrm/xfrm_iptfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/xfrm/xfrm_iptfs.c +6 -0
@@ -901,6 +901,12 @@ static u32 iptfs_reassem_cont(struct xfrm_iptfs_data *xtfs, u64 seq, iptfs_skb_can_add_frags(newskb, fragwalk, data, copylen)) { iptfs_skb_add_frags(newskb, fragwalk, data, copylen); } else { +if (skb_linearize (newskb)) { +XFRM_INC_STATS (xs_net (xtfs->x), +LINUX_MIB_XFRMINBUFFERERROR ); + goto abandon; + } +/* copy fragment data into newskb */ if (skb_copy_seq_read (st, data,skb_put (newskb, copylen), copylen)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/309 pinctrl: renesas: rza1: Normalize return value of gpio_get()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit fb22bb9701d48c4b0e81fe204c2f96a37a520568 ]
The GPIO .get() callback is expected to return 0 or 1 (or a negative error code). Ensure that the value returned by rza1_gpio_get() is normalized to the [0, 1] range.
--- drivers/pinctrl/renesas/pinctrl-rza1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/renesas/pinctrl-rza1.c +1 -1
@@ -590,7 +590,7 @@ static inline unsigned int rza1_get_bit(struct rza1_port *port, {void __iomem *mem =RZA1_ADDR (port->base, reg, port->id); -return ioread16 (mem) &BIT (bit); +return !!(ioread16 (mem) &BIT (bit)); }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/309 xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit daf8e3b253aa760ff9e96c7768a464bc1d6b3c90 ]
After cancel_delayed_work_sync() is called from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining states via __xfrm_state_delete(), which calls xfrm_nat_keepalive_state_updated() to re-schedule nat_keepalive_work.
The following is a simple race scenario:
cpu0 cpu1
cleanup_net() [Round 1]
ops_undo_list()
xfrm_net_exit()
xfrm_nat_keepalive_net_fini()
cancel_delayed_work_sync(nat_keepalive_work);
xfrm_state_fini()
xfrm_state_flush()
xfrm_state_delete(x)
__xfrm_state_delete(x)
xfrm_nat_keepalive_state_updated(x)
schedule_delayed_work(nat_keepalive_work);
rcu_barrier();
net_complete_free();
net_passive_dec(net);
llist_add(&net->defer_free_list, &defer_free_list);cleanup_net() [Round 2]
rcu_barrier();
net_complete_free()
kmem_cache_free(net_cachep, net);
nat_keepalive_work()
// on freed netTo prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().
--- net/xfrm/xfrm_nat_keepalive.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_nat_keepalive.c +1 -1
@@ -261,7 +261,7 @@ int __net_init xfrm_nat_keepalive_net_init(struct net *net)int xfrm_nat_keepalive_net_fini (struct net *net) { -cancel_delayed_work_sync (&net->xfrm.nat_keepalive_work); +disable_delayed_work_sync (&net->xfrm.nat_keepalive_work);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/309 xfrm: prevent policy_hthresh.work from racing with netns teardown
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minwoo Ra <[email protected]>
[ Upstream commit 29fe3a61bcdce398ee3955101c39f89c01a8a77e ]
A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue.
The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct net via container_of(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrm_hash_rebuild() may then dereference stale memory.
xfrm_policy_fini() already flushes policy_hash_work during teardown, but it does not synchronize policy_hthresh.work.
Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net.
--- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +2 -0
@@ -4282,6 +4282,8 @@ static void xfrm_policy_fini(struct net *net)unsigned int sz;int dir; +disable_work_sync (&net->xfrm.policy_hthresh.work); +flush_work (&net->xfrm.policy_hash_work);#ifdef CONFIG_XFRM_SUB_POLICY xfrm_policy_flush (net,XFRM_POLICY_TYPE_SUB , false);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/309 af_key: validate families in pfkey_send_migrate()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb2d16a7d599dc9d4df391b5e660df9949963786 ]
syzbot was able to trigger a crash in skb_put() [1]
Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.
Validate families early, do not wait set_ipsecrequest().
[1]
skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
kernel BUG at net/core/skbuff.c:214 !
Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
--- net/key/af_key.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/key/af_key.c +12 -7
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *static int set_ipsecrequest (struct sk_buff *skb,uint8_t proto,uint8_t mode,int level, -uint32_t reqid,uint8_t family, +uint32_t reqid,sa_family_t family,const xfrm_address_t *src,const xfrm_address_t *dst) {struct sadb_x_ipsecrequest *rq;
@@ -3583,12 +3583,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,/* ipsecrequests */ for (i =0 , mp = m; i < num_bundles; i++, mp++) { -/* old locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->old_family); -/* new locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->new_family); +int pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->old_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->new_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; } size +=sizeof (struct sadb_msg ) + size_pol;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/309 dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 6f770b73d0311a5b099277653199bb6421c4fed2 ]
When a device performs DMA to a bounce buffer, KMSAN is unaware of the write and does not mark the data as initialized. When swiotlb_bounce() later copies the bounce buffer back to the original buffer, memcpy propagates the uninitialized shadow to the original buffer, causing false positive uninit-value reports.
Fix this by calling kmsan_unpoison_memory() on the bounce buffer before copying it back in the DMA_FROM_DEVICE path, so that memcpy naturally propagates initialized shadow to the destination.
--- kernel/dma/swiotlb.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
kernel/dma/swiotlb.c +19 -2
@@ -30,6 +30,7 @@#include <linux/gfp.h> #include <linux/highmem.h> #include <linux/io.h> +#include <linux/kmsan-checks.h> #include <linux/iommu-helper.h> #include <linux/init.h> #include <linux/memblock.h>
@@ -903,10 +904,19 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t sizelocal_irq_save (flags); page =pfn_to_page (pfn); -if (dir ==DMA_TO_DEVICE ) +if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_highmem_page() +* could be used here to detect infoleaks, +* but callers may map uninitialized buffers +* that will be written by the device, +* causing false positives. +*/ memcpy_from_page (vaddr, page, offset, sz); -else + }else { +kmsan_unpoison_memory (vaddr, sz);memcpy_to_page (page, offset, vaddr, sz); + }local_irq_restore (flags); size -= sz;
@@ -915,8 +925,15 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size offset =0 ; } }else if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_memory() could be used here to detect +* infoleaks (uninitialized data being sent to device), but +* callers may map uninitialized buffers that will be written +* by the device, causing false positives. +*/ memcpy (vaddr,phys_to_virt (orig_addr), size); }else { +kmsan_unpoison_memory (vaddr, size);memcpy (phys_to_virt (orig_addr), vaddr, size); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/309 erofs: set fileio bio failed in short read case
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheng Yong <[email protected]>
[ Upstream commit eade54040384f54b7fb330e4b0975c5734850b3c ]
For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of bytes actually copied. Unused folios in bio are unexpectedly marked as uptodate.
vfs_read
filemap_read
filemap_get_pages
filemap_readahead
erofs_fileio_readahead
erofs_fileio_rq_submit
vfs_iocb_iter_read
filemap_read
filemap_get_pages <= detect signal
erofs_fileio_ki_complete <= set all folios uptodate
This patch addresses this by setting short read bio with an error directly.
--- fs/erofs/fileio.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/erofs/fileio.c +2 -4
@@ -25,10 +25,8 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret) container_of(iocb, struct erofs_fileio_rq, iocb);struct folio_iter fi; -if (ret >=0 && ret != rq->bio.bi_iter.bi_size) { -bio_advance (&rq->bio, ret); -zero_fill_bio (&rq->bio); - } +if (ret >=0 && ret != rq->bio.bi_iter.bi_size) + ret = -EIO ;if (!rq->bio.bi_end_io) {bio_for_each_folio_all (fi, &rq->bio) {DBG_BUGON (folio_test_uptodate (fi.folio));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/309 can: statistics: add missing atomic access in hot path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit 46eee1661aa9b49966e6c43d07126fe408edda57 ]
Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path") fixed a KCSAN issue in can_receive() but missed to convert the 'matches' variable used in can_rcv_filter().
--- net/can/af_can.c | 4 ++-- net/can/af_can.h | 2 +- net/can/proc.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-)
net/can/af_can.c +2 -2
@@ -469,7 +469,7 @@ int can_rx_register(struct net *net, struct net_device *dev, canid_t can_id, rcv->can_id = can_id; rcv->mask = mask; - rcv->matches =0 ; +atomic_long_set (&rcv->matches,0 ); rcv->func = func; rcv->data = data; rcv->ident = ident;
@@ -573,7 +573,7 @@ EXPORT_SYMBOL(can_rx_unregister);static inline void deliver (struct sk_buff *skb,struct receiver *rcv) { rcv->func (skb, rcv->data); - rcv->matches++; +atomic_long_inc (&rcv->matches); }static int can_rcv_filter (struct can_dev_rcv_lists *dev_rcv_lists,struct sk_buff *skb)
net/can/af_can.h +1 -1
@@ -52,7 +52,7 @@ struct receiver {struct hlist_node list;canid_t can_id;canid_t mask; -unsigned long matches; +atomic_long_t matches;void (*func)(struct sk_buff *skb,void *data);void *data;char *ident;
net/can/proc.c +2 -1
@@ -196,7 +196,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list," %-5s %03x %08x %pK %pK %8ld %s\n" ;seq_printf (m, fmt,DNAME (dev), r->can_id, r->mask, - r->func, r->data, r->matches, r->ident); + r->func, r->data,atomic_long_read (&r->matches), + r->ident); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/309 pinctrl: stm32: fix HDP driver dependency on GPIO_GENERIC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amelie Delaunay <[email protected]>
[ Upstream commit c8cfeb4b9dda2cdfce79519aee4aaff16310a7b6 ]
The HDP driver uses the generic GPIO chip API, but this configuration may not be enabled.
Ensure it is enabled by selecting the appropriate option.
--- drivers/pinctrl/stm32/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/stm32/Kconfig +1 -0
@@ -65,6 +65,7 @@ config PINCTRL_STM32_HDP select PINMUX select GENERIC_PINCONF select GPIOLIB + select GPIO_GENERIC help The Hardware Debug Port allows the observation of internal signals. It uses configurable multiplexer to route signals in a dedicated observation register.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/309 Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minseo Park <[email protected]>
[ Upstream commit 9d87cb22195b2c67405f5485d525190747ad5493 ]
Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request.
The vulnerability stems from l2cap_ecred_conn_req(). The function allocates a local stack buffer (pdu) designed to hold a maximum of 5 Source Channel IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more than 5 SCIDs, the function calculates rsp_len based on this unvalidated cmd_len before checking if the number of SCIDs exceeds L2CAP_ECRED_MAX_CID.
If the SCID count is too high, the function correctly jumps to the response label to reject the packet, but rsp_len retains the attacker's oversized value. Consequently, l2cap_send_cmd() is instructed to read past the end of the 18-byte pdu buffer, triggering a KASAN panic.
Fix this by moving the assignment of rsp_len to after the num_scid boundary check. If the packet is rejected, rsp_len will safely remain 0, and the error response will only read the 8-byte base header from the stack.
--- net/bluetooth/l2cap_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/bluetooth/l2cap_core.c +3 -3
@@ -5065,14 +5065,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, cmd_len -=sizeof (*req); num_scid = cmd_len /sizeof (u16); -/* Always respond with the same number of scids as in the request */ - rsp_len = cmd_len; -if (num_scid >L2CAP_ECRED_MAX_CID ) { result =L2CAP_CR_LE_INVALID_PARAMS ; goto response; } +/* Always respond with the same number of scids as in the request */ + rsp_len = cmd_len; + mtu =__le16_to_cpu (req->mtu); mps =__le16_to_cpu (req->mps);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/309 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -6672,6 +6672,11 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)if (!chan->sdu) {u16 sdu_len; +if (!pskb_may_pull (skb,L2CAP_SDULEN_SIZE )) { + err = -EINVAL ; + goto failed; + } + sdu_len =get_unaligned_le16 (skb->data);skb_pull (skb,L2CAP_SDULEN_SIZE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/309 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free.
Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.
Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.
--- net/bluetooth/sco.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/bluetooth/sco.c +7 -3
@@ -401,7 +401,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)struct sock *sk;sco_conn_lock (conn); - sk = conn->sk; + sk =sco_sock_hold (conn);sco_conn_unlock (conn);if (!sk)
@@ -410,11 +410,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)BT_DBG ("sk %p len %u" , sk, skb->len);if (sk->sk_state !=BT_CONNECTED ) - goto drop; + goto drop_put; -if (!sock_queue_rcv_skb (sk, skb)) +if (!sock_queue_rcv_skb (sk, skb)) { +sock_put (sk);return ; + } +drop_put: +sock_put (sk); drop:kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/309 Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 5f5fa4cd35f707344f65ce9e225b6528691dbbaa ]
This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.
--- net/bluetooth/mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/mgmt.c +1 -1
@@ -5273,7 +5273,7 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,* hci_adv_monitors_clear is about to be called which will take care of * freeing the adv_monitor instances. */ -if (status == -ECANCELED && !mgmt_pending_valid (hdev, cmd)) +if (status == -ECANCELED || !mgmt_pending_valid (hdev, cmd))return ; monitor = cmd->user_data;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/309 Bluetooth: hci_ll: Fix firmware leak on error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anas Iqbal <[email protected]>
[ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ]
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid.
--- drivers/bluetooth/hci_ll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/hci_ll.c +2 -0
@@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev)if (err || !fw->data || !fw->size) {bt_dev_err (lldev->hu.hdev,"request_firmware failed(errno %d) for %s" , err, bts_scr_name); +if (!err) +release_firmware (fw);return -EINVAL ; } ptr = (void *)fw->data;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/309 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <[email protected]>
[ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Workqueue: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entered promiscuous mode RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x18c0 process_scheduled_works+0xb6e/0x18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entered promiscuous mode ? __switch_to+0xc7d/0x1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- batman_adv: batadv0: Interface activated: batadv_slave_0 batman_adv: batadv0: Interface activated: batadv_slave_1 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1681,6 +1681,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)struct sock *sk = chan->data;struct sock *parent; +if (!sk) +return ; +lock_sock (sk); parent =bt_sk (sk)->parent;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/309 pinctrl: mediatek: common: Fix probe failure for devices without EINT
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <[email protected]>
[ Upstream commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd ]
Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but the mtk_eint_init function is always called and returns -ENODEV, which then bubbles up and causes probe failure.
To address this only call mtk_eint_init if EINT pins are present.
Tested on Xiaomi Mi Smart Clock x04g (mt6392).
--- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mtk-common.c +6 -3
@@ -1135,9 +1135,12 @@ int mtk_pctrl_init(struct platform_device *pdev, goto chip_error; } - ret =mtk_eint_init (pctl, pdev); -if (ret) - goto chip_error; +/* Only initialize EINT if we have EINT pins */ +if (data->eint_hw.ap_num >0 ) { + ret =mtk_eint_init (pctl, pdev); +if (ret) + goto chip_error; + }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/309 ionic: fix persistent MAC address override on PF
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammad Heib <[email protected]>
[ Upstream commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed ]
The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes the ionic firmware to update the LIF's identity in its persistent state. Since the firmware state is maintained across host warm boots and driver reloads, any MAC change on the Physical Function (PF) becomes "sticky.
This is problematic because it causes ethtool -P to report the user-configured MAC as the permanent factory address, which breaks system management tools that rely on a stable hardware identity.
While Virtual Functions (VFs) need this hardware-level programming to properly handle MAC assignments in guest environments, the PF should maintain standard transient behavior. This patch gates the ionic_program_mac call using is_virtfn so that PF MAC changes remain local to the netdev filters and do not overwrite the firmware's permanent identity block.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +11 -6
@@ -1719,13 +1719,18 @@ static int ionic_set_mac_address(struct net_device *netdev, void *sa)if (ether_addr_equal (netdev->dev_addr, mac))return 0 ; - err =ionic_program_mac (lif, mac); -if (err <0 ) -return err; +/* Only program macs for virtual functions to avoid losing the permanent +* Mac across warm reset/reboot. +*/ +if (lif->ionic->pdev->is_virtfn) { + err =ionic_program_mac (lif, mac); +if (err <0 ) +return err; -if (err >0 ) -netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , - __func__); +if (err >0 ) +netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , + __func__); + } err =eth_prepare_mac_addr_change (netdev, addr);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/309 nfc: nci: fix circular locking dependency in nci_close_device
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4527025d440ce84bf56e75ce1df2e84cb8178616 ]
nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.
--- net/nfc/nci/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/nfc/nci/core.c +6 -4
@@ -579,8 +579,7 @@ static int nci_close_device(struct nci_dev *ndev)skb_queue_purge (&ndev->rx_q);skb_queue_purge (&ndev->tx_q); -/* Flush RX and TX wq */ -flush_workqueue (ndev->rx_wq); +/* Flush TX wq, RX wq flush can't be under the lock */ flush_workqueue (ndev->tx_wq);/* Reset device */
@@ -592,13 +591,13 @@ static int nci_close_device(struct nci_dev *ndev) msecs_to_jiffies(NCI_RESET_TIMEOUT));/* After this point our queues are empty -* and no works are scheduled. +* rx work may be running but will see that NCI_UP was cleared */ ndev->ops->close (ndev);clear_bit (NCI_INIT , &ndev->flags); -/* Flush cmd wq */ +/* Flush cmd and tx wq */ flush_workqueue (ndev->cmd_wq);timer_delete_sync (&ndev->cmd_timer);
@@ -613,6 +612,9 @@ static int nci_close_device(struct nci_dev *ndev)mutex_unlock (&ndev->req_lock); +/* rx_work may take req_lock via nci_deactivate_target */ +flush_workqueue (ndev->rx_wq); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/309 net: openvswitch: Avoid releasing netdev before teardown completes
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 ]
The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev.
The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like:
[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] <TASK> [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 [ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 [ 998.394200] </TASK>
To fix this, reorder the operations in ovs_netdev_detach_dev() to only clear the flag after completing the other operations, and introduce an smp_wmb() to make the ordering requirement explicit. The smp_wmb() is paired with a full smp_mb() in netdev_destroy() to make sure the call_rcu() invocation does not happen before the unregister operations are visible.
--- net/openvswitch/vport-netdev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/openvswitch/vport-netdev.c +8 -1
@@ -151,11 +151,15 @@ static void vport_netdev_free(struct rcu_head *rcu)void ovs_netdev_detach_dev (struct vport *vport) {ASSERT_RTNL (); - vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ;netdev_rx_handler_unregister (vport->dev);netdev_upper_dev_unlink (vport->dev,netdev_master_upper_dev_get (vport->dev));dev_set_promiscuity (vport->dev,-1 ); + +/* paired with smp_mb() in netdev_destroy() */ +smp_wmb (); + + vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ; }static void netdev_destroy (struct vport *vport)
@@ -174,6 +178,9 @@ static void netdev_destroy(struct vport *vport)rtnl_unlock (); } +/* paired with smp_wmb() in ovs_netdev_detach_dev() */ +smp_mb (); +call_rcu (&vport->rcu, vport_netdev_free); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/309 openvswitch: defer tunnel netdev_put to RCU release
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 6931d21f87bc6d657f145798fad0bf077b82486c ]
ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
--- net/openvswitch/vport-netdev.c | 2 -- 1 file changed, 2 deletions(-)
net/openvswitch/vport-netdev.c +0 -2
@@ -196,8 +196,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)*/ if (vport->dev->reg_state ==NETREG_REGISTERED )rtnl_delete_link (vport->dev,0 ,NULL ); -netdev_put (vport->dev, &vport->dev_tracker); - vport->dev =NULL ;rtnl_unlock ();call_rcu (&vport->rcu, vport_netdev_free);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/309 openvswitch: validate MPLS set/set_masked payload length
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 ]
validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls).
Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes.
Reject invalid MPLS action payload lengths early.
--- net/openvswitch/flow_netlink.c | 2 ++ 1 file changed, 2 insertions(+)
net/openvswitch/flow_netlink.c +2 -0
@@ -2953,6 +2953,8 @@ static int validate_set(const struct nlattr *a,case OVS_KEY_ATTR_MPLS :if (!eth_p_mpls (eth_type))return -EINVAL ; +if (key_len !=sizeof (struct ovs_key_mpls )) +return -EINVAL ;break ;case OVS_KEY_ATTR_SCTP :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/309 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 24dd586bb4cbba1889a50abe74143817a095c1c9 ]
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately.
The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
--- net/smc/smc_rx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/smc/smc_rx.c +8 -1
@@ -135,9 +135,16 @@ static void smc_rx_pipe_buf_release(struct pipe_inode_info *pipe,sock_put (sk); } +static bool smc_rx_pipe_buf_get (struct pipe_inode_info *pipe, +struct pipe_buffer *buf) +{ +/* smc_spd_priv in buf->private is not shareable; disallow cloning. */ +return false; +} +static const struct pipe_buf_operations smc_pipe_ops = { .release = smc_rx_pipe_buf_release, - .get = generic_pipe_buf_get + .get = smc_rx_pipe_buf_get, }; static void smc_rx_spd_release(struct splice_pipe_desc *spd,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/309 rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 52501989c76206462d9b11a8485beef40ef41821 ]
Commit 00e77ed8e64d ("rtnetlink: add IFLA_PARENT_[DEV|DEV_BUS]_NAME") added those attributes to rtnl_fill_ifinfo, but forgot to extend if_nlmsg_size.
--- net/core/rtnetlink.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
net/core/rtnetlink.c +16 -0
@@ -1267,6 +1267,21 @@ static size_t rtnl_dpll_pin_size(const struct net_device *dev)return size; } +static size_t rtnl_dev_parent_size (const struct net_device *dev) +{ +size_t size =0 ; + +/* IFLA_PARENT_DEV_NAME */ +if (dev->dev.parent) + size +=nla_total_size (strlen (dev_name (dev->dev.parent)) +1 ); + +/* IFLA_PARENT_DEV_BUS_NAME */ +if (dev->dev.parent && dev->dev.parent->bus) + size +=nla_total_size (strlen (dev->dev.parent->bus->name) +1 ); + +return size; +} + static noinline size_t if_nlmsg_size(const struct net_device *dev,u32 ext_filter_mask) {
@@ -1328,6 +1343,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, +nla_total_size (8 )/* IFLA_MAX_PACING_OFFLOAD_HORIZON */ +nla_total_size (2 )/* IFLA_HEADROOM */ +nla_total_size (2 )/* IFLA_TAILROOM */ + +rtnl_dev_parent_size (dev) +0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/309 rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit ee00a12593ffb69db4dd1a1c00ecb0253376874a ]
rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and IFLA_INFO_SLAVE_KIND.
--- net/core/rtnetlink.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/rtnetlink.c +6 -3
@@ -707,11 +707,14 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev) goto out; ops = master_dev->rtnl_link_ops; -if (!ops || !ops->get_slave_size) +if (!ops) + goto out; + size +=nla_total_size (strlen (ops->kind) +1 );/* IFLA_INFO_SLAVE_KIND */ +if (!ops->get_slave_size) goto out;/* IFLA_INFO_SLAVE_DATA + nested data */ - size =nla_total_size (sizeof (struct nlattr )) + - ops->get_slave_size (master_dev, dev); + size +=nla_total_size (sizeof (struct nlattr )) + + ops->get_slave_size (master_dev, dev); out:rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/309 net: bcmasp: streamline early exit in probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit 1fd1281250c38408d793863c8dcaa43c7de8932c ]
Streamline the bcmasp_probe early exit. As support for other functionality is added(i.e. ptp), it is easier to keep track of early exit cleanup when it is all in one place.
Stable-dep-of: cbfa5be2bf64 ("net: bcmasp: fix double free of WoL irq")
--- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 27 +++++++++++---------- 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/net/ethernet/broadcom/asp2/bcmasp.c +14 -13
@@ -1322,6 +1322,8 @@ static int bcmasp_probe(struct platform_device *pdev)bcmasp_core_init_filters (priv); +bcmasp_init_wol (priv); + ports_node =of_find_node_by_name (dev->of_node,"ethernet-ports" );if (!ports_node) {dev_warn (dev,"No ports found\n" );
@@ -1333,16 +1335,14 @@ static int bcmasp_probe(struct platform_device *pdev) intf =bcmasp_interface_create (priv, intf_node, i);if (!intf) {dev_err (dev,"Cannot create eth interface %d\n" , i); -bcmasp_remove_intfs (priv); - ret = -ENOMEM ; - goto of_put_exit; +of_node_put (ports_node); + ret = -EINVAL ; + goto err_cleanup; }list_add_tail (&intf->list, &priv->intfs); i++; } - -/* Check and enable WoL */ -bcmasp_init_wol (priv); +of_node_put (ports_node);/* Drop the clock reference count now and let ndo_open()/ndo_close() * manage it for us from now on.
@@ -1357,19 +1357,20 @@ static int bcmasp_probe(struct platform_device *pdev)list_for_each_entry (intf, &priv->intfs, list) { ret =register_netdev (intf->ndev);if (ret) { -netdev_err (intf->ndev, -"failed to register net_device: %d\n" , ret); -bcmasp_wol_irq_destroy (priv); -bcmasp_remove_intfs (priv); - goto of_put_exit; +dev_err (dev,"failed to register net_device: %d\n" , ret); + goto err_cleanup; } count++; }dev_info (dev,"Initialized %d port(s)\n" , count); -of_put_exit: -of_node_put (ports_node); +return ret; + +err_cleanup: +bcmasp_wol_irq_destroy (priv); +bcmasp_remove_intfs (priv); +return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/309 net: bcmasp: fix double free of WoL irq
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit cbfa5be2bf64511d49b854a0f9fd6d0b5118621f ]
We do not need to free wol_irq since it was instantiated with devm_request_irq(). So devres will free for us.
--- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/net/ethernet/broadcom/asp2/bcmasp.c +0 -8
@@ -1157,12 +1157,6 @@ void bcmasp_enable_wol(struct bcmasp_intf *intf, bool en) } } -static void bcmasp_wol_irq_destroy (struct bcmasp_priv *priv) -{ -if (priv->wol_irq >0 ) -free_irq (priv->wol_irq, priv); -} -static void bcmasp_eee_fixup (struct bcmasp_intf *intf,bool en) {u32 reg, phy_lpi_overwrite;
@@ -1368,7 +1362,6 @@ static int bcmasp_probe(struct platform_device *pdev)return ret; err_cleanup: -bcmasp_wol_irq_destroy (priv);bcmasp_remove_intfs (priv);return ret;
@@ -1381,7 +1374,6 @@ static void bcmasp_remove(struct platform_device *pdev)if (!priv)return ; -bcmasp_wol_irq_destroy (priv);bcmasp_remove_intfs (priv); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/309 net: bcmasp: fix double disable of clk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit 27dfe9030acbc601c260b42ecdbb4e5858a97b53 ]
Switch to devm_clk_get_optional() so we can manage the clock ourselves. We dynamically control the clocks depending on the state of the interface for power savings. The default state is clock disabled, so unbinding the driver causes a double disable.
--- drivers/net/ethernet/broadcom/asp2/bcmasp.c | 33 ++++++++++++++------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/net/ethernet/broadcom/asp2/bcmasp.c +23 -10
@@ -1254,7 +1254,7 @@ static int bcmasp_probe(struct platform_device *pdev)if (priv->irq <=0 )return -EINVAL ; - priv->clk =devm_clk_get_optional_enabled (dev,"sw_asp" ); + priv->clk =devm_clk_get_optional (dev,"sw_asp" );if (IS_ERR (priv->clk))return dev_err_probe (dev,PTR_ERR (priv->clk),"failed to request clock\n" );
@@ -1282,6 +1282,10 @@ static int bcmasp_probe(struct platform_device *pdev)bcmasp_set_pdata (priv, pdata); + ret =clk_prepare_enable (priv->clk); +if (ret) +return dev_err_probe (dev, ret,"failed to start clock\n" ); +/* Enable all clocks to ensure successful probing */ bcmasp_core_clock_set (priv,ASP_CTRL_CLOCK_CTRL_ASP_ALL_DISABLE ,0 );
@@ -1293,8 +1297,10 @@ static int bcmasp_probe(struct platform_device *pdev) ret =devm_request_irq (&pdev->dev, priv->irq, bcmasp_isr,0 , pdev->name, priv); -if (ret) -return dev_err_probe (dev, ret,"failed to request ASP interrupt: %d" , ret); +if (ret) { +dev_err (dev,"Failed to request ASP interrupt: %d" , ret); + goto err_clock_disable; + }/* Register mdio child nodes */ of_platform_populate (dev->of_node, bcmasp_mdio_of_match,NULL , dev);
@@ -1306,13 +1312,17 @@ static int bcmasp_probe(struct platform_device *pdev) priv->mda_filters =devm_kcalloc (dev, priv->num_mda_filters,sizeof (*priv->mda_filters),GFP_KERNEL ); -if (!priv->mda_filters) -return -ENOMEM ; +if (!priv->mda_filters) { + ret = -ENOMEM ; + goto err_clock_disable; + } priv->net_filters =devm_kcalloc (dev, priv->num_net_filters,sizeof (*priv->net_filters),GFP_KERNEL ); -if (!priv->net_filters) -return -ENOMEM ; +if (!priv->net_filters) { + ret = -ENOMEM ; + goto err_clock_disable; + }bcmasp_core_init_filters (priv);
@@ -1321,7 +1331,8 @@ static int bcmasp_probe(struct platform_device *pdev) ports_node =of_find_node_by_name (dev->of_node,"ethernet-ports" );if (!ports_node) {dev_warn (dev,"No ports found\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto err_clock_disable; } i =0 ;
@@ -1343,8 +1354,6 @@ static int bcmasp_probe(struct platform_device *pdev)*/ bcmasp_core_clock_set (priv,0 ,ASP_CTRL_CLOCK_CTRL_ASP_ALL_DISABLE ); -clk_disable_unprepare (priv->clk); -/* Now do the registration of the network ports which will take care * of managing the clock properly. */
@@ -1357,12 +1366,16 @@ static int bcmasp_probe(struct platform_device *pdev) count++; } +clk_disable_unprepare (priv->clk); +dev_info (dev,"Initialized %d port(s)\n" , count);return ret; err_cleanup:bcmasp_remove_intfs (priv); +err_clock_disable: +clk_disable_unprepare (priv->clk);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/309 platform/x86: ISST: Check HWP support before MSR access
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 9f11d9b15efb5f77e810b6dfbeb01b4650a79eae ]
On some systems, HWP can be explicitly disabled in the BIOS settings When HWP is disabled by firmware, the HWP CPUID bit is not set, and attempting to read MSR_PM_ENABLE will result in a General Protection (GP) fault.
unchecked MSR access error: RDMSR from 0x770 at rIP: 0xffffffffc33db92e (disable_dynamic_sst_features+0xe/0x50 [isst_tpmi_core])
Call Trace: <TASK> ? ex_handler_msr+0xf6/0x150 ? fixup_exception+0x1ad/0x340 ? gp_try_fixup_and_notify+0x1e/0xb0 ? exc_general_protection+0xc9/0x390 ? terminate_walk+0x64/0x100 ? asm_exc_general_protection+0x22/0x30 ? disable_dynamic_sst_features+0xe/0x50 [isst_tpmi_core] isst_if_def_ioctl+0xece/0x1050 [isst_tpmi_core] ? ioctl_has_perm.constprop.42+0xe0/0x130 isst_if_def_ioctl+0x10d/0x1a0 [isst_if_common] __se_sys_ioctl+0x86/0xc0 do_syscall_64+0x8a/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 RIP: 0033:0x7f36eaef54a7
Add a check for X86_FEATURE_HWP before accessing the MSR. If HWP is not available, return true safely.
--- drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c +3 -0
@@ -558,6 +558,9 @@ static bool disable_dynamic_sst_features(void) {u64 value; +if (!static_cpu_has (X86_FEATURE_HWP )) +return true; +rdmsrq (MSR_PM_ENABLE , value);return !(value &0x1 ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/309 platform/x86: lenovo: wmi-gamezone: Drop gz_chain_head
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit 5a3955f3602950d1888df743a5b1889e43b5cb60 ]
The gz_chain_head variable has been unused since the driver's initial addition to the tree. Its use was eliminated between v3 and v4 during development but due to the reference of gz_chain_head's wait_list member, the compiler could not warn that it was unused.
After a (tip) commit ("locking/rwsem: Remove the list_head from struct rw_semaphore"), which removed a reference to the variable passed to __RWSEM_INITIALIZER(), certain configurations show an unused variable warning from the Lenovo wmi-gamezone driver:
drivers/platform/x86/lenovo/wmi-gamezone.c:34:31: warning: 'gz_chain_head' defined but not used [-Wunused-variable]
34 | static BLOCKING_NOTIFIER_HEAD(gz_chain_head);
| ^~~~~~~~~~~~~
include/linux/notifier.h:119:39: note: in definition of macro 'BLOCKING_NOTIFIER_HEAD'
119 | struct blocking_notifier_head name = \
| ^~~~Remove the variable to prevent the warning from showing up.
--- drivers/platform/x86/lenovo/wmi-gamezone.c | 2 -- 1 file changed, 2 deletions(-)
drivers/platform/x86/lenovo/wmi-gamezone.c +0 -2
@@ -31,8 +31,6 @@#define LWMI_GZ_METHOD_ID_SMARTFAN_SET 44#define LWMI_GZ_METHOD_ID_SMARTFAN_GET 45 -static BLOCKING_NOTIFIER_HEAD (gz_chain_head); -struct lwmi_gz_priv {enum thermal_mode current_mode;struct notifier_block event_nb;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/309 platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 2061f7b042f88d372cca79615f8425f3564c0b40 ]
The command length check validates inlen (> 5), but the error message incorrectly printed resp_len. Print inlen so the log reflects the actual command length.
--- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/olpc/olpc-xo175-ec.c +1 -1
@@ -482,7 +482,7 @@ static int olpc_xo175_ec_cmd(u8 cmd, u8 *inbuf, size_t inlen, u8 *resp,dev_dbg (dev,"CMD %x, %zd bytes expected\n" , cmd, resp_len);if (inlen >5 ) { -dev_err (dev,"command len %zd too big!\n" , resp_len); +dev_err (dev,"command len %zd too big!\n" , inlen);return -EOVERFLOW ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/309 platform/x86: intel-hid: disable wakeup_mode during hibernation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David McFarland <[email protected]>
[ Upstream commit e02ea3ae8ee40d5835a845884c7b161a27c10bcb ]
Add a freeze handler which clears wakeup_mode. This fixes aborted hibernation on Dell Precision 3880.
Wakeup event detected during hibernation, rolling back
This system sends power button events during hibernation, even when triggered by software.
--- drivers/platform/x86/intel/hid.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/hid.c +9 -1
@@ -432,6 +432,14 @@ static int intel_hid_pl_suspend_handler(struct device *device)return 0 ; } +static int intel_hid_pl_freeze_handler (struct device *device) +{ +struct intel_hid_priv *priv =dev_get_drvdata (device); + + priv->wakeup_mode = false; +return intel_hid_pl_suspend_handler (device); +} +static int intel_hid_pl_resume_handler (struct device *device) {intel_hid_pm_complete (device);
@@ -446,7 +454,7 @@ static int intel_hid_pl_resume_handler(struct device *device)static const struct dev_pm_ops intel_hid_pl_pm_ops = { .prepare = intel_hid_pm_prepare, .complete = intel_hid_pm_complete, - .freeze = intel_hid_pl_suspend_handler, + .freeze = intel_hid_pl_freeze_handler, .thaw = intel_hid_pl_resume_handler, .restore = intel_hid_pl_resume_handler, .suspend = intel_hid_pl_suspend_handler,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/309 ice: fix inverted ready check for VF representors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit ad85de0fc09eb3236e73df5acb2bc257625103f5 ]
Commit 0f00a897c9fcbd ("ice: check if SF is ready in ethtool ops") refactored the VF readiness check into a generic repr->ops.ready() callback but implemented ice_repr_ready_vf() with inverted logic:
return !ice_check_vf_ready_for_cfg(repr->vf);
ice_check_vf_ready_for_cfg() returns 0 on success, so the negation makes ready() return non-zero when the VF is ready. All callers treat non-zero as "not ready, skip", causing ndo_get_stats64, get_drvinfo, get_strings and get_ethtool_stats to always bail out in switchdev mode.
Remove the erroneous negation. The SF variant ice_repr_ready_sf() is already correct (returns !active, i.e. non-zero when not active).
--- drivers/net/ethernet/intel/ice/ice_repr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_repr.c +1 -1
@@ -315,7 +315,7 @@ ice_repr_reg_netdev(struct net_device *netdev, const struct net_device_ops *ops)static int ice_repr_ready_vf (struct ice_repr *repr) { -return !ice_check_vf_ready_for_cfg (repr->vf); +return ice_check_vf_ready_for_cfg (repr->vf); }static int ice_repr_ready_sf (struct ice_repr *repr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/309 ice: use ice_update_eth_stats() for representor stats
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 2526e440df2725e7328d59b835a164826f179b93 ]
ice_repr_get_stats64() and __ice_get_ethtool_stats() call ice_update_vsi_stats() on the VF's src_vsi. This always returns early because ICE_VSI_DOWN is permanently set for VF VSIs - ice_up() is never called on them since queues are managed by iavf through virtchnl.
In __ice_get_ethtool_stats() the original code called ice_update_vsi_stats() for all VSIs including representors, iterated over ice_gstrings_vsi_stats[] to populate the data, and then bailed out with an early return before the per-queue ring stats section. That early return was necessary because representor VSIs have no rings on the PF side - the rings belong to the VF driver (iavf), so accessing per-queue stats would be invalid.
Move the representor handling to the top of __ice_get_ethtool_stats() and call ice_update_eth_stats() directly to read the hardware GLV_* counters. This matches ice_get_vf_stats() which already uses ice_update_eth_stats() for the same VF VSI in legacy mode. Apply the same fix to ice_repr_get_stats64().
Note that ice_gstrings_vsi_stats[] contains five software ring counters (rx_buf_failed, rx_page_failed, tx_linearize, tx_busy, tx_restart) that are always zero for representors since the PF never processes packets on VF rings. This is pre-existing behavior unchanged by this patch.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +++++++++++--- drivers/net/ethernet/intel/ice/ice_repr.c | 3 ++- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +11 -3
@@ -1940,6 +1940,17 @@ __ice_get_ethtool_stats(struct net_device *netdev,int i =0 ;char *p; +if (ice_is_port_repr_netdev (netdev)) { +ice_update_eth_stats (vsi); + +for (j =0 ; j <ICE_VSI_STATS_LEN ; j++) { + p = (char *)vsi + ice_gstrings_vsi_stats[j].stat_offset; + data[i++] = (ice_gstrings_vsi_stats[j].sizeof_stat == +sizeof (u64)) ? *(u64 *)p : *(u32 *)p; + } +return ; + } +ice_update_pf_stats (pf);ice_update_vsi_stats (vsi);
@@ -1949,9 +1960,6 @@ __ice_get_ethtool_stats(struct net_device *netdev, sizeof(u64)) ? *(u64 *)p : *(u32 *)p; } -if (ice_is_port_repr_netdev (netdev)) -return ; -/* populate per queue stats */ rcu_read_lock ();
drivers/net/ethernet/intel/ice/ice_repr.c +2 -1
@@ -2,6 +2,7 @@/* Copyright (C) 2019-2021, Intel Corporation. */ #include "ice.h" +#include "ice_lib.h" #include "ice_eswitch.h" #include "devlink/devlink.h" #include "devlink/port.h"
@@ -67,7 +68,7 @@ ice_repr_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)return ; vsi = repr->src_vsi; -ice_update_vsi_stats (vsi); +ice_update_eth_stats (vsi); eth_stats = &vsi->eth_stats; stats->tx_packets = eth_stats->tx_unicast + eth_stats->tx_broadcast +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/309 iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit fecacfc95f195b99c71c579a472120d0b4ed65fa ]
iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead.
Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1].
For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3:
Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)iavf_set_channels()
...iavf_alloc_queues()
-> num_active_queues = 8iavf_schedule_finish_config()
iavf_get_sset_count()
real_num_tx_queues: 1
-> buffer for 1 queue
iavf_get_ethtool_stats()
num_active_queues: 8
-> out-of-bounds!
iavf_finish_config()
-> real_num_tx_queues = 8Use immutable num_tx_queues in all related functions to avoid the issue.
[1]
BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270
Write of size 8 at addr ffffc900031c9080 by task ethtool/5800
CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6f/0xb0
print_report+0x170/0x4f3
kasan_report+0xe1/0x180
iavf_add_one_ethtool_stat+0x200/0x270
iavf_get_ethtool_stats+0x14c/0x2e0
__dev_ethtool+0x3d0c/0x5830
dev_ethtool+0x12d/0x270
dev_ioctl+0x53c/0xe30
sock_do_ioctl+0x1a9/0x270
sock_ioctl+0x3d4/0x5e0
__x64_sys_ioctl+0x137/0x1c0
do_syscall_64+0xf3/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7da0e6e36d
...
</TASK>
The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff88813a013de0 pfn:0x13a013
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8--- .../net/ethernet/intel/iavf/iavf_ethtool.c | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +15 -16
@@ -313,14 +313,13 @@ static int iavf_get_sset_count(struct net_device *netdev, int sset) {/* Report the maximum number queues, even if not every queue is * currently configured. Since allocation of queues is in pairs, -* use netdev->real_num_tx_queues * 2. The real_num_tx_queues is set -* at device creation and never changes. +* use netdev->num_tx_queues * 2. The num_tx_queues is set at +* device creation and never changes. */ if (sset ==ETH_SS_STATS )return IAVF_STATS_LEN + - (IAVF_QUEUE_STATS_LEN *2 * - netdev->real_num_tx_queues); + (IAVF_QUEUE_STATS_LEN *2 * netdev->num_tx_queues);else return -EINVAL ; }
@@ -345,19 +344,19 @@ static void iavf_get_ethtool_stats(struct net_device *netdev,iavf_add_ethtool_stats (&data, adapter, iavf_gstrings_stats);rcu_read_lock (); -/* As num_active_queues describe both tx and rx queues, we can use -* it to iterate over rings' stats. +/* Use num_tx_queues to report stats for the maximum number of queues. +* Queues beyond num_active_queues will report zero. */ -for (i =0 ; i < adapter->num_active_queues; i++) { -struct iavf_ring *ring; +for (i =0 ; i < netdev->num_tx_queues; i++) { +struct iavf_ring *tx_ring =NULL , *rx_ring =NULL ; -/* Tx rings stats */ - ring = &adapter->tx_rings[i]; -iavf_add_queue_stats (&data, ring); +if (i < adapter->num_active_queues) { + tx_ring = &adapter->tx_rings[i]; + rx_ring = &adapter->rx_rings[i]; + } -/* Rx rings stats */ - ring = &adapter->rx_rings[i]; -iavf_add_queue_stats (&data, ring); +iavf_add_queue_stats (&data, tx_ring); +iavf_add_queue_stats (&data, rx_ring); }rcu_read_unlock (); }
@@ -376,9 +375,9 @@ static void iavf_get_stat_strings(struct net_device *netdev, u8 *data)iavf_add_stat_strings (&data, iavf_gstrings_stats);/* Queues are always allocated in pairs, so we just use -* real_num_tx_queues for both Tx and Rx queues. +* num_tx_queues for both Tx and Rx queues. */ -for (i =0 ; i < netdev->real_num_tx_queues; i++) { +for (i =0 ; i < netdev->num_tx_queues; i++) {iavf_add_stat_strings (&data, iavf_gstrings_queue_stats,"tx" , i); iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/309 ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 6af51e9f31336632263c4680b2a3712295103e1f ]
Commit 5eb902b8e719 ("net/ipv6: Remove expired routes with a separated list of routes.") introduced a per-table GC list and changed GC to iterate over that list instead of traversing the entire route table.
However, it forgot to add permanent routes to tb6_gc_hlist when exception routes are added.
Commit cfe82469a00f ("ipv6: add exception routes to GC list in rt6_insert_exception") fixed that issue but introduced another one.
Even after all exception routes expire, the permanent routes remain in tb6_gc_hlist, potentially negating the performance benefits intended by the initial change.
Let's count gc_args->more before and after rt6_age_exceptions() and remove the permanent route when the delta is 0.
Note that the next patch will reuse fib6_age_exceptions().
--- net/ipv6/ip6_fib.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
net/ipv6/ip6_fib.c +12 -1
@@ -2348,6 +2348,17 @@ static void fib6_flush_trees(struct net *net)/* * Garbage collection */ +static void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now) +{ +bool may_expire = rt->fib6_flags &RTF_EXPIRES && rt->expires; +int old_more = gc_args->more; + +rt6_age_exceptions (rt, gc_args, now); + +if (!may_expire && old_more == gc_args->more) +fib6_remove_gc_list (rt); +}static int fib6_age (struct fib6_info *rt,struct fib6_gc_args *gc_args) {
@@ -2370,7 +2381,7 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)* Note, that clones are aged out * only if they are not in use now. */ -rt6_age_exceptions (rt, gc_args, now); +fib6_age_exceptions (rt, gc_args, now);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/309 ipv6: Dont remove permanent routes with exceptions from tb6_gc_hlist.
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4be7b99c253f0c85a255cc1db7127ba3232dfa30 ]
The cited commit mechanically put fib6_remove_gc_list() just after every fib6_clean_expires() call.
When a temporary route is promoted to a permanent route, there may already be exception routes tied to it.
If fib6_remove_gc_list() removes the route from tb6_gc_hlist, such exception routes will no longer be aged.
Let's replace fib6_remove_gc_list() with a new helper fib6_may_remove_gc_list() and use fib6_age_exceptions() there.
Note that net->ipv6 is only compiled when CONFIG_IPV6 is enabled, so fib6_{add,remove,may_remove}_gc_list() are guarded.
--- include/net/ip6_fib.h | 21 ++++++++++++++++++++- net/ipv6/addrconf.c | 4 ++-- net/ipv6/ip6_fib.c | 6 +++--- net/ipv6/route.c | 2 +- 4 files changed, 26 insertions(+), 7 deletions(-)
include/net/ip6_fib.h +20 -1
@@ -507,12 +507,14 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,void inet6_rt_notify (int event,struct fib6_info *rt,struct nl_info *info,unsigned int flags); +void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now);void fib6_run_gc (unsigned long expires,struct net *net,bool force); -void fib6_gc_cleanup (void );int fib6_init (void ); +#if IS_ENABLED (CONFIG_IPV6 )/* Add the route to the gc list if it is not already there * * The callers should hold f6i->fib6_table->tb6_lock.
@@ -545,6 +547,23 @@ static inline void fib6_remove_gc_list(struct fib6_info *f6i)hlist_del_init (&f6i->gc_link); } +static inline void fib6_may_remove_gc_list (struct net *net, +struct fib6_info *f6i) +{ +struct fib6_gc_args gc_args; + +if (hlist_unhashed (&f6i->gc_link)) +return ; + + gc_args.timeout =READ_ONCE (net->ipv6.sysctl.ip6_rt_gc_interval); + gc_args.more =0 ; + +rcu_read_lock (); +fib6_age_exceptions (f6i, &gc_args, jiffies); +rcu_read_unlock (); +} +#endif +struct ipv6_route_iter {struct seq_net_private p;struct fib6_walker w;
net/ipv6/addrconf.c +2 -2
@@ -2863,7 +2863,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)fib6_add_gc_list (rt); }else {fib6_clean_expires (rt); -fib6_remove_gc_list (rt); +fib6_may_remove_gc_list (net, rt); }spin_unlock_bh (&table->tb6_lock);
@@ -4836,7 +4836,7 @@ static int modify_prefix_route(struct net *net, struct inet6_ifaddr *ifp,if (!(flags &RTF_EXPIRES )) {fib6_clean_expires (f6i); -fib6_remove_gc_list (f6i); +fib6_may_remove_gc_list (net, f6i); }else {fib6_set_expires (f6i, expires);fib6_add_gc_list (f6i);
net/ipv6/ip6_fib.c +3 -3
@@ -1133,7 +1133,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,return -EEXIST ;if (!(rt->fib6_flags &RTF_EXPIRES )) {fib6_clean_expires (iter); -fib6_remove_gc_list (iter); +fib6_may_remove_gc_list (info->nl_net, iter); }else {fib6_set_expires (iter, rt->expires);fib6_add_gc_list (iter);
@@ -2348,8 +2348,8 @@ static void fib6_flush_trees(struct net *net)/* * Garbage collection */ -static void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, -unsigned long now) +void fib6_age_exceptions (struct fib6_info *rt,struct fib6_gc_args *gc_args, +unsigned long now) {bool may_expire = rt->fib6_flags &RTF_EXPIRES && rt->expires;int old_more = gc_args->more;
net/ipv6/route.c +1 -1
@@ -1033,7 +1033,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,if (!addrconf_finite_timeout (lifetime)) {fib6_clean_expires (rt); -fib6_remove_gc_list (rt); +fib6_may_remove_gc_list (net, rt); }else {fib6_set_expires (rt, jiffies +HZ * lifetime);fib6_add_gc_list (rt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/309 net: fix fanout UAF in packet_release() via NETDEV_UP race
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array.packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.
The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
--- net/packet/af_packet.c | 1 + 1 file changed, 1 insertion(+)
net/packet/af_packet.c +1 -0
@@ -3135,6 +3135,7 @@ static int packet_release(struct socket *sock)spin_lock (&po->bind_lock);unregister_prot_hook (sk, false); +WRITE_ONCE (po->num,0 );packet_cached_dev_reset (po);if (po->prot_hook.dev) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/309 net: airoha: add RCU lock around dev_fill_forward_path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 1065913dedfd3a8269816835bfe810b6e2c28579 ]
Since 0417adf367a0 ("ppp: fix race conditions in ppp_fill_forward_path") dev_fill_forward_path() should be called with RCU read lock held. This fix was applied to net, while the Airoha flowtable commit was applied to net-next, so it hadn't been an issue until net was merged into net-next.
--- drivers/net/ethernet/airoha/airoha_ppe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/airoha/airoha_ppe.c +2 -0
@@ -201,7 +201,9 @@ static int airoha_ppe_get_wdma_info(struct net_device *dev, const u8 *addr,if (!dev)return -ENODEV ; +rcu_read_lock (); err =dev_fill_forward_path (dev, addr, &stack); +rcu_read_unlock ();if (err)return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/309 udp: Fix wildcard bind conflict check when using hash2
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit e537dd15d0d4ad989d56a1021290f0c674dd8b28 ]
When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10.
"hash2" is keyed by local address and local port. "hash" is keyed by local port only.
The issue can be shown in the following bind sequence (pseudo code):
bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888")
bind(fd10, "[fd00::10]:8888")
/* Correctly return -EADDRINUSE because "hash" is used
* instead of "hash2". udp_lib_lport_inuse() detects the
* conflict.
*/bind(fail_fd, "[::]:8888")
/* After one more socket is bound to "[fd00::11]:8888",
* hslot->count exceeds 10 and "hash2" is used instead. */bind(fd11, "[fd00::11]:8888")bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */
The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10.
TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix.
--- include/net/inet_hashtables.h | 14 ++++++++++++++ net/ipv4/inet_connection_sock.c | 20 +++----------------- net/ipv4/udp.c | 2 +- 3 files changed, 18 insertions(+), 18 deletions(-)
include/net/inet_hashtables.h +14 -0
@@ -264,6 +264,20 @@ inet_bhashfn_portaddr(const struct inet_hashinfo *hinfo, const struct sock *sk,return &hinfo->bhash2[hash & (hinfo->bhash_size -1 )]; } +static inline bool inet_use_hash2_on_bind (const struct sock *sk) +{ +#if IS_ENABLED (CONFIG_IPV6 ) +if (sk->sk_family ==AF_INET6 ) { +if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) +return false; + +if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) +return true; + } +#endif +return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); +} +struct inet_bind_hashbucket *inet_bhash2_addr_any_hashbucket (const struct sock *sk,const struct net *net,int port);
net/ipv4/inet_connection_sock.c +3 -17
@@ -153,20 +153,6 @@ bool inet_sk_get_local_port_range(const struct sock *sk, int *low, int *high) }EXPORT_SYMBOL (inet_sk_get_local_port_range); -static bool inet_use_bhash2_on_bind (const struct sock *sk) -{ -#if IS_ENABLED (CONFIG_IPV6 ) -if (sk->sk_family ==AF_INET6 ) { -if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) -return false; - -if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) -return true; - } -#endif -return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); -} -static bool inet_bind_conflict (const struct sock *sk,struct sock *sk2,kuid_t uid,bool relax,bool reuseport_cb_ok,bool reuseport_ok)
@@ -258,7 +244,7 @@ static int inet_csk_bind_conflict(const struct sock *sk,* checks separately because their spinlocks have to be acquired/released * independently of each other, to prevent possible deadlocks */ -if (inet_use_bhash2_on_bind (sk)) +if (inet_use_hash2_on_bind (sk))return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, reuseport_ok);
@@ -375,7 +361,7 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret, head = &hinfo->bhash[inet_bhashfn (net, port, hinfo->bhash_size)];spin_lock_bh (&head->lock); -if (inet_use_bhash2_on_bind (sk)) { +if (inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, relax, false)) goto next_port; }
@@ -561,7 +547,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum) check_bind_conflict = false; } -if (check_bind_conflict &&inet_use_bhash2_on_bind (sk)) { +if (check_bind_conflict &&inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, true, true)) goto fail_unlock; }
net/ipv4/udp.c +1 -1
@@ -287,7 +287,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, }else { hslot =udp_hashslot (udptable, net, snum);spin_lock_bh (&hslot->lock); -if (hslot->count >10 ) { +if (inet_use_hash2_on_bind (sk) && hslot->count >10 ) {int exist;unsigned int slot2 =udp_sk (sk)->udp_portaddr_hash ^ snum;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/309 net: enetc: fix the output issue of ethtool --show-ring
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 70b439bf06f6a12e491f827fa81a9887a11501f9 ]
Currently, enetc_get_ringparam() only provides rx_pending and tx_pending, but 'ethtool --show-ring' no longer displays these fields. Because the ringparam retrieval path has moved to the new netlink interface, where rings_fill_reply() emits the *x_pending only if the *x_max_pending values are non-zero. So rx_max_pending and tx_max_pending to are added to enetc_get_ringparam() to fix the issue.
Note that the maximum tx/rx ring size of hardware is 64K, but we haven't added set_ringparam() to make the ring size configurable. To avoid users mistakenly believing that the ring size can be increased, so set the *x_max_pending to priv->*x_bd_count.
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +2 -0
@@ -788,6 +788,8 @@ static void enetc_get_ringparam(struct net_device *ndev, {struct enetc_ndev_priv *priv =netdev_priv (ndev); + ring->rx_max_pending = priv->rx_bd_count; + ring->tx_max_pending = priv->tx_bd_count; ring->rx_pending = priv->rx_bd_count; ring->tx_pending = priv->tx_bd_count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/309 virtio-net: correct hdr_len handling for VIRTIO_NET_F_GUEST_HDRLEN
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuan Zhuo <[email protected]>
[ Upstream commit 38ec410b99a5ee6566f75650ce3d4fd632940fd0 ]
The commit be50da3e9d4a ("net: virtio_net: implement exact header length guest feature") introduces support for the VIRTIO_NET_F_GUEST_HDRLEN feature in virtio-net.
This feature requires virtio-net to set hdr_len to the actual header length of the packet when transmitting, the number of bytes from the start of the packet to the beginning of the transport-layer payload.
However, in practice, hdr_len was being set using skb_headlen(skb), which is clearly incorrect. This commit fixes that issue.
--- drivers/net/tun_vnet.h | 2 +- drivers/net/virtio_net.c | 6 +++++- include/linux/virtio_net.h | 34 ++++++++++++++++++++++++++++++---- 3 files changed, 36 insertions(+), 6 deletions(-)
drivers/net/tun_vnet.h +1 -1
@@ -244,7 +244,7 @@ tun_vnet_hdr_tnl_from_skb(unsigned int flags,if (virtio_net_hdr_tnl_from_skb (skb, tnl_hdr, has_tnl_offload,tun_vnet_is_little_endian (flags), - vlan_hlen, true)) { + vlan_hlen, true, false)) {struct virtio_net_hdr_v1 *hdr = &tnl_hdr->hash_hdr.hdr;struct skb_shared_info *sinfo =skb_shinfo (skb);
drivers/net/virtio_net.c +5 -1
@@ -3326,8 +3326,12 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb, bool orphan)struct virtio_net_hdr_v1_hash_tunnel *hdr;int num_sg;unsigned hdr_len = vi->hdr_len; +bool feature_hdrlen;bool can_push; + feature_hdrlen =virtio_has_feature (vi->vdev, +VIRTIO_NET_F_GUEST_HDRLEN ); +pr_debug ("%s: xmit %p %pM\n" , vi->dev->name, skb, dest);/* Make sure it's safe to cast between formats */
@@ -3347,7 +3351,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb, bool orphan)if (virtio_net_hdr_tnl_from_skb (skb, hdr, vi->tx_tnl,virtio_is_little_endian (vi->vdev),0 , - false)) + false, feature_hdrlen))return -EPROTO ;if (vi->mergeable_rx_bufs)
include/linux/virtio_net.h +30 -4
@@ -207,6 +207,23 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,return __virtio_net_hdr_to_skb (skb, hdr, little_endian, hdr->gso_type); } +/* This function must be called after virtio_net_hdr_from_skb(). */ +static inline void __virtio_net_set_hdrlen (const struct sk_buff *skb, +struct virtio_net_hdr *hdr, +bool little_endian) +{ +u16 hdr_len; + + hdr_len =skb_transport_offset (skb); + +if (hdr->gso_type ==VIRTIO_NET_HDR_GSO_UDP_L4 ) + hdr_len +=sizeof (struct udphdr ); +else + hdr_len +=tcp_hdrlen (skb); + + hdr->hdr_len =__cpu_to_virtio16 (little_endian, hdr_len); +} + static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, struct virtio_net_hdr *hdr, bool little_endian,
@@ -385,7 +402,8 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,bool tnl_hdr_negotiated, bool little_endian, int vlan_hlen, - bool has_data_valid) + bool has_data_valid, + bool feature_hdrlen) { struct virtio_net_hdr *hdr = (struct virtio_net_hdr *)vhdr;unsigned int inner_nh, outer_th;
@@ -394,9 +412,17 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb, tnl_gso_type =skb_shinfo (skb)->gso_type & (SKB_GSO_UDP_TUNNEL |SKB_GSO_UDP_TUNNEL_CSUM ); -if (!tnl_gso_type) -return virtio_net_hdr_from_skb (skb, hdr, little_endian, - has_data_valid, vlan_hlen); +if (!tnl_gso_type) { + ret =virtio_net_hdr_from_skb (skb, hdr, little_endian, + has_data_valid, vlan_hlen); +if (ret) +return ret; + +if (feature_hdrlen && hdr->hdr_len) +__virtio_net_set_hdrlen (skb, hdr, little_endian); + +return ret; + }/* Tunnel support not negotiated but skb ask for it. */ if (!tnl_hdr_negotiated)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/309 virtio-net: correct hdr_len handling for tunnel gso
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuan Zhuo <[email protected]>
[ Upstream commit 6c860dc02a8e60b438e26940227dfa641fcdb66a ]
The commit a2fb4bc4e2a6a03 ("net: implement virtio helpers to handle UDP GSO tunneling.") introduces support for the UDP GSO tunnel feature in virtio-net.
The virtio spec says:
If the \field{gso_type} has the VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4 bit or VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6 bit set, \field{hdr_len} accounts for all the headers up to and including the inner transport.
The commit did not update the hdr_len to include the inner transport.
I observed that the "hdr_len" is 116 for this packet:
17:36:18.241105 52:55:00:d1:27:0a > 2e:2c:df:46:a9:e1, ethertype IPv4 (0x0800), length 2912: (tos 0x0, ttl 64, id 45197, offset 0, flags [none], proto UDP (17), length 2898)
192.168.122.100.50613 > 192.168.122.1.4789: [bad udp cksum 0x8106 -> 0x26a0!] VXLAN, flags [I] (0x08), vni 1
fa:c3:ba:82:05:ee > ce:85:0c:31:77:e5, ethertype IPv4 (0x0800), length 2862: (tos 0x0, ttl 64, id 14678, offset 0, flags [DF], proto TCP (6), length 2848)
192.168.3.1.49880 > 192.168.3.2.9898: Flags [P.], cksum 0x9266 (incorrect -> 0xaa20), seq 515667:518463, ack 1, win 64, options [nop,nop,TS val 2990048824 ecr 2798801412], length 2796116 = 14(mac) + 20(ip) + 8(udp) + 8(vxlan) + 14(inner mac) + 20(inner ip) + 32(innner tcp)
--- include/linux/virtio_net.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
include/linux/virtio_net.h +19 -0
@@ -224,6 +224,22 @@ static inline void __virtio_net_set_hdrlen(const struct sk_buff *skb, hdr->hdr_len =__cpu_to_virtio16 (little_endian, hdr_len); } +/* This function must be called after virtio_net_hdr_from_skb(). */ +static inline void __virtio_net_set_tnl_hdrlen (const struct sk_buff *skb, +struct virtio_net_hdr *hdr) +{ +u16 hdr_len; + + hdr_len =skb_inner_transport_offset (skb); + +if (hdr->gso_type ==VIRTIO_NET_HDR_GSO_UDP_L4 ) + hdr_len +=sizeof (struct udphdr ); +else + hdr_len +=inner_tcp_hdrlen (skb); + + hdr->hdr_len =__cpu_to_virtio16 (true, hdr_len); +} + static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, struct virtio_net_hdr *hdr, bool little_endian,
@@ -440,6 +456,9 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,if (ret)return ret; +if (feature_hdrlen && hdr->hdr_len) +__virtio_net_set_tnl_hdrlen (skb, hdr); +if (skb->protocol ==htons (ETH_P_IPV6 )) hdr->gso_type |=VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6 ;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/309 team: fix header_ops type confusion with non-Ethernet ports
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 425000dbf17373a4ab8be9428f5dc055ef870a56 ]
Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type confusion.
For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops directly. When the team device later calls dev_hard_header() or dev_parse_header(), these callbacks can run with the team net_device instead of the real lower device, so netdev_priv(dev) is interpreted as the wrong private type and can crash.
The syzbot report shows a crash in bond_header_create(), but the root cause is in team: the topology is gre -> bond -> team, and team calls the inherited header_ops with its own net_device instead of the lower device, so bond_header_create() receives a team device and interprets netdev_priv() as bonding private data, causing a type confusion crash.
Fix this by introducing team header_ops wrappers for create/parse, selecting a team port under RCU, and calling the lower device callbacks with port->dev, so each callback always sees the correct net_device context.
Also pass the selected lower device to the lower parse callback, so recursion is bounded in stacked non-Ethernet topologies and parse callbacks always run with the correct device context.
--- drivers/net/team/team_core.c | 65 +++++++++++++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-)
drivers/net/team/team_core.c +64 -1
@@ -2059,6 +2059,68 @@ static const struct ethtool_ops team_ethtool_ops = {* rt netlink interface ***********************/ +/* For tx path we need a linkup && enabled port and for parse any port +* suffices. +*/ +static struct team_port *team_header_port_get_rcu (struct team *team, +bool txable) +{ +struct team_port *port; + +list_for_each_entry_rcu (port, &team->port_list, list) { +if (!txable ||team_port_txable (port)) +return port; + } + +return NULL ; +} + +static int team_header_create (struct sk_buff *skb,struct net_device *team_dev, +unsigned short type,const void *daddr, +const void *saddr,unsigned int len) +{ +struct team *team =netdev_priv (team_dev); +const struct header_ops *port_ops; +struct team_port *port; +int ret =0 ; + +rcu_read_lock (); + port =team_header_port_get_rcu (team, true); +if (port) { + port_ops =READ_ONCE (port->dev->header_ops); +if (port_ops && port_ops->create) + ret = port_ops->create (skb, port->dev, + type, daddr, saddr, len); + } +rcu_read_unlock (); +return ret; +} + +static int team_header_parse (const struct sk_buff *skb, +const struct net_device *team_dev, +unsigned char *haddr) +{ +struct team *team =netdev_priv (team_dev); +const struct header_ops *port_ops; +struct team_port *port; +int ret =0 ; + +rcu_read_lock (); + port =team_header_port_get_rcu (team, false); +if (port) { + port_ops =READ_ONCE (port->dev->header_ops); +if (port_ops && port_ops->parse) + ret = port_ops->parse (skb, port->dev, haddr); + } +rcu_read_unlock (); +return ret; +} + +static const struct header_ops team_header_ops = { + .create = team_header_create, + .parse = team_header_parse, +}; +static void team_setup_by_port (struct net_device *dev,struct net_device *port_dev) {
@@ -2067,7 +2129,8 @@ static void team_setup_by_port(struct net_device *dev,if (port_dev->type ==ARPHRD_ETHER ) dev->header_ops = team->header_ops_cache;else - dev->header_ops = port_dev->header_ops; + dev->header_ops = port_dev->header_ops ? + &team_header_ops :NULL ; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/309 net: lan743x: fix duplex configuration in mac_link_up
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thangaraj Samynathan <[email protected]>
[ Upstream commit 71399707876b93240f236f48b8062f3423a5fe97 ]
The driver does not explicitly configure the MAC duplex mode when bringing the link up. As a result, the MAC may retain a stale duplex setting from a previous link state, leading to duplex mismatches with the link partner and degraded network performance.
Update lan743x_phylink_mac_link_up() to set or clear the MAC_CR_DPX_ bit according to the negotiated duplex mode.
This ensures the MAC configuration is consistent with the phylink resolved state.
--- drivers/net/ethernet/microchip/lan743x_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/microchip/lan743x_main.c +5 -0
@@ -3054,6 +3054,11 @@ static void lan743x_phylink_mac_link_up(struct phylink_config *config,else if (speed ==SPEED_100 ) mac_cr |=MAC_CR_CFG_L_ ; +if (duplex ==DUPLEX_FULL ) + mac_cr |=MAC_CR_DPX_ ; +else + mac_cr &= ~MAC_CR_DPX_ ; +lan743x_csr_write (adapter,MAC_CR , mac_cr);lan743x_ptp_update_latency (adapter, speed);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/309 rtnetlink: fix leak of SRCU struct in rtnl_link_register
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 09474055f2619be9445ba4245e4013741ed01a5e ]
Commit 6b57ff21a310 ("rtnetlink: Protect link_ops by mutex.") swapped the EEXIST check with the init_srcu_struct, but didn't add cleanup of the SRCU struct we just allocated in case of error.
--- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/rtnetlink.c +3 -0
@@ -629,6 +629,9 @@ int rtnl_link_register(struct rtnl_link_ops *ops) unlock:mutex_unlock (&link_ops_mutex); +if (err) +cleanup_srcu_struct (&ops->srcu); +return err; }EXPORT_SYMBOL_GPL (rtnl_link_register);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/309 dma-mapping: add missing `inline` for `dma_free_attrs`
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 ]
Under an UML build for an upcoming series [1], I got -Wstatic-in-inline for dma_free_attrs:
BINDGEN rust/bindings/bindings_generated.rs - due to target missing
In file included from rust/helpers/helpers.c:59:
rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline]
17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs);
| ^
rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage
12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size,
| ^
| static
The issue is that dma_free_attrs was not marked inline when it was introduced alongside the rest of the stubs.
Thus mark it.
--- include/linux/dma-mapping.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/dma-mapping.h +2 -2
@@ -240,8 +240,8 @@ static inline void *dma_alloc_attrs(struct device *dev, size_t size, {return NULL ; } -static void dma_free_attrs (struct device *dev,size_t size,void *cpu_addr, -dma_addr_t dma_handle,unsigned long attrs) +static inline void dma_free_attrs (struct device *dev,size_t size, +void *cpu_addr,dma_addr_t dma_handle,unsigned long attrs) { } static inline void *dmam_alloc_attrs(struct device *dev, size_t size,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/309 Bluetooth: L2CAP: Fix send LE flow credits in ACL link
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Chen <[email protected]>
[ Upstream commit f39f905e55f529b036321220af1ba4f4085564a5 ]
When the L2CAP channel mode is L2CAP_MODE_ERTM/L2CAP_MODE_STREAMING, l2cap_publish_rx_avail will be called and le flow credits will be sent in l2cap_chan_rx_avail, even though the link type is ACL.
The logs in question as follows:
Quoted 1 line
ACL Data RX: Handle 129 flags
0x02dlen 12
L2CAP: Unknown (0x16) ident 4 len 4
40 00 ed 05
< ACL Data TX: Handle 129 flags 0x00 dlen 10
L2CAP: Command Reject (0x01) ident 4 len 2
Reason: Command not understood (0x0000)Bluetooth: Unknown BR/EDR signaling command 0x16
Bluetooth: Wrong link type (-22)
--- net/bluetooth/l2cap_core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/l2cap_core.c +4 -0
@@ -6589,6 +6589,10 @@ static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)struct l2cap_le_credits pkt;u16 return_credits =l2cap_le_rx_credits (chan); +if (chan->mode !=L2CAP_MODE_LE_FLOWCTL && + chan->mode !=L2CAP_MODE_EXT_FLOWCTL ) +return ; +if (chan->rx_credits >= return_credits)return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/309 Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cen Zhang <[email protected]>
[ Upstream commit 94d8e6fe5d0818e9300e514e095a200bd5ff93ae ]
btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb().
Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer.
Below is the data race report and the kasan report:
BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined
read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83:
__hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030
write/free by task ioctl/22580:
btintel_shutdown_combined+0xd0/0x360
drivers/bluetooth/btintel.c:3648
hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246
hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526
BUG: KASAN: slab-use-after-free in
sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202
Read of size 4 at addr ffff888144a738dc
by task kworker/u17:1/83:
__hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200
__hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223
btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260--- drivers/bluetooth/btintel.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/bluetooth/btintel.c +8 -3
@@ -251,11 +251,13 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)bt_dev_err (hdev,"Hardware error 0x%2.2x" , code); +hci_req_sync_lock (hdev); + skb =__hci_cmd_sync (hdev,HCI_OP_RESET ,0 ,NULL ,HCI_INIT_TIMEOUT );if (IS_ERR (skb)) {bt_dev_err (hdev,"Reset after hardware error failed (%ld)" ,PTR_ERR (skb)); -return ; + goto unlock; }kfree_skb (skb);
@@ -263,18 +265,21 @@ void btintel_hw_error(struct hci_dev *hdev, u8 code)if (IS_ERR (skb)) {bt_dev_err (hdev,"Retrieving Intel exception info failed (%ld)" ,PTR_ERR (skb)); -return ; + goto unlock; }if (skb->len !=13 ) {bt_dev_err (hdev,"Exception info size mismatch" );kfree_skb (skb); -return ; + goto unlock; }bt_dev_err (hdev,"Exception info %s" , (char *)(skb->data +1 ));kfree_skb (skb); + +unlock: +hci_req_sync_unlock (hdev); }EXPORT_SYMBOL_GPL (btintel_hw_error);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/309 Bluetooth: L2CAP: Fix not tracking outstanding TX ident
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 6c3ea155e5ee3e56606233acde8309afda66d483 ]
This attempts to proper track outstanding request by using struct ida and allocating from it in l2cap_get_ident using ida_alloc_range which would reuse ids as they are free, then upon completion release the id using ida_free.
This fixes the qualification test case L2CAP/COS/CED/BI-29-C which attempts to check if the host stack is able to work after 256 attempts to connect which requires Ident field to use the full range of possible values in order to pass the test.
Stable-dep-of: 00fdebbbc557 ("Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()")
--- include/net/bluetooth/l2cap.h | 3 +-- net/bluetooth/l2cap_core.c | 46 ++++++++++++++++++++++++----------- 2 files changed, 33 insertions(+), 16 deletions(-)
include/net/bluetooth/l2cap.h +1 -2
@@ -657,8 +657,7 @@ struct l2cap_conn {struct sk_buff *rx_skb;__u32 rx_len; -__u8 tx_ident; -struct mutex ident_lock; +struct ida tx_ida;struct sk_buff_head pending_rx;struct work_struct pending_rx_work;
net/bluetooth/l2cap_core.c +32 -14
95 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/309 Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 00fdebbbc557a2fc21321ff2eaa22fd70c078608 ]
l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work functions l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire conn->lock, creating a potential AB-BA deadlock if the work is already executing when l2cap_conn_del() takes the lock.
Move the work cancellations before acquiring conn->lock and use disable_delayed_work_sync() to additionally prevent the works from being rearmed after cancellation, consistent with the pattern used in hci_conn_del().
--- net/bluetooth/l2cap_core.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/bluetooth/l2cap_core.c +3 -5
@@ -1748,6 +1748,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)BT_DBG ("hcon %p conn %p, err %d" , hcon, conn, err); +disable_delayed_work_sync (&conn->info_timer); +disable_delayed_work_sync (&conn->id_addr_timer); +mutex_lock (&conn->lock);kfree_skb (conn->rx_skb);
@@ -1763,8 +1766,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)ida_destroy (&conn->tx_ida); -cancel_delayed_work_sync (&conn->id_addr_timer); -l2cap_unregister_all_users (conn);/* Force the connection to be immediately dropped */
@@ -1783,9 +1784,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)l2cap_chan_put (chan); } -if (conn->info_state &L2CAP_INFO_FEAT_MASK_REQ_SENT ) -cancel_delayed_work_sync (&conn->info_timer); -hci_chan_del (conn->hchan); conn->hchan =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/309 Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes). However, since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from the initial configuration, the reconfiguration path falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing the previous allocations and sets chan->sdu to NULL without freeing the existing skb. This leaks all previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum value of remote_mps derived from the RFC max_pdu_size option. A zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate since len is never decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state, while still allowing the reconfiguration parameters to be updated through l2cap_parse_conf_req(). Also add a pdu_len zero check in l2cap_segment_sdu() as a safeguard.
--- net/bluetooth/l2cap_core.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/bluetooth/l2cap_core.c +12 -7
@@ -2375,6 +2375,9 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,/* Remote device may have requested smaller PDUs */ pdu_len =min_t (size_t, pdu_len, chan->remote_mps); +if (!pdu_len) +return -EINVAL ; +if (len <= pdu_len) { sar =L2CAP_SAR_UNSEGMENTED ; sdu_len =0 ;
@@ -4310,14 +4313,16 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,if (test_bit (CONF_INPUT_DONE , &chan->conf_state)) {set_default_fcs (chan); -if (chan->mode ==L2CAP_MODE_ERTM || - chan->mode ==L2CAP_MODE_STREAMING ) - err =l2cap_ertm_init (chan); +if (chan->state !=BT_CONNECTED ) { +if (chan->mode ==L2CAP_MODE_ERTM || + chan->mode ==L2CAP_MODE_STREAMING ) + err =l2cap_ertm_init (chan); -if (err <0 ) -l2cap_send_disconn_req (chan, -err); -else -l2cap_chan_ready (chan); +if (err <0 ) +l2cap_send_disconn_req (chan, -err); +else +l2cap_chan_ready (chan); + } goto unlock; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/309 Bluetooth: btusb: clamp SCO altsetting table indices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc ]
btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.
While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -2356,8 +2356,11 @@ static void btusb_work(struct work_struct *work)if (data->air_mode ==HCI_NOTIFY_ENABLE_SCO_CVSD ) {if (hdev->voice_setting &0x0020 ) {static const int alts[3 ] = {2 ,4 ,5 }; +unsigned int sco_idx; - new_alts = alts[data->sco_num -1 ]; + sco_idx = min_t(unsigned int, data->sco_num - 1, +ARRAY_SIZE (alts) -1 ); + new_alts = alts[sco_idx]; }else { new_alts = data->sco_num; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/309 tls: Purge async_hold in tls_decrypt_async_wait()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 84a8335d8300576f1b377ae24abca1d9f197807f ]
The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no longer references those skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to tls_sw_read_sock(), introducing a new call site that must drain pending AEAD operations and release held skbs. Move __skb_queue_purge(&ctx->async_hold) into tls_decrypt_async_wait() so the purge is centralized and every caller -- recvmsg's drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path -- releases held skbs on synchronization without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through, after having added some cloned skbs to the async_hold queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to process all pending decrypts, and drop back to synchronous mode, but tls_sw_recvmsg() only flushes the async_hold queue when one record has been processed in "fully-async" mode, which may not be the case here.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -246,6 +246,7 @@ static int tls_decrypt_async_wait(struct tls_sw_context_rx *ctx)crypto_wait_req (-EINPROGRESS , &ctx->async_wait);atomic_inc (&ctx->decrypt_pending); +__skb_queue_purge (&ctx->async_hold);return ctx->async_wait.err; }
@@ -2225,7 +2226,6 @@ int tls_sw_recvmsg(struct sock *sk,/* Wait for all previously submitted records to be decrypted */ ret =tls_decrypt_async_wait (ctx); -__skb_queue_purge (&ctx->async_hold);if (ret) {if (err >=0 || err == -EINPROGRESS )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/309 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 ]
__build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.
Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.
--- net/netfilter/nfnetlink_log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
net/netfilter/nfnetlink_log.c +2 -6
@@ -647,15 +647,11 @@ __build_packet_message(struct nfnl_log_net *log,if (data_len) {struct nlattr *nla; -int size =nla_attr_size (data_len); -if (skb_tailroom (inst->skb) <nla_total_size (data_len)) + nla =nla_reserve (inst->skb,NFULA_PAYLOAD , data_len); +if (!nla) goto nla_put_failure; - nla =skb_put (inst->skb,nla_total_size (data_len)); - nla->nla_type =NFULA_PAYLOAD ; - nla->nla_len = size; -if (skb_copy_bits (skb,0 ,nla_data (nla), data_len))BUG (); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/309 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Wei <[email protected]>
[ Upstream commit 9d3f027327c2fa265f7f85ead41294792c3296ed ]
Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value.
--- net/ipv6/netfilter/ip6t_rt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/netfilter/ip6t_rt.c +4 -0
@@ -157,6 +157,10 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)pr_debug ("unknown flags %X\n" , rtinfo->invflags);return -EINVAL ; } +if (rtinfo->addrnr >IP6T_RT_HOPS ) { +pr_debug ("too many addresses specified\n" ); +return -EINVAL ; + } if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) && (!(rtinfo->flags & IP6T_RT_TYP) || (rtinfo->rt_type != 0) ||
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/309 netfilter: nft_set_rbtree: revisit array resize logic
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit fafdd92b9e30fe057740c5bb5cd4f92ecea9bf26 ]
Chris Arges reports high memory consumption with thousands of containers, this patch revisits the array allocation logic.
For anonymous sets, start by 16 slots (which takes 256 bytes on x86_64). Expand it by x2 until threshold of 512 slots is reached, over that threshold, expand it by x1.5.
For non-anonymous set, start by 1024 slots in the array (which takes 16 Kbytes initially on x86_64). Expand it by x1.5.
Use set->ndeact to subtract deactivated elements when calculating the number of the slots in the array, otherwise the array size array gets increased artifically. Add special case shrink logic to deal with flush set too.
The shrink logic is skipped by anonymous sets.
Use check_add_overflow() to calculate the new array size.
Add a WARN_ON_ONCE check to make sure elements fit into the new array size.
--- net/netfilter/nft_set_rbtree.c | 92 +++++++++++++++++++++++++++------- 1 file changed, 75 insertions(+), 17 deletions(-)
net/netfilter/nft_set_rbtree.c +75 -17
@@ -572,14 +572,12 @@ static struct nft_array *nft_array_alloc(u32 max_intervals)return array; } -#define NFT_ARRAY_EXTRA_SIZE 10240 -/* Similar to nft_rbtree_{u,k}size to hide details to userspace, but consider * packed representation coming from userspace for anonymous sets too. */ static u32 nft_array_elems (const struct nft_set *set) { -u32 nelems =atomic_read (&set->nelems); +u32 nelems =atomic_read (&set->nelems) - set->ndeact;/* Adjacent intervals are represented with a single start element in * anonymous sets, use the current element counter as is.
@@ -595,27 +593,87 @@ static u32 nft_array_elems(const struct nft_set *set)return (nelems /2 ) +2 ; } -static int nft_array_may_resize (const struct nft_set *set) +#define NFT_ARRAY_INITIAL_SIZE 1024 +#define NFT_ARRAY_INITIAL_ANON_SIZE 16 +#define NFT_ARRAY_INITIAL_ANON_THRESH (8192U / sizeof(struct nft_array_interval)) + +static int nft_array_may_resize (const struct nft_set *set,bool flush) { -u32 nelems =nft_array_elems (set), new_max_intervals; +u32 initial_intervals, max_intervals, new_max_intervals, delta; +u32 shrinked_max_intervals, nelems =nft_array_elems (set);struct nft_rbtree *priv =nft_set_priv (set);struct nft_array *array; -if (!priv->array_next) { - array =nft_array_alloc (nelems +NFT_ARRAY_EXTRA_SIZE ); -if (!array) -return -ENOMEM ; +if (nft_set_is_anonymous (set)) + initial_intervals =NFT_ARRAY_INITIAL_ANON_SIZE ; +else + initial_intervals =NFT_ARRAY_INITIAL_SIZE ; + +if (priv->array_next) { + max_intervals = priv->array_next->max_intervals; + new_max_intervals = priv->array_next->max_intervals; + }else { +if (priv->array) { + max_intervals = priv->array->max_intervals; + new_max_intervals = priv->array->max_intervals; + }else { + max_intervals =0 ; + new_max_intervals = initial_intervals; + } + } - priv->array_next = array; +if (nft_set_is_anonymous (set)) + goto maybe_grow; + +if (flush) { +/* Set flush just started, nelems still report elements.*/ + nelems =0 ; + new_max_intervals =NFT_ARRAY_INITIAL_SIZE ; + goto realloc_array; } -if (nelems < priv->array_next->max_intervals) -return 0 ; +if (check_add_overflow (new_max_intervals, new_max_intervals, + &shrinked_max_intervals)) +return -EOVERFLOW ; + + shrinked_max_intervals =DIV_ROUND_UP (shrinked_max_intervals,3 ); - new_max_intervals = priv->array_next->max_intervals +NFT_ARRAY_EXTRA_SIZE ; -if (nft_array_intervals_alloc (priv->array_next, new_max_intervals) <0 ) +if (shrinked_max_intervals >NFT_ARRAY_INITIAL_SIZE && + nelems < shrinked_max_intervals) { + new_max_intervals = shrinked_max_intervals; + goto realloc_array; + } +maybe_grow: +if (nelems > new_max_intervals) { +if (nft_set_is_anonymous (set) && + new_max_intervals <NFT_ARRAY_INITIAL_ANON_THRESH ) { + new_max_intervals <<=1 ; + }else { + delta = new_max_intervals >>1 ; +if (check_add_overflow (new_max_intervals, delta, + &new_max_intervals)) +return -EOVERFLOW ; + } + } + +realloc_array: +if (WARN_ON_ONCE (nelems > new_max_intervals))return -ENOMEM ; +if (priv->array_next) { +if (max_intervals == new_max_intervals) +return 0 ; + +if (nft_array_intervals_alloc (priv->array_next, new_max_intervals) <0 ) +return -ENOMEM ; + }else { + array =nft_array_alloc (new_max_intervals); +if (!array) +return -ENOMEM ; + + priv->array_next = array; + } +return 0 ; }
@@ -630,7 +688,7 @@ static int nft_rbtree_insert(const struct net *net, const struct nft_set *set,nft_rbtree_maybe_reset_start_cookie (priv, tstamp); -if (nft_array_may_resize (set) <0 ) +if (nft_array_may_resize (set, false) <0 )return -ENOMEM ; do {
@@ -741,7 +799,7 @@ nft_rbtree_deactivate(const struct net *net, const struct nft_set *set, nft_rbtree_interval_null(set, this)) priv->start_rbe_cookie =0 ; -if (nft_array_may_resize (set) <0 ) +if (nft_array_may_resize (set, false) <0 )return NULL ;while (parent !=NULL ) {
@@ -811,7 +869,7 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,switch (iter->type) {case NFT_ITER_UPDATE_CLONE : -if (nft_array_may_resize (set) <0 ) { +if (nft_array_may_resize (set, true) <0 ) { iter->err = -ENOMEM ;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/309 netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
Skip expectations that do not reside in this netns.
Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc").
--- net/netfilter/nf_conntrack_expect.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_expect.c +4 -0
@@ -627,11 +627,15 @@ static int exp_seq_show(struct seq_file *s, void *v) {struct nf_conntrack_expect *expect;struct nf_conntrack_helper *helper; +struct net *net =seq_file_net (s);struct hlist_node *n = v;char *delim ="" ; expect = hlist_entry(n, struct nf_conntrack_expect, hnode); +if (!net_eq (nf_ct_exp_net (expect), net)) +return 0 ; +if (expect->timeout.function)seq_printf (s,"%ld " ,timer_pending (&expect->timeout) ? (long )(expect->timeout.expires - jiffies)/HZ :0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/309 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 ]
process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook after walking the SDP media descriptions. However rtp_addr is only initialized inside the media loop when a recognized media type with a non-zero port is found.
If the SDP body contains no m= lines, only inactive media sections (m=audio 0 ...) or only unrecognized media types, rtp_addr is never assigned. Despite that, the function still calls hooks->sdp_session() with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack value as an IP address and rewrite the SDP session owner and connection lines with it.
With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this results in the session-level o= and c= addresses being rewritten to 0.0.0.0 for inactive SDP sessions. Without stack auto-init the rewritten address is whatever happened to be on the stack.
Fix this by pre-initializing rtp_addr from the session-level connection address (caddr) when available, and tracking via a have_rtp_addr flag whether any valid address was established. Skip the sdp_session hook entirely when no valid address exists.
--- net/netfilter/nf_conntrack_sip.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/netfilter/nf_conntrack_sip.c +10 -4
@@ -1040,6 +1040,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,unsigned int port;const struct sdp_media_type *t;int ret =NF_ACCEPT ; +bool have_rtp_addr = false; hooks =rcu_dereference (nf_nat_sip_hooks);
@@ -1056,8 +1057,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, caddr_len =0 ;if (ct_sip_parse_sdp_addr (ct, *dptr, sdpoff, *datalen,SDP_HDR_CONNECTION ,SDP_HDR_MEDIA , - &matchoff, &matchlen, &caddr) >0 ) + &matchoff, &matchlen, &caddr) >0 ) { caddr_len = matchlen; +memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); + have_rtp_addr = true; + } mediaoff = sdpoff;for (i =0 ; i <ARRAY_SIZE (sdp_media_types); ) {
@@ -1091,9 +1095,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, &matchoff, &matchlen, &maddr) > 0) { maddr_len = matchlen;memcpy (&rtp_addr, &maddr,sizeof (rtp_addr)); - } else if (caddr_len) + have_rtp_addr = true; + } else if (caddr_len) {memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); - else { + have_rtp_addr = true; + } else {nf_ct_helper_log (skb, ct,"cannot parse SDP message" );return NF_DROP ; }
@@ -1125,7 +1131,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,/* Update session connection and owner addresses */ hooks =rcu_dereference (nf_nat_sip_hooks); -if (hooks && ct->status &IPS_NAT_MASK ) +if (hooks && ct->status &IPS_NAT_MASK && have_rtp_addr) ret = hooks->sdp_session (skb, protoff, dataoff, dptr, datalen, sdpoff, &rtp_addr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/309 netfilter: ctnetlink: use netlink policy range checks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 ]
Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree.
--- .../uapi/linux/netfilter/nf_conntrack_common.h | 4 ++++ net/netfilter/nf_conntrack_netlink.c | 16 +++++----------- net/netfilter/nf_conntrack_proto_tcp.c | 10 +++------- 3 files changed, 12 insertions(+), 18 deletions(-)
include/uapi/linux/netfilter/nf_conntrack_common.h +4 -0
@@ -159,5 +159,9 @@ enum ip_conntrack_expect_events {#define NF_CT_EXPECT_INACTIVE 0x2#define NF_CT_EXPECT_USERSPACE 0x4 +#ifdef __KERNEL__ +#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \ + NF_CT_EXPECT_USERSPACE) +#endif #endif /* _UAPI_NF_CONNTRACK_COMMON_H */
net/netfilter/nf_conntrack_netlink.c +5 -11
@@ -909,8 +909,8 @@ struct ctnetlink_filter { };static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX +1 ] = { - [CTA_FILTER_ORIG_FLAGS ] = { .type =NLA_U32 }, - [CTA_FILTER_REPLY_FLAGS ] = { .type =NLA_U32 }, + [CTA_FILTER_ORIG_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), + [CTA_FILTER_REPLY_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), }; static int ctnetlink_parse_filter(const struct nlattr *attr,
@@ -924,17 +924,11 @@ static int ctnetlink_parse_filter(const struct nlattr *attr,if (ret)return ret; -if (tb[CTA_FILTER_ORIG_FLAGS ]) { +if (tb[CTA_FILTER_ORIG_FLAGS ]) filter->orig_flags =nla_get_u32 (tb[CTA_FILTER_ORIG_FLAGS ]); -if (filter->orig_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - } -if (tb[CTA_FILTER_REPLY_FLAGS ]) { +if (tb[CTA_FILTER_REPLY_FLAGS ]) filter->reply_flags =nla_get_u32 (tb[CTA_FILTER_REPLY_FLAGS ]); -if (filter->reply_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - }return 0 ; }
@@ -2633,7 +2627,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING, .len = NF_CT_HELPER_NAME_LEN - 1 }, [CTA_EXPECT_ZONE] = { .type = NLA_U16 }, - [CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, + [CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK), [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
net/netfilter/nf_conntrack_proto_tcp.c +3 -7
@@ -1385,9 +1385,9 @@ static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, }static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX +1 ] = { - [CTA_PROTOINFO_TCP_STATE ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_REPLY ] = { .type =NLA_U8 }, + [CTA_PROTOINFO_TCP_STATE ] =NLA_POLICY_MAX (NLA_U8 ,TCP_CONNTRACK_SYN_SENT2 ), + [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), + [CTA_PROTOINFO_TCP_WSCALE_REPLY ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, [CTA_PROTOINFO_TCP_FLAGS_REPLY ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, };
@@ -1414,10 +1414,6 @@ static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)if (err <0 )return err; -if (tb[CTA_PROTOINFO_TCP_STATE ] && -nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]) >=TCP_CONNTRACK_MAX ) -return -EINVAL ; -spin_lock_bh (&ct->lock);if (tb[CTA_PROTOINFO_TCP_STATE ]) ct->proto.tcp.state =nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/309 net: macb: use the current queue number for stats
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Valerio <[email protected]>
[ Upstream commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 ]
There's a potential mismatch between the memory reserved for statistics and the amount of memory written.
gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat.
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027
CPU: [...]
Tainted: [E]=UNSIGNED_MODULE
Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x80/0xf8
print_report+0x384/0x5e0
kasan_report+0xa0/0xf0
kasan_check_range+0xe8/0x190
__asan_memcpy+0x54/0x98
gem_get_ethtool_stats+0x54/0x78 [macb
926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
dev_ethtool+0x1220/0x38c0
dev_ioctl+0x4ac/0xca8
sock_do_ioctl+0x170/0x1d8
sock_ioctl+0x484/0x5d8
__arm64_sys_ioctl+0x12c/0x1b8
invoke_syscall+0xd4/0x258
el0_svc_common.constprop.0+0xb4/0x240
do_el0_svc+0x48/0x68
el0_svc+0x40/0xf8
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
The buggy address belongs to a 1-page vmalloc region starting at
0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff00000a333000 pfn:0xa333
flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================Fix it by making sure the copied size only considers the active number of queues.
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -3258,7 +3258,7 @@ static void gem_get_ethtool_stats(struct net_device *dev,spin_lock_irq (&bp->stats_lock);gem_update_stats (bp);memcpy (data, &bp->ethtool_stats,sizeof (u64) - * (GEM_STATS_LEN +QUEUE_STATS_LEN *MACB_MAX_QUEUES )); + * (GEM_STATS_LEN +QUEUE_STATS_LEN * bp->num_queues));spin_unlock_irq (&bp->stats_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/309 RDMA/efa: Check stored completion CTX command ID with received one
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Nachum <[email protected]>
[ Upstream commit 4b01ec0f133b3fe1038dc538d6bfcbd72462d2f0 ]
In admin command completion, we receive a CQE with the command ID which is constructed from context index and entropy bits from the admin queue producer counter. To try to detect memory corruptions in the received CQE, validate the full command ID of the fetched context with the CQE command ID. If there is a mismatch, complete the CQE with error. Also use LSBs of the admin queue producer counter to better detect entropy mismatch between smaller number of commands.
Stable-dep-of: ef3b06742c8a ("RDMA/efa: Fix use of completion ctx after free")
--- drivers/infiniband/hw/efa/efa_com.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/hw/efa/efa_com.c +4 -2
@@ -3,6 +3,8 @@* Copyright 2018-2025 Amazon.com, Inc. or its affiliates. All rights reserved. */ +#include <linux/log2.h> +#include "efa_com.h" #include "efa_regs_defs.h"
@@ -317,7 +319,7 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu/* cmd_id LSBs are the ctx_id and MSBs are entropy bits from pc */ cmd_id = ctx_id & queue_size_mask; - cmd_id |= aq->sq.pc & ~queue_size_mask; + cmd_id |= aq->sq.pc <<ilog2 (aq->depth); cmd_id &=EFA_ADMIN_AQ_COMMON_DESC_COMMAND_ID_MASK ; cmd->aq_common_descriptor.command_id = cmd_id;
@@ -418,7 +420,7 @@ static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID); comp_ctx =efa_com_get_comp_ctx (aq, cmd_id, false); -if (comp_ctx->status !=EFA_CMD_SUBMITTED ) { +if (comp_ctx->status !=EFA_CMD_SUBMITTED || comp_ctx->cmd_id != cmd_id) {ibdev_err (aq->efa_dev,"Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n" , cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 134/309 RDMA/efa: Improve admin completion context state machine
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Nachum <[email protected]>
[ Upstream commit dab5825491f7b0ea92a09390f39df0a51100f12f ]
Add a new unused state to the admin completion contexts state machine instead of the occupied field. This improves the completion validity check because it now enforce the context to be in submitted state prior to completing it. Also add allocated state as a intermediate state between unused and submitted.
Stable-dep-of: ef3b06742c8a ("RDMA/efa: Fix use of completion ctx after free")
--- drivers/infiniband/hw/efa/efa_com.c | 91 ++++++++++++++++------------- 1 file changed, 50 insertions(+), 41 deletions(-)
drivers/infiniband/hw/efa/efa_com.c +50 -41
@@ -23,6 +23,8 @@#define EFA_CTRL_SUB_MINOR 1enum efa_cmd_status { +EFA_CMD_UNUSED , +EFA_CMD_ALLOCATED ,EFA_CMD_SUBMITTED ,EFA_CMD_COMPLETED , };
@@ -34,7 +36,6 @@ struct efa_comp_ctx {enum efa_cmd_status status;u16 cmd_id;u8 cmd_opcode; -u8 occupied; };static const char *efa_com_cmd_str (u8 cmd)
@@ -243,7 +244,6 @@ static int efa_com_admin_init_aenq(struct efa_com_dev *edev,return 0 ; } -/* ID to be used with efa_com_get_comp_ctx */ static u16 efa_com_alloc_ctx_id (struct efa_com_admin_queue *aq) {u16 ctx_id;
@@ -265,36 +265,47 @@ static void efa_com_dealloc_ctx_id(struct efa_com_admin_queue *aq,spin_unlock (&aq->comp_ctx_lock); } -static inline void efa_com_put_comp_ctx (struct efa_com_admin_queue *aq, -struct efa_comp_ctx *comp_ctx) +static struct efa_comp_ctx *efa_com_alloc_comp_ctx (struct efa_com_admin_queue *aq) { -u16 cmd_id =EFA_GET (&comp_ctx->user_cqe->acq_common_descriptor.command, -EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID ); -u16 ctx_id = cmd_id & (aq->depth -1 ); +struct efa_comp_ctx *comp_ctx; +u16 ctx_id; -ibdev_dbg (aq->efa_dev,"Put completion command_id %#x\n" , cmd_id); - comp_ctx->occupied =0 ; -efa_com_dealloc_ctx_id (aq, ctx_id); + ctx_id =efa_com_alloc_ctx_id (aq); + + comp_ctx = &aq->comp_ctx[ctx_id]; +if (comp_ctx->status !=EFA_CMD_UNUSED ) { +efa_com_dealloc_ctx_id (aq, ctx_id); +ibdev_err_ratelimited (aq->efa_dev, +"Completion context[%u] is used[%u]\n" , + ctx_id, comp_ctx->status); +return NULL ; + } + + comp_ctx->status =EFA_CMD_ALLOCATED ; +ibdev_dbg (aq->efa_dev,"Take completion context[%u]\n" , ctx_id); +return comp_ctx; } -static struct efa_comp_ctx *efa_com_get_comp_ctx (struct efa_com_admin_queue *aq, -u16 cmd_id,bool capture) +static inline u16 efa_com_get_comp_ctx_id (struct efa_com_admin_queue *aq, +struct efa_comp_ctx *comp_ctx) { -u16 ctx_id = cmd_id & (aq->depth -1 ); +return comp_ctx - aq->comp_ctx; +} -if (aq->comp_ctx[ctx_id].occupied && capture) { -ibdev_err_ratelimited ( - aq->efa_dev, -"Completion context for command_id %#x is occupied\n" , - cmd_id); -return NULL ; - } +static inline void efa_com_dealloc_comp_ctx (struct efa_com_admin_queue *aq, +struct efa_comp_ctx *comp_ctx) +{ +u16 ctx_id =efa_com_get_comp_ctx_id (aq, comp_ctx); -if (capture) { - aq->comp_ctx[ctx_id].occupied =1 ; -ibdev_dbg (aq->efa_dev, -"Take completion ctxt for command_id %#x\n" , cmd_id); - } +ibdev_dbg (aq->efa_dev,"Put completion context[%u]\n" , ctx_id); + comp_ctx->status =EFA_CMD_UNUSED ; +efa_com_dealloc_ctx_id (aq, ctx_id); +} + +static inline struct efa_comp_ctx *efa_com_get_comp_ctx_by_cmd_id (struct efa_com_admin_queue *aq, +u16 cmd_id) +{ +u16 ctx_id = cmd_id & (aq->depth -1 );return &aq->comp_ctx[ctx_id]; }
@@ -312,10 +323,13 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queuu16 ctx_id;u16 pi; + comp_ctx =efa_com_alloc_comp_ctx (aq); +if (!comp_ctx) +return ERR_PTR (-EINVAL ); + queue_size_mask = aq->depth -1 ; pi = aq->sq.pc & queue_size_mask; - - ctx_id =efa_com_alloc_ctx_id (aq); + ctx_id =efa_com_get_comp_ctx_id (aq, comp_ctx);/* cmd_id LSBs are the ctx_id and MSBs are entropy bits from pc */ cmd_id = ctx_id & queue_size_mask;
@@ -326,12 +340,6 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queuEFA_SET (&cmd->aq_common_descriptor.flags,EFA_ADMIN_AQ_COMMON_DESC_PHASE , aq->sq.phase); - comp_ctx =efa_com_get_comp_ctx (aq, cmd_id, true); -if (!comp_ctx) { -efa_com_dealloc_ctx_id (aq, ctx_id); -return ERR_PTR (-EINVAL ); - } - comp_ctx->status =EFA_CMD_SUBMITTED ; comp_ctx->comp_size = comp_size_in_bytes; comp_ctx->user_cqe = comp;
@@ -372,9 +380,9 @@ static inline int efa_com_init_comp_ctxt(struct efa_com_admin_queue *aq) }for (i =0 ; i < aq->depth; i++) { - comp_ctx =efa_com_get_comp_ctx (aq, i, false); -if (comp_ctx) -init_completion (&comp_ctx->wait_event); + comp_ctx = &aq->comp_ctx[i]; + comp_ctx->status =EFA_CMD_UNUSED ; +init_completion (&comp_ctx->wait_event); aq->comp_ctx_pool[i] = i; }
@@ -419,11 +427,12 @@ static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq cmd_id =EFA_GET (&cqe->acq_common_descriptor.command,EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID ); - comp_ctx =efa_com_get_comp_ctx (aq, cmd_id, false); + comp_ctx =efa_com_get_comp_ctx_by_cmd_id (aq, cmd_id);if (comp_ctx->status !=EFA_CMD_SUBMITTED || comp_ctx->cmd_id != cmd_id) {ibdev_err (aq->efa_dev, -"Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n" , - cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc); +"Received completion with unexpected command id[%x], status[%d] sq producer[%d], sq consumer[%d], cq consumer[%d]\n" , + cmd_id, comp_ctx->status, aq->sq.pc, aq->sq.cc, + aq->cq.cc);return -EINVAL ; }
@@ -532,7 +541,7 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_c err =efa_com_comp_status_to_errno (comp_ctx->user_cqe->acq_common_descriptor.status); out: -efa_com_put_comp_ctx (aq, comp_ctx); +efa_com_dealloc_comp_ctx (aq, comp_ctx);return err; }
@@ -582,7 +591,7 @@ static int efa_com_wait_and_process_admin_cq_interrupts(struct efa_comp_ctx *com err =efa_com_comp_status_to_errno (comp_ctx->user_cqe->acq_common_descriptor.status); out: -efa_com_put_comp_ctx (aq, comp_ctx); +efa_com_dealloc_comp_ctx (aq, comp_ctx);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 135/309 RDMA/efa: Fix use of completion ctx after free
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonatan Nachum <[email protected]>
[ Upstream commit ef3b06742c8a201d0e83edc9a33a89a4fe3009f8 ]
On admin queue completion handling, if the admin command completed with error we print data from the completion context. The issue is that we already freed the completion context in polling/interrupts handler which means we print data from context in an unknown state (it might be already used again).
Change the admin submission flow so alloc/dealloc of the context will be symmetric and dealloc will be called after any potential use of the context.
--- drivers/infiniband/hw/efa/efa_com.c | 87 +++++++++++++---------------- 1 file changed, 39 insertions(+), 48 deletions(-)
drivers/infiniband/hw/efa/efa_com.c +39 -48
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause /* -* Copyright 2018-2025 Amazon.com, Inc. or its affiliates. All rights reserved. +* Copyright 2018-2026 Amazon.com, Inc. or its affiliates. All rights reserved. */ #include <linux/log2.h>
@@ -310,23 +310,19 @@ static inline struct efa_comp_ctx *efa_com_get_comp_ctx_by_cmd_id(struct efa_comreturn &aq->comp_ctx[ctx_id]; } -static struct efa_comp_ctx *__efa_com_submit_admin_cmd (struct efa_com_admin_queue *aq, -struct efa_admin_aq_entry *cmd, -size_t cmd_size_in_bytes, -struct efa_admin_acq_entry *comp, -size_t comp_size_in_bytes) +static void __efa_com_submit_admin_cmd (struct efa_com_admin_queue *aq, +struct efa_comp_ctx *comp_ctx, +struct efa_admin_aq_entry *cmd, +size_t cmd_size_in_bytes, +struct efa_admin_acq_entry *comp, +size_t comp_size_in_bytes) {struct efa_admin_aq_entry *aqe; -struct efa_comp_ctx *comp_ctx;u16 queue_size_mask;u16 cmd_id;u16 ctx_id;u16 pi; - comp_ctx =efa_com_alloc_comp_ctx (aq); -if (!comp_ctx) -return ERR_PTR (-EINVAL ); - queue_size_mask = aq->depth -1 ; pi = aq->sq.pc & queue_size_mask; ctx_id =efa_com_get_comp_ctx_id (aq, comp_ctx);
@@ -360,8 +356,6 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu/* barrier not needed in case of writel */ writel (aq->sq.pc, aq->sq.db_addr); - -return comp_ctx; }static inline int efa_com_init_comp_ctxt (struct efa_com_admin_queue *aq)
@@ -394,28 +388,25 @@ static inline int efa_com_init_comp_ctxt(struct efa_com_admin_queue *aq)return 0 ; } -static struct efa_comp_ctx *efa_com_submit_admin_cmd (struct efa_com_admin_queue *aq, -struct efa_admin_aq_entry *cmd, -size_t cmd_size_in_bytes, -struct efa_admin_acq_entry *comp, -size_t comp_size_in_bytes) +static int efa_com_submit_admin_cmd (struct efa_com_admin_queue *aq, +struct efa_comp_ctx *comp_ctx, +struct efa_admin_aq_entry *cmd, +size_t cmd_size_in_bytes, +struct efa_admin_acq_entry *comp, +size_t comp_size_in_bytes) { -struct efa_comp_ctx *comp_ctx; -spin_lock (&aq->sq.lock);if (!test_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state)) {ibdev_err_ratelimited (aq->efa_dev,"Admin queue is closed\n" );spin_unlock (&aq->sq.lock); -return ERR_PTR (-ENODEV ); +return -ENODEV ; } - comp_ctx =__efa_com_submit_admin_cmd (aq, cmd, cmd_size_in_bytes, comp, - comp_size_in_bytes); +__efa_com_submit_admin_cmd (aq, comp_ctx, cmd, cmd_size_in_bytes, comp, + comp_size_in_bytes);spin_unlock (&aq->sq.lock); -if (IS_ERR (comp_ctx)) -clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); -return comp_ctx; +return 0 ; } static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq,
@@ -512,7 +503,6 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_c {unsigned long timeout;unsigned long flags; -int err; timeout = jiffies +usecs_to_jiffies (aq->completion_timeout);
@@ -532,24 +522,20 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_catomic64_inc (&aq->stats.no_completion);clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); - err = -ETIME ; - goto out; +return -ETIME ; }msleep (aq->poll_interval); } - err =efa_com_comp_status_to_errno (comp_ctx->user_cqe->acq_common_descriptor.status); -out: -efa_com_dealloc_comp_ctx (aq, comp_ctx); -return err; +return efa_com_comp_status_to_errno ( + comp_ctx->user_cqe->acq_common_descriptor.status); }static int efa_com_wait_and_process_admin_cq_interrupts (struct efa_comp_ctx *comp_ctx,struct efa_com_admin_queue *aq) {unsigned long flags; -int err;wait_for_completion_timeout (&comp_ctx->wait_event,usecs_to_jiffies (aq->completion_timeout));
@@ -585,14 +571,11 @@ static int efa_com_wait_and_process_admin_cq_interrupts(struct efa_comp_ctx *com aq->cq.cc);clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); - err = -ETIME ; - goto out; +return -ETIME ; } - err =efa_com_comp_status_to_errno (comp_ctx->user_cqe->acq_common_descriptor.status); -out: -efa_com_dealloc_comp_ctx (aq, comp_ctx); -return err; +return efa_com_comp_status_to_errno ( + comp_ctx->user_cqe->acq_common_descriptor.status); }/*
@@ -642,30 +625,38 @@ int efa_com_cmd_exec(struct efa_com_admin_queue *aq,ibdev_dbg (aq->efa_dev,"%s (opcode %d)\n" ,efa_com_cmd_str (cmd->aq_common_descriptor.opcode), cmd->aq_common_descriptor.opcode); - comp_ctx =efa_com_submit_admin_cmd (aq, cmd, cmd_size, comp, comp_size); -if (IS_ERR (comp_ctx)) { + + comp_ctx =efa_com_alloc_comp_ctx (aq); +if (!comp_ctx) { +clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); +return -EINVAL ; + } + + err =efa_com_submit_admin_cmd (aq, comp_ctx, cmd, cmd_size, comp, comp_size); +if (err) {ibdev_err_ratelimited ( aq->efa_dev, -"Failed to submit command %s (opcode %u) err %pe\n" , +"Failed to submit command %s (opcode %u) err %d\n" ,efa_com_cmd_str (cmd->aq_common_descriptor.opcode), - cmd->aq_common_descriptor.opcode, comp_ctx); + cmd->aq_common_descriptor.opcode, err); +efa_com_dealloc_comp_ctx (aq, comp_ctx);up (&aq->avail_cmds);atomic64_inc (&aq->stats.cmd_err); -return PTR_ERR (comp_ctx); +return err; } err =efa_com_wait_and_process_admin_cq (comp_ctx, aq);if (err) {ibdev_err_ratelimited ( aq->efa_dev, -"Failed to process command %s (opcode %u) comp_status %d err %d\n" , +"Failed to process command %s (opcode %u) err %d\n" ,efa_com_cmd_str (cmd->aq_common_descriptor.opcode), - cmd->aq_common_descriptor.opcode, - comp_ctx->user_cqe->acq_common_descriptor.status, err); + cmd->aq_common_descriptor.opcode, err);atomic64_inc (&aq->stats.cmd_err); } +efa_com_dealloc_comp_ctx (aq, comp_ctx);up (&aq->avail_cmds);return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 136/309 regmap: Synchronize cache for the page selector
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 ]
If the selector register is represented in each page, its value according to the debugfs is stale because it gets synchronized only after the real page switch happens. Hence the regmap cache initialisation from the HW inherits outdated data in the selector register.
Synchronize cache for the page selector just in time.
Before (offset followed by hexdump, the first byte is selector):
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 01 ff 00 00 ff ff 00 00 00 00 00 00
70: 02 ff 00 00 cf f3 00 00 00 00 00 0c
80: 03 ff 00 00 00 00 00 00 00 00 00 ff
90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00After:
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 02 ff 00 00 ff ff 00 00 00 00 00 00
70: 03 ff 00 00 cf f3 00 00 00 00 00 0c
80: 04 ff 00 00 00 00 00 00 00 00 00 ff
90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00--- drivers/base/regmap/regmap.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap.c +26 -4
@@ -1543,6 +1543,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, unsigned int val_num) {void *orig_work_buf; +unsigned int selector_reg;unsigned int win_offset;unsigned int win_page;bool page_chg;
@@ -1561,10 +1562,31 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,return -EINVAL ; } -/* It is possible to have selector register inside data window. -In that case, selector register is located on every page and -it needs no page switching, when accessed alone. */ +/* +* Calculate the address of the selector register in the corresponding +* data window if it is located on every page. +*/ + page_chg =in_range (range->selector_reg, range->window_start, range->window_len); +if (page_chg) + selector_reg = range->range_min + win_page * range->window_len + + range->selector_reg - range->window_start; + +/* +* It is possible to have selector register inside data window. +* In that case, selector register is located on every page and it +* needs no page switching, when accessed alone. +* +* Nevertheless we should synchronize the cache values for it. +* This can't be properly achieved if the selector register is +* the first and the only one to be read inside the data window. +* That's why we update it in that case as well. +* +* However, we specifically avoid updating it for the default page, +* when it's overlapped with the real data window, to prevent from +* infinite looping. +*/ if (val_num >1 || + (page_chg && selector_reg != range->selector_reg) || range->window_start + win_offset != range->selector_reg) {/* Use separate work_buf during page switching */ orig_work_buf = map->work_buf;
@@ -1573,7 +1595,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, ret =_regmap_update_bits (map, range->selector_reg, range->selector_mask, win_page << range->selector_shift, - &page_chg, false); +NULL , false); map->work_buf = orig_work_buf;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 137/309 ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Rhodes <[email protected]>
[ Upstream commit a6919f2a01f8fbf807b015e5b26aecae7db8117b ]
The initial StarFighter quirk fixed the runtime suspend pop by muting speakers in the shutup callback before power-down. Further hardware validation showed that the speaker path is controlled directly by LINE2 EAPD on NID 0x1b together with GPIO2 for the external amplifier.
Replace the shutup-delay workaround with explicit sequencing of those controls at playback start and stop:
- assert LINE2 EAPD and drive GPIO2 high on PREPARE
- deassert LINE2 EAPD and drive GPIO2 low on CLEANUP
This avoids the runtime suspend pop without a sleep, and also fixes pops around G3 entry and display-manager start that the original workaround did not cover.
--- sound/hda/codecs/realtek/alc269.c | 38 ++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 6 deletions(-)
sound/hda/codecs/realtek/alc269.c +32 -6
@@ -1017,12 +1017,30 @@ static int alc269_resume(struct hda_codec *codec)return 0 ; } -#define STARLABS_STARFIGHTER_SHUTUP_DELAY_MS 30 +#define ALC233_STARFIGHTER_SPK_PIN 0x1b +#define ALC233_STARFIGHTER_GPIO2 0x04 -static void starlabs_starfighter_shutup (struct hda_codec *codec) +static void alc233_starfighter_update_amp (struct hda_codec *codec,bool on) { -if (snd_hda_gen_shutup_speakers (codec)) -msleep (STARLABS_STARFIGHTER_SHUTUP_DELAY_MS ); +snd_hda_codec_write (codec,ALC233_STARFIGHTER_SPK_PIN ,0 , +AC_VERB_SET_EAPD_BTLENABLE , + on ?AC_EAPDBTL_EAPD :0 ); +alc_update_gpio_data (codec,ALC233_STARFIGHTER_GPIO2 , on); +} + +static void alc233_starfighter_pcm_hook (struct hda_pcm_stream *hinfo, +struct hda_codec *codec, +struct snd_pcm_substream *substream, +int action) +{ +switch (action) { +case HDA_GEN_PCM_ACT_PREPARE : +alc233_starfighter_update_amp (codec, true); +break ; +case HDA_GEN_PCM_ACT_CLEANUP : +alc233_starfighter_update_amp (codec, false); +break ; + } } static void alc233_fixup_starlabs_starfighter(struct hda_codec *codec,
@@ -1031,8 +1049,16 @@ static void alc233_fixup_starlabs_starfighter(struct hda_codec *codec, {struct alc_spec *spec = codec->spec; -if (action ==HDA_FIXUP_ACT_PRE_PROBE ) - spec->shutup = starlabs_starfighter_shutup; +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : + spec->gpio_mask |=ALC233_STARFIGHTER_GPIO2 ; + spec->gpio_dir |=ALC233_STARFIGHTER_GPIO2 ; + spec->gpio_data &= ~ALC233_STARFIGHTER_GPIO2 ; +break ; +case HDA_FIXUP_ACT_PROBE : + spec->gen.pcm_playback_hook = alc233_starfighter_pcm_hook; +break ; + } } static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 138/309 RDMA/rw: Fall back to direct SGE on MR pool exhaustion
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 ]
When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs() produces no coalescing: each scatterlist page maps 1:1 to a DMA entry, so sgt.nents equals the raw page count. A 1 MB transfer yields 256 DMA entries. If that count exceeds the device's max_sgl_rd threshold (an optimization hint from mlx5 firmware), rdma_rw_io_needs_mr() steers the operation into the MR registration path. Each such operation consumes one or more MRs from a pool sized at max_rdma_ctxs -- roughly one MR per concurrent context. Under write-intensive workloads that issue many concurrent RDMA READs, the pool is rapidly exhausted, ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns -EAGAIN. Upper layer protocols treat this as a fatal DMA mapping failure and tear down the connection.
The max_sgl_rd check is a performance optimization, not a correctness requirement: the device can handle large SGE counts via direct posting, just less efficiently than with MR registration. When the MR pool cannot satisfy a request, falling back to the direct SGE (map_wrs) path avoids the connection reset while preserving the MR optimization for the common case where pool resources are available.
Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from rdma_rw_init_mr_wrs() triggers direct SGE posting instead of propagating the error. iWARP devices, which mandate MR registration for RDMA READs, and force_mr debug mode continue to treat -EAGAIN as terminal.
--- drivers/infiniband/core/rw.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/infiniband/core/rw.c +18 -3
@@ -326,14 +326,29 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx *ctx, struct ib_qp *qp, u32 port_num,if (rdma_rw_io_needs_mr (qp->device, port_num, dir, sg_cnt)) { ret =rdma_rw_init_mr_wrs (ctx, qp, port_num, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else if (sg_cnt >1 ) { +/* +* If MR init succeeded or failed for a reason other +* than pool exhaustion, that result is final. +* +* Pool exhaustion (-EAGAIN) from the max_sgl_rd +* optimization is recoverable: fall back to +* direct SGE posting. iWARP and force_mr require +* MRs unconditionally, so -EAGAIN is terminal. +*/ +if (ret != -EAGAIN || +rdma_protocol_iwarp (qp->device, port_num) || +unlikely (rdma_rw_force_mr)) + goto out; + } + +if (sg_cnt >1 ) ret =rdma_rw_init_map_wrs (ctx, qp, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else { +else ret =rdma_rw_init_single_wr (ctx, qp, sg, sg_offset, remote_addr, rkey, dir); - } +out:if (ret <0 ) goto out_unmap_sg;return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 139/309 RDMA/efa: Fix possible deadlock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <[email protected]>
[ Upstream commit 0f2055db7b630559870afb40fc84490816ab8ec5 ]
In the error path for efa_com_alloc_comp_ctx() the semaphore assigned to &aq->avail_cmds is not released.
Detected by Smatch:drivers/infiniband/hw/efa/efa_com.c:662 efa_com_cmd_exec() warn:
inconsistent returns '&aq->avail_cmds'
Add release for &aq->avail_cmds in efa_com_alloc_comp_ctx() error path.
--- drivers/infiniband/hw/efa/efa_com.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/efa/efa_com.c +1 -0
@@ -629,6 +629,7 @@ int efa_com_cmd_exec(struct efa_com_admin_queue *aq, comp_ctx =efa_com_alloc_comp_ctx (aq);if (!comp_ctx) {clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); +up (&aq->avail_cmds);return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 140/309 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen from SKIP_IFACE_SETUP
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <[email protected]>
[ Upstream commit 8780f561f6717dec52351251881bff79e960eb46 ]
The Focusrite Scarlett 2i2 1st Gen (1235:8006) produces distorted/silent audio when QUIRK_FLAG_SKIP_IFACE_SETUP is active, as that flag causes the feedback format to be detected as 17.15 instead of 16.16.
Add a DEVICE_FLG entry for this device before the Focusrite VENDOR_FLG entry so that it gets no quirk flags, overriding the vendor-wide SKIP_IFACE_SETUP. This device doesn't have the internal mixer, Air, or Safe modes that the quirk was designed to protect.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -2422,6 +2422,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_CTL_MSG_DELAY | QUIRK_FLAG_IFACE_DELAY),VENDOR_FLG (0x07fd ,/* MOTU */ QUIRK_FLAG_VALIDATE_RATES ), +DEVICE_FLG (0x1235 ,0x8006 ,0 ),/* Focusrite Scarlett 2i2 1st Gen */ VENDOR_FLG (0x1235 ,/* Focusrite Novation */ QUIRK_FLAG_SKIP_IFACE_SETUP ), VENDOR_FLG(0x1511, /* AURALiC */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 141/309 RDMA/irdma: Initialize free_qp completion before using it
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 11a95521fb93c91e2d4ef9d53dc80ef0a755549b ]
In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp completion, which is not initialized yet. Fix this by initializing the completion before the ib_copy_to_udata call.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -1106,6 +1106,7 @@ static int irdma_create_qp(struct ib_qp *ibqp,spin_lock_init (&iwqp->sc_qp.pfpdu.lock); iwqp->sig_all = init_attr->sq_sig_type ==IB_SIGNAL_ALL_WR ; rf->qp_table[qp_num] = iwqp; +init_completion (&iwqp->free_qp);if (udata) {/* GEN_1 legacy support with libi40iw does not have expanded uresp struct */
@@ -1130,7 +1131,6 @@ static int irdma_create_qp(struct ib_qp *ibqp, } } -init_completion (&iwqp->free_qp);return 0 ; error:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 142/309 RDMA/irdma: Update ibqp state to error if QP is already in error state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 8c1f19a2225cf37b3f8ab0b5a8a5322291cda620 ]
In irdma_modify_qp() update ibqp state to error if the irdma QP is already in error state, otherwise the ibqp state which is visible to the consumer app remains stale.
--- drivers/infiniband/hw/irdma/verbs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -1541,6 +1541,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
@@ -1746,6 +1747,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 143/309 RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 5e8f0239731a83753473b7aa91bda67bbdff5053 ]
Remove a NOP wait_event() in irdma_modify_qp_roce() which is relevant for iWARP and likely a copy and paste artifact for RoCEv2. The wait event is for sending a reset on a TCP connection, after the reset has been requested in irdma_modify_qp(), which occurs only in iWarp mode.
--- drivers/infiniband/hw/irdma/verbs.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +0 -2
@@ -1463,8 +1463,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, ctx_info->remote_atomics_en = true; } -wait_event (iwqp->mod_qp_waitq, !atomic_read (&iwqp->hw_mod_qp_pend)); - ibdev_dbg(&iwdev->ibdev, "VERBS: caller: %pS qp_id=%d to_ibqpstate=%d ibqpstate=%d irdma_qpstate=%d attr_mask=0x%x\n", __builtin_return_address(0), ibqp->qp_num, attr->qp_state,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 144/309 RDMA/irdma: Clean up unnecessary dereference of event->cm_node
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Barrera <[email protected]>
[ Upstream commit b415399c9a024d574b65479636f0d4eb625b9abd ]
The cm_node is available and the usage of cm_node and event->cm_node seems arbitrary. Clean up unnecessary dereference of event->cm_node.
--- drivers/infiniband/hw/irdma/cm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/irdma/cm.c +6 -6
@@ -4239,21 +4239,21 @@ static void irdma_cm_event_handler(struct work_struct *work)irdma_cm_event_reset (event);break ;case IRDMA_CM_EVENT_CONNECTED : -if (!event->cm_node->cm_id || - event->cm_node->state !=IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state !=IRDMA_CM_STATE_OFFLOADED )break ;irdma_cm_event_connected (event);break ;case IRDMA_CM_EVENT_MPA_REJECT : -if (!event->cm_node->cm_id || +if (!cm_node->cm_id || cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_send_cm_event (cm_node, cm_node->cm_id,IW_CM_EVENT_CONNECT_REPLY , -ECONNREFUSED );break ;case IRDMA_CM_EVENT_ABORTED : -if (!event->cm_node->cm_id || - event->cm_node->state ==IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_event_connect_error (event);break ;
@@ -4263,7 +4263,7 @@ static void irdma_cm_event_handler(struct work_struct *work)break ; } -irdma_rem_ref_cm_node (event->cm_node); +irdma_rem_ref_cm_node (cm_node);kfree (event); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 145/309 RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit c45c6ebd693b944f1ffe429fdfb6cc1674c237be ]
During reset, irdma_modify_qp() to error should be called to disconnect the QP. Without this fix, if not preceded by irdma_modify_qp() to error, the API call irdma_destroy_qp() gets stuck waiting for the QP refcount to go to zero, because the cm_node associated with this QP isn't disconnected.
--- drivers/infiniband/hw/irdma/utils.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/utils.c +0 -2
@@ -2325,8 +2325,6 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp)struct irdma_qp *qp = sc_qp->qp_uk.back_qp;struct ib_qp_attr attr; -if (qp->iwdev->rf->reset) -return ; attr.qp_state =IB_QPS_ERR ;if (rdma_protocol_roce (qp->ibqp.device,1 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/309 RDMA/irdma: Fix deadlock during netdev reset with active connections
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Samal <[email protected]>
[ Upstream commit 6f52370970ac07d352a7af4089e55e0e6425f827 ]
Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.
--- drivers/infiniband/hw/irdma/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +2 -1
@@ -558,7 +558,8 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) }irdma_qp_rem_ref (&iwqp->ibqp); -wait_for_completion (&iwqp->free_qp); +if (!iwdev->rf->reset) +wait_for_completion (&iwqp->free_qp);irdma_free_lsmm_rsrc (iwqp);irdma_cqp_qp_destroy_cmd (&iwdev->rf->sc_dev, &iwqp->sc_qp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 147/309 RDMA/irdma: Return EINVAL for invalid arp index error
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 7221f581eefa79ead06e171044f393fb7ee22f87 ]
When rdma_connect() fails due to an invalid arp index, user space rdma core reports ENOMEM which is confusing. Modify irdma_make_cm_node() to return the correct error code.
--- drivers/infiniband/hw/irdma/cm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/infiniband/hw/irdma/cm.c +10 -7
@@ -2241,11 +2241,12 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev,int oldarpindex;int arpindex;struct net_device *netdev = iwdev->netdev; +int ret;/* create an hte and cm_node for this instance */ cm_node =kzalloc (sizeof (*cm_node),GFP_ATOMIC );if (!cm_node) -return NULL ; +return ERR_PTR (-ENOMEM );/* set our node specific transport info */ cm_node->ipv4 = cm_info->ipv4;
@@ -2348,8 +2349,10 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, arpindex = -EINVAL ; } -if (arpindex <0 ) +if (arpindex <0 ) { + ret = -EINVAL ; goto err; + }ether_addr_copy (cm_node->rem_mac, iwdev->rf->arp_table[arpindex].mac_addr);
@@ -2360,7 +2363,7 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, err:kfree (cm_node); -return NULL ; +return ERR_PTR (ret); }static void irdma_destroy_connection (struct irdma_cm_node *cm_node)
@@ -3021,8 +3024,8 @@ static int irdma_create_cm_node(struct irdma_cm_core *cm_core,/* create a CM connection node */ cm_node =irdma_make_cm_node (cm_core, iwdev, cm_info,NULL ); -if (!cm_node) -return -ENOMEM ; +if (IS_ERR (cm_node)) +return PTR_ERR (cm_node);/* set our node side to client (active) side */ cm_node->tcp_cntxt.client =1 ;
@@ -3219,9 +3222,9 @@ void irdma_receive_ilq(struct irdma_sc_vsi *vsi, struct irdma_puda_buf *rbuf) cm_info.cm_id = listener->cm_id; cm_node =irdma_make_cm_node (cm_core, iwdev, &cm_info, listener); -if (!cm_node) { +if (IS_ERR (cm_node)) {ibdev_dbg (&cm_core->iwdev->ibdev, -"CM: allocate node failed\n" ); +"CM: allocate node failed ret=%ld\n" ,PTR_ERR (cm_node));refcount_dec (&listener->refcnt);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 148/309 RDMA/irdma: Harden depth calculation functions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiraz Saleem <[email protected]>
[ Upstream commit e37afcb56ae070477741fe2d6e61fc0c542cce2d ]
An issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size. This can cause integer overflow and truncation of SQ/RQ/SRQ depth returning a success when it should have failed.
Harden the functions to do all depth calculations and boundary checking in u64 sizes.
--- drivers/infiniband/hw/irdma/uk.c | 39 ++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 17 deletions(-)
drivers/infiniband/hw/irdma/uk.c +22 -17
@@ -1410,7 +1410,7 @@ int irdma_uk_cq_poll_cmpl(struct irdma_cq_uk *cq,* irdma_round_up_wq - return round up qp wq depth * @wqdepth: wq depth in quanta to round up */ -static int irdma_round_up_wq (u32 wqdepth) +static u64 irdma_round_up_wq (u64 wqdepth) {int scount =1 ;
@@ -1463,15 +1463,16 @@ void irdma_get_wqe_shift(struct irdma_uk_attrs *uk_attrs, u32 sge,int irdma_get_sqdepth (struct irdma_uk_attrs *uk_attrs,u32 sq_size,u8 shift,u32 *sqdepth) { -u32 min_size = (u32 )uk_attrs->min_hw_wq_size << shift; +u32 min_hw_quanta = (u32 )uk_attrs->min_hw_wq_size << shift; +u64 hw_quanta = +irdma_round_up_wq (((u64 )sq_size << shift) +IRDMA_SQ_RSVD ); - *sqdepth =irdma_round_up_wq ((sq_size << shift) +IRDMA_SQ_RSVD ); - -if (*sqdepth < min_size) - *sqdepth = min_size; -else if (*sqdepth > uk_attrs->max_hw_wq_quanta) +if (hw_quanta < min_hw_quanta) + hw_quanta = min_hw_quanta; +else if (hw_quanta > uk_attrs->max_hw_wq_quanta)return -EINVAL ; + *sqdepth = hw_quanta;return 0 ; }
@@ -1485,15 +1486,16 @@ int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift,int irdma_get_rqdepth (struct irdma_uk_attrs *uk_attrs,u32 rq_size,u8 shift,u32 *rqdepth) { -u32 min_size = (u32 )uk_attrs->min_hw_wq_size << shift; - - *rqdepth =irdma_round_up_wq ((rq_size << shift) +IRDMA_RQ_RSVD ); +u32 min_hw_quanta = (u32 )uk_attrs->min_hw_wq_size << shift; +u64 hw_quanta = +irdma_round_up_wq (((u64 )rq_size << shift) +IRDMA_RQ_RSVD ); -if (*rqdepth < min_size) - *rqdepth = min_size; -else if (*rqdepth > uk_attrs->max_hw_rq_quanta) +if (hw_quanta < min_hw_quanta) + hw_quanta = min_hw_quanta; +else if (hw_quanta > uk_attrs->max_hw_rq_quanta)return -EINVAL ; + *rqdepth = hw_quanta;return 0 ; }
@@ -1507,13 +1509,16 @@ int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift,int irdma_get_srqdepth (struct irdma_uk_attrs *uk_attrs,u32 srq_size,u8 shift,u32 *srqdepth) { - *srqdepth =irdma_round_up_wq ((srq_size << shift) +IRDMA_RQ_RSVD ); +u32 min_hw_quanta = (u32 )uk_attrs->min_hw_wq_size << shift; +u64 hw_quanta = +irdma_round_up_wq (((u64 )srq_size << shift) +IRDMA_RQ_RSVD ); -if (*srqdepth < ((u32 )uk_attrs->min_hw_wq_size << shift)) - *srqdepth = uk_attrs->min_hw_wq_size << shift; -else if (*srqdepth > uk_attrs->max_hw_srq_quanta) +if (hw_quanta < min_hw_quanta) + hw_quanta = min_hw_quanta; +else if (hw_quanta > uk_attrs->max_hw_srq_quanta)return -EINVAL ; + *srqdepth = hw_quanta;return 0 ; }
Signature · 1 line
2.53.0