6.1.168-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.168-rc1 review
This is the start of the stable review cycle for the 6.1.168 release. There are 312 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 10 Apr 2026 17:58:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.168-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.168-rc1
Rafael J. Wysocki <[email protected]>
ACPI: EC: Evaluate orphan _REG under EC device
Nathan Chancellor <[email protected]>
ext4: fix unused iterator variable warnings
Theodore Ts'o <[email protected]>
ext4: fix lost error code reporting in __ext4_fill_super()
Bart Van Assche <[email protected]>
block: Fix the blk_mq_destroy_queue() documentation
Luiz Augusto von Dentz <[email protected]>
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check removing signal+subflow endp
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: implicit: stop transfer after last check
Andreas Gruenbacher <[email protected]>
gfs2: Fix unlikely race in gdlm_put_lock
Russell King (Oracle) <[email protected]>
net: phy: fix phy_uses_state_machine()
Vladimir Oltean <[email protected]>
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
Vladimir Oltean <[email protected]>
net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
Yuto Ohnuki <[email protected]>
xfs: save ailp before dropping the AIL lock in push callbacks
Yuto Ohnuki <[email protected]>
xfs: avoid dereferencing log items after push callbacks
Denis Arefev <[email protected]>
erofs: Fix the slab-out-of-bounds in drop_buffers()
Gao Xiang <[email protected]>
erofs: fix PSI memstall accounting
Gao Xiang <[email protected]>
erofs: handle overlapped pclusters out of crafted images properly
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
Pratyush Yadav <[email protected]>
mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
Guangshuo Li <[email protected]>
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
Liao Chang <[email protected]>
cpufreq: governor: Free dbs_data directly when gov->init() fails
Theodore Ts'o <[email protected]>
ext4: handle wraparound when searching for blocks for indirect mapped blocks
Li Xiasong <[email protected]>
MPTCP: fix lock class name family in pm_nl_create_listen_socket
Li Chen <[email protected]>
ext4: publish jinode after initialization
Zqiang <[email protected]>
ext4: fix the might_sleep() warnings in kvfree()
Jason Yan <[email protected]>
ext4: factor out ext4_flex_groups_free()
Jason Yan <[email protected]>
ext4: use ext4_group_desc_free() in ext4_put_super() to save some duplicated code
Jason Yan <[email protected]>
ext4: factor out ext4_percpu_param_init() and ext4_percpu_param_destroy()
Sanman Pradhan <[email protected]>
hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
Eddie James <[email protected]>
hwmon: (pmbus/core) Add lock and unlock functions
Luo Haiyang <[email protected]>
tracing: Fix potential deadlock in cpu hotplug with osnoise
Namjae Jeon <[email protected]>
ksmbd: fix potencial OOB in get_file_all_info() for compound requests
Werner Kasselman <[email protected]>
ksmbd: fix memory leaks and NULL deref in smb2_lock()
Nikunj A Dadhania <[email protected]>
x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
Jinjiang Tu <[email protected]>
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
Josef Bacik <[email protected]>
scsi: target: tcm_loop: Drain commands in target_reset handler
Kevin Hao <[email protected]>
net: macb: Move devm_{free,request}_irq() out of spin lock area
Willem de Bruijn <[email protected]>
net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
Sean Christopherson <[email protected]>
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
Zheng Qixing <[email protected]>
block: fix resource leak in blk_register_queue() error path
Jiayuan Chen <[email protected]>
ext4: fix use-after-free in update_super_work when racing with umount
Alexander Popov <[email protected]>
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
Taegu Ha <[email protected]>
usb: gadget: f_uac1_legacy: validate control request size
Kuen-Han Tsai <[email protected]>
usb: gadget: f_rndis: Protect RNDIS options with mutex
Kuen-Han Tsai <[email protected]>
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
Jimmy Hu <[email protected]>
usb: gadget: uvc: fix NULL pointer dereference during unbind race
Vladimir Oltean <[email protected]>
net: enetc: fix PF !of_device_is_available() teardown path
Josh Law <[email protected]>
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
Ming Lei <[email protected]>
nvme: fix admin queue leak on controller reset
Keith Busch <[email protected]>
nvme: fix admin request_queue lifetime
Christoph Hellwig <[email protected]>
nvme-pci: put the admin queue in nvme_dev_remove_admin
Christoph Hellwig <[email protected]>
nvme-pci: remove an extra queue reference
Christoph Hellwig <[email protected]>
blk-mq: move the call to blk_put_queue out of blk_mq_destroy_queue
Heyne, Maximilian <[email protected]>
Revert "nvme: fix admin request_queue lifetime"
Filipe Manana <[email protected]>
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
Qu Wenruo <[email protected]>
btrfs: fix the qgroup data free range for inline data extents
Sebastian Urban <[email protected]>
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
Alan Stern <[email protected]>
USB: dummy-hcd: Fix interrupt synchronization error
Alan Stern <[email protected]>
USB: dummy-hcd: Fix locking/synchronization error
Konrad Dybcio <[email protected]>
thunderbolt: Fix property read in nhi_wake_supported()
Yufan Chen <[email protected]>
net: ftgmac100: fix ring allocation unwind on open failure
Yang Yang <[email protected]>
vxlan: validate ND option lengths in vxlan_na_create
Yifan Wu <[email protected]>
netfilter: ipset: drop logically empty buckets in mtype_del
Ian Abbott <[email protected]>
comedi: me4000: Fix potential overrun of firmware buffer
Ian Abbott <[email protected]>
comedi: me_daq: Fix potential overrun of firmware buffer
Ian Abbott <[email protected]>
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
Ian Abbott <[email protected]>
comedi: Reinit dev->spinlock between attachments to low-level drivers
Deepanshu Kartikey <[email protected]>
comedi: dt2815: add hardware detection to prevent crash
Oliver Neukum <[email protected]>
cdc-acm: new quirk for EPSON HMD
Yang Yang <[email protected]>
bridge: br_nd_send: validate ND option lengths
Sasha Levin <[email protected]>
Revert "ext4: make ext4_es_remove_extent() return void"
Sasha Levin <[email protected]>
Revert "ext4: get rid of ppath in ext4_find_extent()"
Sasha Levin <[email protected]>
Revert "ext4: get rid of ppath in ext4_ext_create_new_leaf()"
Sasha Levin <[email protected]>
Revert "ext4: get rid of ppath in ext4_ext_insert_extent()"
Sasha Levin <[email protected]>
Revert "ext4: get rid of ppath in ext4_split_extent_at()"
Sasha Levin <[email protected]>
Revert "ext4: subdivide EXT4_EXT_DATA_VALID1"
Sasha Levin <[email protected]>
Revert "ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1"
Sasha Levin <[email protected]>
Revert "ext4: drop extent cache after doing PARTIAL_VALID1 zeroout"
Sasha Levin <[email protected]>
Revert "ext4: drop extent cache when splitting extent fails"
Sasha Levin <[email protected]>
Revert "ext4: avoid infinite loops caused by residual data"
Yongchao Wu <[email protected]>
usb: cdns3: gadget: fix state inconsistency on gadget init failure
Yongchao Wu <[email protected]>
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
Juno Choi <[email protected]>
usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
Justin Chen <[email protected]>
usb: ehci-brcm: fix sleep during atomic
Heitor Alves de Siqueira <[email protected]>
usb: usbtmc: Flush anchored URBs in usbtmc_release
Guangshuo Li <[email protected]>
usb: ulpi: fix double free in ulpi_register_interface() error path
Miao Li <[email protected]>
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Move iio_device_register() to correct location
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix irq resource leak
Ethan Tidmore <[email protected]>
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
Josh Poimboeuf <[email protected]>
iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
David Lechner <[email protected]>
iio: light: vcnl4035: fix scan buffer on big-endian
Antoniu Miclaus <[email protected]>
iio: dac: ad5770r: fix error return in ad5770r_read_raw()
Valek Andrej <[email protected]>
iio: accel: fix ADXL355 temperature signature value
Zoltan Illes <[email protected]>
Input: xpad - add support for Razer Wolverine V3 Pro
Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
Bart Van Assche <[email protected]>
Input: synaptics-rmi4 - fix a locking bug in an error path
David Lechner <[email protected]>
iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
JP Hein <[email protected]>
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
Wanquan Zhong <[email protected]>
USB: serial: option: add support for Rolling Wireless RW135R-GL
Frej Drejhammar <[email protected]>
USB: serial: io_edgeport: add support for Blackbox IC135A
Thomas Zimmermann <[email protected]>
drm/ast: dp501: Fix initialization of SCU2C
David Lechner <[email protected]>
iio: adc: ti-adc161s626: fix buffer read on big-endian
Stefan Wiehler <[email protected]>
mips: mm: Allocate tlb_vpn array atomically
Sanman Pradhan <[email protected]>
hwmon: (occ) Fix division by zero in occ_show_power_1()
Maciej W. Rozycki <[email protected]>
MIPS: Fix the GCC version check for `__multi3' workaround
Oleh Konko <[email protected]>
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Oleh Konko <[email protected]>
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
Takashi Iwai <[email protected]>
ALSA: ctxfi: Fix missing SPDIFI1 index handling
Berk Cem Goksel <[email protected]>
ALSA: caiaq: fix stack out-of-bounds read in init_card
Ernestas Kulik <[email protected]>
USB: serial: option: add MeiG Smart SRM825WN
Alexey Velichayshiy <[email protected]>
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
Yasuaki Torimaru <[email protected]>
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
Greg Kroah-Hartman <[email protected]>
drm/ioc32: stop speculation on the drm_compat_ioctl path
Paul Walmsley <[email protected]>
riscv: kgdb: fix several debug register assignment bugs
Sanman Pradhan <[email protected]>
hwmon: (occ) Fix missing newline in occ_show_extended()
Sanman Pradhan <[email protected]>
hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
Jamie Gibbons <[email protected]>
dt-bindings: gpio: fix microchip #interrupt-cells
Sanman Pradhan <[email protected]>
hwmon: (pxe1610) Check return value of page-select write in probe
David Lechner <[email protected]>
iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
Qi Tang <[email protected]>
bpf: reject direct access to nullable PTR_TO_BUF pointers
Eric Dumazet <[email protected]>
ipv6: avoid overflows in ip6_datagram_send_ctl()
Luka Gejak <[email protected]>
net: hsr: fix VLAN add unwind on slave errors
Xiang Mei <[email protected]>
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
Xiang Mei <[email protected]>
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
Martin Schiller <[email protected]>
net/x25: Fix overflow when accumulating packets
Martin Schiller <[email protected]>
net/x25: Fix potential double free of skb
Saeed Mahameed <[email protected]>
net/mlx5: Avoid "No data available" when FW version queries fail
Shay Drory <[email protected]>
net/mlx5: lag: Check for LAG device before creating debugfs
Fedor Pchelkin <[email protected]>
net: macb: properly unregister fixed rate clocks
Fedor Pchelkin <[email protected]>
net: macb: fix clk handling on PCI glue driver removal
Weiming Shi <[email protected]>
rds: ib: reject FRMR registration before IB connection is established
Keenan Dong <[email protected]>
Bluetooth: MGMT: validate mesh send advertising payload length
Pauli Virtanen <[email protected]>
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Keenan Dong <[email protected]>
Bluetooth: MGMT: validate LTK enc_size on load
Cen Zhang <[email protected]>
Bluetooth: SCO: fix race conditions in sco_sock_connect()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject immediate NF_QUEUE verdict
Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: ignore explicit helper on new expectations
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: store netns and zone in expectation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: use expect->helper
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: honor expectation helper field
Christophe JAILLET <[email protected]>
netfilter: Reorder fields in 'struct nf_conntrack_expect'
Qi Tang <[email protected]>
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
Qi Tang <[email protected]>
netfilter: nf_conntrack_helper: pass helper to expect cleanup
Florian Westphal <[email protected]>
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
Florian Westphal <[email protected]>
netfilter: x_tables: ensure names are nul-terminated
Florian Westphal <[email protected]>
netfilter: nfnetlink_log: account for netlink header size
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: strictly check for maximum number of actions
Zhengchuan Liang <[email protected]>
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
Alexei Starovoitov <[email protected]>
bpf: Fix regsafe() for pointers to packet
Suraj Gupta <[email protected]>
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
Pengpeng Hou <[email protected]>
NFC: pn533: bound the UART receive buffer
Yochai Eisenrich <[email protected]>
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
Paolo Abeni <[email protected]>
ipv6: prevent possible UaF in addrconf_permanent_addr()
Jihed Chaibi <[email protected]>
ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
Alexander Sverdlin <[email protected]>
ASoC: ep93xx: i2s: move enable call to startup callback
Xiang Mei <[email protected]>
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
Yang Yang <[email protected]>
bridge: br_nd_send: linearize skb before parsing ND options
Eric Dumazet <[email protected]>
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
Eric Dumazet <[email protected]>
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
Thomas Bogendoerfer <[email protected]>
tg3: Fix race for querying speed/duplex
Pengpeng Hou <[email protected]>
net/ipv6: ioam6: prevent schema length wraparound in trace fill
Yochai Eisenrich <[email protected]>
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
Jiayuan Chen <[email protected]>
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
Norbert Szetei <[email protected]>
crypto: af-alg - fix NULL pointer dereference in scatterwalk
Frank Li <[email protected]>
dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
ZhengYuan Huang <[email protected]>
btrfs: reject root items with drop_progress and zero drop_level
Mikko Perttunen <[email protected]>
i2c: tegra: Don't mark devices with pins as IRQ safe
Lee Jones <[email protected]>
HID: multitouch: Check to ensure report responses match the request
Josh Poimboeuf <[email protected]>
objtool: Fix Clang jump table detection
Paul SAGE <[email protected]>
tg3: replace placeholder MAC address with device property
Johannes Thumshirn <[email protected]>
btrfs: don't take device_list_mutex when querying zone info
Deepanshu Kartikey <[email protected]>
atm: lec: fix use-after-free in sock_def_readable()
Benoît Sevens <[email protected]>
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.
Davidlohr Bueso <[email protected]>
futex: Clear stale exiting pointer in futex_lock_pi() retry path
Tomi Valkeinen <[email protected]>
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
Radhey Shyam Pandey <[email protected]>
dmaengine: xilinx_dma: Program interrupt delay timeout
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix freeing the allocated ida too late
Christophe JAILLET <[email protected]>
dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
Filipe Manana <[email protected]>
btrfs: fix lost error when running device stats on multiple devices fs
Shin'ichiro Kawasaki <[email protected]>
btrfs: fix leak of kobject name for sub-group space_info
Mark Harmstone <[email protected]>
btrfs: fix super block offset in error message in btrfs_validate_super()
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
Marek Vasut <[email protected]>
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
Felix Gu <[email protected]>
phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix memory leak when a wq is reset
Vinicius Costa Gomes <[email protected]>
dmaengine: idxd: Fix not releasing workqueue on .release()
Hari Bathini <[email protected]>
powerpc64/bpf: do not increment tailcall count when prog is NULL
Markus Niebel <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
Theodore Ts'o <[email protected]>
ext4: always drain queued discard work in ext4_mb_release()
Baokun Li <[email protected]>
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
Helen Koike <[email protected]>
ext4: reject mount if bigalloc with s_first_data_block != 0
Ye Bin <[email protected]>
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
Edward Adam Davis <[email protected]>
ext4: avoid infinite loops caused by residual data
Jan Kara <[email protected]>
ext4: make recently_deleted() properly work with lazy itable initialization
Deepanshu Kartikey <[email protected]>
ext4: convert inline data to extents when truncate exceeds inline size
Simon Weber <[email protected]>
ext4: fix journal credit check when setting fscrypt context
Long Li <[email protected]>
xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
Yuto Ohnuki <[email protected]>
xfs: stop reclaim before pushing AIL during unmount
Huacai Chen <[email protected]>
LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
Claudiu Beznea <[email protected]>
dmaengine: sh: rz-dmac: Protect the driver specific lists
Jassi Brar <[email protected]>
irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
Milos Nikic <[email protected]>
jbd2: gracefully abort on checkpointing state corruptions
Kevin Hao <[email protected]>
net: macb: Use dev_consume_skb_any() to free TX SKBs
Greg Kroah-Hartman <[email protected]>
scsi: ses: Handle positive SCSI error from ses_recv_diag()
Tyllis Xu <[email protected]>
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
Zhan Xusheng <[email protected]>
alarmtimer: Fix argument order in alarm_timer_forward()
Jiucheng Xu <[email protected]>
erofs: add GFP_NOIO in the bio completion if needed
xietangxin <[email protected]>
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Yuchan Nam <[email protected]>
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
Sanman Pradhan <[email protected]>
hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
Marc Zyngier <[email protected]>
KVM: arm64: Discard PC update state on vcpu reset
Viresh Kumar <[email protected]>
cpufreq: conservative: Reset requested_freq on limits change
Ali Norouzi <[email protected]>
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
Hyunwoo Kim <[email protected]>
ksmbd: do not expire session on binding failure
Namjae Jeon <[email protected]>
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
Vasily Gorbik <[email protected]>
s390/barrier: Make array_index_mask_nospec() __always_inline
Greg Kroah-Hartman <[email protected]>
s390/syscalls: Add spectre boundary for syscall dispatch table
Marc Kleine-Budde <[email protected]>
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix clock leak on PLL lock failure
Jihed Chaibi <[email protected]>
ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
Marc Buerg <[email protected]>
sysctl: fix uninitialized variable in proc_do_large_bitmap
Sanman Pradhan <[email protected]>
hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
Weiming Shi <[email protected]>
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Install address space handler at the namespace root
Hans de Goede <[email protected]>
ACPI: EC: Fix ECDT probe ordering issues
Hans de Goede <[email protected]>
ACPI: EC: Fix EC address space handler unregistration
Hans de Goede <[email protected]>
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
Hans de Goede <[email protected]>
ACPICA: include/acpi/acpixf.h: Fix indentation
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix the device initialization
Samasth Norway Ananda <[email protected]>
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
Mike Rapoport (Microsoft) <[email protected]>
x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
Yihang Li <[email protected]>
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
Tatyana Nikolova <[email protected]>
RDMA/irdma: Return EINVAL for invalid arp index error
Anil Samal <[email protected]>
RDMA/irdma: Fix deadlock during netdev reset with active connections
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
Ivan Barrera <[email protected]>
RDMA/irdma: Clean up unnecessary dereference of event->cm_node
Tatyana Nikolova <[email protected]>
RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
Tatyana Nikolova <[email protected]>
RDMA/irdma: Update ibqp state to error if QP is already in error state
Jacob Moroni <[email protected]>
RDMA/irdma: Initialize free_qp completion before using it
Chuck Lever <[email protected]>
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
Andy Shevchenko <[email protected]>
regmap: Synchronize cache for the page selector
Paolo Valerio <[email protected]>
net: macb: use the current queue number for stats
David Carlier <[email protected]>
netfilter: ctnetlink: use netlink policy range checks
Florian Westphal <[email protected]>
netlink: allow be16 and be32 types in all uint policy checks
Weiming Shi <[email protected]>
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
Pablo Neira Ayuso <[email protected]>
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
Ren Wei <[email protected]>
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Weiming Shi <[email protected]>
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Chuck Lever <[email protected]>
tls: Purge async_hold in tls_decrypt_async_wait()
Pengpeng Hou <[email protected]>
Bluetooth: btusb: clamp SCO altsetting table indices
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
Zhang Chen <[email protected]>
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
Miguel Ojeda <[email protected]>
dma-mapping: add missing inline for dma_free_attrs
Wei Fang <[email protected]>
net: enetc: fix the output issue of 'ethtool --show-ring'
Martin KaFai Lau <[email protected]>
udp: Fix wildcard bind conflict check when using hash2
Eric Dumazet <[email protected]>
tcp: optimize inet_use_bhash2_on_bind()
Kuniyuki Iwashima <[email protected]>
tcp: Rearrange tests in inet_csk_bind_conflict().
Kuniyuki Iwashima <[email protected]>
tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.
Yochai Eisenrich <[email protected]>
net: fix fanout UAF in packet_release() via NETDEV_UP race
Petr Oros <[email protected]>
ice: use ice_update_eth_stats() for representor stats
Alok Tiwari <[email protected]>
platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
Sabrina Dubroca <[email protected]>
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
Qi Tang <[email protected]>
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
Yang Yang <[email protected]>
openvswitch: validate MPLS set/set_masked payload length
Yang Yang <[email protected]>
openvswitch: defer tunnel netdev_put to RCU release
Hangbin Liu <[email protected]>
rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link
Hangbin Liu <[email protected]>
net: add new helper unregister_netdevice_many_notify
Hangbin Liu <[email protected]>
rtnetlink: pass netlink message header and portid to rtnl_configure_link()
Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid releasing netdev before teardown completes
Jakub Kicinski <[email protected]>
nfc: nci: fix circular locking dependency in nci_close_device
Mohammad Heib <[email protected]>
ionic: fix persistent MAC address override on PF
Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Helen Koike <[email protected]>
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Anas Iqbal <[email protected]>
Bluetooth: hci_ll: Fix firmware leak on error path
Hyunwoo Kim <[email protected]>
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Oliver Hartkopp <[email protected]>
can: statistics: add missing atomic access in hot path
Shigeru Yoshida <[email protected]>
dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
Eric Dumazet <[email protected]>
af_key: validate families in pfkey_send_migrate()
Sabrina Dubroca <[email protected]>
esp: fix skb leak with espintcp and async crypto
Steffen Klassert <[email protected]>
xfrm: Fix the usage of skb->sk
Sabrina Dubroca <[email protected]>
xfrm: call xdo_dev_state_delete during state update
Jie Deng <[email protected]>
usb: core: new quirk to handle devices with zero configurations
Uzair Mughal <[email protected]>
ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
Liucheng Lu <[email protected]>
ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
Boris Burkov <[email protected]>
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
Günther Noack <[email protected]>
HID: apple: avoid memory leak in apple_report_fixup()
Isaac J. Manjarres <[email protected]>
dma-buf: Include ioctl.h in UAPI header
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
Mark Brown <[email protected]>
ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
Ihor Solodrai <[email protected]>
module: Fix kernel panic when a symbol st_shndx is out of bounds
Romain Sioen <[email protected]>
HID: mcp2221: cancel last I2C command on read error
Valentin Spreckels <[email protected]>
net: usb: r8152: add TRENDnet TUC-ET2G
Günther Noack <[email protected]>
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
Julius Lehmann <[email protected]>
HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
Keith Busch <[email protected]>
nvme-pci: ensure we're polling a polled queue
Hans de Goede <[email protected]>
platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
Leif Skunberg <[email protected]>
platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
Daniel Hodges <[email protected]>
nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
Keith Busch <[email protected]>
nvme-pci: cap queue creation to used queues
Peter Metz <[email protected]>
platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
Günther Noack <[email protected]>
HID: asus: avoid memory leak in asus_report_fixup()
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Release module BTF IDR before module unload
Danilo Krummrich <[email protected]>
sh: platform_early: remove pdev->driver_override check
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + .../bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- .../bindings/gpio/microchip,mpfs-gpio.yaml | 4 +- Documentation/hwmon/adm1177.rst | 8 +- Documentation/hwmon/peci-cputemp.rst | 10 +- Makefile | 4 +- .../boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 +- .../arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++ arch/arm64/kvm/reset.c | 14 + arch/loongarch/pci/pci.c | 80 ++++++ arch/mips/lib/multi3.c | 6 +- arch/mips/mm/tlb-r4k.c | 2 +- arch/powerpc/net/bpf_jit_comp64.c | 23 +- arch/riscv/kernel/kgdb.c | 7 +- arch/s390/include/asm/barrier.h | 4 +- arch/s390/kernel/syscall.c | 2 + arch/sh/drivers/platform_early.c | 4 - arch/x86/kernel/cpu/common.c | 18 +- arch/x86/kvm/mmu/mmu.c | 15 +- arch/x86/platform/efi/quirks.c | 2 +- block/blk-mq.c | 9 +- block/blk-sysfs.c | 2 + block/bsg-lib.c | 2 + crypto/af_alg.c | 4 +- drivers/acpi/acpica/acevents.h | 4 + drivers/acpi/acpica/evregion.c | 6 +- drivers/acpi/acpica/evxfregn.c | 146 +++++++++- drivers/acpi/ec.c | 52 +++- drivers/base/regmap/regmap.c | 30 +- drivers/bluetooth/btusb.c | 5 +- drivers/bluetooth/hci_ll.c | 2 + drivers/comedi/drivers.c | 8 + drivers/comedi/drivers/dt2815.c | 12 + drivers/comedi/drivers/me4000.c | 16 +- drivers/comedi/drivers/me_daq.c | 35 +-- drivers/comedi/drivers/ni_atmio16d.c | 3 +- drivers/cpufreq/cpufreq_conservative.c | 12 + drivers/cpufreq/cpufreq_governor.c | 13 +- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/dma/idxd/cdev.c | 10 +- drivers/dma/idxd/device.c | 3 +- drivers/dma/idxd/sysfs.c | 1 + drivers/dma/sh/rz-dmac.c | 68 +++-- drivers/dma/xilinx/xilinx_dma.c | 66 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 +- drivers/gpu/drm/ast/ast_dp501.c | 2 +- drivers/gpu/drm/drm_ioc32.c | 2 + drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +- drivers/hid/hid-apple.c | 4 +- drivers/hid/hid-asus.c | 15 +- drivers/hid/hid-magicmouse.c | 6 +- drivers/hid/hid-mcp2221.c | 2 + drivers/hid/hid-multitouch.c | 7 + drivers/hid/wacom_wac.c | 10 + drivers/hwmon/adm1177.c | 54 ++-- drivers/hwmon/occ/common.c | 19 +- drivers/hwmon/peci/cputemp.c | 4 +- drivers/hwmon/pmbus/isl68137.c | 21 +- drivers/hwmon/pmbus/pmbus.h | 2 + drivers/hwmon/pmbus/pmbus_core.c | 30 ++ drivers/hwmon/pmbus/pxe1610.c | 5 +- drivers/hwmon/pmbus/tps53679.c | 4 +- drivers/i2c/busses/Kconfig | 2 + drivers/i2c/busses/i2c-tegra.c | 5 +- drivers/iio/accel/adxl355_core.c | 2 +- drivers/iio/adc/ti-adc161s626.c | 41 ++- drivers/iio/dac/ad5770r.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 32 ++- drivers/iio/imu/bmi160/bmi160_core.c | 15 +- drivers/iio/imu/bno055/bno055.c | 2 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 4 + drivers/iio/light/vcnl4035.c | 18 +- drivers/infiniband/core/rw.c | 27 +- drivers/infiniband/hw/irdma/cm.c | 29 +- drivers/infiniband/hw/irdma/utils.c | 2 - drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/input/joystick/xpad.c | 2 + drivers/input/rmi4/rmi_f54.c | 4 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/irqchip/irq-qcom-mpm.c | 3 + drivers/media/mc/mc-request.c | 5 + drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/mtd/spi-nor/core.c | 145 +++++++++- drivers/net/can/vxcan.c | 2 +- drivers/net/ethernet/broadcom/tg3.c | 13 +- drivers/net/ethernet/cadence/macb_main.c | 17 +- drivers/net/ethernet/cadence/macb_pci.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 28 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +- drivers/net/ethernet/intel/ice/ice_repr.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/fw.c | 49 ++-- .../net/ethernet/mellanox/mlx5/core/lag/debugfs.c | 3 + .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +- drivers/net/ethernet/xilinx/xilinx_axienet.h | 4 +- drivers/net/geneve.c | 2 +- drivers/net/phy/phy_device.c | 58 +++- drivers/net/usb/r8152.c | 1 + drivers/net/veth.c | 2 +- drivers/net/virtio_net.c | 1 + drivers/net/vxlan/vxlan_core.c | 10 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 2 +- drivers/net/wireless/microchip/wilc1000/hif.c | 2 +- drivers/net/wireless/virt_wifi.c | 1 - drivers/net/wwan/wwan_core.c | 2 +- drivers/nfc/pn533/uart.c | 3 + drivers/nvme/host/apple.c | 1 + drivers/nvme/host/core.c | 16 +- drivers/nvme/host/fabrics.c | 4 +- drivers/nvme/host/pci.c | 25 +- drivers/phy/ti/phy-j721e-wiz.c | 2 + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 +- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- drivers/platform/x86/intel/hid.c | 13 + drivers/platform/x86/touchscreen_dmi.c | 18 ++ drivers/scsi/ibmvscsi/ibmvfc.c | 3 +- drivers/scsi/scsi_sysfs.c | 1 + drivers/scsi/scsi_transport_sas.c | 2 +- drivers/scsi/ses.c | 2 +- drivers/spi/spi-fsl-lpspi.c | 3 +- drivers/target/loopback/tcm_loop.c | 52 +++- drivers/thunderbolt/nhi.c | 2 +- drivers/ufs/core/ufshcd.c | 2 + drivers/usb/cdns3/cdns3-gadget.c | 4 + drivers/usb/class/cdc-acm.c | 9 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/usbtmc.c | 3 + drivers/usb/common/ulpi.c | 5 +- drivers/usb/core/config.c | 6 +- drivers/usb/core/quirks.c | 8 + drivers/usb/dwc2/gadget.c | 2 + drivers/usb/gadget/function/f_rndis.c | 9 +- drivers/usb/gadget/function/f_subset.c | 6 + drivers/usb/gadget/function/f_uac1_legacy.c | 47 +++- drivers/usb/gadget/function/f_uvc.c | 39 ++- drivers/usb/gadget/function/uvc.h | 3 + drivers/usb/gadget/function/uvc_v4l2.c | 5 +- drivers/usb/gadget/udc/dummy_hcd.c | 42 +-- drivers/usb/host/ehci-brcm.c | 4 +- drivers/usb/serial/io_edgeport.c | 3 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 4 + fs/btrfs/block-group.c | 2 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/inode.c | 6 +- fs/btrfs/ioctl.c | 7 + fs/btrfs/tree-checker.c | 17 ++ fs/btrfs/volumes.c | 5 +- fs/btrfs/zoned.c | 6 +- fs/erofs/data.c | 2 + fs/erofs/zdata.c | 70 ++--- fs/ext4/crypto.c | 9 +- fs/ext4/ext4.h | 10 +- fs/ext4/extents.c | 312 +++++++++------------ fs/ext4/extents_status.c | 12 +- fs/ext4/extents_status.h | 4 +- fs/ext4/fast_commit.c | 25 +- fs/ext4/ialloc.c | 6 + fs/ext4/inline.c | 12 +- fs/ext4/inode.c | 35 ++- fs/ext4/mballoc.c | 30 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 7 +- fs/ext4/super.c | 164 +++++------ fs/ext4/sysfs.c | 10 +- fs/gfs2/lock_dlm.c | 10 +- fs/jbd2/checkpoint.c | 15 +- fs/smb/server/smb2pdu.c | 72 +++-- fs/xfs/xfs_attr_item.c | 4 +- fs/xfs/xfs_dquot_item.c | 9 +- fs/xfs/xfs_inode_item.c | 9 +- fs/xfs/xfs_mount.c | 7 +- fs/xfs/xfs_trace.c | 1 + fs/xfs/xfs_trace.h | 36 ++- fs/xfs/xfs_trans_ail.c | 26 +- include/acpi/acpixf.h | 142 +++++----- include/linux/dma-mapping.h | 4 +- include/linux/netdevice.h | 2 - include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/rtnetlink.h | 9 +- include/linux/swapops.h | 20 +- include/linux/usb/quirks.h | 3 + include/linux/usb/r8152.h | 1 + include/net/inet_hashtables.h | 14 + include/net/netfilter/nf_conntrack_expect.h | 44 ++- include/net/netlink.h | 21 +- include/net/rtnetlink.h | 5 +- include/uapi/linux/dma-buf.h | 1 + include/uapi/linux/netfilter/nf_conntrack_common.h | 4 + kernel/bpf/btf.c | 24 +- kernel/bpf/verifier.c | 10 +- kernel/dma/swiotlb.c | 21 +- kernel/futex/pi.c | 3 +- kernel/module/main.c | 7 + kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/trace/trace_osnoise.c | 8 +- lib/nlattr.c | 6 + mm/damon/sysfs.c | 3 + net/atm/lec.c | 72 +++-- net/atm/lec.h | 2 +- net/bluetooth/eir.c | 7 +- net/bluetooth/eir.h | 2 +- net/bluetooth/hci_event.c | 33 ++- net/bluetooth/hci_sync.c | 5 +- net/bluetooth/l2cap_core.c | 28 +- net/bluetooth/l2cap_sock.c | 3 + net/bluetooth/mgmt.c | 17 +- net/bluetooth/sco.c | 40 ++- net/bluetooth/smp.c | 11 +- net/bridge/br_arp_nd_proxy.c | 18 +- net/can/af_can.c | 4 +- net/can/af_can.h | 2 +- net/can/gw.c | 6 +- net/can/proc.c | 3 +- net/core/dev.c | 70 +++-- net/core/dev.h | 7 + net/core/rtnetlink.c | 51 ++-- net/hsr/hsr_device.c | 32 ++- net/ipv4/esp4.c | 11 +- net/ipv4/inet_connection_sock.c | 72 +++-- net/ipv4/inet_hashtables.c | 3 +- net/ipv4/ip_gre.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 6 +- net/ipv6/datagram.c | 10 + net/ipv6/esp6.c | 11 +- net/ipv6/icmp.c | 3 + net/ipv6/ioam6.c | 4 +- net/ipv6/ip6_flowlabel.c | 5 - net/ipv6/ip6_tunnel.c | 5 + net/ipv6/ndisc.c | 3 + net/ipv6/netfilter/ip6t_rt.c | 4 + net/ipv6/xfrm6_output.c | 4 +- net/key/af_key.c | 19 +- net/mptcp/pm_netlink.c | 2 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 4 +- net/netfilter/nf_conntrack_broadcast.c | 8 +- net/netfilter/nf_conntrack_expect.c | 29 +- net/netfilter/nf_conntrack_h323_main.c | 12 +- net/netfilter/nf_conntrack_helper.c | 13 +- net/netfilter/nf_conntrack_netlink.c | 103 +++---- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 18 +- net/netfilter/nf_flow_table_offload.c | 196 ++++++++----- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nfnetlink_log.c | 10 +- net/netfilter/x_tables.c | 23 ++ net/netfilter/xt_cgroup.c | 6 + net/netfilter/xt_rateest.c | 5 + net/nfc/nci/core.c | 10 +- net/openvswitch/flow_netlink.c | 2 + net/openvswitch/vport-geneve.c | 2 +- net/openvswitch/vport-gre.c | 2 +- net/openvswitch/vport-netdev.c | 13 +- net/openvswitch/vport-vxlan.c | 2 +- net/packet/af_packet.c | 1 + net/qrtr/af_qrtr.c | 31 +- net/rds/ib_rdma.c | 7 +- net/sched/cls_api.c | 1 + net/sched/cls_flow.c | 10 +- net/sched/cls_fw.c | 14 +- net/sched/sch_hfsc.c | 4 +- net/smc/smc_rx.c | 9 +- net/tls/tls_sw.c | 2 +- net/x25/x25_in.c | 9 +- net/x25/x25_subr.c | 1 + net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 +- net/xfrm/xfrm_policy.c | 2 +- net/xfrm/xfrm_state.c | 1 + sound/pci/ctxfi/ctdaio.c | 1 + sound/pci/hda/patch_realtek.c | 2 + sound/soc/cirrus/ep93xx-i2s.c | 40 ++- sound/soc/codecs/adau1372.c | 34 ++- sound/soc/fsl/fsl_easrc.c | 14 +- sound/soc/intel/catpt/device.c | 10 +- sound/soc/intel/catpt/dsp.c | 3 - sound/usb/caiaq/device.c | 2 +- tools/objtool/check.c | 5 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 + 286 files changed, 3071 insertions(+), 1445 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/312 sh: platform_early: remove pdev->driver_override check
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
[ Upstream commit c5f60e3f07b6609562d21efda878e83ce8860728 ]
In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check.
This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check.
--- arch/sh/drivers/platform_early.c | 4 ---- 1 file changed, 4 deletions(-)
arch/sh/drivers/platform_early.c +0 -4
@@ -26,10 +26,6 @@ static int platform_match(struct device *dev, struct device_driver *drv)struct platform_device *pdev =to_platform_device (dev);struct platform_driver *pdrv =to_platform_driver (drv); -/* When driver_override is set, only bind to the matching driver */ -if (pdev->driver_override) -return !strcmp (pdev->driver_override, drv->name); -/* Then try to match against the id table */ if (pdrv->id_table)return platform_match_id (pdrv->id_table, pdev) !=NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/312 bpf: Release module BTF IDR before module unload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 146bd2a87a65aa407bb17fac70d8d583d19aba06 ]
Gregory reported in [0] that the global_map_resize test when run in repeatedly ends up failing during program load. This stems from the fact that BTF reference has not dropped to zero after the previous run's module is unloaded, and the older module's BTF is still discoverable and visible. Later, in libbpf, load_module_btfs() will find the ID for this stale BTF, open its fd, and then it will be used during program load where later steps taking module reference using btf_try_get_module() fail since the underlying module for the BTF is gone.
Logically, once a module is unloaded, it's associated BTF artifacts should become hidden. The BTF object inside the kernel may still remain alive as long its reference counts are alive, but it should no longer be discoverable.
To fix this, let us call btf_free_id() from the MODULE_STATE_GOING case for the module unload to free the BTF associated IDR entry, and disable its discovery once module unload returns to user space. If a race happens during unload, the outcome is non-deterministic anyway. However, user space should be able to rely on the guarantee that once it has synchronously established a successful module unload, no more stale artifacts associated with this module can be obtained subsequently.
Note that we must be careful to not invoke btf_free_id() in btf_put() when btf_is_module() is true now. There could be a window where the module unload drops a non-terminal reference, frees the IDR, but the same ID gets reused and the second unconditional btf_free_id() ends up releasing an unrelated entry.
To avoid a special case for btf_is_module() case, set btf->id to zero to make btf_free_id() idempotent, such that we can unconditionally invoke it from btf_put(), and also from the MODULE_STATE_GOING case. Since zero is an invalid IDR, the idr_remove() should be a noop.
Note that we can be sure that by the time we reach final btf_put() for btf_is_module() case, the btf_free_id() is already done, since the module itself holds the BTF reference, and it will call this function for the BTF before dropping its own reference.
[0]: https://lore.kernel.org/bpf/[email protected]
--- kernel/bpf/btf.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
kernel/bpf/btf.c +20 -4
@@ -1606,7 +1606,16 @@ static void btf_free_id(struct btf *btf)* of the _bh() version. */ spin_lock_irqsave (&btf_idr_lock, flags); -idr_remove (&btf_idr, btf->id); +if (btf->id) { +idr_remove (&btf_idr, btf->id); +/* +* Clear the id here to make this function idempotent, since it will get +* called a couple of times for module BTFs: on module unload, and then +* the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use +* 0 as sentinel value. +*/ +WRITE_ONCE (btf->id,0 ); + }spin_unlock_irqrestore (&btf_idr_lock, flags); }
@@ -6875,7 +6884,7 @@ static void bpf_btf_show_fdinfo(struct seq_file *m, struct file *filp) {const struct btf *btf = filp->private_data; -seq_printf (m,"btf_id:\t%u\n" , btf->id); +seq_printf (m,"btf_id:\t%u\n" ,READ_ONCE (btf->id)); }#endif
@@ -6970,7 +6979,7 @@ int btf_get_info_by_fd(const struct btf *btf,if (copy_from_user (&info, uinfo, info_copy))return -EFAULT ; - info.id = btf->id; + info.id =READ_ONCE (btf->id); ubtf =u64_to_user_ptr (info.btf); btf_copy =min_t (u32, btf->data_size, info.btf_size);if (copy_to_user (ubtf, btf->data, btf_copy))
@@ -7033,7 +7042,7 @@ int btf_get_fd_by_id(u32 id)u32 btf_obj_id (const struct btf *btf) { -return btf->id; +return READ_ONCE (btf->id); }bool btf_is_kernel (const struct btf *btf)
@@ -7179,6 +7188,13 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,if (btf_mod->module != module)continue ; +/* +* For modules, we do the freeing of BTF IDR as soon as +* module goes away to disable BTF discovery, since the +* btf_try_get_module() on such BTFs will fail. This may +* be called again on btf_put(), but it's ok to do so. +*/ +btf_free_id (btf_mod->btf);list_del (&btf_mod->list);if (btf_mod->sysfs_attr)sysfs_remove_bin_file (btf_kobj, btf_mod->sysfs_attr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/312 HID: asus: avoid memory leak in asus_report_fixup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 2bad24c17742fc88973d6aea526ce1353f5334a3 ]
The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed.
The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer.
Also fix a harmless out-of-bounds read by copying only the original descriptor size.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -1206,14 +1206,21 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if (*rsize == rsize_orig && rdesc[offs] ==0x09 && rdesc[offs +1 ] ==0x76 ) { - *rsize = rsize_orig +1 ; - rdesc =kmemdup (rdesc, *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; +__u8 *new_rdesc; + + new_rdesc =devm_kzalloc (&hdev->dev, rsize_orig +1 , +GFP_KERNEL ); +if (!new_rdesc) +return rdesc;hid_info (hdev,"Fixing up %s keyb report descriptor\n" , drvdata->quirks &QUIRK_T100CHI ?"T100CHI" :"T90CHI" ); + +memcpy (new_rdesc, rdesc, rsize_orig); + *rsize = rsize_orig +1 ; + rdesc = new_rdesc; +memmove (rdesc + offs +4 , rdesc + offs +2 ,12 ); rdesc[offs] =0x19 ; rdesc[offs +1 ] =0x00 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/312 platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Metz <[email protected]>
[ Upstream commit 6b3fa0615cd8432148581de62a52f83847af3d70 ]
The Dell 14 Plus 2-in-1 (model DB04250) requires the VGBS allow list entry to correctly enable the tablet mode switch. Without this, the chassis state is not reported, and the hinge rotation only emits unknown scancodes.
Verified on Dell 14 Plus 2-in-1 DB04250.
--- drivers/platform/x86/intel/hid.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/platform/x86/intel/hid.c +6 -0
@@ -156,6 +156,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell 14 Plus 2-in-1 DB04250"), + }, + }, { } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/312 nvme-pci: cap queue creation to used queues
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 4735b510a00fb2d4ac9e8d21a8c9552cb281f585 ]
If the user reduces the special queue count at runtime and resets the controller, we need to reduce the number of queues and interrupts requested accordingly rather than start with the pre-allocated queue count.
--- drivers/nvme/host/pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +7 -1
@@ -2402,7 +2402,13 @@ static int nvme_setup_io_queues(struct nvme_dev *dev) dev->nr_write_queues = write_queues; dev->nr_poll_queues = poll_queues; - nr_io_queues = dev->nr_allocated_queues -1 ; +/* +* The initial number of allocated queue slots may be too large if the +* user reduced the special queue parameters. Cap the value to the +* number we need for this round. +*/ + nr_io_queues =min (nvme_max_io_queues (dev), + dev->nr_allocated_queues -1 ); result =nvme_set_queue_count (&dev->ctrl, &nr_io_queues);if (result <0 )return result;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/312 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Hodges <[email protected]>
[ Upstream commit 0a1fc2f301529ac75aec0ce80d5ab9d9e4dc4b16 ]
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain authentication key material for NVMe-oF. Use kfree_sensitive() instead of kfree() in nvmf_free_options() to ensure secrets are zeroed before the memory is freed, preventing recovery from freed pages.
--- drivers/nvme/host/fabrics.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/fabrics.c +2 -2
@@ -1049,8 +1049,8 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)kfree (opts->subsysnqn);kfree (opts->host_traddr);kfree (opts->host_iface); -kfree (opts->dhchap_secret); -kfree (opts->dhchap_ctrl_secret); +kfree_sensitive (opts->dhchap_secret); +kfree_sensitive (opts->dhchap_ctrl_secret);kfree (opts); }EXPORT_SYMBOL_GPL (nvmf_free_options);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/312 platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leif Skunberg <[email protected]>
[ Upstream commit b38d478dad79e61e8a65931021bdfd7a71741212 ]
The Lenovo ThinkPad X1 Fold 16 Gen 1 has physical volume up/down buttons that are handled through the intel-hid 5-button array interface. The firmware does not advertise 5-button array support via HEBC, so the driver relies on a DMI allowlist to enable it.
Add the ThinkPad X1 Fold 16 Gen 1 to the button_array_table so the volume buttons work out of the box.
--- drivers/platform/x86/intel/hid.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/intel/hid.c +7 -0
@@ -102,6 +102,13 @@ static const struct dmi_system_id button_array_table[] = { DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"), }, }, + { + .ident = "Lenovo ThinkPad X1 Fold 16 Gen 1", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Fold 16 Gen 1"), + }, + }, { .ident ="Microsoft Surface Go 3" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/312 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7d87ed70fc95482c12edf9493c249b6413be485e ]
The touchscreen on the SUPI S10 tablet reports inverted Y coordinates, causing touch input to be mirrored vertically relative to the display.
Add a quirk to set the "touchscreen-inverted-y" boolean device-property on the touchscreen device, so that the goodix_ts driver will fixup the coordinates.
--- drivers/platform/x86/touchscreen_dmi.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +18 -0
@@ -399,6 +399,16 @@ static const struct ts_dmi_data gdix1002_00_upside_down_data = { .properties = gdix1001_upside_down_props, }; +static const struct property_entry gdix1001_y_inverted_props[] = { +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), + { } +}; + +static const struct ts_dmi_data gdix1001_y_inverted_data = { + .acpi_name ="GDIX1001" , + .properties = gdix1001_y_inverted_props, +}; +static const struct property_entry gp_electronic_t701_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,960 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,640 ),
@@ -1646,6 +1656,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_SKU, "PN20170413488"), }, }, + { +/* SUPI S10 */ + .driver_data = (void *)&gdix1001_y_inverted_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"SUPI" ), + DMI_MATCH(DMI_PRODUCT_NAME, "S10"), + }, + }, {/* Techbite Arc 11.6 */ .driver_data = (void *)&techbite_arc_11_6_data,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/312 nvme-pci: ensure were polling a polled queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a ]
A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -1167,7 +1167,8 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)struct nvme_queue *nvmeq = hctx->driver_data;bool found; -if (!nvme_cqe_pending (nvmeq)) +if (!test_bit (NVMEQ_POLLED , &nvmeq->flags) || + !nvme_cqe_pending (nvmeq))return 0 ;spin_lock (&nvmeq->cq_poll_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/312 HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Lehmann <[email protected]>
[ Upstream commit 5f3518d77419255f8b12bb23c8ec22acbeb6bc5b ]
Battery reporting does not work for the Apple Magic Trackpad 2 if it is connected via USB. The current hid descriptor fixup code checks for a hid descriptor length of exactly 83 bytes. If the hid descriptor is larger, which is the case for newer apple mice, the fixup is not applied.
This fix checks for hid descriptor sizes greater/equal 83 bytes which applies the fixup for newer devices as well.
--- drivers/hid/hid-magicmouse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-magicmouse.c +1 -1
@@ -963,7 +963,7 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ if ((is_usb_magicmouse2 (hdev->vendor, hdev->product) ||is_usb_magictrackpad2 (hdev->vendor, hdev->product)) && - *rsize ==83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) { + *rsize >=83 && rdesc[46 ] ==0x84 && rdesc[58 ] ==0x85 ) {hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/312 HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 91e8c6e601bdc1ccdf886479b6513c01c7e51c2c ]
The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-magicmouse.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-magicmouse.c +1 -3
@@ -967,9 +967,7 @@ static __u8 *magicmouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up magicmouse battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/312 net: usb: r8152: add TRENDnet TUC-ET2G
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Spreckels <[email protected]>
[ Upstream commit 15fba71533bcdfaa8eeba69a5a5a2927afdf664a ]
The TRENDnet TUC-ET2G is a RTL8156 based usb ethernet adapter. Add its vendor and product IDs.
--- drivers/net/usb/r8152.c | 1 + include/linux/usb/r8152.h | 1 + 2 files changed, 2 insertions(+)
drivers/net/usb/r8152.c +1 -0
@@ -9884,6 +9884,7 @@ static const struct usb_device_id rtl8152_table[] = { { USB_DEVICE(VENDOR_ID_DLINK, 0xb301) }, { USB_DEVICE(VENDOR_ID_DELL, 0xb097) }, { USB_DEVICE(VENDOR_ID_ASUS, 0x1976) }, + { USB_DEVICE(VENDOR_ID_TRENDNET, 0xe02b) }, {} };
include/linux/usb/r8152.h +1 -0
@@ -32,6 +32,7 @@#define VENDOR_ID_DLINK 0x2001#define VENDOR_ID_DELL 0x413c#define VENDOR_ID_ASUS 0x0b05 +#define VENDOR_ID_TRENDNET 0x20f4#if IS_REACHABLE (CONFIG_USB_RTL8152 )extern u8 rtl8152_get_version (struct usb_interface *intf);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/312 HID: mcp2221: cancel last I2C command on read error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Sioen <[email protected]>
[ Upstream commit e31b556c0ba21f20c298aa61181b96541140b7b9 ]
When an I2C SMBus read operation fails, the MCP2221 internal state machine may not reset correctly, causing subsequent transactions to fail.
By adding a short delay and explicitly cancelling the last command, we ensure the device is ready for the next operation.
Fix an issue where i2cdetect was not able to detect all devices correctly on the bus.
--- drivers/hid/hid-mcp2221.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/hid-mcp2221.c +2 -0
@@ -319,6 +319,8 @@ static int mcp_i2c_smbus_read(struct mcp2221 *mcp,usleep_range (90 ,100 ); retries++; }else { +usleep_range (980 ,1000 ); +mcp_cancel_last_cmd (mcp);return ret; } }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/312 module: Fix kernel panic when a symbol st_shndx is out of bounds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ihor Solodrai <[email protected]>
[ Upstream commit f9d69d5e7bde2295eb7488a56f094ac8f5383b92 ]
The module loader doesn't check for bounds of the ELF section index in simplify_symbols():
for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;
switch (sym[i].st_shndx) {
case SHN_COMMON:
[...]
default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:
BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception
This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted.
Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it.
This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1].
[1] https://lore.kernel.org/linux-modules/[email protected]/
--- kernel/module/main.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/module/main.c +7 -0
@@ -1343,6 +1343,13 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)break ;default : +if (sym[i].st_shndx >= info->hdr->e_shnum) { +pr_err ("%s: Symbol %s has an invalid section index %u (max %u)\n" , + mod->name, name, sym[i].st_shndx, info->hdr->e_shnum -1 ); + ret = -ENOEXEC ; +break ; + } +/* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long )mod_percpu (mod);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/312 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 31ddc62c1cd92e51b9db61d7954b85ae2ec224da ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_set_reg() only returns 0 or a negative error code, causing ALSA to not generate any change events. Add a suitable check by using regmap_update_bits_check() with the underlying regmap, this is more clearly and simply correct than trying to verify that one of the generic ops is exactly equivalent to this one.
--- sound/soc/fsl/fsl_easrc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_easrc.c +6 -3
@@ -93,14 +93,17 @@ static int fsl_easrc_set_reg(struct snd_kcontrol *kcontrol,struct snd_soc_component *component =snd_kcontrol_chip (kcontrol);struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value; +struct fsl_asrc *easrc =snd_soc_component_get_drvdata (component);unsigned int regval = ucontrol->value.integer.value[0 ]; +bool changed;int ret; - ret =snd_soc_component_write (component, mc->regbase, regval); -if (ret <0 ) + ret =regmap_update_bits_check (easrc->regmap, mc->regbase, +GENMASK (31 ,0 ), regval, &changed); +if (ret !=0 )return ret; -return 0 ; +return changed; }#define SOC_SINGLE_REG_RW (xname, xreg) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/312 ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 54a86cf48eaa6d1ab5130d756b718775e81e1748 ]
ALSA controls should return 1 if the value in the control changed but the control put operation fsl_easrc_iec958_put_bits() unconditionally returns 0, causing ALSA to not generate any change events. This is detected by mixer-test with large numbers of messages in the form:
No event generated for Context 3 IEC958 CS5 Context 3 IEC958 CS5.0 orig 5224 read 5225, is_volatile 0
Add a suitable check.
--- sound/soc/fsl/fsl_easrc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_easrc.c +4 -1
@@ -52,10 +52,13 @@ static int fsl_easrc_iec958_put_bits(struct snd_kcontrol *kcontrol,struct soc_mreg_control *mc = (struct soc_mreg_control *)kcontrol->private_value;unsigned int regval = ucontrol->value.integer.value[0 ]; +int ret; + + ret = (easrc_priv->bps_iec958[mc->regbase] != regval); easrc_priv->bps_iec958[mc->regbase] = regval; -return 0 ; +return ret; } static int fsl_easrc_iec958_get_bits(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/312 dma-buf: Include ioctl.h in UAPI header
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <[email protected]>
[ Upstream commit a116bac87118903925108e57781bbfc7a7eea27b ]
include/uapi/linux/dma-buf.h uses several macros from ioctl.h to define its ioctl commands. However, it does not include ioctl.h itself. So, if userspace source code tries to include the dma-buf.h file without including ioctl.h, it can result in build failures.
Therefore, include ioctl.h in the dma-buf UAPI header.
--- include/uapi/linux/dma-buf.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/dma-buf.h +1 -0
@@ -20,6 +20,7 @@#ifndef _DMA_BUF_UAPI_H_#define _DMA_BUF_UAPI_H_ +#include <linux/ioctl.h> #include <linux/types.h> /**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/312 HID: apple: avoid memory leak in apple_report_fixup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <[email protected]>
[ Upstream commit 239c15116d80f67d32f00acc34575f1a6b699613 ]
The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.
--- drivers/hid/hid-apple.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/hid/hid-apple.c +1 -3
@@ -611,9 +611,7 @@ static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,hid_info (hdev,"fixing up Magic Keyboard battery report descriptor\n" ); *rsize = *rsize -1 ; - rdesc =kmemdup (rdesc +1 , *rsize,GFP_KERNEL ); -if (!rdesc) -return NULL ; + rdesc = rdesc +1 ; rdesc[0 ] =0x05 ; rdesc[1 ] =0x01 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/312 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 5131fa077f9bb386a1b901bf5b247041f0ec8f80 ]
We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like:
drwxrwxrwt 1 root root 16 Jan 23 16:49 .
drwxr-xr-x 1 root root 24 Jan 23 16:48 ..
d????????? ? ? ? ? ? broken_subvol
and similarly stat-ing the file fails.
In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck.
dmesg contains a single notable error message reading:
"could not do orphan cleanup -2"
2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup().
btrfs_lookupbtrfs_lookup_dentrybtrfs_orphan_cleanup // prints that message and returns -ENOENT
After some detailed inspection of the internal state, it became clear that:
- there are no orphan items for the subvol
- the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc.
- the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later.
- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want.
i.e.,btrfs_lookup()
btrfs_lookup_dentry()
if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root)
test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N
...
prints "could not do orphan cleanup -2"
if (inode == ERR_PTR(-ENOENT))
inode = NULL;
return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume
btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit.
The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache.
The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive.
Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races)
Phase 1:
Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set
btrfs_mksubvol()
lookup_one_len()
__lookup_slow()
d_alloc_parallel()
__d_alloc() // d_lockref.count = 1
create_subvol(dentry)
// doesn't touch the bit..
d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.count == 1Phase 2:
Create a delayed iput for a file in the subvol but leave the subvol in state where its dentry can be evicted (d_lockref.count == 0)
T1 (task) T2 (writeback) T3 (OE workqueue)
write() // dirty pages
btrfs_writepages()
btrfs_run_delalloc_range()
cow_file_range()
btrfs_alloc_ordered_extent()
igrab() // i_count: 1 -> 2btrfs_unlink_inode()
btrfs_orphan_add()close()
__fput()
dput()
finish_dput()
__dentry_kill()
dentry_unlink_inode()
iput() // 2 -> 1
--parent->d_lockref.count // 1 -> 0; evictable
finish_ordered_fn()
btrfs_finish_ordered_io()
btrfs_put_ordered_extent()
btrfs_add_delayed_iput()Phase 3:
Once the delayed iput is pending and the subvol dentry is evictable, the shrinker can free it, causing the next lookup to go through btrfs_lookup() and call btrfs_orphan_cleanup() for the first time. If the cleaner kthread processes the delayed iput concurrently, the two race:
T1 (shrinker) T2 (cleaner kthread) T3 (lookup)
super_cache_scan()
prune_dcache_sb()
__dentry_kill()
// subvol dentry freed
btrfs_run_delayed_iputs()
iput() // i_count -> 0
evict() // sets I_FREEING
btrfs_evict_inode()
// truncation loop
btrfs_lookup()
btrfs_lookup_dentry()
btrfs_orphan_cleanup()
// first call (bit never set)
btrfs_iget()
// blocks on I_FREEING
btrfs_orphan_del()
// inode freed
// returns -ENOENT
btrfs_del_orphan_item()
// -ENOENT
// "could not do orphan cleanup -2"
d_splice_alias(NULL, dentry)
// negative dentry for valid subvolThe most straightforward fix is to ensure the invariant that a dentry for a subvolume can exist if and only if that subvolume has BTRFS_ROOT_ORPHAN_CLEANUP set on its root (and is known to have no orphans or ran btrfs_orphan_cleanup()).
--- fs/btrfs/ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/btrfs/ioctl.c +7 -0
@@ -744,6 +744,13 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, goto out; } +/* +* Subvolumes have orphans cleaned on first dentry lookup. A new +* subvolume cannot have any orphans, so we should set the bit before we +* add the subvolume dentry to the dentry cache, so that it is in the +* same state as a subvolume after first lookup. +*/ +set_bit (BTRFS_ROOT_ORPHAN_CLEANUP , &new_root->state);d_instantiate_new (dentry, new_inode_args.inode); new_inode_args.inode =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/312 ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liucheng Lu <[email protected]>
[ Upstream commit 178dd118c0f07fd63a9ed74cfbd8c31ae50e33af ]
HP Laptop 14s-dr5xxx with ALC236 codec does not handle the toggling of the mute LED.
This patch adds a quirk entry for subsystem ID 0x8a1f using ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10019,6 +10019,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x89ca ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x89d3 ,"HP EliteBook 645 G9 (MB 89D2)" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8a0f ,"HP Pavilion 14-ec1xxx" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8a1f ,"HP Laptop 14s-dr5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a20 ,"HP Laptop 15s-fq5xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8a25 ,"HP Victus 16-d1xxx (MB 8A25)" ,ALC245_FIXUP_HP_MUTE_LED_COEFBIT ), SND_PCI_QUIRK(0x103c, 0x8a78, "HP Dev One", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/312 ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uzair Mughal <[email protected]>
[ Upstream commit 542127f6528ca7cc3cf61e1651d6ccb58495f953 ]
The Lenovo ThinkPad X390 (ALC257 codec, subsystem ID 0x17aa2288) does not report headset button press events. Headphone insertion is detected (SW_HEADPHONE_INSERT), but pressing the inline microphone button on a headset produces no input events.
Add a SND_PCI_QUIRK entry that maps this subsystem ID to ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, which enables headset jack button detection through alc_fixup_headset_jack() and ThinkPad ACPI integration. This is the same fixup used by similar ThinkPad models (P1 Gen 3, X1 Extreme Gen 3).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10345,6 +10345,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x224c ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x224d ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x225d ,"Thinkpad T480" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), +SND_PCI_QUIRK (0x17aa ,0x2288 ,"Thinkpad X390" ,ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x2292 ,"Thinkpad X1 Carbon 7th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ),SND_PCI_QUIRK (0x17aa ,0x22be ,"Thinkpad X1 Carbon 8th" ,ALC285_FIXUP_THINKPAD_HEADSET_JACK ), SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/312 usb: core: new quirk to handle devices with zero configurations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Deng <[email protected]>
[ Upstream commit 9f6a983cfa22ac662c86e60816d3a357d4b551e9 ]
Some USB devices incorrectly report bNumConfigurations as 0 in their device descriptor, which causes the USB core to reject them during enumeration.
logs:
usb 1-2: device descriptor read/64, error -71
usb 1-2: no configurations
usb 1-2: can't read configurations, error -22
However, these devices actually work correctly when treated as having a single configuration.
Add a new quirk USB_QUIRK_FORCE_ONE_CONFIG to handle such devices. When this quirk is set, assume the device has 1 configuration instead of failing with -EINVAL.
This quirk is applied to the device with VID:PID 5131:2007 which exhibits this behavior.
--- Documentation/admin-guide/kernel-parameters.txt | 3 +++ drivers/usb/core/config.c | 6 +++++- drivers/usb/core/quirks.c | 5 +++++ include/linux/usb/quirks.h | 3 +++ 4 files changed, 16 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +3 -0
@@ -6643,6 +6643,9 @@ p = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT (Reduce timeout of the SET_ADDRESS request from 5000 ms to 500 ms); + q = USB_QUIRK_FORCE_ONE_CONFIG (Device + claims zero configurations, + forcing to 1); Example: quirks=0781:5580:bk,0a5c:5834:gij usbhid.mousepoll=
drivers/usb/core/config.c +5 -1
@@ -891,7 +891,11 @@ int usb_get_configuration(struct usb_device *dev) dev->descriptor.bNumConfigurations = ncfg =USB_MAXCONFIG ; } -if (ncfg <1 ) { +if (ncfg <1 && dev->quirks &USB_QUIRK_FORCE_ONE_CONFIG ) { +dev_info (ddev,"Device claims zero configurations, forcing to 1\n" ); + dev->descriptor.bNumConfigurations =1 ; + ncfg =1 ; + }else if (ncfg <1 ) {dev_err (ddev,"no configurations\n" );return -EINVAL ; }
drivers/usb/core/quirks.c +5 -0
@@ -141,6 +141,8 @@ static int quirks_param_set(const char *value, const struct kernel_param *kp)case 'p' : flags |=USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT ;break ; +case 'q' : + flags |=USB_QUIRK_FORCE_ONE_CONFIG ;/* Ignore unrecognized flag characters */ } }
@@ -594,6 +596,9 @@ static const struct usb_device_id usb_quirk_list[] = {/* VCOM device */ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Noji-MCS SmartCard Reader */ + { USB_DEVICE(0x5131, 0x2007), .driver_info = USB_QUIRK_FORCE_ONE_CONFIG }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
include/linux/usb/quirks.h +3 -0
@@ -78,4 +78,7 @@/* skip BOS descriptor request */ #define USB_QUIRK_NO_BOS BIT(17) +/* Device claims zero configurations, forcing to 1 */ +#define USB_QUIRK_FORCE_ONE_CONFIG BIT(18) +#endif /* __LINUX_USB_QUIRKS_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/312 xfrm: call xdo_dev_state_delete during state update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 7d2fc41f91bc69acb6e01b0fa23cd7d0109a6a23 ]
When we update an SA, we construct a new state and call xdo_dev_state_add, but never insert it. The existing state is updated, then we immediately destroy the new state. Since we haven't added it, we don't go through the standard state delete code, and we're skipping removing it from the device (but xdo_dev_state_free will get called when we destroy the temporary state).
This is similar to commit c5d4d7d83165 ("xfrm: Fix deletion of offloaded SAs on failure.").
--- net/xfrm/xfrm_state.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_state.c +1 -0
@@ -1768,6 +1768,7 @@ int xfrm_state_update(struct xfrm_state *x) err =0 ; x->km.state =XFRM_STATE_DEAD ; +xfrm_dev_state_delete (x);__xfrm_state_put (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/312 xfrm: Fix the usage of skb->sk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
[ Upstream commit 1620c88887b16940e00dbe57dd38c74eda9bad9e ]
xfrm assumed to always have a full socket at skb->sk. This is not always true, so fix it by converting to a full socket before it is used.
Stable-dep-of: 0c0eef8ccd24 ("esp: fix skb leak with espintcp and async crypto")
--- net/ipv4/esp4.c | 2 +- net/ipv6/esp6.c | 2 +- net/ipv6/xfrm6_output.c | 4 ++-- net/xfrm/xfrm_interface_core.c | 2 +- net/xfrm/xfrm_output.c | 7 ++++--- net/xfrm/xfrm_policy.c | 2 +- 6 files changed, 10 insertions(+), 9 deletions(-)
net/ipv4/esp4.c +1 -1
@@ -236,7 +236,7 @@ static void esp_output_done(struct crypto_async_request *base, int err) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)esp_output_tail_tcp (x, skb); else - xfrm_output_resume(skb->sk, skb, err); +xfrm_output_resume (skb_to_full_sk (skb ),skb ,err ); } }
net/ipv6/esp6.c +1 -1
@@ -272,7 +272,7 @@ static void esp_output_done(struct crypto_async_request *base, int err) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)esp_output_tail_tcp (x, skb); else - xfrm_output_resume(skb->sk, skb, err); +xfrm_output_resume (skb_to_full_sk (skb ),skb ,err ); } }
net/ipv6/xfrm6_output.c +2 -2
@@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) toobig = skb->len > mtu && !skb_is_gso (skb); -if (toobig &&xfrm6_local_dontfrag (skb->sk)) { +if (toobig &&xfrm6_local_dontfrag (sk)) {xfrm6_local_rxpmtu (skb, mtu);kfree_skb (skb);return -EMSGSIZE ; }else if (toobig &&xfrm6_noneed_fragment (skb)) { skb->ignore_df =1 ; goto skip_frag; - }else if (!skb->ignore_df && toobig && skb->sk) { + }else if (!skb->ignore_df && toobig && sk) {xfrm_local_error (skb, mtu);kfree_skb (skb);return -EMSGSIZE ;
net/xfrm/xfrm_interface_core.c +1 -1
@@ -498,7 +498,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)skb_dst_set (skb, dst); skb->dev = tdev; - err =dst_output (xi->net, skb->sk, skb); + err =dst_output (xi->net,skb_to_full_sk (skb), skb);if (net_xmit_eval (err) ==0 ) {dev_sw_netstats_tx_add (dev,1 , length); }else {
net/xfrm/xfrm_output.c +4 -3
@@ -782,7 +782,7 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb) !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) { skb->protocol =htons (ETH_P_IP ); -if (skb->sk) +if (skb->sk &&sk_fullsock (skb->sk))xfrm_local_error (skb, mtu);else icmp_send(skb, ICMP_DEST_UNREACH,
@@ -818,6 +818,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) {int mtu, ret =0 ;struct dst_entry *dst =skb_dst (skb); +struct sock *sk =skb_to_full_sk (skb);if (skb->ignore_df) goto out;
@@ -832,9 +833,9 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb) skb->dev = dst->dev; skb->protocol =htons (ETH_P_IPV6 ); -if (xfrm6_local_dontfrag (skb->sk)) +if (xfrm6_local_dontfrag (sk)) ipv6_stub->xfrm6_local_rxpmtu (skb, mtu); -else if (skb->sk) +else if (sk)xfrm_local_error (skb, mtu);else icmpv6_send (skb,ICMPV6_PKT_TOOBIG ,0 , mtu);
net/xfrm/xfrm_policy.c +1 -1
@@ -2858,7 +2858,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)skb_dst_drop (skb);skb_dst_set (skb, dst); -dst_output (net, skb->sk, skb); +dst_output (net,skb_to_full_sk (skb), skb); } out:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/312 esp: fix skb leak with espintcp and async crypto
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 ]
When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us.
With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.
--- net/ipv4/esp4.c | 9 ++++++--- net/ipv6/esp6.c | 9 ++++++--- 2 files changed, 12 insertions(+), 6 deletions(-)
net/ipv4/esp4.c +6 -3
@@ -233,10 +233,13 @@ static void esp_output_done(struct crypto_async_request *base, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
net/ipv6/esp6.c +6 -3
@@ -269,10 +269,13 @@ static void esp_output_done(struct crypto_async_request *base, int err)xfrm_dev_resume (skb); }else {if (!err && - x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) -esp_output_tail_tcp (x, skb); -else + x->encap && x->encap->encap_type ==TCP_ENCAP_ESPINTCP ) { + err =esp_output_tail_tcp (x, skb); +if (err != -EINPROGRESS ) +kfree_skb (skb); + }else {xfrm_output_resume (skb_to_full_sk (skb), skb, err); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/312 af_key: validate families in pfkey_send_migrate()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb2d16a7d599dc9d4df391b5e660df9949963786 ]
syzbot was able to trigger a crash in skb_put() [1]
Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.
Validate families early, do not wait set_ipsecrequest().
[1]
skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
kernel BUG at net/core/skbuff.c:214 !
Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
--- net/key/af_key.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/key/af_key.c +12 -7
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress *static int set_ipsecrequest (struct sk_buff *skb,uint8_t proto,uint8_t mode,int level, -uint32_t reqid,uint8_t family, +uint32_t reqid,sa_family_t family,const xfrm_address_t *src,const xfrm_address_t *dst) {struct sadb_x_ipsecrequest *rq;
@@ -3583,12 +3583,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,/* ipsecrequests */ for (i =0 , mp = m; i < num_bundles; i++, mp++) { -/* old locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->old_family); -/* new locator pair */ - size_pol +=sizeof (struct sadb_x_ipsecrequest ) + -pfkey_sockaddr_pair_size (mp->new_family); +int pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->old_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; + + pair_size =pfkey_sockaddr_pair_size (mp->new_family); +if (!pair_size) +return -EINVAL ; + size_pol +=sizeof (struct sadb_x_ipsecrequest ) + pair_size; } size +=sizeof (struct sadb_msg ) + size_pol;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/312 dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 6f770b73d0311a5b099277653199bb6421c4fed2 ]
When a device performs DMA to a bounce buffer, KMSAN is unaware of the write and does not mark the data as initialized. When swiotlb_bounce() later copies the bounce buffer back to the original buffer, memcpy propagates the uninitialized shadow to the original buffer, causing false positive uninit-value reports.
Fix this by calling kmsan_unpoison_memory() on the bounce buffer before copying it back in the DMA_FROM_DEVICE path, so that memcpy naturally propagates initialized shadow to the destination.
--- kernel/dma/swiotlb.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
kernel/dma/swiotlb.c +19 -2
@@ -30,6 +30,7 @@#include <linux/gfp.h> #include <linux/highmem.h> #include <linux/io.h> +#include <linux/kmsan-checks.h> #include <linux/iommu-helper.h> #include <linux/init.h> #include <linux/memblock.h>
@@ -600,10 +601,19 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t sizelocal_irq_save (flags); page =pfn_to_page (pfn); -if (dir ==DMA_TO_DEVICE ) +if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_highmem_page() +* could be used here to detect infoleaks, +* but callers may map uninitialized buffers +* that will be written by the device, +* causing false positives. +*/ memcpy_from_page (vaddr, page, offset, sz); -else + }else { +kmsan_unpoison_memory (vaddr, sz);memcpy_to_page (page, offset, vaddr, sz); + }local_irq_restore (flags); size -= sz;
@@ -612,8 +622,15 @@ static void swiotlb_bounce(struct device *dev, phys_addr_t tlb_addr, size_t size offset =0 ; } }else if (dir ==DMA_TO_DEVICE ) { +/* +* Ideally, kmsan_check_memory() could be used here to detect +* infoleaks (uninitialized data being sent to device), but +* callers may map uninitialized buffers that will be written +* by the device, causing false positives. +*/ memcpy (vaddr,phys_to_virt (orig_addr), size); }else { +kmsan_unpoison_memory (vaddr, size);memcpy (phys_to_virt (orig_addr), vaddr, size); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/312 can: statistics: add missing atomic access in hot path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
[ Upstream commit 46eee1661aa9b49966e6c43d07126fe408edda57 ]
Commit 80b5f90158d1 ("can: statistics: use atomic access in hot path") fixed a KCSAN issue in can_receive() but missed to convert the 'matches' variable used in can_rcv_filter().
--- net/can/af_can.c | 4 ++-- net/can/af_can.h | 2 +- net/can/proc.c | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-)
net/can/af_can.c +2 -2
@@ -468,7 +468,7 @@ int can_rx_register(struct net *net, struct net_device *dev, canid_t can_id, rcv->can_id = can_id; rcv->mask = mask; - rcv->matches =0 ; +atomic_long_set (&rcv->matches,0 ); rcv->func = func; rcv->data = data; rcv->ident = ident;
@@ -572,7 +572,7 @@ EXPORT_SYMBOL(can_rx_unregister);static inline void deliver (struct sk_buff *skb,struct receiver *rcv) { rcv->func (skb, rcv->data); - rcv->matches++; +atomic_long_inc (&rcv->matches); }static int can_rcv_filter (struct can_dev_rcv_lists *dev_rcv_lists,struct sk_buff *skb)
net/can/af_can.h +1 -1
@@ -52,7 +52,7 @@ struct receiver {struct hlist_node list;canid_t can_id;canid_t mask; -unsigned long matches; +atomic_long_t matches;void (*func)(struct sk_buff *skb,void *data);void *data;char *ident;
net/can/proc.c +2 -1
@@ -196,7 +196,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list," %-5s %03x %08x %pK %pK %8ld %s\n" ;seq_printf (m, fmt,DNAME (dev), r->can_id, r->mask, - r->func, r->data, r->matches, r->ident); + r->func, r->data,atomic_long_read (&r->matches), + r->ident); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/312 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -7708,6 +7708,11 @@ static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)if (!chan->sdu) {u16 sdu_len; +if (!pskb_may_pull (skb,L2CAP_SDULEN_SIZE )) { + err = -EINVAL ; + goto failed; + } + sdu_len =get_unaligned_le16 (skb->data);skb_pull (skb,L2CAP_SDULEN_SIZE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/312 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free.
Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.
Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.
--- net/bluetooth/sco.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/bluetooth/sco.c +7 -3
@@ -339,7 +339,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)struct sock *sk;sco_conn_lock (conn); - sk = conn->sk; + sk =sco_sock_hold (conn);sco_conn_unlock (conn);if (!sk)
@@ -348,11 +348,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)BT_DBG ("sk %p len %u" , sk, skb->len);if (sk->sk_state !=BT_CONNECTED ) - goto drop; + goto drop_put; -if (!sock_queue_rcv_skb (sk, skb)) +if (!sock_queue_rcv_skb (sk, skb)) { +sock_put (sk);return ; + } +drop_put: +sock_put (sk); drop:kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/312 Bluetooth: hci_ll: Fix firmware leak on error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anas Iqbal <[email protected]>
[ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ]
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned firmware content is invalid (no data or zero size), the function returns without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when request_firmware() succeeded but the firmware content is invalid.
--- drivers/bluetooth/hci_ll.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/hci_ll.c +2 -0
@@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev)if (err || !fw->data || !fw->size) {bt_dev_err (lldev->hu.hdev,"request_firmware failed(errno %d) for %s" , err, bts_scr_name); +if (!err) +release_firmware (fw);return -EINVAL ; } ptr = (void *)fw->data;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/312 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <[email protected]>
[ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Workqueue: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entered promiscuous mode RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x18c0 process_scheduled_works+0xb6e/0x18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entered promiscuous mode ? __switch_to+0xc7d/0x1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- batman_adv: batadv0: Interface activated: batadv_slave_0 batman_adv: batadv0: Interface activated: batadv_slave_1 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception
--- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_sock.c +3 -0
@@ -1701,6 +1701,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan)struct sock *sk = chan->data;struct sock *parent; +if (!sk) +return ; +lock_sock (sk); parent =bt_sk (sk)->parent;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/312 pinctrl: mediatek: common: Fix probe failure for devices without EINT
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <[email protected]>
[ Upstream commit 8f9f64c8f90dca07d3b9f1d7ce5d34ccd246c9dd ]
Some pinctrl devices like mt6397 or mt6392 don't support EINT at all, but the mtk_eint_init function is always called and returns -ENODEV, which then bubbles up and causes probe failure.
To address this only call mtk_eint_init if EINT pins are present.
Tested on Xiaomi Mi Smart Clock x04g (mt6392).
--- drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mtk-common.c +6 -3
@@ -1127,9 +1127,12 @@ int mtk_pctrl_init(struct platform_device *pdev, goto chip_error; } - ret =mtk_eint_init (pctl, pdev); -if (ret) - goto chip_error; +/* Only initialize EINT if we have EINT pins */ +if (data->eint_hw.ap_num >0 ) { + ret =mtk_eint_init (pctl, pdev); +if (ret) + goto chip_error; + }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/312 ionic: fix persistent MAC address override on PF
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammad Heib <[email protected]>
[ Upstream commit cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed ]
The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes the ionic firmware to update the LIF's identity in its persistent state. Since the firmware state is maintained across host warm boots and driver reloads, any MAC change on the Physical Function (PF) becomes "sticky.
This is problematic because it causes ethtool -P to report the user-configured MAC as the permanent factory address, which breaks system management tools that rely on a stable hardware identity.
While Virtual Functions (VFs) need this hardware-level programming to properly handle MAC assignments in guest environments, the PF should maintain standard transient behavior. This patch gates the ionic_program_mac call using is_virtfn so that PF MAC changes remain local to the netdev filters and do not overwrite the firmware's permanent identity block.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +11 -6
@@ -1665,13 +1665,18 @@ static int ionic_set_mac_address(struct net_device *netdev, void *sa)if (ether_addr_equal (netdev->dev_addr, mac))return 0 ; - err =ionic_program_mac (lif, mac); -if (err <0 ) -return err; +/* Only program macs for virtual functions to avoid losing the permanent +* Mac across warm reset/reboot. +*/ +if (lif->ionic->pdev->is_virtfn) { + err =ionic_program_mac (lif, mac); +if (err <0 ) +return err; -if (err >0 ) -netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , - __func__); +if (err >0 ) +netdev_dbg (netdev,"%s: SET and GET ATTR Mac are not equal-due to old FW running\n" , + __func__); + } err =eth_prepare_mac_addr_change (netdev, addr);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/312 nfc: nci: fix circular locking dependency in nci_close_device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4527025d440ce84bf56e75ce1df2e84cb8178616 ]
nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.
--- net/nfc/nci/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/nfc/nci/core.c +6 -4
@@ -574,8 +574,7 @@ static int nci_close_device(struct nci_dev *ndev)skb_queue_purge (&ndev->rx_q);skb_queue_purge (&ndev->tx_q); -/* Flush RX and TX wq */ -flush_workqueue (ndev->rx_wq); +/* Flush TX wq, RX wq flush can't be under the lock */ flush_workqueue (ndev->tx_wq);/* Reset device */
@@ -587,13 +586,13 @@ static int nci_close_device(struct nci_dev *ndev) msecs_to_jiffies(NCI_RESET_TIMEOUT));/* After this point our queues are empty -* and no works are scheduled. +* rx work may be running but will see that NCI_UP was cleared */ ndev->ops->close (ndev);clear_bit (NCI_INIT , &ndev->flags); -/* Flush cmd wq */ +/* Flush cmd and tx wq */ flush_workqueue (ndev->cmd_wq);del_timer_sync (&ndev->cmd_timer);
@@ -603,6 +602,9 @@ static int nci_close_device(struct nci_dev *ndev)mutex_unlock (&ndev->req_lock); +/* rx_work may take req_lock via nci_deactivate_target */ +flush_workqueue (ndev->rx_wq); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/312 net: openvswitch: Avoid releasing netdev before teardown completes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 ]
The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev.
The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like:
[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] <TASK> [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 [ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 [ 998.394200] </TASK>
To fix this, reorder the operations in ovs_netdev_detach_dev() to only clear the flag after completing the other operations, and introduce an smp_wmb() to make the ordering requirement explicit. The smp_wmb() is paired with a full smp_mb() in netdev_destroy() to make sure the call_rcu() invocation does not happen before the unregister operations are visible.
--- net/openvswitch/vport-netdev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/openvswitch/vport-netdev.c +8 -1
@@ -144,11 +144,15 @@ static void vport_netdev_free(struct rcu_head *rcu)void ovs_netdev_detach_dev (struct vport *vport) {ASSERT_RTNL (); - vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ;netdev_rx_handler_unregister (vport->dev);netdev_upper_dev_unlink (vport->dev,netdev_master_upper_dev_get (vport->dev));dev_set_promiscuity (vport->dev,-1 ); + +/* paired with smp_mb() in netdev_destroy() */ +smp_wmb (); + + vport->dev->priv_flags &= ~IFF_OVS_DATAPATH ; }static void netdev_destroy (struct vport *vport)
@@ -167,6 +171,9 @@ static void netdev_destroy(struct vport *vport)rtnl_unlock (); } +/* paired with smp_wmb() in ovs_netdev_detach_dev() */ +smp_mb (); +call_rcu (&vport->rcu, vport_netdev_free); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/312 rtnetlink: pass netlink message header and portid to rtnl_configure_link()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 1d997f1013079c05b642c739901e3584a3ae558d ]
This patch pass netlink message header and portid to rtnl_configure_link() All the functions in this call chain need to add the parameters so we can use them in the last call rtnl_notify(), and notify the userspace about the new link info if NLM_F_ECHO flag is set.
- rtnl_configure_link()
- __dev_notify_flags()
- rtmsg_ifinfo()
- rtmsg_ifinfo_event()
- rtmsg_ifinfo_build_skb()
- rtmsg_ifinfo_send()
- rtnl_notify()
Also move __dev_notify_flags() declaration to net/core/dev.h, as Jakub suggested.
Stable-dep-of: 6931d21f87bc ("openvswitch: defer tunnel netdev_put to RCU release")
--- drivers/net/can/vxcan.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/veth.c | 2 +- drivers/net/vxlan/vxlan_core.c | 4 ++-- drivers/net/wwan/wwan_core.c | 2 +- include/linux/netdevice.h | 2 -- include/linux/rtnetlink.h | 9 +++++---- include/net/netlink.h | 11 +++++++++++ include/net/rtnetlink.h | 3 ++- net/core/dev.c | 25 ++++++++++++------------ net/core/dev.h | 4 ++++ net/core/rtnetlink.c | 35 ++++++++++++++++++---------------- net/ipv4/ip_gre.c | 2 +- 13 files changed, 61 insertions(+), 42 deletions(-)
drivers/net/can/vxcan.c +1 -1
@@ -231,7 +231,7 @@ static int vxcan_newlink(struct net *net, struct net_device *dev,netif_carrier_off (peer); - err =rtnl_configure_link (peer, ifmp); + err =rtnl_configure_link (peer, ifmp,0 ,NULL );if (err <0 ) goto unregister_network_device;
drivers/net/geneve.c +1 -1
@@ -1924,7 +1924,7 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,if (err) goto err; - err =rtnl_configure_link (dev,NULL ); + err =rtnl_configure_link (dev,NULL ,0 ,NULL );if (err <0 ) goto err;
drivers/net/veth.c +1 -1
@@ -1734,7 +1734,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,veth_disable_gro (peer);netif_carrier_off (peer); - err =rtnl_configure_link (peer, ifmp); + err =rtnl_configure_link (peer, ifmp,0 ,NULL );if (err <0 ) goto err_configure_peer;
drivers/net/vxlan/vxlan_core.c +2 -2
@@ -3880,7 +3880,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, goto errout; } - err =rtnl_configure_link (dev,NULL ); + err =rtnl_configure_link (dev,NULL ,0 ,NULL );if (err <0 ) goto unlink;
@@ -4516,7 +4516,7 @@ struct net_device *vxlan_dev_create(struct net *net, const char *name,return ERR_PTR (err); } - err =rtnl_configure_link (dev,NULL ); + err =rtnl_configure_link (dev,NULL ,0 ,NULL );if (err <0 ) {LIST_HEAD (list_kill);
drivers/net/wwan/wwan_core.c +1 -1
@@ -1058,7 +1058,7 @@ static void wwan_create_default_link(struct wwan_device *wwandev, goto unlock; } -rtnl_configure_link (dev,NULL );/* Link initialized, notify new link */ +rtnl_configure_link (dev,NULL ,0 ,NULL );/* Link initialized, notify new link */ unlock:rtnl_unlock ();
include/linux/netdevice.h +0 -2
@@ -3911,8 +3911,6 @@ int __dev_change_flags(struct net_device *dev, unsigned int flags, struct netlink_ext_ack *extack);int dev_change_flags (struct net_device *dev,unsigned int flags,struct netlink_ext_ack *extack); -void __dev_notify_flags (struct net_device *,unsigned int old_flags, -unsigned int gchanges);int dev_set_alias (struct net_device *,const char *,size_t );int dev_get_alias (const struct net_device *,char *,size_t ); int __dev_change_net_namespace(struct net_device *dev, struct net *net,
include/linux/rtnetlink.h +5 -4
@@ -12,21 +12,22 @@extern int rtnetlink_send (struct sk_buff *skb,struct net *net,u32 pid,u32 group,int echo);extern int rtnl_unicast (struct sk_buff *skb,struct net *net,u32 pid);extern void rtnl_notify (struct sk_buff *skb,struct net *net,u32 pid, -u32 group,struct nlmsghdr *nlh,gfp_t flags); +u32 group,const struct nlmsghdr *nlh,gfp_t flags);extern void rtnl_set_sk_err (struct net *net,u32 group,int error);extern int rtnetlink_put_metrics (struct sk_buff *skb,u32 *metrics);extern int rtnl_put_cacheinfo (struct sk_buff *skb,struct dst_entry *dst,u32 id,long expires,u32 error); -void rtmsg_ifinfo (int type,struct net_device *dev,unsigned change,gfp_t flags); +void rtmsg_ifinfo (int type,struct net_device *dev,unsigned int change,gfp_t flags, +u32 portid,const struct nlmsghdr *nlh);void rtmsg_ifinfo_newnet (int type,struct net_device *dev,unsigned int change,gfp_t flags,int *new_nsid,int new_ifindex);struct sk_buff *rtmsg_ifinfo_build_skb (int type,struct net_device *dev,unsigned change,u32 event,gfp_t flags,int *new_nsid, -int new_ifindex); +int new_ifindex,u32 portid,u32 seq);void rtmsg_ifinfo_send (struct sk_buff *skb,struct net_device *dev, -gfp_t flags); +gfp_t flags,u32 portid,const struct nlmsghdr *nlh);/* RTNL is used as a global lock for all changes to network configuration */
include/net/netlink.h +11 -0
@@ -905,6 +905,17 @@ static inline int nlmsg_report(const struct nlmsghdr *nlh)return nlh ? !!(nlh->nlmsg_flags &NLM_F_ECHO ) :0 ; } +/** +* nlmsg_seq - return the seq number of netlink message +* @nlh: netlink message header +* +* Returns 0 if netlink message is NULL +*/ +static inline u32 nlmsg_seq (const struct nlmsghdr *nlh) +{ +return nlh ? nlh->nlmsg_seq :0 ; +} +/** * nlmsg_for_each_attr - iterate over a stream of attributes * @pos: loop counter, set to current attribute
include/net/rtnetlink.h +2 -1
@@ -204,7 +204,8 @@ struct net_device *rtnl_create_link(struct net *net, const char *ifname,struct nlattr *tb[], struct netlink_ext_ack *extack);int rtnl_delete_link (struct net_device *dev); -int rtnl_configure_link (struct net_device *dev,const struct ifinfomsg *ifm); +int rtnl_configure_link (struct net_device *dev,const struct ifinfomsg *ifm, +u32 portid,const struct nlmsghdr *nlh);int rtnl_nla_parse_ifinfomsg (struct nlattr **tb,const struct nlattr *nla_peer,struct netlink_ext_ack *exterr);
net/core/dev.c +13 -12
@@ -1402,7 +1402,7 @@ void netdev_state_change(struct net_device *dev)call_netdevice_notifiers_info (NETDEV_CHANGE , &change_info.info); -rtmsg_ifinfo (RTM_NEWLINK , dev,0 ,GFP_KERNEL ); +rtmsg_ifinfo (RTM_NEWLINK , dev,0 ,GFP_KERNEL ,0 ,NULL ); } }EXPORT_SYMBOL (netdev_state_change);
@@ -1538,7 +1538,7 @@ int dev_open(struct net_device *dev, struct netlink_ext_ack *extack)if (ret <0 )return ret; -rtmsg_ifinfo (RTM_NEWLINK , dev,IFF_UP |IFF_RUNNING ,GFP_KERNEL ); +rtmsg_ifinfo (RTM_NEWLINK , dev,IFF_UP |IFF_RUNNING ,GFP_KERNEL ,0 ,NULL );call_netdevice_notifiers (NETDEV_UP , dev);return ret;
@@ -1610,7 +1610,7 @@ void dev_close_many(struct list_head *head, bool unlink)__dev_close_many (head);list_for_each_entry_safe (dev, tmp, head, close_list) { -rtmsg_ifinfo (RTM_NEWLINK , dev,IFF_UP |IFF_RUNNING ,GFP_KERNEL ); +rtmsg_ifinfo (RTM_NEWLINK , dev,IFF_UP |IFF_RUNNING ,GFP_KERNEL ,0 ,NULL );call_netdevice_notifiers (NETDEV_DOWN , dev);if (unlink)list_del_init (&dev->close_list);
@@ -8472,7 +8472,7 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc, bool notify)dev_change_rx_flags (dev,IFF_PROMISC ); }if (notify) -__dev_notify_flags (dev, old_flags,IFF_PROMISC ); +__dev_notify_flags (dev, old_flags,IFF_PROMISC ,0 ,NULL );return 0 ; }
@@ -8527,7 +8527,7 @@ static int __dev_set_allmulti(struct net_device *dev, int inc, bool notify)dev_set_rx_mode (dev);if (notify)__dev_notify_flags (dev, old_flags, - dev->gflags ^ old_gflags); + dev->gflags ^ old_gflags,0 ,NULL ); }return 0 ; }
@@ -8690,12 +8690,13 @@ int __dev_change_flags(struct net_device *dev, unsigned int flags, }void __dev_notify_flags (struct net_device *dev,unsigned int old_flags, -unsigned int gchanges) +unsigned int gchanges,u32 portid, +const struct nlmsghdr *nlh) {unsigned int changes = dev->flags ^ old_flags;if (gchanges) -rtmsg_ifinfo (RTM_NEWLINK , dev, gchanges,GFP_ATOMIC ); +rtmsg_ifinfo (RTM_NEWLINK , dev, gchanges,GFP_ATOMIC , portid, nlh);if (changes &IFF_UP ) {if (dev->flags &IFF_UP )
@@ -8737,7 +8738,7 @@ int dev_change_flags(struct net_device *dev, unsigned int flags,return ret; changes = (old_flags ^ dev->flags) | (old_gflags ^ dev->gflags); -__dev_notify_flags (dev, old_flags, changes); +__dev_notify_flags (dev, old_flags, changes,0 ,NULL );return ret; }EXPORT_SYMBOL (dev_change_flags);
@@ -10274,7 +10275,7 @@ int register_netdevice(struct net_device *dev)*/ if (!dev->rtnl_link_ops || dev->rtnl_link_state ==RTNL_LINK_INITIALIZED ) -rtmsg_ifinfo (RTM_NEWLINK , dev, ~0U ,GFP_KERNEL ); +rtmsg_ifinfo (RTM_NEWLINK , dev, ~0U ,GFP_KERNEL ,0 ,NULL ); out:return ret;
@@ -11018,7 +11019,7 @@ void unregister_netdevice_many(struct list_head *head)if (!dev->rtnl_link_ops || dev->rtnl_link_state ==RTNL_LINK_INITIALIZED ) skb =rtmsg_ifinfo_build_skb (RTM_DELLINK , dev, ~0U ,0 , -GFP_KERNEL ,NULL ,0 ); +GFP_KERNEL ,NULL ,0 ,0 ,0 );/* * Flush the unicast and multicast chains
@@ -11033,7 +11034,7 @@ void unregister_netdevice_many(struct list_head *head) dev->netdev_ops->ndo_uninit (dev);if (skb) -rtmsg_ifinfo_send (skb, dev,GFP_KERNEL ); +rtmsg_ifinfo_send (skb, dev,GFP_KERNEL ,0 ,NULL );/* Notifier chain MUST detach us all upper devices. */ WARN_ON (netdev_has_any_upper_dev (dev));
@@ -11221,7 +11222,7 @@ int __dev_change_net_namespace(struct net_device *dev, struct net *net,* Prevent userspace races by waiting until the network * device is fully setup before sending notifications. */ -rtmsg_ifinfo (RTM_NEWLINK , dev, ~0U ,GFP_KERNEL ); +rtmsg_ifinfo (RTM_NEWLINK , dev, ~0U ,GFP_KERNEL ,0 ,NULL );synchronize_net (); err =0 ;
net/core/dev.h +4 -0
@@ -94,6 +94,10 @@ int dev_change_carrier(struct net_device *dev, bool new_carrier);void __dev_set_rx_mode (struct net_device *dev); +void __dev_notify_flags (struct net_device *dev,unsigned int old_flags, +unsigned int gchanges,u32 portid, +const struct nlmsghdr *nlh); +static inline void netif_set_gso_max_size (struct net_device *dev,unsigned int size) {
net/core/rtnetlink.c +19 -16
@@ -789,7 +789,7 @@ int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid)EXPORT_SYMBOL (rtnl_unicast);void rtnl_notify (struct sk_buff *skb,struct net *net,u32 pid,u32 group, -struct nlmsghdr *nlh,gfp_t flags) +const struct nlmsghdr *nlh,gfp_t flags) {struct sock *rtnl = net->rtnl;
@@ -3232,7 +3232,8 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh,return err; } -int rtnl_configure_link (struct net_device *dev,const struct ifinfomsg *ifm) +int rtnl_configure_link (struct net_device *dev,const struct ifinfomsg *ifm, +u32 portid,const struct nlmsghdr *nlh) {unsigned int old_flags;int err;
@@ -3246,10 +3247,10 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm) }if (dev->rtnl_link_state ==RTNL_LINK_INITIALIZED ) { -__dev_notify_flags (dev, old_flags, (old_flags ^ dev->flags)); +__dev_notify_flags (dev, old_flags, (old_flags ^ dev->flags), portid, nlh); }else { dev->rtnl_link_state =RTNL_LINK_INITIALIZED ; -__dev_notify_flags (dev, old_flags, ~0U ); +__dev_notify_flags (dev, old_flags, ~0U , portid, nlh); }return 0 ; }
@@ -3427,7 +3428,7 @@ static int rtnl_newlink_create(struct sk_buff *skb, struct ifinfomsg *ifm, goto out; } - err =rtnl_configure_link (dev, ifm); + err =rtnl_configure_link (dev, ifm,0 ,NULL );if (err <0 ) goto out_unregister;if (link_net) {
@@ -3957,7 +3958,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)struct sk_buff *rtmsg_ifinfo_build_skb (int type,struct net_device *dev,unsigned int change,u32 event,gfp_t flags,int *new_nsid, -int new_ifindex) +int new_ifindex,u32 portid,u32 seq) {struct net *net =dev_net (dev);struct sk_buff *skb;
@@ -3968,7 +3969,7 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev, goto errout; err =rtnl_fill_ifinfo (skb, dev,dev_net (dev), - type,0 ,0 , change,0 ,0 , event, + type, portid, seq, change,0 ,0 , event, new_nsid, new_ifindex,-1 , flags);if (err <0 ) {/* -EMSGSIZE implies BUG in if_nlmsg_size() */
@@ -3983,16 +3984,18 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,return NULL ; } -void rtmsg_ifinfo_send (struct sk_buff *skb,struct net_device *dev,gfp_t flags) +void rtmsg_ifinfo_send (struct sk_buff *skb,struct net_device *dev,gfp_t flags, +u32 portid,const struct nlmsghdr *nlh) {struct net *net =dev_net (dev); -rtnl_notify (skb, net,0 ,RTNLGRP_LINK ,NULL , flags); +rtnl_notify (skb, net, portid,RTNLGRP_LINK , nlh, flags); }static void rtmsg_ifinfo_event (int type,struct net_device *dev,unsigned int change,u32 event, -gfp_t flags,int *new_nsid,int new_ifindex) +gfp_t flags,int *new_nsid,int new_ifindex, +u32 portid,const struct nlmsghdr *nlh) {struct sk_buff *skb;
@@ -4000,23 +4003,23 @@ static void rtmsg_ifinfo_event(int type, struct net_device *dev,return ; skb =rtmsg_ifinfo_build_skb (type, dev, change, event, flags, new_nsid, - new_ifindex); + new_ifindex, portid,nlmsg_seq (nlh));if (skb) -rtmsg_ifinfo_send (skb, dev, flags); +rtmsg_ifinfo_send (skb, dev, flags, portid, nlh); }void rtmsg_ifinfo (int type,struct net_device *dev,unsigned int change, -gfp_t flags) +gfp_t flags,u32 portid,const struct nlmsghdr *nlh) {rtmsg_ifinfo_event (type, dev, change,rtnl_get_event (0 ), flags, -NULL ,0 ); +NULL ,0 , portid, nlh); }void rtmsg_ifinfo_newnet (int type,struct net_device *dev,unsigned int change,gfp_t flags,int *new_nsid,int new_ifindex) {rtmsg_ifinfo_event (type, dev, change,rtnl_get_event (0 ), flags, - new_nsid, new_ifindex); + new_nsid, new_ifindex,0 ,NULL ); } static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
@@ -6199,7 +6202,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voicase NETDEV_CHANGELOWERSTATE :case NETDEV_CHANGE_TX_QUEUE_LEN :rtmsg_ifinfo_event (RTM_NEWLINK , dev,0 ,rtnl_get_event (event), -GFP_KERNEL ,NULL ,0 ); +GFP_KERNEL ,NULL ,0 ,0 ,NULL );break ;default :break ;
net/ipv4/ip_gre.c +1 -1
@@ -1690,7 +1690,7 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,if (err) goto out; - err =rtnl_configure_link (dev,NULL ); + err =rtnl_configure_link (dev,NULL ,0 ,NULL );if (err <0 ) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/312 net: add new helper unregister_netdevice_many_notify
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 77f4aa9a2a1766a0b9343fd812b71f18d05178da ]
Add new helper unregister_netdevice_many_notify(), pass netlink message header and portid, which could be used to notify userspace when flag NLM_F_ECHO is set.
Make the unregister_netdevice_many() as a wrapper of new function unregister_netdevice_many_notify().
Stable-dep-of: 6931d21f87bc ("openvswitch: defer tunnel netdev_put to RCU release")
--- net/core/dev.c | 27 +++++++++++++++++---------- net/core/dev.h | 3 +++ 2 files changed, 20 insertions(+), 10 deletions(-)
net/core/dev.c +17 -10
@@ -10950,14 +10950,8 @@ void unregister_netdevice_queue(struct net_device *dev, struct list_head *head) }EXPORT_SYMBOL (unregister_netdevice_queue); -/** -* unregister_netdevice_many - unregister many devices -* @head: list of devices -* -* Note: As most callers use a stack allocated list_head, -* we force a list_del() to make sure stack wont be corrupted later. -*/ -void unregister_netdevice_many (struct list_head *head) +void unregister_netdevice_many_notify (struct list_head *head, +u32 portid,const struct nlmsghdr *nlh) {struct net_device *dev, *tmp;LIST_HEAD (close_head);
@@ -11019,7 +11013,8 @@ void unregister_netdevice_many(struct list_head *head)if (!dev->rtnl_link_ops || dev->rtnl_link_state ==RTNL_LINK_INITIALIZED ) skb =rtmsg_ifinfo_build_skb (RTM_DELLINK , dev, ~0U ,0 , -GFP_KERNEL ,NULL ,0 ,0 ,0 ); +GFP_KERNEL ,NULL ,0 , + portid,nlmsg_seq (nlh));/* * Flush the unicast and multicast chains
@@ -11034,7 +11029,7 @@ void unregister_netdevice_many(struct list_head *head) dev->netdev_ops->ndo_uninit (dev);if (skb) -rtmsg_ifinfo_send (skb, dev,GFP_KERNEL ,0 ,NULL ); +rtmsg_ifinfo_send (skb, dev,GFP_KERNEL , portid, nlh);/* Notifier chain MUST detach us all upper devices. */ WARN_ON (netdev_has_any_upper_dev (dev));
@@ -11057,6 +11052,18 @@ void unregister_netdevice_many(struct list_head *head)list_del (head); } + +/** +* unregister_netdevice_many - unregister many devices +* @head: list of devices +* +* Note: As most callers use a stack allocated list_head, +* we force a list_del() to make sure stack wont be corrupted later. +*/ +void unregister_netdevice_many (struct list_head *head) +{ +unregister_netdevice_many_notify (head,0 ,NULL ); +}EXPORT_SYMBOL (unregister_netdevice_many);/**
net/core/dev.h +3 -0
@@ -98,6 +98,9 @@ void __dev_notify_flags(struct net_device *dev, unsigned int old_flags, unsigned int gchanges, u32 portid, const struct nlmsghdr *nlh); +void unregister_netdevice_many_notify (struct list_head *head, +u32 portid,const struct nlmsghdr *nlh); +static inline void netif_set_gso_max_size (struct net_device *dev,unsigned int size) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/312 rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit f3a63cce1b4fbde7738395c5a2dea83f05de3407 ]
This patch use the new helper unregister_netdevice_many_notify() for rtnl_delete_link(), so that the kernel could reply unicast when userspace
set NLM_F_ECHO flag to request the new created interface info.
At the same time, the parameters of rtnl_delete_link() need to be updated since we need nlmsghdr and portid info.
Stable-dep-of: 6931d21f87bc ("openvswitch: defer tunnel netdev_put to RCU release")
--- include/net/rtnetlink.h | 2 +- net/core/rtnetlink.c | 7 ++++--- net/openvswitch/vport-geneve.c | 2 +- net/openvswitch/vport-gre.c | 2 +- net/openvswitch/vport-netdev.c | 2 +- net/openvswitch/vport-vxlan.c | 2 +- 6 files changed, 9 insertions(+), 8 deletions(-)
include/net/rtnetlink.h +1 -1
@@ -203,7 +203,7 @@ struct net_device *rtnl_create_link(struct net *net, const char *ifname,const struct rtnl_link_ops *ops, struct nlattr *tb[], struct netlink_ext_ack *extack); -int rtnl_delete_link (struct net_device *dev); +int rtnl_delete_link (struct net_device *dev,u32 portid,const struct nlmsghdr *nlh);int rtnl_configure_link (struct net_device *dev,const struct ifinfomsg *ifm,u32 portid,const struct nlmsghdr *nlh);
net/core/rtnetlink.c +4 -3
@@ -3162,7 +3162,7 @@ static int rtnl_group_dellink(const struct net *net, int group)return 0 ; } -int rtnl_delete_link (struct net_device *dev) +int rtnl_delete_link (struct net_device *dev,u32 portid,const struct nlmsghdr *nlh) {const struct rtnl_link_ops *ops;LIST_HEAD (list_kill);
@@ -3172,7 +3172,7 @@ int rtnl_delete_link(struct net_device *dev)return -EOPNOTSUPP ; ops->dellink (dev, &list_kill); -unregister_netdevice_many (&list_kill); +unregister_netdevice_many_notify (&list_kill, portid, nlh);return 0 ; }
@@ -3182,6 +3182,7 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, struct netlink_ext_ack *extack) {struct net *net =sock_net (skb->sk); +u32 portid =NETLINK_CB (skb).portid;struct net *tgt_net = net;struct net_device *dev =NULL ;struct ifinfomsg *ifm;
@@ -3223,7 +3224,7 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, goto out; } - err =rtnl_delete_link (dev); + err =rtnl_delete_link (dev, portid, nlh); out:if (netnsid >=0 )
net/openvswitch/vport-geneve.c +1 -1
@@ -91,7 +91,7 @@ static struct vport *geneve_tnl_create(const struct vport_parms *parms) err =dev_change_flags (dev, dev->flags |IFF_UP ,NULL );if (err <0 ) { -rtnl_delete_link (dev); +rtnl_delete_link (dev,0 ,NULL );rtnl_unlock ();ovs_vport_free (vport); goto error;
net/openvswitch/vport-gre.c +1 -1
@@ -57,7 +57,7 @@ static struct vport *gre_tnl_create(const struct vport_parms *parms) err =dev_change_flags (dev, dev->flags |IFF_UP ,NULL );if (err <0 ) { -rtnl_delete_link (dev); +rtnl_delete_link (dev,0 ,NULL );rtnl_unlock ();ovs_vport_free (vport);return ERR_PTR (err);
net/openvswitch/vport-netdev.c +1 -1
@@ -188,7 +188,7 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)* if it's not already shutting down. */ if (vport->dev->reg_state ==NETREG_REGISTERED ) -rtnl_delete_link (vport->dev); +rtnl_delete_link (vport->dev,0 ,NULL );netdev_put (vport->dev, &vport->dev_tracker); vport->dev =NULL ;rtnl_unlock ();
net/openvswitch/vport-vxlan.c +1 -1
@@ -120,7 +120,7 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms) err =dev_change_flags (dev, dev->flags |IFF_UP ,NULL );if (err <0 ) { -rtnl_delete_link (dev); +rtnl_delete_link (dev,0 ,NULL );rtnl_unlock ();ovs_vport_free (vport); goto error;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/312 openvswitch: defer tunnel netdev_put to RCU release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 6931d21f87bc6d657f145798fad0bf077b82486c ]
ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
--- net/openvswitch/vport-netdev.c | 2 -- 1 file changed, 2 deletions(-)
net/openvswitch/vport-netdev.c +0 -2
@@ -189,8 +189,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)*/ if (vport->dev->reg_state ==NETREG_REGISTERED )rtnl_delete_link (vport->dev,0 ,NULL ); -netdev_put (vport->dev, &vport->dev_tracker); - vport->dev =NULL ;rtnl_unlock ();call_rcu (&vport->rcu, vport_netdev_free);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/312 openvswitch: validate MPLS set/set_masked payload length
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yang <[email protected]>
[ Upstream commit 546b68ac893595877ffbd7751e5c55fd1c43ede6 ]
validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls).
Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes.
Reject invalid MPLS action payload lengths early.
--- net/openvswitch/flow_netlink.c | 2 ++ 1 file changed, 2 insertions(+)
net/openvswitch/flow_netlink.c +2 -0
@@ -2937,6 +2937,8 @@ static int validate_set(const struct nlattr *a,case OVS_KEY_ATTR_MPLS :if (!eth_p_mpls (eth_type))return -EINVAL ; +if (key_len !=sizeof (struct ovs_key_mpls )) +return -EINVAL ;break ;case OVS_KEY_ATTR_SCTP :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/312 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Tang <[email protected]>
[ Upstream commit 24dd586bb4cbba1889a50abe74143817a095c1c9 ]
smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *.
When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object:
1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]
KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer:
BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception
Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately.
The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
--- net/smc/smc_rx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/smc/smc_rx.c +8 -1
@@ -131,9 +131,16 @@ static void smc_rx_pipe_buf_release(struct pipe_inode_info *pipe,sock_put (sk); } +static bool smc_rx_pipe_buf_get (struct pipe_inode_info *pipe, +struct pipe_buffer *buf) +{ +/* smc_spd_priv in buf->private is not shareable; disallow cloning. */ +return false; +} +static const struct pipe_buf_operations smc_pipe_ops = { .release = smc_rx_pipe_buf_release, - .get = generic_pipe_buf_get + .get = smc_rx_pipe_buf_get, }; static void smc_rx_spd_release(struct splice_pipe_desc *spd,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/312 rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit ee00a12593ffb69db4dd1a1c00ecb0253376874a ]
rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and IFLA_INFO_SLAVE_KIND.
--- net/core/rtnetlink.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/rtnetlink.c +6 -3
@@ -567,11 +567,14 @@ static size_t rtnl_link_get_slave_info_data_size(const struct net_device *dev) goto out; ops = master_dev->rtnl_link_ops; -if (!ops || !ops->get_slave_size) +if (!ops) + goto out; + size +=nla_total_size (strlen (ops->kind) +1 );/* IFLA_INFO_SLAVE_KIND */ +if (!ops->get_slave_size) goto out;/* IFLA_INFO_SLAVE_DATA + nested data */ - size =nla_total_size (sizeof (struct nlattr )) + - ops->get_slave_size (master_dev, dev); + size +=nla_total_size (sizeof (struct nlattr )) + + ops->get_slave_size (master_dev, dev); out:rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/312 platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 2061f7b042f88d372cca79615f8425f3564c0b40 ]
The command length check validates inlen (> 5), but the error message incorrectly printed resp_len. Print inlen so the log reflects the actual command length.
--- drivers/platform/olpc/olpc-xo175-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/olpc/olpc-xo175-ec.c +1 -1
@@ -482,7 +482,7 @@ static int olpc_xo175_ec_cmd(u8 cmd, u8 *inbuf, size_t inlen, u8 *resp,dev_dbg (dev,"CMD %x, %zd bytes expected\n" , cmd, resp_len);if (inlen >5 ) { -dev_err (dev,"command len %zd too big!\n" , resp_len); +dev_err (dev,"command len %zd too big!\n" , inlen);return -EOVERFLOW ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/312 ice: use ice_update_eth_stats() for representor stats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 2526e440df2725e7328d59b835a164826f179b93 ]
ice_repr_get_stats64() and __ice_get_ethtool_stats() call ice_update_vsi_stats() on the VF's src_vsi. This always returns early because ICE_VSI_DOWN is permanently set for VF VSIs - ice_up() is never called on them since queues are managed by iavf through virtchnl.
In __ice_get_ethtool_stats() the original code called ice_update_vsi_stats() for all VSIs including representors, iterated over ice_gstrings_vsi_stats[] to populate the data, and then bailed out with an early return before the per-queue ring stats section. That early return was necessary because representor VSIs have no rings on the PF side - the rings belong to the VF driver (iavf), so accessing per-queue stats would be invalid.
Move the representor handling to the top of __ice_get_ethtool_stats() and call ice_update_eth_stats() directly to read the hardware GLV_* counters. This matches ice_get_vf_stats() which already uses ice_update_eth_stats() for the same VF VSI in legacy mode. Apply the same fix to ice_repr_get_stats64().
Note that ice_gstrings_vsi_stats[] contains five software ring counters (rx_buf_failed, rx_page_failed, tx_linearize, tx_busy, tx_restart) that are always zero for representors since the PF never processes packets on VF rings. This is pre-existing behavior unchanged by this patch.
--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 14 +++++++++++--- drivers/net/ethernet/intel/ice/ice_repr.c | 3 ++- 2 files changed, 13 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool.c +11 -3
@@ -1358,6 +1358,17 @@ __ice_get_ethtool_stats(struct net_device *netdev,int i =0 ;char *p; +if (ice_is_port_repr_netdev (netdev)) { +ice_update_eth_stats (vsi); + +for (j =0 ; j <ICE_VSI_STATS_LEN ; j++) { + p = (char *)vsi + ice_gstrings_vsi_stats[j].stat_offset; + data[i++] = (ice_gstrings_vsi_stats[j].sizeof_stat == +sizeof (u64)) ? *(u64 *)p : *(u32 *)p; + } +return ; + } +ice_update_pf_stats (pf);ice_update_vsi_stats (vsi);
@@ -1367,9 +1378,6 @@ __ice_get_ethtool_stats(struct net_device *netdev, sizeof(u64)) ? *(u64 *)p : *(u32 *)p; } -if (ice_is_port_repr_netdev (netdev)) -return ; -/* populate per queue stats */ rcu_read_lock ();
drivers/net/ethernet/intel/ice/ice_repr.c +2 -1
@@ -2,6 +2,7 @@/* Copyright (C) 2019-2021, Intel Corporation. */ #include "ice.h" +#include "ice_lib.h" #include "ice_eswitch.h" #include "ice_devlink.h" #include "ice_sriov.h"
@@ -56,7 +57,7 @@ ice_repr_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats)return ; vsi = np->repr->src_vsi; -ice_update_vsi_stats (vsi); +ice_update_eth_stats (vsi); eth_stats = &vsi->eth_stats; stats->tx_packets = eth_stats->tx_unicast + eth_stats->tx_broadcast +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/312 net: fix fanout UAF in packet_release() via NETDEV_UP race
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <[email protected]>
[ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array.packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.
The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
--- net/packet/af_packet.c | 1 + 1 file changed, 1 insertion(+)
net/packet/af_packet.c +1 -0
@@ -3185,6 +3185,7 @@ static int packet_release(struct socket *sock)spin_lock (&po->bind_lock);unregister_prot_hook (sk, false); +WRITE_ONCE (po->num,0 );packet_cached_dev_reset (po);if (po->prot_hook.dev) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/312 tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 5e07e672412bed473122813ab35d4f7d42fd9635 ]
While checking port availability in bind() or listen(), we used only bhash for all v4-mapped-v6 addresses. But there is no good reason not to use bhash2 for v4-mapped-v6 non-wildcard addresses.
Let's do it by returning true in inet_use_bhash2_on_bind(). Then, we also need to add a test in inet_bind2_bucket_match_addr_any() so that ::ffff:X.X.X.X will match with 0.0.0.0.
Note that sk->sk_rcv_saddr is initialised for v4-mapped-v6 sk in __inet6_bind().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 7 +++++-- net/ipv4/inet_hashtables.c | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-)
net/ipv4/inet_connection_sock.c +5 -2
@@ -157,8 +157,11 @@ static bool inet_use_bhash2_on_bind(const struct sock *sk)if (sk->sk_family ==AF_INET6 ) {int addr_type =ipv6_addr_type (&sk->sk_v6_rcv_saddr); -return addr_type !=IPV6_ADDR_ANY && - addr_type !=IPV6_ADDR_MAPPED ; +if (addr_type ==IPV6_ADDR_ANY ) +return false; + +if (addr_type !=IPV6_ADDR_MAPPED ) +return true; }#endif return sk->sk_rcv_saddr !=htonl (INADDR_ANY );
net/ipv4/inet_hashtables.c +2 -1
@@ -832,7 +832,8 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, constreturn ipv6_addr_any (&tb->v6_rcv_saddr) ||ipv6_addr_v4mapped_any (&tb->v6_rcv_saddr); -return false; +return ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr) && + tb->rcv_saddr ==0 ; }if (sk->sk_family ==AF_INET6 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/312 tcp: Rearrange tests in inet_csk_bind_conflict().
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 58655bc0ad7ccdd5b53319bcc091cb81b6aee7c3 ]
The following patch adds code in the !inet_use_bhash2_on_bind(sk) case in inet_csk_bind_conflict().
To avoid adding nest and make the change cleaner, this patch rearranges tests in inet_csk_bind_conflict().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 40 ++++++++++++++++----------------- 1 file changed, 19 insertions(+), 21 deletions(-)
net/ipv4/inet_connection_sock.c +19 -21
@@ -240,9 +240,10 @@ static int inet_csk_bind_conflict(const struct sock *sk,const struct inet_bind2_bucket *tb2,/* may be null */ bool relax, bool reuseport_ok) { - bool reuseport_cb_ok; -struct sock_reuseport *reuseport_cb; kuid_t uid = sock_i_uid((struct sock *)sk); +struct sock_reuseport *reuseport_cb; +bool reuseport_cb_ok; +struct sock *sk2;rcu_read_lock (); reuseport_cb =rcu_dereference (sk->sk_reuseport_cb);
@@ -250,32 +251,29 @@ static int inet_csk_bind_conflict(const struct sock *sk, reuseport_cb_ok = !reuseport_cb ||READ_ONCE (reuseport_cb->num_closed_socks);rcu_read_unlock (); -/* -* Unlike other sk lookup places we do not check +/* Conflicts with an existing IPV6_ADDR_ANY (if ipv6) or INADDR_ANY (if +* ipv4) should have been checked already. We need to do these two +* checks separately because their spinlocks have to be acquired/released +* independently of each other, to prevent possible deadlocks +*/ +if (inet_use_bhash2_on_bind (sk)) +return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, + reuseport_cb_ok, reuseport_ok); + +/* Unlike other sk lookup places we do not check * for sk_net here, since _all_ the socks listed * in tb->owners and tb2->owners list belong * to the same net - the one this bucket belongs to. */ +sk_for_each_bound (sk2, &tb->owners) { +if (!inet_bind_conflict (sk, sk2, uid, relax, reuseport_cb_ok, reuseport_ok)) +continue ; -if (!inet_use_bhash2_on_bind (sk)) { -struct sock *sk2; - -sk_for_each_bound (sk2, &tb->owners) -if (inet_bind_conflict (sk, sk2, uid, relax, - reuseport_cb_ok, reuseport_ok) && -inet_rcv_saddr_equal (sk, sk2, true)) -return true; - -return false; +if (inet_rcv_saddr_equal (sk, sk2, true)) +return true; } -/* Conflicts with an existing IPV6_ADDR_ANY (if ipv6) or INADDR_ANY (if -* ipv4) should have been checked already. We need to do these two -* checks separately because their spinlocks have to be acquired/released -* independently of each other, to prevent possible deadlocks -*/ -return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, - reuseport_ok); +return false; }/* Determine if there is a bind conflict with an existing IPV6_ADDR_ANY (if ipv6) or
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/312 tcp: optimize inet_use_bhash2_on_bind()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ca79d80b0b9f42362a893f06413a9fe91811158a ]
There is no reason to call ipv6_addr_type().
Instead, use highly optimized ipv6_addr_any() and ipv6_addr_v4mapped().
Stable-dep-of: e537dd15d0d4 ("udp: Fix wildcard bind conflict check when using hash2")
--- net/ipv4/inet_connection_sock.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv4/inet_connection_sock.c +2 -4
@@ -155,12 +155,10 @@ static bool inet_use_bhash2_on_bind(const struct sock *sk) {#if IS_ENABLED (CONFIG_IPV6 )if (sk->sk_family ==AF_INET6 ) { -int addr_type =ipv6_addr_type (&sk->sk_v6_rcv_saddr); - -if (addr_type ==IPV6_ADDR_ANY ) +if (ipv6_addr_any (&sk->sk_v6_rcv_saddr))return false; -if (addr_type !=IPV6_ADDR_MAPPED ) +if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr))return true; }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/312 udp: Fix wildcard bind conflict check when using hash2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit e537dd15d0d4ad989d56a1021290f0c674dd8b28 ]
When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10.
"hash2" is keyed by local address and local port. "hash" is keyed by local port only.
The issue can be shown in the following bind sequence (pseudo code):
bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888")
bind(fd10, "[fd00::10]:8888")
/* Correctly return -EADDRINUSE because "hash" is used
* instead of "hash2". udp_lib_lport_inuse() detects the
* conflict.
*/bind(fail_fd, "[::]:8888")
/* After one more socket is bound to "[fd00::11]:8888",
* hslot->count exceeds 10 and "hash2" is used instead. */bind(fd11, "[fd00::11]:8888")bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */
The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10.
TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix.
--- include/net/inet_hashtables.h | 14 ++++++++++++++ net/ipv4/inet_connection_sock.c | 20 +++----------------- net/ipv4/udp.c | 2 +- 3 files changed, 18 insertions(+), 18 deletions(-)
include/net/inet_hashtables.h +14 -0
@@ -278,6 +278,20 @@ inet_bhashfn_portaddr(const struct inet_hashinfo *hinfo, const struct sock *sk,return &hinfo->bhash2[hash & (hinfo->bhash_size -1 )]; } +static inline bool inet_use_hash2_on_bind (const struct sock *sk) +{ +#if IS_ENABLED (CONFIG_IPV6 ) +if (sk->sk_family ==AF_INET6 ) { +if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) +return false; + +if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) +return true; + } +#endif +return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); +} +struct inet_bind_hashbucket *inet_bhash2_addr_any_hashbucket (const struct sock *sk,const struct net *net,int port);
net/ipv4/inet_connection_sock.c +3 -17
@@ -151,20 +151,6 @@ void inet_sk_get_local_port_range(const struct sock *sk, int *low, int *high) }EXPORT_SYMBOL (inet_sk_get_local_port_range); -static bool inet_use_bhash2_on_bind (const struct sock *sk) -{ -#if IS_ENABLED (CONFIG_IPV6 ) -if (sk->sk_family ==AF_INET6 ) { -if (ipv6_addr_any (&sk->sk_v6_rcv_saddr)) -return false; - -if (!ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) -return true; - } -#endif -return sk->sk_rcv_saddr !=htonl (INADDR_ANY ); -} -static bool inet_bind_conflict (const struct sock *sk,struct sock *sk2,kuid_t sk_uid,bool relax,bool reuseport_cb_ok,bool reuseport_ok)
@@ -254,7 +240,7 @@ static int inet_csk_bind_conflict(const struct sock *sk,* checks separately because their spinlocks have to be acquired/released * independently of each other, to prevent possible deadlocks */ -if (inet_use_bhash2_on_bind (sk)) +if (inet_use_hash2_on_bind (sk))return tb2 &&inet_bhash2_conflict (sk, tb2, uid, relax, reuseport_cb_ok, reuseport_ok);
@@ -371,7 +357,7 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret, head = &hinfo->bhash[inet_bhashfn (net, port, hinfo->bhash_size)];spin_lock_bh (&head->lock); -if (inet_use_bhash2_on_bind (sk)) { +if (inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, relax, false)) goto next_port; }
@@ -556,7 +542,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum) check_bind_conflict = false; } -if (check_bind_conflict &&inet_use_bhash2_on_bind (sk)) { +if (check_bind_conflict &&inet_use_hash2_on_bind (sk)) {if (inet_bhash2_addr_any_conflict (sk, port, l3mdev, true, true)) goto fail_unlock; }
net/ipv4/udp.c +1 -1
@@ -280,7 +280,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, }else { hslot =udp_hashslot (udptable, net, snum);spin_lock_bh (&hslot->lock); -if (hslot->count >10 ) { +if (inet_use_hash2_on_bind (sk) && hslot->count >10 ) {int exist;unsigned int slot2 =udp_sk (sk)->udp_portaddr_hash ^ snum;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/312 net: enetc: fix the output issue of ethtool --show-ring
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 70b439bf06f6a12e491f827fa81a9887a11501f9 ]
Currently, enetc_get_ringparam() only provides rx_pending and tx_pending, but 'ethtool --show-ring' no longer displays these fields. Because the ringparam retrieval path has moved to the new netlink interface, where rings_fill_reply() emits the *x_pending only if the *x_max_pending values are non-zero. So rx_max_pending and tx_max_pending to are added to enetc_get_ringparam() to fix the issue.
Note that the maximum tx/rx ring size of hardware is 64K, but we haven't added set_ringparam() to make the ring size configurable. To avoid users mistakenly believing that the ring size can be increased, so set the *x_max_pending to priv->*x_bd_count.
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +2 -0
@@ -677,6 +677,8 @@ static void enetc_get_ringparam(struct net_device *ndev, {struct enetc_ndev_priv *priv =netdev_priv (ndev); + ring->rx_max_pending = priv->rx_bd_count; + ring->tx_max_pending = priv->tx_bd_count; ring->rx_pending = priv->rx_bd_count; ring->tx_pending = priv->tx_bd_count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/312 dma-mapping: add missing `inline` for `dma_free_attrs`
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 2cdaff22ed26f1e619aa2b43f27bb84f2c6ef8f8 ]
Under an UML build for an upcoming series [1], I got -Wstatic-in-inline for dma_free_attrs:
BINDGEN rust/bindings/bindings_generated.rs - due to target missing
In file included from rust/helpers/helpers.c:59:
rust/helpers/dma.c:17:2: warning: static function 'dma_free_attrs' is used in an inline function with external linkage [-Wstatic-in-inline]
17 | dma_free_attrs(dev, size, cpu_addr, dma_handle, attrs);
| ^
rust/helpers/dma.c:12:1: note: use 'static' to give inline function 'rust_helper_dma_free_attrs' internal linkage
12 | __rust_helper void rust_helper_dma_free_attrs(struct device *dev, size_t size,
| ^
| static
The issue is that dma_free_attrs was not marked inline when it was introduced alongside the rest of the stubs.
Thus mark it.
--- include/linux/dma-mapping.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/dma-mapping.h +2 -2
@@ -219,8 +219,8 @@ static inline void *dma_alloc_attrs(struct device *dev, size_t size, {return NULL ; } -static void dma_free_attrs (struct device *dev,size_t size,void *cpu_addr, -dma_addr_t dma_handle,unsigned long attrs) +static inline void dma_free_attrs (struct device *dev,size_t size, +void *cpu_addr,dma_addr_t dma_handle,unsigned long attrs) { } static inline void *dmam_alloc_attrs(struct device *dev, size_t size,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/312 Bluetooth: L2CAP: Fix send LE flow credits in ACL link
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Chen <[email protected]>
[ Upstream commit f39f905e55f529b036321220af1ba4f4085564a5 ]
When the L2CAP channel mode is L2CAP_MODE_ERTM/L2CAP_MODE_STREAMING, l2cap_publish_rx_avail will be called and le flow credits will be sent in l2cap_chan_rx_avail, even though the link type is ACL.
The logs in question as follows:
Quoted 1 line
ACL Data RX: Handle 129 flags
0x02dlen 12
L2CAP: Unknown (0x16) ident 4 len 4
40 00 ed 05
< ACL Data TX: Handle 129 flags 0x00 dlen 10
L2CAP: Command Reject (0x01) ident 4 len 2
Reason: Command not understood (0x0000)Bluetooth: Unknown BR/EDR signaling command 0x16
Bluetooth: Wrong link type (-22)
--- net/bluetooth/l2cap_core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/l2cap_core.c +4 -0
@@ -7625,6 +7625,10 @@ static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)struct l2cap_le_credits pkt;u16 return_credits =l2cap_le_rx_credits (chan); +if (chan->mode !=L2CAP_MODE_LE_FLOWCTL && + chan->mode !=L2CAP_MODE_EXT_FLOWCTL ) +return ; +if (chan->rx_credits >= return_credits)return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/312 Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes). However, since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from the initial configuration, the reconfiguration path falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing the previous allocations and sets chan->sdu to NULL without freeing the existing skb. This leaks all previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum value of remote_mps derived from the RFC max_pdu_size option. A zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate since len is never decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state, while still allowing the reconfiguration parameters to be updated through l2cap_parse_conf_req(). Also add a pdu_len zero check in l2cap_segment_sdu() as a safeguard.
--- net/bluetooth/l2cap_core.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/bluetooth/l2cap_core.c +12 -7
@@ -2565,6 +2565,9 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,/* Remote device may have requested smaller PDUs */ pdu_len =min_t (size_t, pdu_len, chan->remote_mps); +if (!pdu_len) +return -EINVAL ; +if (len <= pdu_len) { sar =L2CAP_SAR_UNSEGMENTED ; sdu_len =0 ;
@@ -4539,14 +4542,16 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,if (test_bit (CONF_INPUT_DONE , &chan->conf_state)) {set_default_fcs (chan); -if (chan->mode ==L2CAP_MODE_ERTM || - chan->mode ==L2CAP_MODE_STREAMING ) - err =l2cap_ertm_init (chan); +if (chan->state !=BT_CONNECTED ) { +if (chan->mode ==L2CAP_MODE_ERTM || + chan->mode ==L2CAP_MODE_STREAMING ) + err =l2cap_ertm_init (chan); -if (err <0 ) -l2cap_send_disconn_req (chan, -err); -else -l2cap_chan_ready (chan); +if (err <0 ) +l2cap_send_disconn_req (chan, -err); +else +l2cap_chan_ready (chan); + } goto unlock; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/312 Bluetooth: btusb: clamp SCO altsetting table indices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 129fa608b6ad08b8ab7178eeb2ec272c993aaccc ]
btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries.
While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[].
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -2096,8 +2096,11 @@ static void btusb_work(struct work_struct *work)if (data->air_mode ==HCI_NOTIFY_ENABLE_SCO_CVSD ) {if (hdev->voice_setting &0x0020 ) {static const int alts[3 ] = {2 ,4 ,5 }; +unsigned int sco_idx; - new_alts = alts[data->sco_num -1 ]; + sco_idx = min_t(unsigned int, data->sco_num - 1, +ARRAY_SIZE (alts) -1 ); + new_alts = alts[sco_idx]; }else { new_alts = data->sco_num; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/312 tls: Purge async_hold in tls_decrypt_async_wait()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 84a8335d8300576f1b377ae24abca1d9f197807f ]
The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns, every AEAD operation has completed and the engine no longer references those skbs, so they can be freed unconditionally.
A subsequent patch adds batch async decryption to tls_sw_read_sock(), introducing a new call site that must drain pending AEAD operations and release held skbs. Move __skb_queue_purge(&ctx->async_hold) into tls_decrypt_async_wait() so the purge is centralized and every caller -- recvmsg's drain path, the -EBUSY fallback in tls_do_decryption(), and the new read_sock batch path -- releases held skbs on synchronization without each site managing the purge independently.
This fixes a leak when tls_strp_msg_hold() fails part-way through, after having added some cloned skbs to the async_hold queue. tls_decrypt_sg() will then call tls_decrypt_async_wait() to process all pending decrypts, and drop back to synchronous mode, but tls_sw_recvmsg() only flushes the async_hold queue when one record has been processed in "fully-async" mode, which may not be the case here.
--- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tls/tls_sw.c +1 -1
@@ -245,6 +245,7 @@ static int tls_decrypt_async_wait(struct tls_sw_context_rx *ctx)crypto_wait_req (-EINPROGRESS , &ctx->async_wait);atomic_inc (&ctx->decrypt_pending); +__skb_queue_purge (&ctx->async_hold);return ctx->async_wait.err; }
@@ -2278,7 +2279,6 @@ int tls_sw_recvmsg(struct sock *sk,/* Wait for all previously submitted records to be decrypted */ ret =tls_decrypt_async_wait (ctx); -__skb_queue_purge (&ctx->async_hold);if (ret) {if (err >=0 || err == -EINPROGRESS )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/312 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 ]
__build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.
Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.
--- net/netfilter/nfnetlink_log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
net/netfilter/nfnetlink_log.c +2 -6
@@ -639,15 +639,11 @@ __build_packet_message(struct nfnl_log_net *log,if (data_len) {struct nlattr *nla; -int size =nla_attr_size (data_len); -if (skb_tailroom (inst->skb) <nla_total_size (data_len)) + nla =nla_reserve (inst->skb,NFULA_PAYLOAD , data_len); +if (!nla) goto nla_put_failure; - nla =skb_put (inst->skb,nla_total_size (data_len)); - nla->nla_type =NFULA_PAYLOAD ; - nla->nla_len = size; -if (skb_copy_bits (skb,0 ,nla_data (nla), data_len))BUG (); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/312 netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Wei <[email protected]>
[ Upstream commit 9d3f027327c2fa265f7f85ead41294792c3296ed ]
Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value.
--- net/ipv6/netfilter/ip6t_rt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/netfilter/ip6t_rt.c +4 -0
@@ -157,6 +157,10 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)pr_debug ("unknown flags %X\n" , rtinfo->invflags);return -EINVAL ; } +if (rtinfo->addrnr >IP6T_RT_HOPS ) { +pr_debug ("too many addresses specified\n" ); +return -EINVAL ; + } if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) && (!(rtinfo->flags & IP6T_RT_TYP) || (rtinfo->rt_type != 0) ||
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/312 netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
Skip expectations that do not reside in this netns.
Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc").
--- net/netfilter/nf_conntrack_expect.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_expect.c +4 -0
@@ -627,11 +627,15 @@ static int exp_seq_show(struct seq_file *s, void *v) {struct nf_conntrack_expect *expect;struct nf_conntrack_helper *helper; +struct net *net =seq_file_net (s);struct hlist_node *n = v;char *delim ="" ; expect = hlist_entry(n, struct nf_conntrack_expect, hnode); +if (!net_eq (nf_ct_exp_net (expect), net)) +return 0 ; +if (expect->timeout.function)seq_printf (s,"%ld " ,timer_pending (&expect->timeout) ? (long )(expect->timeout.expires - jiffies)/HZ :0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/312 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 6a2b724460cb67caed500c508c2ae5cf012e4db4 ]
process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook after walking the SDP media descriptions. However rtp_addr is only initialized inside the media loop when a recognized media type with a non-zero port is found.
If the SDP body contains no m= lines, only inactive media sections (m=audio 0 ...) or only unrecognized media types, rtp_addr is never assigned. Despite that, the function still calls hooks->sdp_session() with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack value as an IP address and rewrite the SDP session owner and connection lines with it.
With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this results in the session-level o= and c= addresses being rewritten to 0.0.0.0 for inactive SDP sessions. Without stack auto-init the rewritten address is whatever happened to be on the stack.
Fix this by pre-initializing rtp_addr from the session-level connection address (caddr) when available, and tracking via a have_rtp_addr flag whether any valid address was established. Skip the sdp_session hook entirely when no valid address exists.
--- net/netfilter/nf_conntrack_sip.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/netfilter/nf_conntrack_sip.c +10 -4
@@ -1040,6 +1040,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,unsigned int port;const struct sdp_media_type *t;int ret =NF_ACCEPT ; +bool have_rtp_addr = false; hooks =rcu_dereference (nf_nat_sip_hooks);
@@ -1056,8 +1057,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, caddr_len =0 ;if (ct_sip_parse_sdp_addr (ct, *dptr, sdpoff, *datalen,SDP_HDR_CONNECTION ,SDP_HDR_MEDIA , - &matchoff, &matchlen, &caddr) >0 ) + &matchoff, &matchlen, &caddr) >0 ) { caddr_len = matchlen; +memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); + have_rtp_addr = true; + } mediaoff = sdpoff;for (i =0 ; i <ARRAY_SIZE (sdp_media_types); ) {
@@ -1091,9 +1095,11 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, &matchoff, &matchlen, &maddr) > 0) { maddr_len = matchlen;memcpy (&rtp_addr, &maddr,sizeof (rtp_addr)); - } else if (caddr_len) + have_rtp_addr = true; + } else if (caddr_len) {memcpy (&rtp_addr, &caddr,sizeof (rtp_addr)); - else { + have_rtp_addr = true; + } else {nf_ct_helper_log (skb, ct,"cannot parse SDP message" );return NF_DROP ; }
@@ -1125,7 +1131,7 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,/* Update session connection and owner addresses */ hooks =rcu_dereference (nf_nat_sip_hooks); -if (hooks && ct->status &IPS_NAT_MASK ) +if (hooks && ct->status &IPS_NAT_MASK && have_rtp_addr) ret = hooks->sdp_session (skb, protoff, dataoff, dptr, datalen, sdpoff, &rtp_addr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/312 netlink: allow be16 and be32 types in all uint policy checks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 5fac9b7c16c50c6c7699517f582b56e3743f453a ]
__NLA_IS_BEINT_TYPE(tp) isn't useful. NLA_BE16/32 are identical to NLA_U16/32, the only difference is that it tells the netlink validation functions that byteorder conversion might be needed before comparing the value to the policy min/max ones.
After this change all policy macros that can be used with UINT types, such as NLA_POLICY_MASK() can also be used with NLA_BE16/32.
This will be used to validate nf_tables flag attributes which are in bigendian byte order.
Stable-dep-of: 8f15b5071b45 ("netfilter: ctnetlink: use netlink policy range checks")
--- include/net/netlink.h | 10 +++------- lib/nlattr.c | 6 ++++++ 2 files changed, 9 insertions(+), 7 deletions(-)
include/net/netlink.h +3 -7
@@ -374,12 +374,11 @@ struct nla_policy {#define NLA_POLICY_BITFIELD32 (valid) \ { .type = NLA_BITFIELD32, .bitfield32_valid = valid } -#define __NLA_IS_UINT_TYPE (tp) \ - (tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || tp == NLA_U64) +#define __NLA_IS_UINT_TYPE (tp) \ + (tp == NLA_U8 || tp == NLA_U16 || tp == NLA_U32 || \ + tp == NLA_U64 || tp == NLA_BE16 || tp == NLA_BE32)#define __NLA_IS_SINT_TYPE (tp) \ (tp == NLA_S8 || tp == NLA_S16 || tp == NLA_S32 || tp == NLA_S64) -#define __NLA_IS_BEINT_TYPE (tp) \ - (tp == NLA_BE16 || tp == NLA_BE32)#define __NLA_ENSURE (condition) BUILD_BUG_ON_ZERO(!(condition))#define NLA_ENSURE_UINT_TYPE (tp) \
@@ -393,7 +392,6 @@ struct nla_policy {#define NLA_ENSURE_INT_OR_BINARY_TYPE (tp) \ (__NLA_ENSURE(__NLA_IS_UINT_TYPE(tp) || \ __NLA_IS_SINT_TYPE(tp) || \ - __NLA_IS_BEINT_TYPE(tp) || \ tp == NLA_MSECS || \ tp == NLA_BINARY) + tp)#define NLA_ENSURE_NO_VALIDATION_PTR (tp) \
@@ -401,8 +399,6 @@ struct nla_policy { tp != NLA_REJECT && \ tp != NLA_NESTED && \ tp != NLA_NESTED_ARRAY) + tp) -#define NLA_ENSURE_BEINT_TYPE (tp) \ - (__NLA_ENSURE(__NLA_IS_BEINT_TYPE(tp)) + tp)#define NLA_POLICY_RANGE (tp, _min, _max) { \ .type = NLA_ENSURE_INT_OR_BINARY_TYPE(tp), \
lib/nlattr.c +6 -0
@@ -359,6 +359,12 @@ static int nla_validate_mask(const struct nla_policy *pt,case NLA_U64 : value =nla_get_u64 (nla);break ; +case NLA_BE16 : + value =ntohs (nla_get_be16 (nla)); +break ; +case NLA_BE32 : + value =ntohl (nla_get_be32 (nla)); +break ;default :return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/312 netfilter: ctnetlink: use netlink policy range checks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 8f15b5071b4548b0aafc03b366eb45c9c6566704 ]
Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree.
--- .../uapi/linux/netfilter/nf_conntrack_common.h | 4 ++++ net/netfilter/nf_conntrack_netlink.c | 16 +++++----------- net/netfilter/nf_conntrack_proto_tcp.c | 10 +++------- 3 files changed, 12 insertions(+), 18 deletions(-)
include/uapi/linux/netfilter/nf_conntrack_common.h +4 -0
@@ -159,5 +159,9 @@ enum ip_conntrack_expect_events {#define NF_CT_EXPECT_INACTIVE 0x2#define NF_CT_EXPECT_USERSPACE 0x4 +#ifdef __KERNEL__ +#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \ + NF_CT_EXPECT_USERSPACE) +#endif #endif /* _UAPI_NF_CONNTRACK_COMMON_H */
net/netfilter/nf_conntrack_netlink.c +5 -11
@@ -883,8 +883,8 @@ struct ctnetlink_filter { };static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX +1 ] = { - [CTA_FILTER_ORIG_FLAGS ] = { .type =NLA_U32 }, - [CTA_FILTER_REPLY_FLAGS ] = { .type =NLA_U32 }, + [CTA_FILTER_ORIG_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), + [CTA_FILTER_REPLY_FLAGS ] =NLA_POLICY_MASK (NLA_U32 ,CTA_FILTER_F_ALL ), }; static int ctnetlink_parse_filter(const struct nlattr *attr,
@@ -898,17 +898,11 @@ static int ctnetlink_parse_filter(const struct nlattr *attr,if (ret)return ret; -if (tb[CTA_FILTER_ORIG_FLAGS ]) { +if (tb[CTA_FILTER_ORIG_FLAGS ]) filter->orig_flags =nla_get_u32 (tb[CTA_FILTER_ORIG_FLAGS ]); -if (filter->orig_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - } -if (tb[CTA_FILTER_REPLY_FLAGS ]) { +if (tb[CTA_FILTER_REPLY_FLAGS ]) filter->reply_flags =nla_get_u32 (tb[CTA_FILTER_REPLY_FLAGS ]); -if (filter->reply_flags & ~CTA_FILTER_F_ALL ) -return -EOPNOTSUPP ; - }return 0 ; }
@@ -2626,7 +2620,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING, .len = NF_CT_HELPER_NAME_LEN - 1 }, [CTA_EXPECT_ZONE] = { .type = NLA_U16 }, - [CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, + [CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK), [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
net/netfilter/nf_conntrack_proto_tcp.c +3 -7
@@ -1393,9 +1393,9 @@ static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla, }static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX +1 ] = { - [CTA_PROTOINFO_TCP_STATE ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] = { .type =NLA_U8 }, - [CTA_PROTOINFO_TCP_WSCALE_REPLY ] = { .type =NLA_U8 }, + [CTA_PROTOINFO_TCP_STATE ] =NLA_POLICY_MAX (NLA_U8 ,TCP_CONNTRACK_SYN_SENT2 ), + [CTA_PROTOINFO_TCP_WSCALE_ORIGINAL ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), + [CTA_PROTOINFO_TCP_WSCALE_REPLY ] =NLA_POLICY_MAX (NLA_U8 ,TCP_MAX_WSCALE ), [CTA_PROTOINFO_TCP_FLAGS_ORIGINAL ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, [CTA_PROTOINFO_TCP_FLAGS_REPLY ] = { .len =sizeof (struct nf_ct_tcp_flags ) }, };
@@ -1422,10 +1422,6 @@ static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)if (err <0 )return err; -if (tb[CTA_PROTOINFO_TCP_STATE ] && -nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]) >=TCP_CONNTRACK_MAX ) -return -EINVAL ; -spin_lock_bh (&ct->lock);if (tb[CTA_PROTOINFO_TCP_STATE ]) ct->proto.tcp.state =nla_get_u8 (tb[CTA_PROTOINFO_TCP_STATE ]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/312 net: macb: use the current queue number for stats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Valerio <[email protected]>
[ Upstream commit 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 ]
There's a potential mismatch between the memory reserved for statistics and the amount of memory written.
gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat.
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027
CPU: [...]
Tainted: [E]=UNSIGNED_MODULE
Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x80/0xf8
print_report+0x384/0x5e0
kasan_report+0xa0/0xf0
kasan_check_range+0xe8/0x190
__asan_memcpy+0x54/0x98
gem_get_ethtool_stats+0x54/0x78 [macb
926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
dev_ethtool+0x1220/0x38c0
dev_ioctl+0x4ac/0xca8
sock_do_ioctl+0x170/0x1d8
sock_ioctl+0x484/0x5d8
__arm64_sys_ioctl+0x12c/0x1b8
invoke_syscall+0xd4/0x258
el0_svc_common.constprop.0+0xb4/0x240
do_el0_svc+0x48/0x68
el0_svc+0x40/0xf8
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
The buggy address belongs to a 1-page vmalloc region starting at
0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff00000a333000 pfn:0xa333
flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================Fix it by making sure the copied size only considers the active number of queues.
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -3170,7 +3170,7 @@ static void gem_get_ethtool_stats(struct net_device *dev,spin_lock_irq (&bp->stats_lock);gem_update_stats (bp);memcpy (data, &bp->ethtool_stats,sizeof (u64) - * (GEM_STATS_LEN +QUEUE_STATS_LEN *MACB_MAX_QUEUES )); + * (GEM_STATS_LEN +QUEUE_STATS_LEN * bp->num_queues));spin_unlock_irq (&bp->stats_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/312 regmap: Synchronize cache for the page selector
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 09e70e4f119ff650d24c96161fd2f62ac7e424b0 ]
If the selector register is represented in each page, its value according to the debugfs is stale because it gets synchronized only after the real page switch happens. Hence the regmap cache initialisation from the HW inherits outdated data in the selector register.
Synchronize cache for the page selector just in time.
Before (offset followed by hexdump, the first byte is selector):
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 05 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 01 ff 00 00 ff ff 00 00 00 00 00 00
70: 02 ff 00 00 cf f3 00 00 00 00 00 0c
80: 03 ff 00 00 00 00 00 00 00 00 00 ff
90: 04 ff 00 00 ff 0f 00 00 f0 00 00 00After:
// Real registers
18: 05 ff 00 00 ff 0f 00 00 f0 00 00 00
...
// Virtual (per port)
40: 00 ff 00 00 e0 e0 00 00 00 00 00 1f
50: 01 ff 00 00 e0 e0 00 00 00 00 00 1f
60: 02 ff 00 00 ff ff 00 00 00 00 00 00
70: 03 ff 00 00 cf f3 00 00 00 00 00 0c
80: 04 ff 00 00 00 00 00 00 00 00 00 ff
90: 05 ff 00 00 ff 0f 00 00 f0 00 00 00--- drivers/base/regmap/regmap.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap.c +26 -4
@@ -1634,6 +1634,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, unsigned int val_num) {void *orig_work_buf; +unsigned int selector_reg;unsigned int win_offset;unsigned int win_page;bool page_chg;
@@ -1652,10 +1653,31 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,return -EINVAL ; } -/* It is possible to have selector register inside data window. -In that case, selector register is located on every page and -it needs no page switching, when accessed alone. */ +/* +* Calculate the address of the selector register in the corresponding +* data window if it is located on every page. +*/ + page_chg =in_range (range->selector_reg, range->window_start, range->window_len); +if (page_chg) + selector_reg = range->range_min + win_page * range->window_len + + range->selector_reg - range->window_start; + +/* +* It is possible to have selector register inside data window. +* In that case, selector register is located on every page and it +* needs no page switching, when accessed alone. +* +* Nevertheless we should synchronize the cache values for it. +* This can't be properly achieved if the selector register is +* the first and the only one to be read inside the data window. +* That's why we update it in that case as well. +* +* However, we specifically avoid updating it for the default page, +* when it's overlapped with the real data window, to prevent from +* infinite looping. +*/ if (val_num >1 || + (page_chg && selector_reg != range->selector_reg) || range->window_start + win_offset != range->selector_reg) {/* Use separate work_buf during page switching */ orig_work_buf = map->work_buf;
@@ -1664,7 +1686,7 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg, ret =_regmap_update_bits (map, range->selector_reg, range->selector_mask, win_page << range->selector_shift, - &page_chg, false); +NULL , false); map->work_buf = orig_work_buf;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/312 RDMA/rw: Fall back to direct SGE on MR pool exhaustion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 00da250c21b074ea9494c375d0117b69e5b1d0a4 ]
When IOMMU passthrough mode is active, ib_dma_map_sgtable_attrs() produces no coalescing: each scatterlist page maps 1:1 to a DMA entry, so sgt.nents equals the raw page count. A 1 MB transfer yields 256 DMA entries. If that count exceeds the device's max_sgl_rd threshold (an optimization hint from mlx5 firmware), rdma_rw_io_needs_mr() steers the operation into the MR registration path. Each such operation consumes one or more MRs from a pool sized at max_rdma_ctxs -- roughly one MR per concurrent context. Under write-intensive workloads that issue many concurrent RDMA READs, the pool is rapidly exhausted, ib_mr_pool_get() returns NULL, and rdma_rw_init_one_mr() returns -EAGAIN. Upper layer protocols treat this as a fatal DMA mapping failure and tear down the connection.
The max_sgl_rd check is a performance optimization, not a correctness requirement: the device can handle large SGE counts via direct posting, just less efficiently than with MR registration. When the MR pool cannot satisfy a request, falling back to the direct SGE (map_wrs) path avoids the connection reset while preserving the MR optimization for the common case where pool resources are available.
Add a fallback in rdma_rw_ctx_init() so that -EAGAIN from rdma_rw_init_mr_wrs() triggers direct SGE posting instead of propagating the error. iWARP devices, which mandate MR registration for RDMA READs, and force_mr debug mode continue to treat -EAGAIN as terminal.
--- drivers/infiniband/core/rw.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/infiniband/core/rw.c +18 -3
@@ -326,14 +326,29 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx *ctx, struct ib_qp *qp, u32 port_num,if (rdma_rw_io_needs_mr (qp->device, port_num, dir, sg_cnt)) { ret =rdma_rw_init_mr_wrs (ctx, qp, port_num, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else if (sg_cnt >1 ) { +/* +* If MR init succeeded or failed for a reason other +* than pool exhaustion, that result is final. +* +* Pool exhaustion (-EAGAIN) from the max_sgl_rd +* optimization is recoverable: fall back to +* direct SGE posting. iWARP and force_mr require +* MRs unconditionally, so -EAGAIN is terminal. +*/ +if (ret != -EAGAIN || +rdma_protocol_iwarp (qp->device, port_num) || +unlikely (rdma_rw_force_mr)) + goto out; + } + +if (sg_cnt >1 ) ret =rdma_rw_init_map_wrs (ctx, qp, sg, sg_cnt, sg_offset, remote_addr, rkey, dir); - }else { +else ret =rdma_rw_init_single_wr (ctx, qp, sg, sg_offset, remote_addr, rkey, dir); - } +out:if (ret <0 ) goto out_unmap_sg;return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/312 RDMA/irdma: Initialize free_qp completion before using it
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <[email protected]>
[ Upstream commit 11a95521fb93c91e2d4ef9d53dc80ef0a755549b ]
In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp completion, which is not initialized yet. Fix this by initializing the completion before the ib_copy_to_udata call.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -1005,6 +1005,7 @@ static int irdma_create_qp(struct ib_qp *ibqp,spin_lock_init (&iwqp->sc_qp.pfpdu.lock); iwqp->sig_all = (init_attr->sq_sig_type ==IB_SIGNAL_ALL_WR ) ?1 :0 ; rf->qp_table[qp_num] = iwqp; +init_completion (&iwqp->free_qp);if (rdma_protocol_roce (&iwdev->ibdev,1 )) {if (dev->ws_add (&iwdev->vsi,0 )) {
@@ -1039,7 +1040,6 @@ static int irdma_create_qp(struct ib_qp *ibqp, } } -init_completion (&iwqp->free_qp);return 0 ; error:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/312 RDMA/irdma: Update ibqp state to error if QP is already in error state
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 8c1f19a2225cf37b3f8ab0b5a8a5322291cda620 ]
In irdma_modify_qp() update ibqp state to error if the irdma QP is already in error state, otherwise the ibqp state which is visible to the consumer app remains stale.
--- drivers/infiniband/hw/irdma/verbs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -1419,6 +1419,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
@@ -1624,6 +1625,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,case IB_QPS_ERR :case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) { + iwqp->ibqp_state = attr->qp_state;spin_unlock_irqrestore (&iwqp->lock, flags);if (udata && udata->inlen) { if (ib_copy_from_udata(&ureq, udata,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/312 RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 5e8f0239731a83753473b7aa91bda67bbdff5053 ]
Remove a NOP wait_event() in irdma_modify_qp_roce() which is relevant for iWARP and likely a copy and paste artifact for RoCEv2. The wait event is for sending a reset on a TCP connection, after the reset has been requested in irdma_modify_qp(), which occurs only in iWarp mode.
--- drivers/infiniband/hw/irdma/verbs.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +0 -2
@@ -1341,8 +1341,6 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, roce_info->rd_en = true; } -wait_event (iwqp->mod_qp_waitq, !atomic_read (&iwqp->hw_mod_qp_pend)); - ibdev_dbg(&iwdev->ibdev, "VERBS: caller: %pS qp_id=%d to_ibqpstate=%d ibqpstate=%d irdma_qpstate=%d attr_mask=0x%x\n", __builtin_return_address(0), ibqp->qp_num, attr->qp_state,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/312 RDMA/irdma: Clean up unnecessary dereference of event->cm_node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Barrera <[email protected]>
[ Upstream commit b415399c9a024d574b65479636f0d4eb625b9abd ]
The cm_node is available and the usage of cm_node and event->cm_node seems arbitrary. Clean up unnecessary dereference of event->cm_node.
--- drivers/infiniband/hw/irdma/cm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/infiniband/hw/irdma/cm.c +6 -6
@@ -4181,21 +4181,21 @@ static void irdma_cm_event_handler(struct work_struct *work)irdma_cm_event_reset (event);break ;case IRDMA_CM_EVENT_CONNECTED : -if (!event->cm_node->cm_id || - event->cm_node->state !=IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state !=IRDMA_CM_STATE_OFFLOADED )break ;irdma_cm_event_connected (event);break ;case IRDMA_CM_EVENT_MPA_REJECT : -if (!event->cm_node->cm_id || +if (!cm_node->cm_id || cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_send_cm_event (cm_node, cm_node->cm_id,IW_CM_EVENT_CONNECT_REPLY , -ECONNREFUSED );break ;case IRDMA_CM_EVENT_ABORTED : -if (!event->cm_node->cm_id || - event->cm_node->state ==IRDMA_CM_STATE_OFFLOADED ) +if (!cm_node->cm_id || + cm_node->state ==IRDMA_CM_STATE_OFFLOADED )break ;irdma_event_connect_error (event);break ;
@@ -4205,7 +4205,7 @@ static void irdma_cm_event_handler(struct work_struct *work)break ; } -irdma_rem_ref_cm_node (event->cm_node); +irdma_rem_ref_cm_node (cm_node);kfree (event); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/312 RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit c45c6ebd693b944f1ffe429fdfb6cc1674c237be ]
During reset, irdma_modify_qp() to error should be called to disconnect the QP. Without this fix, if not preceded by irdma_modify_qp() to error, the API call irdma_destroy_qp() gets stuck waiting for the QP refcount to go to zero, because the cm_node associated with this QP isn't disconnected.
--- drivers/infiniband/hw/irdma/utils.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/hw/irdma/utils.c +0 -2
@@ -2456,8 +2456,6 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp)struct irdma_qp *qp = sc_qp->qp_uk.back_qp;struct ib_qp_attr attr; -if (qp->iwdev->rf->reset) -return ; attr.qp_state =IB_QPS_ERR ;if (rdma_protocol_roce (qp->ibqp.device,1 ))
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/312 RDMA/irdma: Fix deadlock during netdev reset with active connections
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Samal <[email protected]>
[ Upstream commit 6f52370970ac07d352a7af4089e55e0e6425f827 ]
Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.
--- drivers/infiniband/hw/irdma/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +2 -1
@@ -534,7 +534,8 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) }irdma_qp_rem_ref (&iwqp->ibqp); -wait_for_completion (&iwqp->free_qp); +if (!iwdev->rf->reset) +wait_for_completion (&iwqp->free_qp);irdma_free_lsmm_rsrc (iwqp);irdma_cqp_qp_destroy_cmd (&iwdev->rf->sc_dev, &iwqp->sc_qp);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/312 RDMA/irdma: Return EINVAL for invalid arp index error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 7221f581eefa79ead06e171044f393fb7ee22f87 ]
When rdma_connect() fails due to an invalid arp index, user space rdma core reports ENOMEM which is confusing. Modify irdma_make_cm_node() to return the correct error code.
--- drivers/infiniband/hw/irdma/cm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/infiniband/hw/irdma/cm.c +10 -7
@@ -2196,11 +2196,12 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev,int oldarpindex;int arpindex;struct net_device *netdev = iwdev->netdev; +int ret;/* create an hte and cm_node for this instance */ cm_node =kzalloc (sizeof (*cm_node),GFP_ATOMIC );if (!cm_node) -return NULL ; +return ERR_PTR (-ENOMEM );/* set our node specific transport info */ cm_node->ipv4 = cm_info->ipv4;
@@ -2299,8 +2300,10 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, arpindex = -EINVAL ; } -if (arpindex <0 ) +if (arpindex <0 ) { + ret = -EINVAL ; goto err; + }ether_addr_copy (cm_node->rem_mac, iwdev->rf->arp_table[arpindex].mac_addr);
@@ -2311,7 +2314,7 @@ irdma_make_cm_node(struct irdma_cm_core *cm_core, struct irdma_device *iwdev, err:kfree (cm_node); -return NULL ; +return ERR_PTR (ret); }static void irdma_destroy_connection (struct irdma_cm_node *cm_node)
@@ -2972,8 +2975,8 @@ static int irdma_create_cm_node(struct irdma_cm_core *cm_core,/* create a CM connection node */ cm_node =irdma_make_cm_node (cm_core, iwdev, cm_info,NULL ); -if (!cm_node) -return -ENOMEM ; +if (IS_ERR (cm_node)) +return PTR_ERR (cm_node);/* set our node side to client (active) side */ cm_node->tcp_cntxt.client =1 ;
@@ -3170,9 +3173,9 @@ void irdma_receive_ilq(struct irdma_sc_vsi *vsi, struct irdma_puda_buf *rbuf) cm_info.cm_id = listener->cm_id; cm_node =irdma_make_cm_node (cm_core, iwdev, &cm_info, listener); -if (!cm_node) { +if (IS_ERR (cm_node)) {ibdev_dbg (&cm_core->iwdev->ibdev, -"CM: allocate node failed\n" ); +"CM: allocate node failed ret=%ld\n" ,PTR_ERR (cm_node));refcount_dec (&listener->refcnt);return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/312 scsi: scsi_transport_sas: Fix the maximum channel scanning issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit d71afa9deb4d413232ba16d693f7d43b321931b4 ]
After commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"), if the device supports multiple channels (0 to shost->max_channel), user_scan() invokes updated sas_user_scan() to perform the scan behavior for a specific transfer. However, when the user specifies shost->max_channel, it will return -EINVAL, which is not expected.
Fix and support specifying the scan shost->max_channel for scanning.
--- drivers/scsi/scsi_transport_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/scsi_transport_sas.c +1 -1
@@ -1732,7 +1732,7 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,break ;default : -if (channel < shost->max_channel) { +if (channel <= shost->max_channel) { res =scsi_scan_host_selected (shost, channel, id, lun,SCSI_SCAN_MANUAL ); }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/312 x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (Microsoft) <[email protected]>
[ Upstream commit 217c0a5c177a3d4f7c8497950cbf5c36756e8bbb ]
ranges_to_free array should have enough room to store the entire EFI memmap plus an extra element for NULL entry.
The calculation of this array size wrongly adds 1 to the overall size instead of adding 1 to the number of elements.
Add parentheses to properly size the array.
--- arch/x86/platform/efi/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/platform/efi/quirks.c +1 -1
@@ -416,7 +416,7 @@ void __init efi_unmap_boot_services(void)if (efi_enabled (EFI_DBG ))return ; - sz =sizeof (*ranges_to_free) * efi.memmap.nr_map +1 ; + sz =sizeof (*ranges_to_free) * (efi.memmap.nr_map +1 ); ranges_to_free =kzalloc (sz,GFP_KERNEL );if (!ranges_to_free) {pr_err ("Failed to allocate storage for freeable EFI regions\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/312 drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit 08441f10f4dc09fdeb64529953ac308abc79dd38 ]
When reading exactly 512 bytes with burst read enabled, the extra_byte_added path breaks out of the inner do-while without decrementing len. The outer while(len) then re-enters and gmbus_wait() times out since all data has been delivered. Decrement len before the break so the outer loop terminates correctly.
--- drivers/gpu/drm/i915/display/intel_gmbus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_gmbus.c +3 -1
@@ -470,8 +470,10 @@ gmbus_xfer_read_chunk(struct drm_i915_private *i915, val =intel_de_read_fw (i915,GMBUS3 (i915)); do { - if (extra_byte_added && len == 1) + if (extra_byte_added && len == 1) { + len--; break; + } *buf++ = val & 0xff; val >>= 8;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/312 ASoC: Intel: catpt: Fix the device initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 5a184f1cb43a8e035251c635f5c47da5dc3e3049 ]
The DMA mask shall be coerced before any buffer allocations for the device are done. At the same time explain why DMA mask of 31 bits is used in the first place.
--- sound/soc/intel/catpt/device.c | 10 +++++++++- sound/soc/intel/catpt/dsp.c | 3 --- 2 files changed, 9 insertions(+), 4 deletions(-)
sound/soc/intel/catpt/device.c +9 -1
@@ -271,7 +271,15 @@ static int catpt_acpi_probe(struct platform_device *pdev)if (IS_ERR (cdev->pci_ba))return PTR_ERR (cdev->pci_ba); -/* alloc buffer for storing DRAM context during dx transitions */ +/* +* As per design HOST is responsible for preserving firmware's runtime +* context during D0 -> D3 -> D0 transitions. Addresses used for DMA +* to/from HOST memory shall be outside the reserved range of 0xFFFxxxxx. +*/ + ret =dma_coerce_mask_and_coherent (cdev->dev,DMA_BIT_MASK (31 )); +if (ret) +return ret; + cdev->dxbuf_vaddr =dmam_alloc_coherent (dev,catpt_dram_size (cdev), &cdev->dxbuf_paddr,GFP_KERNEL );if (!cdev->dxbuf_vaddr)
sound/soc/intel/catpt/dsp.c +0 -3
@@ -125,9 +125,6 @@ int catpt_dmac_probe(struct catpt_dev *cdev) dmac->dev = cdev->dev; dmac->irq = cdev->irq; - ret =dma_coerce_mask_and_coherent (cdev->dev,DMA_BIT_MASK (31 )); -if (ret) -return ret;/* * Caller is responsible for putting device in D0 to allow * for I/O and memory access before probing DW.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/312 ACPICA: include/acpi/acpixf.h: Fix indentation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 7a9d74e7e403cb2e60d4d00c05f2f3ab2a33d0c3 ]
A bunch of the functions declared in include/acpi/acpixf.h have their name aligned a space after the '(' of e.g. the ACPI_EXTERNAL_RETURN_STATUS(acpi_status line above rather then being directly aligned after the '('.
This breaks applying patches generated from the ACPICA upstream git, remove the extra space before the function-names and all the arguments to fix this.
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
--- include/acpi/acpixf.h | 120 +++++++++++++++++++++--------------------- 1 file changed, 60 insertions(+), 60 deletions(-)
include/acpi/acpixf.h +60 -60
@@ -595,82 +595,82 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_statusacpi_install_initialization_handler (acpi_init_handler handler, u32 function)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_install_sci_handler(acpi_sci_handler - address, - void *context)) -ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_remove_sci_handler(acpi_sci_handler - address)) + acpi_install_sci_handler(acpi_sci_handler + address, + void *context)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_install_global_event_handler - (acpi_gbl_event_handler handler, - void *context)) + acpi_remove_sci_handler(acpi_sci_handler + address)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_install_fixed_event_handler(u32 - acpi_event, - acpi_event_handler - handler, - void - *context)) + acpi_install_global_event_handler + (acpi_gbl_event_handler handler, + void *context)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_remove_fixed_event_handler(u32 acpi_event, + acpi_install_fixed_event_handler(u32 + acpi_event, acpi_event_handler - handler)) -ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_install_gpe_handler(acpi_handle - gpe_device, - u32 gpe_number, - u32 type, - acpi_gpe_handler - address, - void *context)) + handler, + void + *context)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_install_gpe_raw_handler(acpi_handle - gpe_device, - u32 gpe_number, - u32 type, - acpi_gpe_handler - address, - void *context)) + acpi_remove_fixed_event_handler(u32 acpi_event, + acpi_event_handler + handler)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status - acpi_remove_gpe_handler(acpi_handle gpe_device, + acpi_install_gpe_handler(acpi_handle + gpe_device, u32 gpe_number, + u32 type, acpi_gpe_handler - address)) -ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_install_notify_handler(acpi_handle device, - u32 handler_type, - acpi_notify_handler - handler, + address, void *context)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status + acpi_install_gpe_raw_handler(acpi_handle + gpe_device, + u32 gpe_number, + u32 type, + acpi_gpe_handler + address, + void *context)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status + acpi_remove_gpe_handler(acpi_handle gpe_device, + u32 gpe_number, + acpi_gpe_handler + address)) ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_remove_notify_handler(acpi_handle device, + acpi_install_notify_handler(acpi_handle device, u32 handler_type, acpi_notify_handler - handler)) -ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_install_address_space_handler(acpi_handle - device, - acpi_adr_space_type - space_id, - acpi_adr_space_handler - handler, - acpi_adr_space_setup - setup, - void *context)) -ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_remove_address_space_handler(acpi_handle + handler, + void *context)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_remove_notify_handler(acpi_handle device, + u32 handler_type, + acpi_notify_handler + handler)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_install_address_space_handler(acpi_handle device, acpi_adr_space_type space_id, acpi_adr_space_handler - handler)) -ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_install_exception_handler - (acpi_exception_handler handler)) -ACPI_EXTERNAL_RETURN_STATUS(acpi_status - acpi_install_interface_handler - (acpi_interface_handler handler)) + handler, + acpi_adr_space_setup + setup, + void *context)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_remove_address_space_handler(acpi_handle + device, + acpi_adr_space_type + space_id, + acpi_adr_space_handler + handler)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_install_exception_handler + (acpi_exception_handler handler)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_install_interface_handler + (acpi_interface_handler handler))/* * Global Lock interfaces
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/312 ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 54c516aeb8b39eeae6450b7d8076d381568dca46 ]
ACPI-2.0 says that the EC op_region handler must be available immediately (like the standard default op_region handlers):
Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
2. OSPM must make Embedded Controller operation regions, accessed via the Embedded Controllers described in ECDT, available before executing any control method. These operation regions may become inaccessible after OSPM runs _REG(EmbeddedControl, 0)."
So the OS must probe the ECDT described EC and install the OpRegion handler before calling acpi_enable_subsystem() and acpi_initialize_objects().
This is a problem because calling acpi_install_address_space_handler() does not just install the op_region handler, it also runs the EC's _REG method. This _REG method may rely on initialization done by the _INI methods of one of the PCI / _SB root devices.
For the other early/default op_region handlers the op_region handler install and the _REG execution is split into 2 separate steps:
1. acpi_ev_install_region_handlers(), called early from acpi_load_tables()
2. acpi_ev_initialize_op_regions(), called from acpi_initialize_objects()
To fix the EC op_region issue, add 2 bew functions:
1. acpi_install_address_space_handler_no_reg()
2. acpi_execute_reg_methods()
to allow doing things in 2 steps for other op_region handlers, like the EC handler, too.
Note that the comment describing acpi_ev_install_region_handlers() even has an alinea describing this problem. Using the new methods allows users to avoid this problem.
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
--- drivers/acpi/acpica/evxfregn.c | 92 +++++++++++++++++++++++++++++++--- include/acpi/acpixf.h | 10 ++++ 2 files changed, 95 insertions(+), 7 deletions(-)
drivers/acpi/acpica/evxfregn.c +85 -7
@@ -20,13 +20,14 @@ ACPI_MODULE_NAME("evxfregn")/******************************************************************************* * -* FUNCTION: acpi_install_address_space_handler +* FUNCTION: acpi_install_address_space_handler_internal * * PARAMETERS: device - Handle for the device * space_id - The address space ID * handler - Address of the handler * setup - Address of the setup function * context - Value passed to the handler on each access +* Run_reg - Run _REG methods for this address space? * * RETURN: Status *
@@ -37,13 +38,16 @@ ACPI_MODULE_NAME("evxfregn")* are executed here, and these methods can only be safely executed after * the default handlers have been installed and the hardware has been * initialized (via acpi_enable_subsystem.) +* To avoid this problem pass FALSE for Run_Reg and later on call +* acpi_execute_reg_methods() to execute _REG. * ******************************************************************************/ -acpi_status -acpi_install_address_space_handler (acpi_handle device, -acpi_adr_space_type space_id, -acpi_adr_space_handler handler, -acpi_adr_space_setup setup,void *context) +static acpi_status +acpi_install_address_space_handler_internal (acpi_handle device, +acpi_adr_space_type space_id, +acpi_adr_space_handler handler, +acpi_adr_space_setup setup, +void *context,u8 run_reg) {struct acpi_namespace_node *node;acpi_status status;
@@ -80,14 +84,40 @@ acpi_install_address_space_handler(acpi_handle device,/* Run all _REG methods for this address space */ -acpi_ev_execute_reg_methods (node, space_id,ACPI_REG_CONNECT ); +if (run_reg) { +acpi_ev_execute_reg_methods (node, space_id,ACPI_REG_CONNECT ); + } unlock_and_exit: (void )acpi_ut_release_mutex (ACPI_MTX_NAMESPACE );return_ACPI_STATUS (status); } +acpi_status +acpi_install_address_space_handler (acpi_handle device, +acpi_adr_space_type space_id, +acpi_adr_space_handler handler, +acpi_adr_space_setup setup,void *context) +{ +return acpi_install_address_space_handler_internal (device, space_id, + handler, setup, + context, TRUE); +} +ACPI_EXPORT_SYMBOL (acpi_install_address_space_handler) +acpi_status +acpi_install_address_space_handler_no_reg (acpi_handle device, +acpi_adr_space_type space_id, +acpi_adr_space_handler handler, +acpi_adr_space_setup setup, +void *context) +{ +return acpi_install_address_space_handler_internal (device, space_id, + handler, setup, + context, FALSE); +} + +ACPI_EXPORT_SYMBOL (acpi_install_address_space_handler_no_reg)/******************************************************************************* *
@@ -226,3 +256,51 @@ acpi_remove_address_space_handler(acpi_handle device, }ACPI_EXPORT_SYMBOL (acpi_remove_address_space_handler) +/******************************************************************************* +* +* FUNCTION: acpi_execute_reg_methods +* +* PARAMETERS: device - Handle for the device +* space_id - The address space ID +* +* RETURN: Status +* +* DESCRIPTION: Execute _REG for all op_regions of a given space_id. +* +******************************************************************************/ +acpi_status +acpi_execute_reg_methods (acpi_handle device,acpi_adr_space_type space_id) +{ +struct acpi_namespace_node *node; +acpi_status status; + +ACPI_FUNCTION_TRACE (acpi_execute_reg_methods); + +/* Parameter validation */ + +if (!device) { +return_ACPI_STATUS (AE_BAD_PARAMETER ); + } + + status =acpi_ut_acquire_mutex (ACPI_MTX_NAMESPACE ); +if (ACPI_FAILURE (status)) { +return_ACPI_STATUS (status); + } + +/* Convert and validate the device handle */ + + node =acpi_ns_validate_handle (device); +if (node) { + +/* Run all _REG methods for this address space */ + +acpi_ev_execute_reg_methods (node, space_id,ACPI_REG_CONNECT ); + }else { + status =AE_BAD_PARAMETER ; + } + + (void )acpi_ut_release_mutex (ACPI_MTX_NAMESPACE ); +return_ACPI_STATUS (status); +} + +ACPI_EXPORT_SYMBOL (acpi_execute_reg_methods)
include/acpi/acpixf.h +10 -0
@@ -658,6 +658,16 @@ ACPI_EXTERNAL_RETURN_STATUS(acpi_statusacpi_adr_space_setup setup, void *context)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_install_address_space_handler_no_reg + (acpi_handle device, acpi_adr_space_type space_id, + acpi_adr_space_handler handler, + acpi_adr_space_setup setup, + void *context)) +ACPI_EXTERNAL_RETURN_STATUS(acpi_status + acpi_execute_reg_methods(acpi_handle device, + acpi_adr_space_type + space_id)) ACPI_EXTERNAL_RETURN_STATUS(acpi_status acpi_remove_address_space_handler(acpi_handle device,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/312 ACPI: EC: Fix EC address space handler unregistration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit a5072078dbfaa9d70130805766dfa34bbb7bf2a7 ]
When an ECDT table is present the EC address space handler gets registered on the root node. So to unregister it properly the unregister call also must be done on the root node.
Store the ACPI handle used for the acpi_install_address_space_handler() call and use te same handle for the acpi_remove_address_space_handler() call.
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
--- drivers/acpi/ec.c | 4 +++- drivers/acpi/internal.h | 1 + 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/acpi/ec.c +3 -1
@@ -1524,6 +1524,7 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)return -ENODEV ; }set_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags); + ec->address_space_handler_holder = ec->handle; }if (!device)
@@ -1575,7 +1576,8 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)static void ec_remove_handlers (struct acpi_ec *ec) {if (test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) { -if (ACPI_FAILURE (acpi_remove_address_space_handler (ec->handle, +if (ACPI_FAILURE (acpi_remove_address_space_handler ( + ec->address_space_handler_holder,ACPI_ADR_SPACE_EC , &acpi_ec_space_handler)))pr_err ("failed to remove space handler\n" );clear_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags);
drivers/acpi/internal.h +1 -0
@@ -173,6 +173,7 @@ enum acpi_ec_event_state {struct acpi_ec {acpi_handle handle; +acpi_handle address_space_handler_holder;int gpe;int irq;unsigned long command_addr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/312 ACPI: EC: Fix ECDT probe ordering issues
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit ab4620f58d38206687b9f99d9d2cc1d5a2640985 ]
ACPI-2.0 says that the EC OpRegion handler must be available immediately (like the standard default OpRegion handlers):
Quoting from the ACPI spec version 6.3: "6.5.4 _REG (Region) ...
2. OSPM must make Embedded Controller operation regions, accessed via the Embedded Controllers described in ECDT, available before executing any control method. These operation regions may become inaccessible after OSPM runs _REG(EmbeddedControl, 0)."
So acpi_bus_init() calls acpi_ec_ecdt_probe(), which calls acpi_install_address_space_handler() to install the EC's OpRegion handler, early on.
This not only installs the OpRegion handler, but also calls the EC's _REG method. The _REG method call is a problem because it may rely on initialization done by the _INI methods of one of the PCI / _SB root devs, see for example: https://bugzilla.kernel.org/show_bug.cgi?id=214899 .
Generally speaking _REG methods are executed when the ACPI-device they are part of has a driver bound to it. Where as _INI methods must be executed at table load time (according to the spec). The problem here is that the early acpi_install_address_space_handler() call causes the _REG handler to run too early.
To allow fixing this the ACPICA code now allows to split the OpRegion handler installation and the executing of _REG into 2 separate steps.
This commit uses this ACPICA functionality to fix the EC probe ordering by delaying the executing of _REG for ECDT described ECs till the matching EC device in the DSDT gets parsed and acpi_ec_add() for it gets called. This moves the calling of _REG for the EC on devices with an ECDT to the same point in time where it is called on devices without an ECDT table.
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
--- drivers/acpi/ec.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
drivers/acpi/ec.c +18 -10
@@ -94,6 +94,7 @@ enum {EC_FLAGS_QUERY_ENABLED ,/* Query is enabled */ EC_FLAGS_EVENT_HANDLER_INSTALLED ,/* Event handler installed */ EC_FLAGS_EC_HANDLER_INSTALLED ,/* OpReg handler installed */ +EC_FLAGS_EC_REG_CALLED ,/* OpReg ACPI _REG method called */ EC_FLAGS_QUERY_METHODS_INSTALLED ,/* _Qxx handlers installed */ EC_FLAGS_STARTED ,/* Driver is started */ EC_FLAGS_STOPPED, /* Driver is stopped */
@@ -1495,6 +1496,7 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)* ec_install_handlers - Install service callbacks and register query methods. * @ec: Target EC. * @device: ACPI device object corresponding to @ec. +* @call_reg: If _REG should be called to notify OpRegion availability * * Install a handler for the EC address space type unless it has been installed * already. If @device is not NULL, also look for EC query methods in the
@@ -1507,7 +1509,8 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)* -EPROBE_DEFER if GPIO IRQ acquisition needs to be deferred, * or 0 (success) otherwise. */ -static int ec_install_handlers (struct acpi_ec *ec,struct acpi_device *device) +static int ec_install_handlers (struct acpi_ec *ec,struct acpi_device *device, +bool call_reg) {acpi_status status;
@@ -1515,10 +1518,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device)if (!test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) {acpi_ec_enter_noirq (ec); - status =acpi_install_address_space_handler (ec->handle, -ACPI_ADR_SPACE_EC , - &acpi_ec_space_handler, -NULL , ec); + status =acpi_install_address_space_handler_no_reg (ec->handle, +ACPI_ADR_SPACE_EC , + &acpi_ec_space_handler, +NULL , ec);if (ACPI_FAILURE (status)) {acpi_ec_stop (ec, false);return -ENODEV ;
@@ -1527,6 +1530,11 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device) ec->address_space_handler_holder = ec->handle; } +if (call_reg && !test_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags)) { +acpi_execute_reg_methods (ec->handle,ACPI_ADR_SPACE_EC ); +set_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags); + } +if (!device)return 0 ;
@@ -1613,11 +1621,11 @@ static void ec_remove_handlers(struct acpi_ec *ec) } } -static int acpi_ec_setup (struct acpi_ec *ec,struct acpi_device *device) +static int acpi_ec_setup (struct acpi_ec *ec,struct acpi_device *device,bool call_reg) {int ret; - ret =ec_install_handlers (ec, device); + ret =ec_install_handlers (ec, device, call_reg);if (ret)return ret;
@@ -1682,7 +1690,7 @@ static int acpi_ec_add(struct acpi_device *device) } } - ret =acpi_ec_setup (ec, device); + ret =acpi_ec_setup (ec, device, true);if (ret) goto err;
@@ -1802,7 +1810,7 @@ void __init acpi_ec_dsdt_probe(void)* At this point, the GPE is not fully initialized, so do not to * handle the events. */ - ret =acpi_ec_setup (ec,NULL ); + ret =acpi_ec_setup (ec,NULL , true);if (ret) {acpi_ec_free (ec);return ;
@@ -2017,7 +2025,7 @@ void __init acpi_ec_ecdt_probe(void)* At this point, the namespace is not initialized, so do not find * the namespace objects, or handle the events. */ - ret =acpi_ec_setup (ec,NULL ); + ret =acpi_ec_setup (ec,NULL , false);if (ret) {acpi_ec_free (ec); goto out;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/312 ACPI: EC: Install address space handler at the namespace root
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 60fa6ae6e6d09e377fce6f8d9b6f6a4d88769f63 ]
It is reported that _DSM evaluation fails in ucsi_acpi_dsm() on Lenovo IdeaPad Pro 5 due to a missing address space handler for the EC address space:
ACPI Error: No handler for Region [ECSI] (000000007b8176ee) [EmbeddedControl] (20230628/evregion-130)
This happens because if there is no ECDT, the EC driver only registers the EC address space handler for operation regions defined in the EC device scope of the ACPI namespace while the operation region being accessed by the _DSM in question is located beyond that scope.
To address this, modify the ACPI EC driver to install the EC address space handler at the root of the ACPI namespace for the first EC that can be found regardless of whether or not an ECDT is present.
Note that this change is consistent with some examples in the ACPI specification in which EC operation regions located outside the EC device scope are used (for example, see Section 9.17.15 in ACPI 6.5), so the current behavior of the EC driver is arguably questionable.
Stable-dep-of: f6484cadbcaf ("ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()")
--- drivers/acpi/ec.c | 25 ++++++++++++++++--------- drivers/acpi/internal.h | 1 - 2 files changed, 16 insertions(+), 10 deletions(-)
drivers/acpi/ec.c +16 -9
@@ -1512,13 +1512,14 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)static int ec_install_handlers (struct acpi_ec *ec,struct acpi_device *device,bool call_reg) { +acpi_handle scope_handle = ec == first_ec ?ACPI_ROOT_OBJECT : ec->handle;acpi_status status;acpi_ec_start (ec, false);if (!test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) {acpi_ec_enter_noirq (ec); - status =acpi_install_address_space_handler_no_reg (ec->handle, + status =acpi_install_address_space_handler_no_reg (scope_handle,ACPI_ADR_SPACE_EC , &acpi_ec_space_handler,NULL , ec);
@@ -1527,11 +1528,10 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,return -ENODEV ; }set_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags); - ec->address_space_handler_holder = ec->handle; }if (call_reg && !test_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags)) { -acpi_execute_reg_methods (ec->handle,ACPI_ADR_SPACE_EC ); +acpi_execute_reg_methods (scope_handle,ACPI_ADR_SPACE_EC );set_bit (EC_FLAGS_EC_REG_CALLED , &ec->flags); }
@@ -1583,10 +1583,13 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,static void ec_remove_handlers (struct acpi_ec *ec) { +acpi_handle scope_handle = ec == first_ec ?ACPI_ROOT_OBJECT : ec->handle; +if (test_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags)) {if (ACPI_FAILURE (acpi_remove_address_space_handler ( - ec->address_space_handler_holder, -ACPI_ADR_SPACE_EC , &acpi_ec_space_handler))) + scope_handle, +ACPI_ADR_SPACE_EC , + &acpi_ec_space_handler)))pr_err ("failed to remove space handler\n" );clear_bit (EC_FLAGS_EC_HANDLER_INSTALLED , &ec->flags); }
@@ -1625,14 +1628,18 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca {int ret; - ret =ec_install_handlers (ec, device, call_reg); -if (ret) -return ret; -/* First EC capable of handling transactions */ if (!first_ec) first_ec = ec; + ret =ec_install_handlers (ec, device, call_reg); +if (ret) { +if (ec == first_ec) + first_ec =NULL ; + +return ret; + } +pr_info ("EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n" , ec->command_addr, ec->data_addr);
drivers/acpi/internal.h +0 -1
@@ -173,7 +173,6 @@ enum acpi_ec_event_state {struct acpi_ec {acpi_handle handle; -acpi_handle address_space_handler_holder;int gpe;int irq;unsigned long command_addr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/312 ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit f6484cadbcaf26b5844b51bd7307a663dda48ef6 ]
When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpi_ec pointer as handler context. However, acpi_ec_setup() propagates the error without any cleanup.
The caller acpi_ec_add() then frees the struct acpi_ec for non-boot instances, leaving a dangling handler context in ACPICA.
Any subsequent AML evaluation that accesses an EC OpRegion field dispatches into acpi_ec_space_handler() with the freed pointer, causing a use-after-free:
BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289) Write of size 8 at addr ffff88800721de38 by task init/1 Call Trace: <TASK> mutex_lock (kernel/locking/mutex.c:289) acpi_ec_space_handler (drivers/acpi/ec.c:1362) acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293) acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246) acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509) acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700) acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327) acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392) </TASK> Allocated by task 1: acpi_ec_alloc (drivers/acpi/ec.c:1424) acpi_ec_add (drivers/acpi/ec.c:1692) Freed by task 1: kfree (mm/slub.c:6876) acpi_ec_add (drivers/acpi/ec.c:1751)
The bug triggers on reduced-hardware EC platforms (ec->gpe < 0) when the GPIO IRQ provider defers probing. Once the stale handler exists, any unprivileged sysfs read that causes AML to touch an EC OpRegion (battery, thermal, backlight) exercises the dangling pointer.
Fix this by calling ec_remove_handlers() in the error path of acpi_ec_setup() before clearing first_ec. ec_remove_handlers() checks each EC_FLAGS_* bit before acting, so it is safe to call regardless of how far ec_install_handlers() progressed:
-ENODEV (handler not installed): only calls acpi_ec_stop() -EPROBE_DEFER (handler installed): removes handler, stops EC
--- drivers/acpi/ec.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/ec.c +2 -0
@@ -1634,6 +1634,8 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca ret =ec_install_handlers (ec, device, call_reg);if (ret) { +ec_remove_handlers (ec); +if (ec == first_ec) first_ec =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/312 drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 7150850146ebfa4ca998f653f264b8df6f7f85be ]
amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.
Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().
If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.
Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.
Fixes the below:drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +2 -2
@@ -694,9 +694,9 @@ int amdgpu_amdkfd_submit_ib(struct amdgpu_device *adev, goto err_ib_sched; } -/* Drop the initial kref_init count (see drm_sched_main as example) */ -dma_fence_put (f); ret =dma_fence_wait (f, false); +/* Drop the returned fence reference after the wait completes */ +dma_fence_put (f); err_ib_sched:amdgpu_job_free (job);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/312 hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
[ Upstream commit bf08749a6abb6d1959bfdc0edc32c640df407558 ]
The adm1177 driver exposes the current alert threshold through hwmon_curr_max_alarm. This violates the hwmon sysfs ABI, where *_alarm attributes are read-only status flags and writable thresholds must use currN_max.
The driver also stores the threshold internally in microamps, while currN_max is defined in milliamps. Convert the threshold accordingly on both the read and write paths.
Widen the cached threshold and related calculations to 64 bits so that small shunt resistor values do not cause truncation or overflow. Also use 64-bit arithmetic for the mA/uA conversions, clamp writes to the range the hardware can represent, and propagate failures from adm1177_write_alert_thr() instead of silently ignoring them.
Update the hwmon documentation to reflect the attribute rename and the correct units returned by the driver.
--- Documentation/hwmon/adm1177.rst | 8 ++--- drivers/hwmon/adm1177.c | 54 +++++++++++++++++++-------------- 2 files changed, 35 insertions(+), 27 deletions(-)
Documentation/hwmon/adm1177.rst +4 -4
@@ -27,10 +27,10 @@ for details. Sysfs entries ------------- -The following attributes are supported. Current maxim attribute +The following attributes are supported. Current maximum attribute is read-write, all other attributes are read-only. -in0_input Measured voltage in microvolts. +in0_input Measured voltage in millivolts. -curr1_input Measured current in microamperes. -curr1_max_alarm Overcurrent alarm in microamperes. +curr1_input Measured current in milliamperes. +curr1_max Overcurrent shutdown threshold in milliamperes.
drivers/hwmon/adm1177.c +31 -23
111 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/312 sysctl: fix uninitialized variable in proc_do_large_bitmap
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Buerg <[email protected]>
[ Upstream commit f63a9df7e3f9f842945d292a19d9938924f066f9 ]
proc_do_large_bitmap() does not initialize variable c, which is expected to be set to a trailing character by proc_get_long().
However, proc_get_long() only sets c when the input buffer contains a trailing character after the parsed value.
If c is not initialized it may happen to contain a '-'. If this is the case proc_do_large_bitmap() expects to be able to parse a second part of the input buffer. If there is no second part an unjustified -EINVAL will be returned.
Initialize c to 0 to prevent returning -EINVAL on valid input.
--- kernel/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sysctl.c +1 -1
@@ -1391,7 +1391,7 @@ int proc_do_large_bitmap(struct ctl_table *table, int write,unsigned long bitmap_len = table->maxlen;unsigned long *bitmap = *(unsigned long **) table->data;unsigned long *tmp_bitmap =NULL ; -char tr_a[] = {'-' ,',' ,'\n' }, tr_b[] = {',' ,'\n' ,0 }, c; +char tr_a[] = {'-' ,',' ,'\n' }, tr_b[] = {',' ,'\n' ,0 }, c =0 ;if (!bitmap || !bitmap_len || !left || (*ppos && !write)) { *lenp =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/312 ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit 326fe8104a4020d30080d37ac8b6b43893cdebca ]
adau1372_set_power() calls clk_prepare_enable() but discards the return value. If the clock enable fails, the driver proceeds to access registers on unpowered hardware, potentially causing silent corruption.
Make adau1372_set_power() return int and propagate the error from clk_prepare_enable(). Update adau1372_set_bias_level() to return the error directly for the STANDBY and OFF cases.
--- sound/soc/codecs/adau1372.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
sound/soc/codecs/adau1372.c +10 -7
@@ -781,15 +781,18 @@ static void adau1372_enable_pll(struct adau1372 *adau1372)dev_err (adau1372->dev,"Failed to lock PLL\n" ); } -static void adau1372_set_power (struct adau1372 *adau1372,bool enable) +static int adau1372_set_power (struct adau1372 *adau1372,bool enable) {if (adau1372->enabled == enable) -return ; +return 0 ;if (enable) {unsigned int clk_ctrl =ADAU1372_CLK_CTRL_MCLK_EN ; +int ret; -clk_prepare_enable (adau1372->mclk); + ret =clk_prepare_enable (adau1372->mclk); +if (ret) +return ret;if (adau1372->pd_gpio)gpiod_set_value (adau1372->pd_gpio,0 );
@@ -828,6 +831,8 @@ static void adau1372_set_power(struct adau1372 *adau1372, bool enable) } adau1372->enabled = enable; + +return 0 ; } static int adau1372_set_bias_level(struct snd_soc_component *component,
@@ -841,11 +846,9 @@ static int adau1372_set_bias_level(struct snd_soc_component *component,case SND_SOC_BIAS_PREPARE :break ;case SND_SOC_BIAS_STANDBY : -adau1372_set_power (adau1372, true); -break ; +return adau1372_set_power (adau1372, true);case SND_SOC_BIAS_OFF : -adau1372_set_power (adau1372, false); -break ; +return adau1372_set_power (adau1372, false); }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/312 ASoC: adau1372: Fix clock leak on PLL lock failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <[email protected]>
[ Upstream commit bfe6a264effcb6fe99ad7ceaf9e8c7439fc9555b ]
adau1372_enable_pll() was a void function that logged a dev_err() on PLL lock timeout but did not propagate the error. As a result, adau1372_set_power() would continue with adau1372->enabled set to true despite the PLL being unlocked, and the mclk left enabled with no corresponding disable on the error path.
Convert adau1372_enable_pll() to return int, using -ETIMEDOUT on lock timeout and propagating regmap errors directly. In adau1372_set_power(), check the return value and unwind in reverse order: restore regcache to cache-only mode, reassert GPIO power-down, and disable the clock before returning the error.
--- sound/soc/codecs/adau1372.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
sound/soc/codecs/adau1372.c +14 -3
@@ -761,7 +761,7 @@ static int adau1372_startup(struct snd_pcm_substream *substream, struct snd_soc_return 0 ; } -static void adau1372_enable_pll (struct adau1372 *adau1372) +static int adau1372_enable_pll (struct adau1372 *adau1372) {unsigned int val, timeout =0 ;int ret;
@@ -777,8 +777,12 @@ static void adau1372_enable_pll(struct adau1372 *adau1372) timeout++; }while (!(val &1 ) && timeout <3 ); -if (ret <0 || !(val &1 )) +if (ret <0 || !(val &1 )) {dev_err (adau1372->dev,"Failed to lock PLL\n" ); +return ret <0 ? ret : -ETIMEDOUT ; + } + +return 0 ; }static int adau1372_set_power (struct adau1372 *adau1372,bool enable)
@@ -806,7 +810,14 @@ static int adau1372_set_power(struct adau1372 *adau1372, bool enable)* accessed. */ if (adau1372->use_pll) { -adau1372_enable_pll (adau1372); + ret =adau1372_enable_pll (adau1372); +if (ret) { +regcache_cache_only (adau1372->regmap, true); +if (adau1372->pd_gpio) +gpiod_set_value (adau1372->pd_gpio,1 ); +clk_disable_unprepare (adau1372->mclk); +return ret; + } clk_ctrl |=ADAU1372_CLK_CTRL_CLKSRC ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/312 spi: spi-fsl-lpspi: fix teardown order issue (UAF)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit b341c1176f2e001b3adf0b47154fc31589f7410e ]
There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns.
As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free:
| fsl_lpspi 42550000.spi: I/O Error in DMA RX
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...]
| Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev]
[...]
Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove().
--- drivers/spi/spi-fsl-lpspi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +2 -1
@@ -913,7 +913,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)enable_irq (irq); } - ret =devm_spi_register_controller (&pdev->dev, controller); + ret =spi_register_controller (controller);if (ret <0 ) {dev_err_probe (&pdev->dev, ret,"spi_register_controller error\n" ); goto free_dma;
@@ -942,6 +942,7 @@ static int fsl_lpspi_remove(struct platform_device *pdev)struct fsl_lpspi_data *fsl_lpspi =spi_controller_get_devdata (controller); +spi_unregister_controller (controller);fsl_lpspi_dma_exit (controller);pm_runtime_dont_use_autosuspend (fsl_lpspi->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/312 s390/syscalls: Add spectre boundary for syscall dispatch table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 48b8814e25d073dd84daf990a879a820bad2bcbd upstream.
The s390 syscall number is directly controlled by userspace, but does not have an array_index_nospec() boundary to prevent access past the syscall function pointer tables.
--- arch/s390/kernel/syscall.c | 2 ++ 1 file changed, 2 insertions(+)
arch/s390/kernel/syscall.c +2 -0
@@ -13,6 +13,7 @@*/ #include <linux/errno.h> +#include <linux/nospec.h> #include <linux/sched.h> #include <linux/mm.h> #include <linux/fs.h>
@@ -141,6 +142,7 @@ static void do_syscall(struct pt_regs *rif (likely (nr >= NR_syscalls)) goto out;do { + nr =array_index_nospec (nr, NR_syscalls); regs->gprs[2 ] = current->thread.sys_call_table[nr](regs); }while (test_and_clear_pt_regs_flag (regs,PIF_EXECVE_PGSTE_RESTART )); out:
Greg Kroah-Hartman
maintainerPATCH 90/312 s390/barrier: Make array_index_mask_nospec() __always_inline
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit c5c0a268b38adffbb2e70e6957017537ff54c157 upstream.
Mark array_index_mask_nospec() as __always_inline to guarantee the mitigation is emitted inline regardless of compiler inlining decisions.
--- arch/s390/include/asm/barrier.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/include/asm/barrier.h +2 -2
@@ -60,8 +60,8 @@ do { \* @size: number of elements in array */ #define array_index_mask_nospec array_index_mask_nospec -static inline unsigned long array_index_mask_nospec (unsigned long index, -unsigned long size) +static __always_inline unsigned long array_index_mask_nospec (unsigned long index, +unsigned long size) {unsigned long mask;
Greg Kroah-Hartman
maintainerPATCH 91/312 ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 0e55f63dd08f09651d39e1b709a91705a8a0ddcb upstream.
After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was changed to use dynamic iov array. In the new design, smb2_calc_max_out_buf_len() expects the second argument (hdr2_len) to be the offset of ->Buffer field in the response structure, not a hardcoded magic number.
Fix the remaining call sites to use the correct offsetof() value.
--- fs/smb/server/smb2pdu.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
fs/smb/server/smb2pdu.c +12 -8
@@ -4124,8 +4124,9 @@ int smb2_query_dir(struct ksmbd_work *wo d_info.wptr = (char *)rsp->Buffer; d_info.rptr = (char *)rsp->Buffer; d_info.out_buf_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_directory_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (d_info.out_buf_len <0 ) { rc = -EINVAL ; goto err_out;
@@ -4392,8 +4393,9 @@ static int smb2_get_ea(struct ksmbd_work } buf_free_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (buf_free_len <0 )return -EINVAL ;
@@ -4690,8 +4692,9 @@ static void get_file_stream_info(struct file_info = (struct smb2_file_stream_info *)rsp->Buffer; buf_free_len = -smb2_calc_max_out_buf_len (work,8 , -le32_to_cpu (req->OutputBufferLength)); +smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_query_info_rsp , Buffer), +le32_to_cpu (req->OutputBufferLength));if (buf_free_len <0 ) goto out;
@@ -7740,8 +7743,9 @@ int smb2_ioctl(struct ksmbd_work *work) buffer = (char *)req +le32_to_cpu (req->InputOffset); cnt_code =le32_to_cpu (req->CtlCode); - ret =smb2_calc_max_out_buf_len (work,48 , -le32_to_cpu (req->MaxOutputResponse)); + ret =smb2_calc_max_out_buf_len (work, + offsetof(struct smb2_ioctl_rsp , Buffer), +le32_to_cpu (req->MaxOutputResponse));if (ret <0 ) { rsp->hdr.Status =STATUS_INVALID_PARAMETER ; goto out;
Greg Kroah-Hartman
maintainerPATCH 92/312 ksmbd: do not expire session on binding failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
commit 9bbb19d21ded7d78645506f20d8c44895e3d0fb9 upstream.
When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS).
Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put().
--- fs/smb/server/smb2pdu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/smb/server/smb2pdu.c +8 -2
@@ -1928,8 +1928,14 @@ out_err:if (sess->user && sess->user->flags &KSMBD_USER_FLAG_DELAY_SESSION ) try_delay = true; - sess->last_active = jiffies; - sess->state =SMB2_SESSION_EXPIRED ; +/* +* For binding requests, session belongs to another +* connection. Do not expire it. +*/ +if (!(req->Flags &SMB2_SESSION_REQ_FLAG_BINDING )) { + sess->last_active = jiffies; + sess->state =SMB2_SESSION_EXPIRED ; + }ksmbd_user_session_put (sess); work->sess =NULL ;if (try_delay) {
Greg Kroah-Hartman
maintainerPATCH 93/312 can: gw: fix OOB heap access in cgw_csum_crc8_rel()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Norouzi <[email protected]>
commit b9c310d72783cc2f30d103eed83920a5a29c671a upstream.
cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():
int from = calc_idx(crc8->from_idx, cf->len);
int to = calc_idx(crc8->to_idx, cf->len);
int res = calc_idx(crc8->result_idx, cf->len);
if (from < 0 || to < 0 || res < 0)
return;However, the loop and the result write then use the raw s8 fields directly instead of the computed variables:
for (i = crc8->from_idx; ...) /* BUG: raw negative index */
cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap.
The companion function cgw_csum_xor_rel() uses from/to/res correctly throughout; fix cgw_csum_crc8_rel() to match.
Confirmed with KASAN on linux-7.0-rc2:
BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62
To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
--- net/can/gw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/can/gw.c +3 -3
@@ -374,10 +374,10 @@ static void cgw_csum_crc8_rel(struct canreturn ;if (from <= to) { -for (i = crc8->from_idx; i <= crc8->to_idx; i++) +for (i = from; i <= to; i++) crc = crc8->crctab[crc ^ cf->data[i]]; }else { -for (i = crc8->from_idx; i >= crc8->to_idx; i--) +for (i = from; i >= to; i--) crc = crc8->crctab[crc ^ cf->data[i]]; }
@@ -396,7 +396,7 @@ static void cgw_csum_crc8_rel(struct canbreak ; } - cf->data[crc8->result_idx] = crc ^ crc8->final_xor_val; + cf->data[res] = crc ^ crc8->final_xor_val; } static void cgw_csum_crc8_pos(struct canfd_frame *cf,
Greg Kroah-Hartman
maintainerPATCH 94/312 cpufreq: conservative: Reset requested_freq on limits change
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 6a28fb8cb28b9eb39a392e531d938a889eacafc5 upstream.
A recently reported issue highlighted that the cached requested_freq is not guaranteed to stay in sync with policy->cur. If the platform changes the actual CPU frequency after the governor sets one (e.g. due to platform-specific frequency scaling) and a re-sync occurs later, policy->cur may diverge from requested_freq.
This can lead to incorrect behavior in the conservative governor. For example, the governor may assume the CPU is already running at the maximum frequency and skip further increases even though there is still headroom.
Avoid this by resetting the cached requested_freq to policy->cur on detecting a change in policy limits.
--- drivers/cpufreq/cpufreq_conservative.c | 12 ++++++++++++ drivers/cpufreq/cpufreq_governor.c | 3 +++ drivers/cpufreq/cpufreq_governor.h | 1 + 3 files changed, 16 insertions(+)
drivers/cpufreq/cpufreq_conservative.c +12 -0
@@ -314,6 +314,17 @@ static void cs_start(struct cpufreq_poli dbs_info->requested_freq = policy->cur; } +static void cs_limits (struct cpufreq_policy *policy) +{ +struct cs_policy_dbs_info *dbs_info =to_dbs_info (policy->governor_data); + +/* +* The limits have changed, so may have the current frequency. Reset +* requested_freq to avoid any unintended outcomes due to the mismatch. +*/ + dbs_info->requested_freq = policy->cur; +} +static struct dbs_governor cs_governor = { .gov =CPUFREQ_DBS_GOVERNOR_INITIALIZER ("conservative" ), .kobj_type = { .default_groups = cs_groups },
@@ -323,6 +334,7 @@ static struct dbs_governor cs_governor = .init = cs_init, .exit = cs_exit, .start = cs_start, + .limits = cs_limits, };#define CPU_FREQ_GOV_CONSERVATIVE (cs_governor.gov)
drivers/cpufreq/cpufreq_governor.c +3 -0
@@ -561,6 +561,7 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_svoid cpufreq_dbs_governor_limits (struct cpufreq_policy *policy) { +struct dbs_governor *gov =dbs_governor_of (policy);struct policy_dbs_info *policy_dbs;/* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
@@ -572,6 +573,8 @@ void cpufreq_dbs_governor_limits(structmutex_lock (&policy_dbs->update_mutex);cpufreq_policy_apply_limits (policy);gov_update_sample_delay (policy_dbs,0 ); +if (gov->limits) + gov->limits (policy);mutex_unlock (&policy_dbs->update_mutex); out:
drivers/cpufreq/cpufreq_governor.h +1 -0
@@ -138,6 +138,7 @@ struct dbs_governor {int (*init)(struct dbs_data *dbs_data);void (*exit)(struct dbs_data *dbs_data);void (*start)(struct cpufreq_policy *policy); +void (*limits)(struct cpufreq_policy *policy); };static inline struct dbs_governor *dbs_governor_of (struct cpufreq_policy *policy)
Greg Kroah-Hartman
maintainerPATCH 95/312 KVM: arm64: Discard PC update state on vcpu reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 1744a6ef48b9a48f017e3e1a0d05de0a6978396e upstream.
Our vcpu reset suffers from a particularly interesting flaw, as it does not correctly deal with state that will have an effect on the execution flow out of reset.
Take the following completely random example, never seen in the wild and that never resulted in a couple of sleepless nights: /s
- vcpu-A issues a PSCI_CPU_OFF using the SMC conduit
- SMC being a trapped instruction (as opposed to HVC which is always normally executed), we annotate the vcpu as needing to skip the next instruction, which is the SMC itself
- vcpu-A is now safely off
- vcpu-B issues a PSCI_CPU_ON for vcpu-A, providing a starting PC
- vcpu-A gets reset, get the new PC, and is sent on its merry way
- right at the point of entering the guest, we notice that a PC increment is pending (remember the earlier SMC?)
- vcpu-A skips its first instruction...
What could possibly go wrong?
Well, I'm glad you asked. For pKVM as a NV guest, that first instruction is extremely significant, as it indicates whether the CPU is booting or resuming. Having skipped that instruction, nothing makes any sense anymore, and CPU hotplugging fails.
This is all caused by the decoupling of PC update from the handling of an exception that triggers such update, making it non-obvious what affects what when.
Fix this train wreck by discarding all the PC-affecting state on vcpu reset.
--- arch/arm64/kvm/reset.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
arch/arm64/kvm/reset.c +14 -0
@@ -339,6 +339,20 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpukvm_vcpu_set_be (vcpu); *vcpu_pc (vcpu) = target_pc; + +/* +* We may come from a state where either a PC update was +* pending (SMC call resulting in PC being increpented to +* skip the SMC) or a pending exception. Make sure we get +* rid of all that, as this cannot be valid out of reset. +* +* Note that clearing the exception mask also clears PC +* updates, but that's an implementation detail, and we +* really want to make it explicit. +*/ +vcpu_clear_flag (vcpu,PENDING_EXCEPTION ); +vcpu_clear_flag (vcpu,EXCEPT_MASK ); +vcpu_clear_flag (vcpu,INCREMENT_PC );vcpu_set_reg (vcpu,0 , reset_state.r0); }
Greg Kroah-Hartman
maintainerPATCH 96/312 hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit 0adc752b4f7d82af7bd14f7cad3091b3b5d702ba upstream.
The hwmon sysfs ABI expects tempN_crit_hyst to report the temperature at which the critical condition clears, not the hysteresis delta from the critical limit.
The peci cputemp driver currently returns tjmax - tcontrol for crit_hyst_type, which is the hysteresis margin rather than the corresponding absolute temperature.
Return tcontrol directly, and update the documentation accordingly.
--- Documentation/hwmon/peci-cputemp.rst | 10 ++++++---- drivers/hwmon/peci/cputemp.c | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-)
Documentation/hwmon/peci-cputemp.rst +6 -4
@@ -51,8 +51,9 @@ temp1_max Provides thermal control temp temp1_crit Provides shutdown temperature of the CPU package which is also known as the maximum processor junction temperature, Tjmax or Tprochot. -temp1_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of - the CPU package. +temp1_crit_hyst Provides the hysteresis temperature of the CPU + package. Returns Tcontrol, the temperature at which + the critical condition clears. temp2_label "DTS" temp2_input Provides current temperature of the CPU package scaled
@@ -62,8 +63,9 @@ temp2_max Provides thermal control temp temp2_crit Provides shutdown temperature of the CPU package which is also known as the maximum processor junction temperature, Tjmax or Tprochot. -temp2_crit_hyst Provides the hysteresis value from Tcontrol to Tjmax of - the CPU package. +temp2_crit_hyst Provides the hysteresis temperature of the CPU + package. Returns Tcontrol, the temperature at which + the critical condition clears. temp3_label "Tcontrol" temp3_input Provides current Tcontrol temperature of the CPU
drivers/hwmon/peci/cputemp.c +1 -1
@@ -133,7 +133,7 @@ static int get_temp_target(struct peci_c *val = priv->temp.target.tjmax;break ;case crit_hyst_type: - *val = priv->temp.target.tjmax - priv->temp.target.tcontrol; + *val = priv->temp.target.tcontrol;break ;default : ret = -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 97/312 hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <[email protected]>
commit b0c9d8ae71509f25690d57f2efddebf7f4b12194 upstream.
cputemp_is_visible() validates the channel index against CPUTEMP_CHANNEL_NUMS, but currently uses '>' instead of '>='. As a result, channel == CPUTEMP_CHANNEL_NUMS is not rejected even though valid indices are 0 .. CPUTEMP_CHANNEL_NUMS - 1.
Fix the bounds check by using '>=' so invalid channel indices are rejected before indexing the core bitmap.
--- drivers/hwmon/peci/cputemp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/peci/cputemp.c +1 -1
@@ -339,7 +339,7 @@ static umode_t cputemp_is_visible(const {const struct peci_cputemp *priv = data; -if (channel >CPUTEMP_CHANNEL_NUMS ) +if (channel >=CPUTEMP_CHANNEL_NUMS )return 0 ;if (channel < channel_core)
Greg Kroah-Hartman
maintainerPATCH 98/312 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchan Nam <[email protected]>
commit bef4f4a88b73e4cc550d25f665b8a9952af22773 upstream.
MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports.
We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain.
This keeps request cleanup and queue cancellation from running in parallel for request-capable devices.
--- drivers/media/mc/mc-request.c | 5 +++++ drivers/media/v4l2-core/v4l2-ioctl.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/media/mc/mc-request.c +5 -0
@@ -190,6 +190,8 @@ static long media_request_ioctl_reinit(sstruct media_device *mdev = req->mdev;unsigned long flags; +mutex_lock (&mdev->req_queue_mutex); +spin_lock_irqsave (&req->lock, flags);if (req->state !=MEDIA_REQUEST_STATE_IDLE && req->state !=MEDIA_REQUEST_STATE_COMPLETE ) {
@@ -197,6 +199,7 @@ static long media_request_ioctl_reinit(s"request: %s not in idle or complete state, cannot reinit\n" , req->debug_str);spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return -EBUSY ; }if (req->access_count) {
@@ -204,6 +207,7 @@ static long media_request_ioctl_reinit(s"request: %s is being accessed, cannot reinit\n" , req->debug_str);spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return -EBUSY ; } req->state =MEDIA_REQUEST_STATE_CLEANING ;
@@ -214,6 +218,7 @@ static long media_request_ioctl_reinit(sspin_lock_irqsave (&req->lock, flags); req->state =MEDIA_REQUEST_STATE_IDLE ;spin_unlock_irqrestore (&req->lock, flags); +mutex_unlock (&mdev->req_queue_mutex);return 0 ; }
drivers/media/v4l2-core/v4l2-ioctl.c +3 -2
@@ -2987,13 +2987,14 @@ static long __video_do_ioctl(struct file vfh = file->private_data;/* -* We need to serialize streamon/off with queueing new requests. +* We need to serialize streamon/off/reqbufs with queueing new requests. * These ioctls may trigger the cancellation of a streaming * operation, and that should not be mixed with queueing a new * request at the same time. */ if (v4l2_device_supports_requests (vfd->v4l2_dev) && - (cmd ==VIDIOC_STREAMON || cmd ==VIDIOC_STREAMOFF )) { + (cmd ==VIDIOC_STREAMON || cmd ==VIDIOC_STREAMOFF || + cmd ==VIDIOC_REQBUFS )) { req_queue_lock = &vfd->v4l2_dev->mdev->req_queue_mutex;if (mutex_lock_interruptible (req_queue_lock))
Greg Kroah-Hartman
maintainerPATCH 99/312 virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: xietangxin <[email protected]>
commit ba8bda9a0896746053aa97ac6c3e08168729172c upstream.
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net.
Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \
protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2test_ns
--- drivers/net/virtio_net.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/virtio_net.c +1 -0
@@ -1924,6 +1924,7 @@ static netdev_tx_t start_xmit(struct sk_/* Don't wait up for transmitted skbs to be freed. */ if (!use_napi) {skb_orphan (skb); +skb_dst_drop (skb);nf_reset_ct (skb); }
Greg Kroah-Hartman
maintainerPATCH 100/312 erofs: add GFP_NOIO in the bio completion if needed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiucheng Xu <[email protected]>
commit c23df30915f83e7257c8625b690a1cece94142a0 upstream.
The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL.
Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios.
Trimmed down the call stack, as follows:
f2fs_submit_read_io
submit_bio //bio_list is initialized.
mmc_blk_mq_recovery
z_erofs_endio
vm_map_ram
__pte_alloc_kernel
__alloc_pages_direct_reclaim
shrink_folio_list
__swap_writepage
submit_bio_wait //bio_list is non-NULL, hang!!!
Use memalloc_noio_{save,restore}() to wrap up this path.
--- fs/erofs/zdata.c | 3 +++ 1 file changed, 3 insertions(+)
fs/erofs/zdata.c +3 -0
@@ -1259,6 +1259,7 @@ static void z_erofs_decompress_kickoff(s int bios) {struct erofs_sb_info *const sbi =EROFS_SB (io->sb); +int gfp_flag;/* wake up the caller thread for sync decompression */ if (io->sync) {
@@ -1277,7 +1278,9 @@ static void z_erofs_decompress_kickoff(s sbi->opt.sync_decompress =EROFS_SYNC_DECOMPRESS_FORCE_ON ;return ; } + gfp_flag =memalloc_noio_save ();z_erofs_decompressqueue_work (&io->u.work); +memalloc_noio_restore (gfp_flag); } static struct page *pickup_page_for_submission(struct z_erofs_pcluster *pcl,
Greg Kroah-Hartman
maintainerPATCH 101/312 alarmtimer: Fix argument order in alarm_timer_forward()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <[email protected]>
commit 5d16467ae56343b9205caedf85e3a131e0914ad8 upstream.
alarm_timer_forward() passes arguments to alarm_forward() in the wrong order:
alarm_forward(alarm, timr->it_interval, now);
However, alarm_forward() is defined as:
u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
and uses the second argument as the current time:
delta = ktime_sub(now, alarm->node.expires);
Passing the interval as "now" results in incorrect delta computation, which can lead to missed expirations or incorrect overrun accounting.
This issue has been present since the introduction of alarm_timer_forward().
Fix this by swapping the arguments.
--- kernel/time/alarmtimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/alarmtimer.c +1 -1
@@ -609,7 +609,7 @@ static s64 alarm_timer_forward(struct k_ {struct alarm *alarm = &timr->it.alarm.alarmtimer; -return alarm_forward (alarm, timr->it_interval, now); +return alarm_forward (alarm, now, timr->it_interval); }/**
Greg Kroah-Hartman
maintainerPATCH 102/312 scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyllis Xu <[email protected]>
commit 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f upstream.
A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory.
Fix by clamping num_written to max_targets before storing it.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/ibmvscsi/ibmvfc.c +2 -1
@@ -4928,7 +4928,8 @@ static void ibmvfc_discover_targets_doneswitch (mad_status) {case IBMVFC_MAD_SUCCESS :ibmvfc_dbg (vhost,"Discover Targets succeeded\n" ); - vhost->num_targets =be32_to_cpu (rsp->num_written); + vhost->num_targets =min_t (u32,be32_to_cpu (rsp->num_written), + max_targets);ibmvfc_set_host_action (vhost,IBMVFC_HOST_ACTION_ALLOC_TGTS );break ;case IBMVFC_MAD_FAILED :
Greg Kroah-Hartman
maintainerPATCH 103/312 scsi: ses: Handle positive SCSI error from ses_recv_diag()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 7a9f448d44127217fabc4065c5ba070d4e0b5d37 upstream.
ses_recv_diag() can return a positive value, which also means that an error happened, so do not only test for negative values.
--- drivers/scsi/ses.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/ses.c +1 -1
@@ -184,7 +184,7 @@ static unsigned char *ses_get_page2_descunsigned char *type_ptr = ses_dev->page1_types;unsigned char *desc_ptr = ses_dev->page2 +8 ; -if (ses_recv_diag (sdev,2 , ses_dev->page2, ses_dev->page2_len) <0 ) +if (ses_recv_diag (sdev,2 , ses_dev->page2, ses_dev->page2_len))return NULL ;for (i =0 ; i < ses_dev->page1_num_types; i++, type_ptr +=4 ) {
Greg Kroah-Hartman
maintainerPATCH 104/312 net: macb: Use dev_consume_skb_any() to free TX SKBs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <[email protected]>
commit 647b8a2fe474474704110db6bd07f7a139e621eb upstream.
The napi_consume_skb() function is not intended to be called in an IRQ disabled context. However, after commit 6bc8a5098bf4 ("net: macb: Fix tx_ptr_lock locking"), the freeing of TX SKBs is performed with IRQs disabled. To resolve the following call trace, use dev_consume_skb_any() for freeing TX SKBs:
WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15
Modules linked in:
CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT
Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __local_bh_enable_ip+0x174/0x188
lr : local_bh_enable+0x24/0x38
sp : ffff800082b3bb10
x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0
x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80
x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000
x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001
x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000
x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650
x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258
x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc
Call trace:
__local_bh_enable_ip+0x174/0x188 (P)
local_bh_enable+0x24/0x38
skb_attempt_defer_free+0x190/0x1d8
napi_consume_skb+0x58/0x108
macb_tx_poll+0x1a4/0x558
__napi_poll+0x50/0x198
net_rx_action+0x1f4/0x3d8
handle_softirqs+0x16c/0x560
run_ksoftirqd+0x44/0x80
smpboot_thread_fn+0x1d8/0x338
kthread+0x120/0x150
ret_from_fork+0x10/0x20
irq event stamp: 29751
hardirqs last enabled at (29750): [<ffff8000813be184>] _raw_spin_unlock_irqrestore+0x44/0x88
hardirqs last disabled at (29751): [<ffff8000813bdf60>] _raw_spin_lock_irqsave+0x38/0x98
softirqs last enabled at (29150): [<ffff8000800f1aec>] handle_softirqs+0x504/0x560
softirqs last disabled at (29153): [<ffff8000800f2fec>] run_ksoftirqd+0x44/0x80--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -1075,7 +1075,7 @@ static void macb_tx_unmap(struct macb *b }if (tx_skb->skb) { -napi_consume_skb (tx_skb->skb, budget); +dev_consume_skb_any (tx_skb->skb); tx_skb->skb =NULL ; } }
Greg Kroah-Hartman
maintainerPATCH 105/312 jbd2: gracefully abort on checkpointing state corruptions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milos Nikic <[email protected]>
commit bac3190a8e79beff6ed221975e0c9b1b5f2a21da upstream.
This patch targets two internal state machine invariants in checkpoint.c residing inside functions that natively return integer error codes.
- In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE and a graceful journal abort, returning -EFSCORRUPTED.
- In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for an unexpected buffer_jwrite state. If the warning triggers, we explicitly drop the just-taken get_bh() reference and call __flush_batch() to safely clean up any previously queued buffers in the j_chkpt_bhs array, preventing a memory leak before returning -EFSCORRUPTED.
--- fs/jbd2/checkpoint.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
fs/jbd2/checkpoint.c +13 -2
@@ -279,7 +279,15 @@ restart:*/ BUFFER_TRACE (bh,"queue" );get_bh (bh); -J_ASSERT_BH (bh, !buffer_jwrite (bh)); +if (WARN_ON_ONCE (buffer_jwrite (bh))) { +put_bh (bh);/* drop the ref we just took */ +spin_unlock (&journal->j_list_lock); +/* Clean up any previously batched buffers */ +if (batch_count) +__flush_batch (journal, &batch_count); +jbd2_journal_abort (journal, -EFSCORRUPTED ); +return -EFSCORRUPTED ; + } journal->j_chkpt_bhs[batch_count++] = bh; transaction->t_chp_stats.cs_written++; transaction->t_checkpoint_list = jh->b_cpnext;
@@ -337,7 +345,10 @@ int jbd2_cleanup_journal_tail(journal_tif (!jbd2_journal_get_log_tail (journal, &first_tid, &blocknr))return 1 ; -J_ASSERT (blocknr !=0 ); +if (WARN_ON_ONCE (blocknr ==0 )) { +jbd2_journal_abort (journal, -EFSCORRUPTED ); +return -EFSCORRUPTED ; + }/* * We need to make sure that any blocks that were recently written out
Greg Kroah-Hartman
maintainerPATCH 106/312 irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jassi Brar <[email protected]>
commit cfe02147e86307a17057ee4e3604f5f5919571d2 upstream.
The mbox_client for qcom-mpm sends NULL doorbell messages via mbox_send_message() but never signals TX completion.
Set knows_txdone=true and call mbox_client_txdone() after a successful send, matching the pattern used by other Qualcomm mailbox clients (smp2p, smsm, qcom_aoss etc).
--- drivers/irqchip/irq-qcom-mpm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/irqchip/irq-qcom-mpm.c +3 -0
@@ -305,6 +305,8 @@ static int mpm_pd_power_off(struct generif (ret <0 )return ret; +mbox_client_txdone (priv->mbox_chan,0 ); +return 0 ; }
@@ -414,6 +416,7 @@ static int qcom_mpm_init(struct device_n } priv->mbox_client.dev = dev; + priv->mbox_client.knows_txdone = true; priv->mbox_chan =mbox_request_channel (&priv->mbox_client,0 );if (IS_ERR (priv->mbox_chan)) { ret =PTR_ERR (priv->mbox_chan);
Greg Kroah-Hartman
maintainerPATCH 107/312 dmaengine: sh: rz-dmac: Protect the driver specific lists
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit abb863e6213dc41a58ef8bb3289b7e77460dabf3 upstream.
The driver lists (ld_free, ld_queue) are used in rz_dmac_free_chan_resources(), rz_dmac_terminate_all(), rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg() and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since these functions also check whether the lists are empty and update or remove list entries.
--- drivers/dma/sh/rz-dmac.c | 63 ++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 28 deletions(-)
drivers/dma/sh/rz-dmac.c +35 -28
@@ -10,6 +10,7 @@*/ #include <linux/bitfield.h> +#include <linux/cleanup.h> #include <linux/dma-mapping.h> #include <linux/dmaengine.h> #include <linux/interrupt.h>
@@ -424,6 +425,7 @@ static int rz_dmac_alloc_chan_resources(if (!desc)break ; +/* No need to lock. This is called only for the 1st client. */ list_add_tail (&desc->node, &channel->ld_free); channel->descs_allocated++; }
@@ -479,18 +481,21 @@ rz_dmac_prep_dma_memcpy(struct dma_chandev_dbg (dmac->dev,"%s channel: %d src=0x%pad dst=0x%pad len=%zu\n" , __func__, channel->index, &src, &dest, len); -if (list_empty (&channel->ld_free)) -return NULL ; + scoped_guard(spinlock_irqsave, &channel->vc.lock) { +if (list_empty (&channel->ld_free)) +return NULL ; + + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + + desc->type =RZ_DMAC_DESC_MEMCPY ; + desc->src = src; + desc->dest = dest; + desc->len = len; + desc->direction =DMA_MEM_TO_MEM ; - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); - - desc->type =RZ_DMAC_DESC_MEMCPY ; - desc->src = src; - desc->dest = dest; - desc->len = len; - desc->direction =DMA_MEM_TO_MEM ; +list_move_tail (channel->ld_free.next, &channel->ld_queue); + } -list_move_tail (channel->ld_free.next, &channel->ld_queue);return vchan_tx_prep (&channel->vc, &desc->vd, flags); }
@@ -506,27 +511,29 @@ rz_dmac_prep_slave_sg(struct dma_chan *cint dma_length =0 ;int i =0 ; -if (list_empty (&channel->ld_free)) -return NULL ; - - desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + scoped_guard(spinlock_irqsave, &channel->vc.lock) { +if (list_empty (&channel->ld_free)) +return NULL ; + + desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node); + +for_each_sg (sgl, sg, sg_len, i) + dma_length +=sg_dma_len (sg); + + desc->type =RZ_DMAC_DESC_SLAVE_SG ; + desc->sg = sgl; + desc->sgcount = sg_len; + desc->len = dma_length; + desc->direction = direction; + +if (direction ==DMA_DEV_TO_MEM ) + desc->src = channel->src_per_address; +else + desc->dest = channel->dst_per_address; -for_each_sg (sgl, sg, sg_len, i) { - dma_length +=sg_dma_len (sg); +list_move_tail (channel->ld_free.next, &channel->ld_queue); } - desc->type =RZ_DMAC_DESC_SLAVE_SG ; - desc->sg = sgl; - desc->sgcount = sg_len; - desc->len = dma_length; - desc->direction = direction; - -if (direction ==DMA_DEV_TO_MEM ) - desc->src = channel->src_per_address; -else - desc->dest = channel->dst_per_address; - -list_move_tail (channel->ld_free.next, &channel->ld_queue);return vchan_tx_prep (&channel->vc, &desc->vd, flags); }
Greg Kroah-Hartman
maintainerPATCH 108/312 dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
commit 89a8567d84bde88cb7cdbbac2ab2299c4f991490 upstream.
Both rz_dmac_disable_hw() and rz_dmac_irq_handle_channel() update the CHCTRL register. To avoid concurrency issues when configuring functionalities exposed by this registers, take the virtual channel lock. All other CHCTRL updates were already protected by the same lock.
Previously, rz_dmac_disable_hw() disabled and re-enabled local IRQs, before accessing CHCTRL registers but this does not ensure race-free access. Remove the local IRQ disable/enable code as well.
--- drivers/dma/sh/rz-dmac.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/dma/sh/rz-dmac.c +4 -5
@@ -286,13 +286,10 @@ static void rz_dmac_disable_hw(struct rz {struct dma_chan *chan = &channel->vc.chan;struct rz_dmac *dmac =to_rz_dmac (chan->device); -unsigned long flags;dev_dbg (dmac->dev,"%s channel %d\n" , __func__, channel->index); -local_irq_save (flags);rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); -local_irq_restore (flags); }static void rz_dmac_set_dmars_register (struct rz_dmac *dmac,int nr,u32 dmars)
@@ -545,8 +542,8 @@ static int rz_dmac_terminate_all(structunsigned int i;LIST_HEAD (head); -rz_dmac_disable_hw (channel);spin_lock_irqsave (&channel->vc.lock, flags); +rz_dmac_disable_hw (channel);for (i =0 ; i <DMAC_NR_LMDESC ; i++) lmdesc[i].header =0 ;
@@ -676,7 +673,9 @@ static void rz_dmac_irq_handle_channel(sif (chstat &CHSTAT_ER ) {dev_err (dmac->dev,"DMAC err CHSTAT_%d = %08X\n" , channel->index, chstat); -rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); + + scoped_guard(spinlock_irqsave, &channel->vc.lock) +rz_dmac_ch_writel (channel,CHCTRL_DEFAULT ,CHCTRL ,1 ); goto done; }
Greg Kroah-Hartman
maintainerPATCH 109/312 LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 95db0c9f526d583634cddb2e5914718570fbac87 upstream.
1. Hardware limitation: GPU, DC and VPU are typically PCI device 06.0, 06.1 and 06.2. They share some hardware resources, so when configure the PCI 06.0 device BAR1, DMA memory access cannot be performed through this BAR, otherwise it will cause hardware abnormalities.
2. In typical scenarios of reboot or S3/S4, DC access to memory through BAR is not prohibited, resulting in GPU DMA hangs.
3. Workaround method: When configuring the 06.0 device BAR1, turn off the memory access of DC, GPU and VPU (via DC's CRTC registers).
--- arch/loongarch/pci/pci.c | 80 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+)
arch/loongarch/pci/pci.c +80 -0
@@ -6,9 +6,11 @@#include <linux/export.h> #include <linux/init.h> #include <linux/acpi.h> +#include <linux/delay.h> #include <linux/types.h> #include <linux/pci.h> #include <linux/vgaarb.h> +#include <linux/io-64-nonatomic-lo-hi.h> #include <asm/cacheflush.h> #include <asm/loongson.h>
@@ -16,6 +18,9 @@#define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06#define PCI_DEVICE_ID_LOONGSON_DC2 0x7a36#define PCI_DEVICE_ID_LOONGSON_DC3 0x7a46 +#define PCI_DEVICE_ID_LOONGSON_GPU1 0x7a15 +#define PCI_DEVICE_ID_LOONGSON_GPU2 0x7a25 +#define PCI_DEVICE_ID_LOONGSON_GPU3 0x7a35int raw_pci_read (unsigned int domain,unsigned int bus,unsigned int devfn,int reg,int len,u32 *val)
@@ -100,3 +105,78 @@ static void pci_fixup_vgadev(struct pci_DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC1 , pci_fixup_vgadev);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC2 , pci_fixup_vgadev);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_DC3 , pci_fixup_vgadev); + +#define CRTC_NUM_MAX 2 +#define CRTC_OUTPUT_ENABLE 0x100 + +static void loongson_gpu_fixup_dma_hang (struct pci_dev *pdev,bool on) +{ +u32 i, val, count, crtc_offset, device; +void __iomem *crtc_reg, *base, *regbase; +static u32 crtc_status[CRTC_NUM_MAX ] = {0 }; + + base = pdev->bus->ops->map_bus (pdev->bus, pdev->devfn +1 ,0 ); + device =readw (base +PCI_DEVICE_ID ); + + regbase =ioremap (readq (base +PCI_BASE_ADDRESS_0 ) & ~0xffull ,SZ_64K ); +if (!regbase) { +pci_err (pdev,"Failed to ioremap()\n" ); +return ; + } + +switch (device) { +case PCI_DEVICE_ID_LOONGSON_DC2 : + crtc_reg = regbase +0x1240 ; + crtc_offset =0x10 ; +break ; +case PCI_DEVICE_ID_LOONGSON_DC3 : + crtc_reg = regbase; + crtc_offset =0x400 ; +break ; + } + +for (i =0 ; i <CRTC_NUM_MAX ; i++, crtc_reg += crtc_offset) { + val =readl (crtc_reg); + +if (!on) + crtc_status[i] = val; + +/* No need to fixup if the status is off at startup. */ +if (!(crtc_status[i] &CRTC_OUTPUT_ENABLE )) +continue ; + +if (on) + val |=CRTC_OUTPUT_ENABLE ; +else + val &= ~CRTC_OUTPUT_ENABLE ; + +mb (); +writel (val, crtc_reg); + +for (count =0 ; count <40 ; count++) { + val =readl (crtc_reg) &CRTC_OUTPUT_ENABLE ; +if ((on && val) || (!on && !val)) +break ; +udelay (1000 ); + } + +pci_info (pdev,"DMA hang fixup at reg[0x%lx]: 0x%x\n" , + (unsigned long )crtc_reg &0xffff ,readl (crtc_reg)); + } + +iounmap (regbase); +} + +static void pci_fixup_dma_hang_early (struct pci_dev *pdev) +{ +loongson_gpu_fixup_dma_hang (pdev, false); +} +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU2 , pci_fixup_dma_hang_early); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU3 , pci_fixup_dma_hang_early); + +static void pci_fixup_dma_hang_final (struct pci_dev *pdev) +{ +loongson_gpu_fixup_dma_hang (pdev, true); +} +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU2 , pci_fixup_dma_hang_final); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_LOONGSON ,PCI_DEVICE_ID_LOONGSON_GPU3 , pci_fixup_dma_hang_final);
Greg Kroah-Hartman
maintainerPATCH 110/312 xfs: stop reclaim before pushing AIL during unmount
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuto Ohnuki <[email protected]>
commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 upstream.
The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
--- fs/xfs/xfs_mount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/xfs/xfs_mount.c +4 -3
@@ -575,8 +575,9 @@ xfs_unmount_check(* have been retrying in the background. This will prevent never-ending * retries in AIL pushing from hanging the unmount. * -* Finally, we can push the AIL to clean all the remaining dirty objects, then -* reclaim the remaining inodes that are still in memory at this point in time. +* Stop inodegc and background reclaim before pushing the AIL so that they +* are not running while the AIL is being flushed. Then push the AIL to +* clean all the remaining dirty objects and reclaim the remaining inodes. */ static void xfs_unmount_flush_inodes(
@@ -588,9 +589,9 @@ xfs_unmount_flush_inodes(set_bit (XFS_OPSTATE_UNMOUNTING , &mp->m_opstate); -xfs_ail_push_all_sync (mp->m_ail);xfs_inodegc_stop (mp);cancel_delayed_work_sync (&mp->m_reclaim_work); +xfs_ail_push_all_sync (mp->m_ail);xfs_reclaim_inodes (mp);xfs_health_unmount (mp); }
Greg Kroah-Hartman
maintainerPATCH 111/312 xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit d72f2084e30966097c8eae762e31986a33c3c0ae upstream.
The ri_total checks for SET/REPLACE operations are hardcoded to 3, but xfs_attri_item_size() only emits a value iovec when value_len > 0, so ri_total is 2 when value_len == 0.
For PPTR_SET/PPTR_REMOVE/PPTR_REPLACE, value_len is validated by xfs_attri_validate() to be exactly sizeof(struct xfs_parent_rec) and is never zero, so their hardcoded checks remain correct.
This problem may cause log recovery failures. The following script can be used to reproduce the problem:
#!/bin/bash
mkfs.xfs -f /dev/sda
mount /dev/sda /mnt/test/
touch /mnt/test/file
for i in {1..200}; do
attr -s "user.attr_$i" -V "value_$i" /mnt/test/file > /dev/null
done
echo 1 > /sys/fs/xfs/debug/larp
echo 1 > /sys/fs/xfs/sda/errortag/larp
attr -s "user.zero" -V "" /mnt/test/file
echo 0 > /sys/fs/xfs/sda/errortag/larp
umount /mnt/test
mount /dev/sda /mnt/test/ # mount failed
Fix this by deriving the expected count dynamically as "2 + !!value_len" for SET/REPLACE operations.
--- fs/xfs/xfs_attr_item.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/xfs/xfs_attr_item.c +2 -2
@@ -739,8 +739,8 @@ xlog_recover_attri_commit_pass2(switch (op) {case XFS_ATTRI_OP_FLAGS_SET :case XFS_ATTRI_OP_FLAGS_REPLACE : -/* Log item, attr name, attr value */ -if (item->ri_total !=3 ) { +/* Log item, attr name, optional attr value */ +if (item->ri_total !=2 + !!attri_formatp->alfi_value_len) {XFS_CORRUPTION_ERROR (__func__,XFS_ERRLEVEL_LOW , mp, attri_formatp, len);return -EFSCORRUPTED ;
Greg Kroah-Hartman
maintainerPATCH 112/312 ext4: fix journal credit check when setting fscrypt context
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Weber <[email protected]>
commit b1d682f1990c19fb1d5b97d13266210457092bcd upstream.
Fix an issue arising when ext4 features has_journal, ea_inode, and encrypt are activated simultaneously, leading to ENOSPC when creating an encrypted file.
Fix by passing XATTR_CREATE flag to xattr_set_handle function if a handle is specified, i.e., when the function is called in the control flow of creating a new inode. This aligns the number of jbd2 credits set_handle checks for with the number allocated for creating a new inode.
ext4_set_context must not be called with a non-null handle (fs_data) if fscrypt context xattr is not guaranteed to not exist yet. The only other usage of this function currently is when handling the ioctl FS_IOC_SET_ENCRYPTION_POLICY, which calls it with fs_data=NULL.
--- fs/ext4/crypto.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ext4/crypto.c +8 -1
@@ -169,10 +169,17 @@ static int ext4_set_context(struct inode*/ if (handle) { +/* +* Since the inode is new it is ok to pass the +* XATTR_CREATE flag. This is necessary to match the +* remaining journal credits check in the set_handle +* function with the credits allocated for the new +* inode. +*/ res =ext4_xattr_set_handle (handle, inode,EXT4_XATTR_INDEX_ENCRYPTION ,EXT4_XATTR_NAME_ENCRYPTION_CONTEXT , - ctx, len,0 ); + ctx, len,XATTR_CREATE );if (!res) {ext4_set_inode_flag (inode,EXT4_INODE_ENCRYPT ); ext4_clear_inode_state(inode,
Greg Kroah-Hartman
maintainerPATCH 113/312 ext4: convert inline data to extents when truncate exceeds inline size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 upstream.
Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline.
Without this fix, the following sequence causes a kernel BUG_ON():
1. Mount filesystem with inode that has inline flag set and small size
2. truncate(file, 50MB) - grows size but inline flag remains set
3. sendfile() attempts to write data
4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request.
The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change.
This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations.
--- fs/ext4/inode.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/ext4/inode.c +12 -0
@@ -5551,6 +5551,18 @@ int ext4_setattr(struct user_namespace *if (attr->ia_size == inode->i_size) inc_ivers = false; +/* +* If file has inline data but new size exceeds inline capacity, +* convert to extent-based storage first to prevent inconsistent +* state (inline flag set but size exceeds inline capacity). +*/ +if (ext4_has_inline_data (inode) && + attr->ia_size >EXT4_I (inode)->i_inline_size) { + error =ext4_convert_inline_data (inode); +if (error) + goto err_out; + } +if (shrink) {if (ext4_should_order_data (inode)) { error = ext4_begin_ordered_truncate(inode,
Greg Kroah-Hartman
maintainerPATCH 114/312 ext4: make recently_deleted() properly work with lazy itable initialization
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit bd060afa7cc3e0ad30afa9ecc544a78638498555 upstream.
recently_deleted() checks whether inode has been used in the near past. However this can give false positive result when inode table is not initialized yet and we are in fact comparing to random garbage (or stale itable block of a filesystem before mkfs). Ultimately this results in uninitialized inodes being skipped during inode allocation and possibly they are never initialized and thus e2fsck complains. Verify if the inode has been initialized before checking for dtime.
--- fs/ext4/ialloc.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/ialloc.c +6 -0
@@ -687,6 +687,12 @@ static int recently_deleted(struct superif (unlikely (!gdp))return 0 ; +/* Inode was never used in this filesystem? */ +if (ext4_has_group_desc_csum (sb) && + (gdp->bg_flags &cpu_to_le16 (EXT4_BG_INODE_UNINIT ) || + ino >=EXT4_INODES_PER_GROUP (sb) -ext4_itable_unused_count (sb, gdp))) +return 0 ; + bh =sb_find_get_block (sb,ext4_inode_table (sb, gdp) + (ino / inodes_per_block));if (!bh || !buffer_uptodate (bh))
Greg Kroah-Hartman
maintainerPATCH 115/312 ext4: avoid infinite loops caused by residual data
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 5422fe71d26d42af6c454ca9527faaad4e677d6c upstream.
On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously.
The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1].
If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases:
1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case.
2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks.
[1]
INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]
--- fs/ext4/extents.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ext4/extents.c +6 -2
@@ -4424,9 +4424,13 @@ got_allocated_blocks: path =ext4_ext_insert_extent (handle, inode, path, &newex, flags);if (IS_ERR (path)) { err =PTR_ERR (path); -if (allocated_clusters) { +/* +* Gracefully handle out of space conditions. If the filesystem +* is inconsistent, we'll just leak allocated blocks to avoid +* causing even more damage. +*/ +if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC )) {int fb_flags =0 ; -/* * free data blocks we just allocated. * not a good idea to call discard here directly,
Greg Kroah-Hartman
maintainerPATCH 116/312 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 46066e3a06647c5b186cc6334409722622d05c44 upstream.
There's issue as follows:
...
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117 EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): error count since last fsck: 1
EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760 EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
...
According to the log analysis, blocks are always requested from the corrupted block group. This may happen as follows:ext4_mb_find_by_goal
ext4_mb_load_buddy
ext4_mb_load_buddy_gfp
ext4_mb_init_cache
ext4_read_block_bitmap_nowait
ext4_wait_block_bitmap
ext4_validate_block_bitmap
if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
return -EFSCORRUPTED; // There's no logs.
if (err)
return err; // Will return errorext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
goto out;
After commit 9008a58e5dce ("ext4: make the bitmap read routines return real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group as corrupt on block bitmap error") is no real solution for allocating blocks from corrupted block groups. This is because if 'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then 'ext4_mb_load_buddy()' may return an error. This means that the block allocation will fail.
Therefore, check block group if corrupted when ext4_mb_load_buddy() returns error.
--- fs/ext4/mballoc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/ext4/mballoc.c +5 -1
@@ -2236,8 +2236,12 @@ int ext4_mb_find_by_goal(struct ext4_allreturn 0 ; err =ext4_mb_load_buddy (ac->ac_sb, group, e4b); -if (err) +if (err) { +if (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info) && + !(ac->ac_flags &EXT4_MB_HINT_GOAL_ONLY )) +return 0 ;return err; + }ext4_lock_group (ac->ac_sb, group);if (unlikely (EXT4_MB_GRP_BBITMAP_CORRUPT (e4b->bd_info)))
Greg Kroah-Hartman
maintainerPATCH 117/312 ext4: reject mount if bigalloc with s_first_data_block != 0
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helen Koike <[email protected]>
commit 3822743dc20386d9897e999dbb990befa3a5b3f8 upstream.
bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
--- fs/ext4/super.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/super.c +7 -0
@@ -3575,6 +3575,13 @@ int ext4_feature_set_ok(struct super_blo "extents feature\n");return 0 ; } +if (ext4_has_feature_bigalloc (sb) && +le32_to_cpu (EXT4_SB (sb)->s_es->s_first_data_block)) { +ext4_msg (sb,KERN_WARNING , +"bad geometry: bigalloc file system with non-zero " +"first_data_block\n" ); +return 0 ; + }#if !IS_ENABLED (CONFIG_QUOTA ) || !IS_ENABLED (CONFIG_QFMT_V2 ) if (!readonly && (ext4_has_feature_quota(sb) ||
Greg Kroah-Hartman
maintainerPATCH 118/312 ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit ec0a7500d8eace5b4f305fa0c594dd148f0e8d29 upstream.
During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds a reference to iloc.bh that must be released via brelse().
However, several error paths jump to the 'out' label without releasing iloc.bh:
- ext4_handle_dirty_metadata() failure
- sync_dirty_buffer() failure
- ext4_mark_inode_used() failure
- ext4_iget() failure
Fix this by introducing an 'out_brelse' label placed just before the existing 'out' label to ensure iloc.bh is always released.
Additionally, make ext4_fc_replay_inode() propagate errors properly instead of always returning 0.
--- fs/ext4/fast_commit.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
fs/ext4/fast_commit.c +8 -5
@@ -1623,19 +1623,21 @@ static int ext4_fc_replay_inode(struct s/* Immediately update the inode on disk. */ ret =ext4_handle_dirty_metadata (NULL ,NULL , iloc.bh);if (ret) - goto out; + goto out_brelse; ret =sync_dirty_buffer (iloc.bh);if (ret) - goto out; + goto out_brelse; ret =ext4_mark_inode_used (sb, ino);if (ret) - goto out; + goto out_brelse;/* Given that we just wrote the inode on disk, this SHOULD succeed. */ inode =ext4_iget (sb, ino,EXT4_IGET_NORMAL );if (IS_ERR (inode)) {ext4_debug ("Inode not found." ); -return -EFSCORRUPTED ; + inode =NULL ; + ret = -EFSCORRUPTED ; + goto out_brelse; }/*
@@ -1652,13 +1654,14 @@ static int ext4_fc_replay_inode(struct sext4_inode_csum_set (inode,ext4_raw_inode (&iloc),EXT4_I (inode)); ret =ext4_handle_dirty_metadata (NULL ,NULL , iloc.bh);sync_dirty_buffer (iloc.bh); +out_brelse:brelse (iloc.bh); out:iput (inode);if (!ret)blkdev_issue_flush (sb->s_bdev); -return 0 ; +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 119/312 ext4: always drain queued discard work in ext4_mb_release()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 9ee29d20aab228adfb02ca93f87fb53c56c2f3af upstream.
While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]:
Quoted 5 lines
If the filesystem is initially mounted with the discard option, deleting files will populate
sbi->s_discard_listand queues_discard_work. If it is then remounted with nodiscard, theEXT4_MOUNT_DISCARDflag is cleared, but the pendings_discard_workis neither cancelled nor flushed.
[1] https://lore.kernel.org/r/[email protected]/
[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev
The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing.
In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own.
Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c.
--- fs/ext4/mballoc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
fs/ext4/mballoc.c +5 -7
@@ -3591,13 +3591,11 @@ int ext4_mb_release(struct super_block *struct kmem_cache *cachep =get_groupinfo_cache (sb->s_blocksize_bits);int count; -if (test_opt (sb,DISCARD )) { -/* -* wait the discard work to drain all of ext4_free_data -*/ -flush_work (&sbi->s_discard_work); -WARN_ON_ONCE (!list_empty (&sbi->s_discard_list)); - } +/* +* wait the discard work to drain all of ext4_free_data +*/ +flush_work (&sbi->s_discard_work); +WARN_ON_ONCE (!list_empty (&sbi->s_discard_list));if (sbi->s_group_info) {for (i =0 ; i < ngroups; i++) {
Greg Kroah-Hartman
maintainerPATCH 120/312 arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
commit 8adc841d43ebceabec996c9dcff6e82d3e585268 upstream.
Fix SD card removal caused by automatic LDO5 power off after boot
To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled regulator that is supplied by LDO5. Since this is implemented on SoM but used on baseboards with SD-card interface, implement the functionality on SoM part and optionally enable it on baseboards if needed.
--- arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts | 13 ++++---- arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi | 22 ++++++++++++++ 2 files changed, 29 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl-mba8mx.dts +7 -6
@@ -63,6 +63,10 @@ }; }; +®_usdhc2_vqmmc { + status = "okay"; +}; + &sai3 { assigned-clocks = <&clk IMX8MN_CLK_SAI3>; assigned-clock-parents = <&clk IMX8MN_AUDIO_PLL1_OUT>;
@@ -207,8 +211,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
@@ -217,8 +220,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
@@ -227,8 +229,7 @@ <MX8MN_IOMUXC_SD2_DATA0_USDHC2_DATA0 0x1d4>, <MX8MN_IOMUXC_SD2_DATA1_USDHC2_DATA1 0x1d4>, <MX8MN_IOMUXC_SD2_DATA2_USDHC2_DATA2 0x1d4>, - <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>, - <MX8MN_IOMUXC_GPIO1_IO04_USDHC2_VSELECT 0x84>; + <MX8MN_IOMUXC_SD2_DATA3_USDHC2_DATA3 0x1d4>; }; pinctrl_usdhc2_gpio: usdhc2-gpiogrp {
arch/arm64/boot/dts/freescale/imx8mn-tqma8mqnl.dtsi +22 -0
@@ -30,6 +30,20 @@ regulator-max-microvolt = <3300000>; }; + reg_usdhc2_vqmmc: regulator-usdhc2-vqmmc { + compatible = "regulator-gpio"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_reg_usdhc2_vqmmc>; + regulator-name = "V_SD2"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>; + states = <1800000 0x1>, + <3300000 0x0>; + vin-supply = <&ldo5_reg>; + status = "disabled"; + }; + reserved-memory { #address-cells = <2>; #size-cells = <2>;
@@ -217,6 +231,10 @@ }; }; +&usdhc2 { + vqmmc-supply = <®_usdhc2_vqmmc>; +}; + &usdhc3 { pinctrl-names = "default", "state_100mhz", "state_200mhz"; pinctrl-0 = <&pinctrl_usdhc3>;
@@ -271,6 +289,10 @@ fsl,pins = <MX8MN_IOMUXC_SD2_RESET_B_GPIO2_IO19 0x84>; }; + pinctrl_reg_usdhc2_vqmmc: regusdhc2vqmmcgrp { + fsl,pins = <MX8MN_IOMUXC_GPIO1_IO04_GPIO1_IO4 0xc0>; + }; + pinctrl_usdhc3: usdhc3grp { fsl,pins = <MX8MN_IOMUXC_NAND_WE_B_USDHC3_CLK 0x1d4>, <MX8MN_IOMUXC_NAND_WP_B_USDHC3_CMD 0x1d2>,
Greg Kroah-Hartman
maintainerPATCH 121/312 powerpc64/bpf: do not increment tailcall count when prog is NULL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hari Bathini <[email protected]>
commit 521bd39d9d28ce54cbfec7f9b89c94ad4fdb8350 upstream.
Do not increment tailcall count, if tailcall did not succeed due to missing BPF program.
[ Conflict due to missing feature commit 2ed2d8f6fb38 ("powerpc64/bpf:
Support tailcalls with subprogs") resolved accordingly. ]
--- arch/powerpc/net/bpf_jit_comp64.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/powerpc/net/bpf_jit_comp64.c +14 -9
@@ -288,27 +288,32 @@ static int bpf_jit_emit_tail_call(u32 *i/* * tail_call_cnt++; +* Writeback this updated value only if tailcall succeeds. */ EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ),1 )); -EMIT (PPC_RAW_STD (bpf_to_ppc (TMP_REG_1 ), _R1,bpf_jit_stack_tailcallcnt (ctx)));/* prog = array->ptrs[index]; */ -EMIT (PPC_RAW_MULI (bpf_to_ppc (TMP_REG_1 ), b2p_index,8 )); -EMIT (PPC_RAW_ADD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), b2p_bpf_array)); -EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), offsetof(struct bpf_array , ptrs))); +EMIT (PPC_RAW_MULI (bpf_to_ppc (TMP_REG_2 ), b2p_index,8 )); +EMIT (PPC_RAW_ADD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), b2p_bpf_array)); +EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), + offsetof(struct bpf_array , ptrs)));/* * if (prog == NULL) * goto out; */ -EMIT (PPC_RAW_CMPLDI (bpf_to_ppc (TMP_REG_1 ),0 )); +EMIT (PPC_RAW_CMPLDI (bpf_to_ppc (TMP_REG_2 ),0 ));PPC_BCC_SHORT (COND_EQ , out);/* goto *(prog->bpf_func + prologue_size); */ -EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), offsetof(struct bpf_prog , bpf_func))); -EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_1 ),bpf_to_ppc (TMP_REG_1 ), -FUNCTION_DESCR_SIZE + bpf_tailcall_prologue_size)); -EMIT (PPC_RAW_MTCTR (bpf_to_ppc (TMP_REG_1 ))); +EMIT (PPC_RAW_LD (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), + offsetof(struct bpf_prog , bpf_func))); +EMIT (PPC_RAW_ADDI (bpf_to_ppc (TMP_REG_2 ),bpf_to_ppc (TMP_REG_2 ), +FUNCTION_DESCR_SIZE + bpf_tailcall_prologue_size)); +EMIT (PPC_RAW_MTCTR (bpf_to_ppc (TMP_REG_2 ))); + +/* Writeback updated tailcall count */ +EMIT (PPC_RAW_STD (bpf_to_ppc (TMP_REG_1 ), _R1,bpf_jit_stack_tailcallcnt (ctx)));/* tear down stack, restore NVRs, ... */ bpf_jit_emit_common_epilogue (image, ctx);
Greg Kroah-Hartman
maintainerPATCH 122/312 dmaengine: idxd: Fix not releasing workqueue on .release()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 ]
The workqueue associated with an DSA/IAA device is not released when the object is freed.
--- drivers/dma/idxd/sysfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/idxd/sysfs.c +1 -0
@@ -1663,6 +1663,7 @@ static void idxd_conf_device_release(struct device *dev) {struct idxd_device *idxd =confdev_to_idxd (dev); +destroy_workqueue (idxd->wq);kfree (idxd->groups);bitmap_free (idxd->wq_enable_map);kfree (idxd->wqs);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/312 dmaengine: idxd: Fix memory leak when a wq is reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478 ]
idxd_wq_disable_cleanup() which is called from the reset path for a workqueue, sets the wq type to NONE, which for other parts of the driver mean that the wq is empty (all its resources were released).
Only set the wq type to NONE after its resources are released.
--- drivers/dma/idxd/device.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/dma/idxd/device.c +1 -2
@@ -174,6 +174,7 @@ void idxd_wq_free_resources(struct idxd_wq *wq)free_descs (wq);dma_free_coherent (dev, wq->compls_size, wq->compls, wq->compls_addr);sbitmap_queue_free (&wq->sbq); + wq->type =IDXD_WQT_NONE ; }int idxd_wq_enable (struct idxd_wq *wq)
@@ -381,7 +382,6 @@ static void idxd_wq_disable_cleanup(struct idxd_wq *wq)lockdep_assert_held (&wq->wq_lock); wq->state =IDXD_WQ_DISABLED ;memset (wq->wqcfg,0 , idxd->wqcfg_size); - wq->type =IDXD_WQT_NONE ; wq->threshold =0 ; wq->priority =0 ; wq->enqcmds_retries =IDXD_ENQCMDS_RETRIES ;
@@ -1426,7 +1426,6 @@ void drv_disable_wq(struct idxd_wq *wq)idxd_wq_reset (wq);idxd_wq_free_resources (wq);percpu_ref_exit (&wq->wq_active); - wq->type =IDXD_WQT_NONE ; wq->client_count =0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/312 phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 584b457f4166293bdfa50f930228e9fb91a38392 ]
The serdes device_node is obtained using of_get_child_by_name(), which increments the reference count. However, it is never put, leading to a reference leak.
Add the missing of_node_put() calls to ensure the reference count is properly balanced.
--- drivers/phy/ti/phy-j721e-wiz.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/phy/ti/phy-j721e-wiz.c +2 -0
@@ -1339,6 +1339,7 @@ static int wiz_get_lane_phy_types(struct device *dev, struct wiz *wiz)dev_err (dev,"%s: Reading \"reg\" from \"%s\" failed: %d\n" , __func__, subnode->name, ret); +of_node_put (serdes);return ret; }of_property_read_u32 (subnode,"cdns,num-lanes" , &num_lanes);
@@ -1351,6 +1352,7 @@ static int wiz_get_lane_phy_types(struct device *dev, struct wiz *wiz) wiz->lane_phy_type[i] = phy_type; } +of_node_put (serdes);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/312 dmaengine: xilinx: xilinx_dma: Fix dma_device directions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit e9cc95397bb7da13fe8a5b53a2f23cfaf9018ade ]
Unlike chan->direction , struct dma_device .directions field is a bitfield. Turn chan->direction into a bitfield to make it compatible with struct dma_device .directions .
--- drivers/dma/xilinx/xilinx_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +1 -1
@@ -2860,7 +2860,7 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,return -EINVAL ; } - xdev->common.directions |= chan->direction; + xdev->common.directions |=BIT (chan->direction);/* Request the interrupt */ chan->irq =of_irq_get (node, chan->tdest);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 126/312 dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit f61d145999d61948a23cd436ebbfa4c3b9ab8987 ]
The cyclic DMA calculation is currently entirely broken and reports residue only for the first segment. The problem is twofold.
First, when the first descriptor finishes, it is moved from active_list to done_list, but it is never returned back into the active_list. The xilinx_dma_tx_status() expects the descriptor to be in the active_list to report any meaningful residue information, which never happens after the first descriptor finishes. Fix this up in xilinx_dma_start_transfer() and if the descriptor is cyclic, lift it from done_list and place it back into active_list list.
Second, the segment .status fields of the descriptor remain dirty. Once the DMA did one pass on the descriptor, the .status fields are populated with data by the DMA, but the .status fields are not cleared before reuse during the next cyclic DMA round. The xilinx_dma_get_residue() recognizes that as if the descriptor was complete and had 0 residue, which is bogus. Reinitialize the status field before placing the descriptor back into the active_list.
--- drivers/dma/xilinx/xilinx_dma.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +22 -1
@@ -1511,8 +1511,29 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)if (chan->err)return ; -if (list_empty (&chan->pending_list)) +if (list_empty (&chan->pending_list)) { +if (chan->cyclic) { +struct xilinx_dma_tx_descriptor *desc; +struct list_head *entry; + + desc =list_last_entry (&chan->done_list, + struct xilinx_dma_tx_descriptor, node); +list_for_each (entry, &desc->segments) { +struct xilinx_axidma_tx_segment *axidma_seg; +struct xilinx_axidma_desc_hw *axidma_hw; + axidma_seg =list_entry (entry, + struct xilinx_axidma_tx_segment, + node); + axidma_hw = &axidma_seg->hw; + axidma_hw->status =0 ; + } + +list_splice_tail_init (&chan->done_list, &chan->active_list); + chan->desc_pendingcount =0 ; + chan->idle = false; + }return ; + }if (!chan->idle)return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 127/312 dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit c7d812e33f3e8ca0fa9eeabf71d1c7bc3acedc09 ]
The segment .control and .status fields both contain top bits which are not part of the buffer size, the buffer size is located only in the bottom max_buffer_len bits. To avoid interference from those top bits, mask out the size using max_buffer_len first, and only then subtract the values.
--- drivers/dma/xilinx/xilinx_dma.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +6 -6
@@ -964,16 +964,16 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan, struct xilinx_cdma_tx_segment, node); cdma_hw = &cdma_seg->hw; - residue += (cdma_hw->control - cdma_hw->status) & - chan->xdev->max_buffer_len; + residue += (cdma_hw->control & chan->xdev->max_buffer_len) - + (cdma_hw->status & chan->xdev->max_buffer_len); }else if (chan->xdev->dma_config->dmatype ==XDMA_TYPE_AXIDMA ) { axidma_seg =list_entry (entry, struct xilinx_axidma_tx_segment, node); axidma_hw = &axidma_seg->hw; - residue += (axidma_hw->control - axidma_hw->status) & - chan->xdev->max_buffer_len; + residue += (axidma_hw->control & chan->xdev->max_buffer_len) - + (axidma_hw->status & chan->xdev->max_buffer_len); }else { aximcdma_seg = list_entry(entry,
@@ -981,8 +981,8 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan, node); aximcdma_hw = &aximcdma_seg->hw; residue += - (aximcdma_hw->control - aximcdma_hw->status) & - chan->xdev->max_buffer_len; + (aximcdma_hw->control & chan->xdev->max_buffer_len) - + (aximcdma_hw->status & chan->xdev->max_buffer_len); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 128/312 btrfs: fix super block offset in error message in btrfs_validate_super()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit b52fe51f724385b3ed81e37e510a4a33107e8161 ]
Fix the superblock offset mismatch error message in btrfs_validate_super(): we changed it so that it considers all the superblocks, but the message still assumes we're only looking at the first one.
The change from %u to %llu is because we're changing from a constant to a u64.
--- fs/btrfs/disk-io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/disk-io.c +2 -2
@@ -2759,8 +2759,8 @@ int btrfs_validate_super(struct btrfs_fs_info *fs_info,if (mirror_num >=0 &&btrfs_super_bytenr (sb) !=btrfs_sb_offset (mirror_num)) { -btrfs_err (fs_info,"super offset mismatch %llu != %u" , -btrfs_super_bytenr (sb),BTRFS_SUPER_INFO_OFFSET ); +btrfs_err (fs_info,"super offset mismatch %llu != %llu" , +btrfs_super_bytenr (sb),btrfs_sb_offset (mirror_num)); ret = -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 129/312 btrfs: fix leak of kobject name for sub-group space_info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41 ]
When create_space_info_sub_group() allocates elements of space_info->sub_group[], kobject_init_and_add() is called for each element via btrfs_sysfs_add_space_info_type(). However, when check_removing_space_info() frees these elements, it does not call btrfs_sysfs_remove_space_info() on them. As a result, kobject_put() is not called and the associated kobj->name objects are leaked.
This memory leak is reproduced by running the blktests test case zbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK. The kmemleak feature reports the following error:
unreferenced object 0xffff888112877d40 (size 16):
comm "mount", pid 1244, jiffies 4294996972
hex dump (first 16 bytes):
64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc......
backtrace (crc 53ffde4d):
__kmalloc_node_track_caller_noprof+0x619/0x870
kstrdup+0x42/0xc0
kobject_set_name_vargs+0x44/0x110
kobject_init_and_add+0xcf/0x150
btrfs_sysfs_add_space_info_type+0xfc/0x210 [btrfs]
create_space_info_sub_group.constprop.0+0xfb/0x1b0 [btrfs]
create_space_info+0x211/0x320 [btrfs]
btrfs_init_space_info+0x15a/0x1b0 [btrfs]
open_ctree+0x33c7/0x4a50 [btrfs]
btrfs_get_tree.cold+0x9f/0x1ee [btrfs]
vfs_get_tree+0x87/0x2f0
vfs_cmd_create+0xbd/0x280
__do_sys_fsconfig+0x3df/0x990
do_syscall_64+0x136/0x1540
entry_SYSCALL_64_after_hwframe+0x76/0x7eTo avoid the leak, call btrfs_sysfs_remove_space_info() instead of kfree() for the elements.
--- fs/btrfs/block-group.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/block-group.c +1 -1
@@ -4154,7 +4154,7 @@ static void check_removing_space_info(struct btrfs_space_info *space_info)for (int i =0 ; i <BTRFS_SPACE_INFO_SUB_GROUP_MAX ; i++) {if (space_info->sub_group[i]) {check_removing_space_info (space_info->sub_group[i]); -kfree (space_info->sub_group[i]); +btrfs_sysfs_remove_space_info (space_info->sub_group[i]); space_info->sub_group[i] =NULL ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 130/312 btrfs: fix lost error when running device stats on multiple devices fs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 1c37d896b12dfd0d4c96e310b0033c6676933917 ]
Whenever we get an error updating the device stats item for a device in btrfs_run_dev_stats() we allow the loop to go to the next device, and if updating the stats item for the next device succeeds, we end up losing the error we had from the previous device.
Fix this by breaking out of the loop once we get an error and make sure it's returned to the caller. Since we are in the transaction commit path (and in the critical section actually), returning the error will result in a transaction abort.
--- fs/btrfs/volumes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/btrfs/volumes.c +3 -2
@@ -8089,8 +8089,9 @@ int btrfs_run_dev_stats(struct btrfs_trans_handle *trans)smp_rmb (); ret =update_dev_stat_item (trans, device); -if (!ret) -atomic_sub (stats_cnt, &device->dev_stats_ccnt); +if (ret) +break ; +atomic_sub (stats_cnt, &device->dev_stats_ccnt); }mutex_unlock (&fs_devices->device_list_mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 131/312 dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 1075ee66a8c19bfa375b19c236fd6a22a867f138 ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
This is less verbose.
Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_range() is inclusive. Sothis change allows one more device.
MINORMASK is ((1U << MINORBITS) - 1), so allowing MINORMASK as a maximum value makes sense. It is also consistent with other "ida_.*MINORMASK" and "ida_*MINOR()" usages.
Stable-dep-of: c311f5e92484 ("dmaengine: idxd: Fix freeing the allocated ida too late")
--- drivers/dma/idxd/cdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/idxd/cdev.c +2 -2
@@ -49,7 +49,7 @@ static void idxd_cdev_dev_release(struct device *dev)struct idxd_wq *wq = idxd_cdev->wq; cdev_ctx = &ictx[wq->idxd->data->type]; -ida_simple_remove (&cdev_ctx->minor_ida, idxd_cdev->minor); +ida_free (&cdev_ctx->minor_ida, idxd_cdev->minor);kfree (idxd_cdev); }
@@ -375,7 +375,7 @@ int idxd_wq_add_cdev(struct idxd_wq *wq) cdev = &idxd_cdev->cdev; dev =cdev_dev (idxd_cdev); cdev_ctx = &ictx[wq->idxd->data->type]; - minor =ida_simple_get (&cdev_ctx->minor_ida,0 ,MINORMASK ,GFP_KERNEL ); + minor =ida_alloc_max (&cdev_ctx->minor_ida,MINORMASK ,GFP_KERNEL );if (minor <0 ) {kfree (idxd_cdev);return minor;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 132/312 dmaengine: idxd: Fix freeing the allocated ida too late
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit c311f5e9248471a950f0a524c2fd736414d98900 ]
It can happen that when the cdev .release() is called, the driver already called ida_destroy(). Move ida_free() to the _del() path.
We see with DEBUG_KOBJECT_RELEASE enabled and forcing an early PCI unbind.
--- drivers/dma/idxd/cdev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/dma/idxd/cdev.c +4 -4
@@ -45,11 +45,7 @@ struct idxd_user_context {static void idxd_cdev_dev_release (struct device *dev) {struct idxd_cdev *idxd_cdev =dev_to_cdev (dev); -struct idxd_cdev_context *cdev_ctx; -struct idxd_wq *wq = idxd_cdev->wq; - cdev_ctx = &ictx[wq->idxd->data->type]; -ida_free (&cdev_ctx->minor_ida, idxd_cdev->minor);kfree (idxd_cdev); }
@@ -410,11 +406,15 @@ int idxd_wq_add_cdev(struct idxd_wq *wq)void idxd_wq_del_cdev (struct idxd_wq *wq) { +struct idxd_cdev_context *cdev_ctx;struct idxd_cdev *idxd_cdev; idxd_cdev = wq->idxd_cdev; wq->idxd_cdev =NULL ;cdev_device_del (&idxd_cdev->cdev,cdev_dev (idxd_cdev)); + + cdev_ctx = &ictx[wq->idxd->data->type]; +ida_free (&cdev_ctx->minor_ida, idxd_cdev->minor);put_device (cdev_dev (idxd_cdev)); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 133/312 dmaengine: xilinx_dma: Program interrupt delay timeout
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 84b798fedf3fa8f0ab0c096593ba817abc454fe5 ]
Program IRQDelay for AXI DMA. The interrupt timeout mechanism causes the DMA engine to generate an interrupt after the delay time period has expired. It enables dmaengine to respond in real-time even though interrupt coalescing is configured. It also remove the placeholder for delay interrupt and merge it with frame completion interrupt. Since by default interrupt delay timeout is disabled this feature addition has no functional impact on VDMA, MCDMA and CDMA IP's.
Stable-dep-of: a17ce4bc6f4f ("dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA")
--- drivers/dma/xilinx/xilinx_dma.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +11 -9
@@ -174,8 +174,10 @@#define XILINX_DMA_MAX_TRANS_LEN_MAX 23#define XILINX_DMA_V2_MAX_TRANS_LEN_MAX 26#define XILINX_DMA_CR_COALESCE_MAX GENMASK(23, 16) +#define XILINX_DMA_CR_DELAY_MAX GENMASK(31, 24)#define XILINX_DMA_CR_CYCLIC_BD_EN_MASK BIT(4)#define XILINX_DMA_CR_COALESCE_SHIFT 16 +#define XILINX_DMA_CR_DELAY_SHIFT 24#define XILINX_DMA_BD_SOP BIT(27)#define XILINX_DMA_BD_EOP BIT(26)#define XILINX_DMA_COALESCE_MAX 255
@@ -411,6 +413,7 @@ struct xilinx_dma_tx_descriptor {* @stop_transfer: Differentiate b/w DMA IP's quiesce * @tdest: TDEST value for mcdma * @has_vflip: S2MM vertical flip +* @irq_delay: Interrupt delay timeout */ struct xilinx_dma_chan {struct xilinx_dma_device *xdev;
@@ -449,6 +452,7 @@ struct xilinx_dma_chan {int (*stop_transfer)(struct xilinx_dma_chan *chan);u16 tdest;bool has_vflip; +u8 irq_delay; };/**
@@ -1557,6 +1561,9 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)if (chan->has_sg)xilinx_write (chan,XILINX_DMA_REG_CURDESC , head_desc->async_tx.phys); + reg &= ~XILINX_DMA_CR_DELAY_MAX ; + reg |= chan->irq_delay <<XILINX_DMA_CR_DELAY_SHIFT ; +dma_ctrl_write (chan,XILINX_DMA_REG_DMACR , reg);xilinx_dma_start (chan);
@@ -1884,15 +1891,8 @@ static irqreturn_t xilinx_dma_irq_handler(int irq, void *data) } } -if (status &XILINX_DMA_DMASR_DLY_CNT_IRQ ) { -/* -* Device takes too long to do the transfer when user requires -* responsiveness. -*/ -dev_dbg (chan->dev,"Inter-packet latency too long\n" ); - } - -if (status &XILINX_DMA_DMASR_FRM_CNT_IRQ ) { +if (status & (XILINX_DMA_DMASR_FRM_CNT_IRQ | +XILINX_DMA_DMASR_DLY_CNT_IRQ )) {spin_lock (&chan->lock);xilinx_dma_complete_descriptor (chan); chan->idle = true;
@@ -2816,6 +2816,8 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,/* Retrieve the channel properties from the device tree */ has_dre =of_property_read_bool (node,"xlnx,include-dre" ); +of_property_read_u8 (node,"xlnx,irq-delay" , &chan->irq_delay); + chan->genlock =of_property_read_bool (node,"xlnx,genlock-mode" ); err =of_property_read_u32 (node,"xlnx,datawidth" , &value);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 134/312 dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit a17ce4bc6f4f9acf77ba416c36791a15602e53aa ]
A single AXIDMA controller can have one or two channels. When it has two channels, the reset for both are tied together: resetting one channel resets the other as well. This creates a problem where resetting one channel will reset the registers for both channels, including clearing interrupt enable bits for the other channel, which can then lead to timeouts as the driver is waiting for an interrupt which never comes.
The driver currently has a probe-time work around for this: when a channel is created, the driver also resets and enables the interrupts. With two channels the reset for the second channel will clear the interrupt enables for the first one. The work around in the driver is just to manually enable the interrupts again in xilinx_dma_alloc_chan_resources().
This workaround only addresses the probe-time issue. When channels are reset at runtime (e.g., in xilinx_dma_terminate_all() or during error recovery), there's no corresponding mechanism to restore the other channel's interrupt enables. This leads to one channel having its interrupts disabled while the driver expects them to work, causing timeouts and DMA failures.
A proper fix is a complicated matter, as we should not reset the other channel when it's operating normally. So, perhaps, there should be some kind of synchronization for a common reset, which is not trivial to implement. To add to the complexity, the driver also supports other DMA types, like VDMA, CDMA and MCDMA, which don't have a shared reset.
However, when the two-channel AXIDMA is used in the (assumably) normal use case, providing DMA for a single memory-to-memory device, the common reset is a bit smaller issue: when something bad happens on one channel, or when one channel is terminated, the assumption is that we also want to terminate the other channel. And thus resetting both at the same time is "ok".
With that line of thinking we can implement a bit better work around than just the current probe time work around: let's enable the AXIDMA interrupts at xilinx_dma_start_transfer() instead. This ensures interrupts are enabled whenever a transfer starts, regardless of any prior resets that may have cleared them.
This approach is also more logical: enable interrupts only when needed for a transfer, rather than at resource allocation time, and, I think, all the other DMA types should also use this model, but I'm reluctant to do such changes as I cannot test them.
The reset function still enables interrupts even though it's not needed for AXIDMA anymore, but it's common code for all DMA types (VDMA, CDMA, MCDMA), so leave it unchanged to avoid affecting other variants.
--- drivers/dma/xilinx/xilinx_dma.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +1 -8
@@ -1188,14 +1188,6 @@ static int xilinx_dma_alloc_chan_resources(struct dma_chan *dchan)dma_cookie_init (dchan); -if (chan->xdev->dma_config->dmatype ==XDMA_TYPE_AXIDMA ) { -/* For AXI DMA resetting once channel will reset the -* other channel as well so enable the interrupts here. -*/ -dma_ctrl_set (chan,XILINX_DMA_REG_DMACR , -XILINX_DMA_DMAXR_ALL_IRQ_MASK ); - } -if ((chan->xdev->dma_config->dmatype ==XDMA_TYPE_CDMA ) && chan->has_sg)dma_ctrl_set (chan,XILINX_DMA_REG_DMACR ,XILINX_CDMA_CR_SGMODE );
@@ -1563,6 +1555,7 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan) head_desc->async_tx.phys); reg &= ~XILINX_DMA_CR_DELAY_MAX ; reg |= chan->irq_delay <<XILINX_DMA_CR_DELAY_SHIFT ; + reg |=XILINX_DMA_DMAXR_ALL_IRQ_MASK ;dma_ctrl_write (chan,XILINX_DMA_REG_DMACR , reg);xilinx_dma_start (chan);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 135/312 futex: Clear stale exiting pointer in futex_lock_pi() retry path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <[email protected]>
commit 210d36d892de5195e6766c45519dfb1e65f3eb83 upstream.
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)Fix this by resetting upon retry, essentially aligning it with requeue_pi.
--- kernel/futex/pi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/futex/pi.c +2 -1
@@ -930,9 +930,9 @@ int fixup_pi_owner(u32 __user *uaddr, stint futex_lock_pi (u32 __user *uaddr,unsigned int flags,ktime_t *time,int trylock) {struct hrtimer_sleeper timeout, *to; -struct task_struct *exiting =NULL ;struct rt_mutex_waiter rt_waiter;struct futex_hash_bucket *hb; +struct task_struct *exiting;struct futex_q q = futex_q_init;int res, ret;
@@ -945,6 +945,7 @@ int futex_lock_pi(u32 __user *uaddr, uns to =futex_setup_timer (time, &timeout, flags,0 ); retry: + exiting =NULL ; ret =get_futex_key (uaddr, flags &FLAGS_SHARED , &q.key,FUTEX_WRITE );if (unlikely (ret !=0 )) goto out;
Greg Kroah-Hartman
maintainerPATCH 136/312 tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit ea111449501ea32bf6da82750de860243691efc7 upstream.
Commit 5e07e672412b ("tcp: Use bhash2 for v4-mapped-v6 non-wildcard address.") introduced bind() regression for v4-mapped-v6 address.
When we bind() the following two addresses on the same port, the 2nd bind() should succeed but fails now.
1. [::] w/ IPV6_ONLY
2. ::ffff:127.0.0.1
After the chagne, v4-mapped-v6 uses bhash2 instead of bhash to detect conflict faster, but I forgot to add a necessary change.
During the 2nd bind(), inet_bind2_bucket_match_addr_any() returns the tb2 bucket of [::], and inet_bhash2_conflict() finally calls inet_bind_conflict(), which returns true, meaning conflict.
inet_bhash2_addr_any_conflict
|- inet_bind2_bucket_match_addr_any <-- return [::] bucket `- inet_bhash2_conflict
`- __inet_bhash2_conflict <-- checks IPV6_ONLY for AF_INET
| but not for v4-mapped-v6 address
`- inet_bind_conflict <-- does not check address
inet_bind_conflict() does not check socket addresses because __inet_bhash2_conflict() is expected to do so.
However, it checks IPV6_V6ONLY attribute only against AF_INET socket, and not for v4-mapped-v6 address.
As a result, v4-mapped-v6 address conflicts with v6-only wildcard address.
To avoid that, let's add the missing test to use bhash2 for v4-mapped-v6 address.
--- net/ipv4/inet_connection_sock.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/inet_connection_sock.c +9 -2
@@ -185,8 +185,15 @@ static bool __inet_bhash2_conflict(const kuid_t sk_uid, bool relax, bool reuseport_cb_ok, bool reuseport_ok) { - if (sk->sk_family == AF_INET && ipv6_only_sock(sk2)) - return false; + if (ipv6_only_sock(sk2)) { + if (sk->sk_family == AF_INET) + return false; + +#if IS_ENABLED (CONFIG_IPV6 ) +if (ipv6_addr_v4mapped (&sk->sk_v6_rcv_saddr)) +return false; +#endif + }return inet_bind_conflict (sk, sk2, sk_uid, relax, reuseport_cb_ok, reuseport_ok);
Greg Kroah-Hartman
maintainerPATCH 137/312 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Sevens <[email protected]>
[ Upstream commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 ]
The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure.
Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if a short report is received.
--- drivers/hid/wacom_wac.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/wacom_wac.c +10 -0
@@ -1253,10 +1253,20 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len)switch (data[0 ]) {case 0x04 : +if (len <32 ) { +dev_warn (wacom->pen_input->dev.parent, +"Report 0x04 too short: %zu bytes\n" , len); +break ; + }wacom_intuos_bt_process_data (wacom, data + i); i +=10 ; fallthrough;case 0x03 : +if (i ==1 && len <22 ) { +dev_warn (wacom->pen_input->dev.parent, +"Report 0x03 too short: %zu bytes\n" , len); +break ; + }wacom_intuos_bt_process_data (wacom, data + i); i +=10 ;wacom_intuos_bt_process_data (wacom, data + i);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 138/312 atm: lec: fix use-after-free in sock_def_readable()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
[ Upstream commit 922814879542c2e397b0e9641fd36b8202a8e555 ]
A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown.
Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns.
v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue().
Note: Syzbot patch testing was attempted but the test VM terminated
unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
--- net/atm/lec.c | 72 +++++++++++++++++++++++++++++++++------------------ net/atm/lec.h | 2 +- 2 files changed, 48 insertions(+), 26 deletions(-)
net/atm/lec.c +47 -25
@@ -154,10 +154,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)/* 0x01 is topology change */ priv =netdev_priv (dev); -atm_force_charge (priv->lecd, skb2->truesize); - sk =sk_atm (priv->lecd); -skb_queue_tail (&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); +struct atm_vcc *vcc; + +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (vcc) { +atm_force_charge (vcc, skb2->truesize); + sk =sk_atm (vcc); +skb_queue_tail (&sk->sk_receive_queue, skb2); + sk->sk_data_ready (sk); + }else { +dev_kfree_skb (skb2); + } + rcu_read_unlock(); } }#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,int is_rdesc;pr_debug ("called\n" ); -if (!priv->lecd) { +if (!rcu_access_pointer (priv->lecd)) {pr_info ("%s:No lecd attached\n" , dev->name); dev->stats.tx_errors++;netif_stop_queue (dev);
@@ -449,10 +458,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)break ; skb2->len =sizeof (struct atmlec_msg );skb_copy_to_linear_data (skb2, mesg,sizeof (*mesg)); -atm_force_charge (priv->lecd, skb2->truesize); - sk =sk_atm (priv->lecd); -skb_queue_tail (&sk->sk_receive_queue, skb2); - sk->sk_data_ready(sk); +struct atm_vcc *vcc; + +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (vcc) { +atm_force_charge (vcc, skb2->truesize); + sk =sk_atm (vcc); +skb_queue_tail (&sk->sk_receive_queue, skb2); + sk->sk_data_ready (sk); + }else { +dev_kfree_skb (skb2); + } + rcu_read_unlock(); } }#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -468,23 +486,16 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)static void lec_atm_close (struct atm_vcc *vcc) { -struct sk_buff *skb;struct net_device *dev = (struct net_device *)vcc->proto_data;struct lec_priv *priv =netdev_priv (dev); - priv->lecd =NULL ; +rcu_assign_pointer (priv->lecd,NULL ); +synchronize_rcu ();/* Do something needful? */ netif_stop_queue (dev);lec_arp_destroy (priv); -if (skb_peek (&sk_atm (vcc)->sk_receive_queue)) -pr_info ("%s closing with messages pending\n" , dev->name); -while ((skb =skb_dequeue (&sk_atm (vcc)->sk_receive_queue))) { -atm_return (vcc, skb->truesize); -dev_kfree_skb (skb); - } -pr_info ("%s: Shut down!\n" , dev->name);module_put (THIS_MODULE ); }
@@ -510,12 +521,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, const unsigned char *mac_addr, const unsigned char *atm_addr, struct sk_buff *data) { + struct atm_vcc *vcc;struct sock *sk;struct sk_buff *skb;struct atmlec_msg *mesg; -if (!priv || !priv->lecd) +if (!priv || !rcu_access_pointer (priv->lecd))return -1 ; + skb =alloc_skb (sizeof (struct atmlec_msg ),GFP_ATOMIC );if (!skb)return -1 ;
@@ -532,18 +545,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,if (atm_addr)memcpy (&mesg->content.normal.atm_addr, atm_addr,ATM_ESA_LEN ); -atm_force_charge (priv->lecd, skb->truesize); - sk =sk_atm (priv->lecd); +rcu_read_lock (); + vcc =rcu_dereference (priv->lecd); +if (!vcc) { +rcu_read_unlock (); +kfree_skb (skb); +return -1 ; + } + +atm_force_charge (vcc, skb->truesize); + sk =sk_atm (vcc);skb_queue_tail (&sk->sk_receive_queue, skb); sk->sk_data_ready (sk);if (data !=NULL ) {pr_debug ("about to send %d bytes of data\n" , data->len); -atm_force_charge (priv->lecd, data->truesize); +atm_force_charge (vcc, data->truesize);skb_queue_tail (&sk->sk_receive_queue, data); sk->sk_data_ready (sk); } +rcu_read_unlock ();return 0 ; }
@@ -618,7 +640,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)atm_return (vcc, skb->truesize);if (*(__be16 *) skb->data ==htons (priv->lecid) || - !priv->lecd || !(dev->flags &IFF_UP )) { + !rcu_access_pointer (priv->lecd) || !(dev->flags &IFF_UP )) {/* * Probably looping back, or if lecd is missing, * lecd has gone down
@@ -753,12 +775,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) priv =netdev_priv (dev_lec[i]); }else { priv =netdev_priv (dev_lec[i]); -if (priv->lecd) +if (rcu_access_pointer (priv->lecd))return -EADDRINUSE ; }lec_arp_init (priv); priv->itfnum = i;/* LANE2 addition */ - priv->lecd = vcc; +rcu_assign_pointer (priv->lecd, vcc); vcc->dev = &lecatm_dev;vcc_insert_socket (sk_atm (vcc));
net/atm/lec.h +1 -1
@@ -91,7 +91,7 @@ struct lec_priv {*/ spinlock_t lec_arp_lock;struct atm_vcc *mcast_vcc;/* Default Multicast Send VCC */ -struct atm_vcc *lecd; +struct atm_vcc __rcu *lecd;struct delayed_work lec_arp_work;/* C10 */ unsigned int maximum_unknown_frame_count;/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 139/312 btrfs: dont take device_list_mutex when querying zone info
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <[email protected]>
[ Upstream commit 77603ab10429fe713a03345553ca8dbbfb1d91c6 ]
Shin'ichiro reported sporadic hangs when running generic/013 in our CI system. When enabling lockdep, there is a lockdep splat when calling btrfs_get_dev_zone_info_all_devices() in the mount path that can be triggered by i.e. generic/013:
======================================================
WARNING: possible circular locking dependency detected
7.0.0-rc1+ #355 Not tainted
------------------------------------------------------
mount/1043 is trying to acquire lock:
ffff8881020b5470 (&vblk->vdev_mutex){+.+.}-{4:4}, at: virtblk_report_zones+0xda/0x430
but task is already holding lock:
ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&fs_devs->device_list_mutex){+.+.}-{4:4}:
__mutex_lock+0xa3/0x1360 btrfs_create_pending_block_groups+0x1f4/0x9d0 __btrfs_end_transaction+0x3e/0x2e0 btrfs_zoned_reserve_data_reloc_bg+0x2f8/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #3 (btrfs_trans_num_extwriters){++++}-{0:0}:
join_transaction+0xc2/0x5c0 start_transaction+0x17c/0xbc0 btrfs_zoned_reserve_data_reloc_bg+0x2b4/0x390 open_ctree+0x1934/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #2 (btrfs_trans_num_writers){++++}-{0:0}:
lock_release+0x163/0x4b0 __btrfs_end_transaction+0x1c7/0x2e0 btrfs_dirty_inode+0x6f/0xd0 touch_atime+0xe5/0x2c0 btrfs_file_mmap_prepare+0x65/0x90 __mmap_region+0x4b9/0xf00 mmap_region+0xf7/0x120 do_mmap+0x43d/0x610 vm_mmap_pgoff+0xd6/0x190 ksys_mmap_pgoff+0x7e/0xc0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (&mm->mmap_lock){++++}-{4:4}:
__might_fault+0x68/0xa0 _copy_to_user+0x22/0x70 blkdev_copy_zone_to_user+0x22/0x40 virtblk_report_zones+0x282/0x430 blkdev_report_zones_ioctl+0xfd/0x130 blkdev_ioctl+0x20f/0x2c0 __x64_sys_ioctl+0x86/0xd0 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #0 (&vblk->vdev_mutex){+.+.}-{4:4}:
__lock_acquire+0x1522/0x2680 lock_acquire+0xd5/0x2f0 __mutex_lock+0xa3/0x1360 virtblk_report_zones+0xda/0x430 blkdev_report_zones_cached+0x162/0x190 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of:
&vblk->vdev_mutex --> btrfs_trans_num_extwriters --> &fs_devs->device_list_mutex
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&fs_devs->device_list_mutex);
lock(btrfs_trans_num_extwriters);
lock(&fs_devs->device_list_mutex);
lock(&vblk->vdev_mutex);*** DEADLOCK ***
3 locks held by mount/1043:
#0: ffff88811063e878 (&fc->uapi_mutex){+.+.}-{4:4}, at: __do_sys_fsconfig+0x2ae/0x680
#1: ffff88810cb9f0e8 (&type->s_umount_key#31/1){+.+.}-{4:4}, at: alloc_super+0xc0/0x3e0
#2: ffff888102a738e0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: btrfs_get_dev_zone_info_all_devices+0x45/0x90
stack backtrace: CPU: 2 UID: 0 PID: 1043 Comm: mount Not tainted 7.0.0-rc1+ #355 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 print_circular_bug.cold+0x18d/0x1d8 check_noncircular+0x10d/0x130 __lock_acquire+0x1522/0x2680 ? vmap_small_pages_range_noflush+0x3ef/0x820 lock_acquire+0xd5/0x2f0 ? virtblk_report_zones+0xda/0x430 ? lock_is_held_type+0xcd/0x130 __mutex_lock+0xa3/0x1360 ? virtblk_report_zones+0xda/0x430 ? virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 ? virtblk_report_zones+0xda/0x430 virtblk_report_zones+0xda/0x430 ? __pfx_copy_zone_info_cb+0x10/0x10 blkdev_report_zones_cached+0x162/0x190 ? __pfx_copy_zone_info_cb+0x10/0x10 btrfs_get_dev_zones+0xdc/0x2e0 btrfs_get_dev_zone_info+0x219/0xe80 btrfs_get_dev_zone_info_all_devices+0x62/0x90 open_ctree+0x1200/0x23db btrfs_get_tree.cold+0x105/0x26c ? rcu_is_watching+0x18/0x50 vfs_get_tree+0x28/0xb0 __do_sys_fsconfig+0x324/0x680 do_syscall_64+0x92/0x4f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f615e27a40e RSP: 002b:00007fff11b18fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af RAX: ffffffffffffffda RBX: 000055572e92ab10 RCX: 00007f615e27a40e RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 RBP: 00007fff11b19100 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000055572e92bc40 R14: 00007f615e3faa60 R15: 000055572e92bd08 </TASK>
Don't hold the device_list_mutex while calling into btrfs_get_dev_zone_info() in btrfs_get_dev_zone_info_all_devices() to mitigate the issue. This is safe, as no other thread can touch the device list at the moment of execution.
--- fs/btrfs/zoned.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/btrfs/zoned.c +4 -2
@@ -332,7 +332,10 @@ int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info)if (!btrfs_fs_incompat (fs_info,ZONED ))return 0 ; -mutex_lock (&fs_devices->device_list_mutex); +/* +* No need to take the device_list mutex here, we're still in the mount +* path and devices cannot be added to or removed from the list yet. +*/ list_for_each_entry (device, &fs_devices->devices, dev_list) {/* We can skip reading of zone info for missing devices */ if (!device->bdev)
@@ -342,7 +345,6 @@ int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info)if (ret)break ; } -mutex_unlock (&fs_devices->device_list_mutex);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 140/312 tg3: replace placeholder MAC address with device property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul SAGE <[email protected]>
[ Upstream commit e4c00ba7274b613e3ab19e27eb009f0ec2e28379 ]
On some systems (e.g. iMac 20,1 with BCM57766), the tg3 driver reads a default placeholder mac address (00:10:18:00:00:00) from the mailbox. The correct value on those systems are stored in the 'local-mac-address' property.
This patch, detect the default value and tries to retrieve the correct address from the device_get_mac_address function instead.
The patch has been tested on two different systems:
- iMac 20,1 (BCM57766) model which use the local-mac-address property
- iMac 13,2 (BCM57766) model which can use the mailbox, NVRAM or MAC control registers
--- drivers/net/ethernet/broadcom/tg3.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +11 -0
@@ -16950,6 +16950,13 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)return err; } +static int tg3_is_default_mac_address (u8 *addr) +{ +static const u8 default_mac_address[ETH_ALEN ] = {0x00 ,0x10 ,0x18 ,0x00 ,0x00 ,0x00 }; + +return ether_addr_equal (default_mac_address, addr); +} +static int tg3_get_device_address (struct tg3 *tp,u8 *addr) {u32 hi, lo, mac_offset;
@@ -17021,6 +17028,10 @@ static int tg3_get_device_address(struct tg3 *tp, u8 *addr)if (!is_valid_ether_addr (addr))return -EINVAL ; + +if (tg3_is_default_mac_address (addr)) +return device_get_mac_address (&tp->pdev->dev, addr); +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 141/312 objtool: Fix Clang jump table detection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 4e5019216402ad0b4a84cff457b662d26803f103 ]
With Clang, there can be a conditional forward jump between the load of the jump table address and the indirect branch.
Fixes the following warning:
vmlinux.o: warning: objtool: ___bpf_prog_run+0x1c5: sibling call from callable instruction with modified stack frame
--- tools/objtool/check.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
tools/objtool/check.c +2 -3
@@ -1966,12 +1966,11 @@ static void mark_func_jump_tables(struct objtool_file *file, last = insn;/* -* Store back-pointers for unconditional forward jumps such +* Store back-pointers for forward jumps such * that find_jump_table() can back-track using those and * avoid some potentially confusing code. */ -if (insn->type ==INSN_JUMP_UNCONDITIONAL && insn->jump_dest && - insn->offset > last->offset && +if (insn->jump_dest && insn->jump_dest->offset > insn->offset && !insn->jump_dest->first_jump_src) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 142/312 HID: multitouch: Check to ensure report responses match the request
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit e716edafedad4952fe3a4a273d2e039a84e8681a ]
It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely different report ID. This can cause confusion in the HID core resulting in nasty side-effects such as OOB writes.
Add a check to ensure that the report ID in the response, matches the one that was requested. If it doesn't, omit reporting the raw event and return early.
--- drivers/hid/hid-multitouch.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hid/hid-multitouch.c +7 -0
@@ -472,12 +472,19 @@ static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)dev_warn (&hdev->dev,"failed to fetch feature %d\n" , report->id); }else { +/* The report ID in the request and the response should match */ +if (report->id != buf[0 ]) { +hid_err (hdev,"Returned feature report did not match the request\n" ); + goto free; + } + ret =hid_report_raw_event (hdev,HID_FEATURE_REPORT , buf, size,0 );if (ret)dev_warn (&hdev->dev,"failed to report feature\n" ); } +free:kfree (buf); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 143/312 i2c: tegra: Dont mark devices with pins as IRQ safe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit ec69c9e88315c4be70c283f18c2ff130da6320b5 ]
I2C devices with associated pinctrl states (DPAUX I2C controllers) will change pinctrl state during runtime PM. This requires taking a mutex, so these devices cannot be marked as IRQ safe.
Add PINCTRL as dependency to avoid build errors.
--- drivers/i2c/busses/Kconfig | 2 ++ drivers/i2c/busses/i2c-tegra.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/i2c/busses/Kconfig +2 -0
@@ -1114,6 +1114,8 @@ config I2C_TEGRA tristate "NVIDIA Tegra internal I2C controller" depends on ARCH_TEGRA || (COMPILE_TEST && (ARC || ARM || ARM64 || M68K || RISCV || SUPERH || SPARC)) # COMPILE_TEST needs architectures with readsX()/writesX() primitives + depends on PINCTRL + # ARCH_TEGRA implies PINCTRL, but the COMPILE_TEST side doesn't. help If you say yes to this option, support will be included for the I2C controller embedded in NVIDIA Tegra SOCs
drivers/i2c/busses/i2c-tegra.c +4 -1
@@ -1816,8 +1816,11 @@ static int tegra_i2c_probe(struct platform_device *pdev)* * VI I2C device shouldn't be marked as IRQ-safe because VI I2C won't * be used for atomic transfers. ACPI device is not IRQ safe also. +* +* Devices with pinctrl states cannot be marked IRQ-safe as the pinctrl +* state transitions during runtime PM require mutexes. */ -if (!IS_VI (i2c_dev) && !has_acpi_companion (i2c_dev->dev)) +if (!IS_VI (i2c_dev) && !has_acpi_companion (i2c_dev->dev) && !i2c_dev->dev->pins)pm_runtime_irq_safe (i2c_dev->dev);pm_runtime_enable (i2c_dev->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 144/312 btrfs: reject root items with drop_progress and zero drop_level
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit b17b79ff896305fd74980a5f72afec370ee88ca4 ]
[BUG]
When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered:
------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]---
The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime.
[CAUSE]
A non-zero drop_progress.objectid means an interrupted btrfs_drop_snapshot() left a resume point on disk, and in that case drop_level must be greater than 0 because the checkpoint is only saved at internal node levels.
Although this invariant is enforced when the kernel writes the root item, it is not validated when the root item is read back from disk. That allows on-disk corruption to provide an invalid state with drop_progress.objectid != 0 and drop_level == 0.
When relocation recovery later processes such a root item, merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The same invalid metadata can also trigger the corresponding BUG_ON() in btrfs_drop_snapshot().
[FIX]
Fix this by validating the root_item invariant in tree-checker when reading root items from disk: if drop_progress.objectid is non-zero, drop_level must also be non-zero. Reject such malformed metadata with -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot() and triggers the BUG_ON.
After the fix, the same corruption is correctly rejected by tree-checker and the BUG_ON is no longer triggered.
--- fs/btrfs/tree-checker.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
fs/btrfs/tree-checker.c +17 -0
@@ -1204,6 +1204,23 @@ static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key, btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);return -EUCLEAN ; } +/* +* If drop_progress.objectid is non-zero, a btrfs_drop_snapshot() was +* interrupted and the resume point was recorded in drop_progress and +* drop_level. In that case drop_level must be >= 1: level 0 is the +* leaf level and drop_snapshot never saves a checkpoint there (it +* only records checkpoints at internal node levels in DROP_REFERENCE +* stage). A zero drop_level combined with a non-zero drop_progress +* objectid indicates on-disk corruption and would cause a BUG_ON in +* merge_reloc_root() and btrfs_drop_snapshot() at mount time. +*/ +if (unlikely (btrfs_disk_key_objectid (&ri.drop_progress) !=0 && +btrfs_root_drop_level (&ri) ==0 )) { +generic_err (leaf, slot, +"invalid root drop_level 0 with non-zero drop_progress objectid %llu" , +btrfs_disk_key_objectid (&ri.drop_progress)); +return -EUCLEAN ; + }/* Flags check */ if (unlikely (btrfs_root_flags (&ri) & ~valid_root_flags)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 145/312 dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
[ Upstream commit 398c0c8bbc8f5a9d2f43863275a427a9d3720b6f ]
Change additionalProperties to unevaluatedProperties because it refs to /schemas/input/matrix-keymap.yaml.
Fix below CHECK_DTBS warnings:arch/arm/boot/dts/nxp/imx/imx6dl-victgo.dtb: keypad@70 (holtek,ht16k33): 'keypad,num-columns', 'keypad,num-rows' do not match any of the regexes: '^pinctrl-[0-9]+$'
from schema $id: http://devicetree.org/schemas/auxdisplay/holtek,ht16k33.yaml#
--- .../devicetree/bindings/auxdisplay/holtek,ht16k33.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/auxdisplay/holtek,ht16k33.yaml +1 -1
@@ -65,7 +65,7 @@ then: required: - refresh-rate-hz -additionalProperties: false +unevaluatedProperties: false examples: - |
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/312 crypto: af-alg - fix NULL pointer dereference in scatterwalk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
[ Upstream commit 62397b493e14107ae82d8b80938f293d95425bcb ]
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent sendmsg() allocates a new SGL and chains it, but fails to clear the end marker on the previous SGL's last data entry.
This causes the crypto scatterwalk to hit a premature end, returning NULL on sg_next() and leading to a kernel panic during dereference.
Fix this by explicitly unmarking the end of the previous SGL when performing sg_chain() in af_alg_alloc_tsgl().
--- crypto/af_alg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
crypto/af_alg.c +3 -1
@@ -512,8 +512,10 @@ static int af_alg_alloc_tsgl(struct sock *sk)sg_init_table (sgl->sg,MAX_SGL_ENTS +1 ); sgl->cur =0 ; -if (sg) +if (sg) { +sg_unmark_end (sg +MAX_SGL_ENTS -1 );sg_chain (sg,MAX_SGL_ENTS +1 , sgl->sg); + }list_add_tail (&sgl->list, &ctx->tsgl_list); }
Signature · 1 line
2.53.0