6.6.142-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 136/186 HID: quirks: really enable the intended work around for appledisplay
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Bulwahn <[email protected]>
[ Upstream commit 5f90dcfa8dc32a488581b78e575cdd7808ba5c78 ]
Commit c7fabe4ad921 ("HID: quirks: work around VID/PID conflict for appledisplay") intends to add a quirk for kernels built with Apple Cinema Display support, but it refers to the non-existing config option CONFIG_APPLEDISPLAY, whereas the config option for Apple Cinema Display support is named CONFIG_USB_APPLEDISPLAY.
Refer to the intended config option CONFIG_USB_APPLEDISPLAY in the ifdef directive.
--- drivers/hid/hid-quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-quirks.c +1 -1
@@ -234,7 +234,7 @@ static const struct hid_device_id hid_quirks[] = {* used as a driver. See hid_scan_report(). */ static const struct hid_device_id hid_have_special_driver[] = { -#if IS_ENABLED(CONFIG_APPLEDISPLAY) +#if IS_ENABLED(CONFIG_USB_APPLEDISPLAY) {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9218 ) }, {HID_USB_DEVICE (USB_VENDOR_ID_APPLE ,0x9219 ) }, { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 137/186 accel/qaic: Add overflow check to remap_pfn_range during mmap
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zack McKevitt <[email protected]>
[ Upstream commit aa16b2bc0f02709919e2435f531406531e5bcc69 ]
The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large.
--- drivers/accel/qaic/qaic_data.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic_data.c +21 -2
@@ -595,8 +595,11 @@ static const struct vm_operations_struct drm_vm_ops = {static int qaic_gem_object_mmap (struct drm_gem_object *obj,struct vm_area_struct *vma) {struct qaic_bo *bo =to_qaic_bo (obj); +unsigned long remap_start;unsigned long offset =0 ; +unsigned long remap_end;struct scatterlist *sg; +unsigned long length;int ret =0 ;if (obj->import_attach)
@@ -604,11 +607,27 @@ static int qaic_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_strucfor (sg = bo->sgt->sgl; sg; sg =sg_next (sg)) {if (sg_page (sg)) { +/* if sg is too large for the VMA, so truncate it to fit */ +if (check_add_overflow (vma->vm_start, offset, &remap_start)) +return -EINVAL ; +if (check_add_overflow (remap_start, sg->length, &remap_end)) +return -EINVAL ; + +if (remap_end > vma->vm_end) { +if (check_sub_overflow (vma->vm_end, remap_start, &length)) +return -EINVAL ; + }else { + length = sg->length; + } + +if (length ==0 ) + goto out; + ret =remap_pfn_range (vma, vma->vm_start + offset,page_to_pfn (sg_page (sg)), - sg->length, vma->vm_page_prot); + length, vma->vm_page_prot);if (ret) goto out; - offset += sg->length; + offset += length; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 138/186 net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 7bf563badd37cb796df5477d2b78bb64148a1268 ]
The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and smc_rx_recvmsg, unconditionally dereferences smc->conn.lnk:
__string(name, smc->conn.lnk->ibname)
conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on these paths already handles this (e.g. !conn->lnk in SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first sendmsg()/recvmsg() on an SMC-D socket crashes:
Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [...] RIP: 0010:strlen+0x1e/0xa0 Call Trace: trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44) smc_rx_recvmsg (net/smc/smc_rx.c:515) smc_recvmsg (net/smc/af_smc.c:2859) __sys_recvfrom (net/socket.c:2315) __x64_sys_recvfrom (net/socket.c:2326) do_syscall_64
The faulting address 0x3e0 is offsetof(struct smc_link, ibname), confirming the NULL ->lnk deref. Enabling the tracepoint requires root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has no capability check, and SMC-D negotiation needs no admin step on s390 or on x86 with the loopback ISM device loaded.
Log an empty device name for SMC-D instead of dereferencing NULL.
--- net/smc/smc_tracepoint.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/smc_tracepoint.h +1 -1
@@ -51,7 +51,7 @@ DECLARE_EVENT_CLASS(smc_msg_event, __field(const void *, smc) __field(u64, net_cookie) __field(size_t, len) - __string(name, smc->conn.lnk->ibname) + __string(name, smc->conn.lnk ? smc->conn.lnk->ibname : "") ), TP_fast_assign(
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 139/186 ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 3d042592ebd4c7e44974d556de0b727cb7db4dab ]
ethnl_bitmap32_not_zero() should return true if some bit in [start, end) is set:
- Fix inverted memchr_inv() sense: return true when the scan finds a non-zero byte, not when the middle words are all zero.
- Return false for an empty interval (end <= start).
- When end is 32-bit aligned, indices in [start, end) do not include any bits from map[end_word]; return false after earlier checks found no non-zero data.
--- net/ethtool/bitset.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ethtool/bitset.c +4 -4
@@ -91,7 +91,7 @@ static bool ethnl_bitmap32_not_zero(const u32 *map, unsigned int start,u32 mask;if (end <= start) -return true; +return false;if (start %32 ) { mask =ethnl_upper_bits (start);
@@ -104,11 +104,11 @@ static bool ethnl_bitmap32_not_zero(const u32 *map, unsigned int start, start_word++; } -if (!memchr_inv (map + start_word,'\0' , - (end_word - start_word) *sizeof (u32))) +if (memchr_inv (map + start_word,'\0' , + (end_word - start_word) *sizeof (u32)))return true;if (end %32 ==0 ) -return true; +return false;return map[end_word] ðnl_lower_bits (end); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 140/186 drm/msm/dsi: dont dump registers past the mapped region
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4 ]
On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area.
msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140
Patchwork: https://patchwork.freedesktop.org/patch/721747/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/dsi/dsi_host.c +1 -0
@@ -1929,6 +1929,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)/* fixup base address by io offset */ msm_host->ctrl_base += cfg->io_offset; + msm_host->ctrl_size -= cfg->io_offset; ret = devm_regulator_bulk_get_const(&pdev->dev, cfg->num_regulators, cfg->regulator_data,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 141/186 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit 55e0f0d1c1a4ee1e46da7da4d443eb3044fb3851 ]
Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero.
Store the return value in the appropriate type and in case of error, return it rather than WARNing.
Patchwork: https://patchwork.freedesktop.org/patch/719685/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/msm_iommu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_iommu.c +3 -2
@@ -362,14 +362,15 @@ static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova, struct sg_table *sgt, size_t len, int prot) { struct msm_iommu *iommu = to_msm_iommu(mmu); -size_t ret; +ssize_t ret;/* The arm-smmu driver expects the addresses to be sign extended */ if (iova &BIT_ULL (48 )) iova |=GENMASK_ULL (63 ,49 ); ret =iommu_map_sgtable (iommu->domain, iova, sgt, prot); -WARN_ON (!ret); +if (ret <0 ) +return ret;return (ret == len) ?0 : -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 142/186 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <[email protected]>
[ Upstream commit 31467b23823ffec1f6fff407f8e3ca9af8b7491a ]
A kernel panic is observed when handling machine check exceptions from real mode.
BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70 LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0
The crash occurs because arch_irq_work_raise() calls preempt_disable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preempt_count can fault, leading to the panic.
The preempt_disable()/preempt_enable() pair in arch_irq_work_raise() was originally added by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call") to avoid races while raising irq work from exception context.
Later, commit 471ba0e686cb ("irq_work: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irq_work_queue() path, while commit 20b876918c06 ("irq_work: Use per cpu atomics instead of regular atomics") added equivalent protection in irq_work_queue_on() before reaching arch_irq_work_raise():
irq_work_queue() / irq_work_queue_on()
-> preempt_disable()
-> __irq_work_queue_local()
-> irq_work_raise()
-> arch_irq_work_raise()As a result, callers other than mce_irq_work_raise() already execute with preemption disabled, making the additional preempt_disable()/preempt_enable() pair in arch_irq_work_raise() redundant.
The arch_irq_work_raise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preempt_disable()/preempt_enable() calls from here.
Remove it to avoid accessing preempt_count from real mode context.
--- arch/powerpc/kernel/time.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/powerpc/kernel/time.c +4 -2
@@ -436,6 +436,10 @@ DEFINE_PER_CPU(u8, irq_work_pending);#endif /* 32 vs 64 bit */ +/* +* Must be called with preemption disabled since it updates +* per-CPU irq_work state and programs the local CPU decrementer. +*/ void arch_irq_work_raise (void ) {/*
@@ -449,10 +453,8 @@ void arch_irq_work_raise(void)* which could get tangled up if we're messing with the same state * here. */ -preempt_disable ();set_irq_work_pending_flag ();set_dec (1 ); -preempt_enable (); }static void set_dec_or_work (u64 val)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 143/186 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 277740023def559a4a2ddc3e8e784ee37a0f16a9 ]
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
--- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/smc/af_smc.c +2 -1
@@ -1378,7 +1378,8 @@ smc_v2_determine_accepted_chid(struct smc_clc_msg_accept_confirm *aclc,int i;for (i =0 ; i < ini->ism_offered_cnt +1 ; i++) { -if (ini->ism_chid[i] ==ntohs (aclc->d1.chid)) { +if (ini->ism_dev[i] && + ini->ism_chid[i] ==ntohs (aclc->d1.chid)) { ini->ism_selected = i;return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 144/186 net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 285943c6e7ca309bbea84b253745154241d9788a ]
When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this:
struct sk_msg_sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];
The current code uses MAX_SKB_FRAGS + 1 as the ring size:
sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
MAX_SKB_FRAGS - msg_pl->sg.start + 1,
msg_pl->sg.data);This places the chain pointer at
sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS]
instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")
Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina).
--- net/tls/tls_sw.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/tls/tls_sw.c +2 -4
@@ -800,11 +800,9 @@ static int tls_push_record(struct sock *sk, int flags,sg_mark_end (sk_msg_elem (msg_pl, i)); } -if (msg_pl->sg.end < msg_pl->sg.start) { -sg_chain (&msg_pl->sg.data[msg_pl->sg.start], -MAX_SKB_FRAGS - msg_pl->sg.start +1 , +if (msg_pl->sg.end < msg_pl->sg.start) +sg_chain (msg_pl->sg.data,ARRAY_SIZE (msg_pl->sg.data), msg_pl->sg.data); - } i = msg_pl->sg.start;sg_chain (rec->sg_aead_in,2 , &msg_pl->sg.data[i]);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 145/186 net: tls: prevent chain-after-chain in plain text SG
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit ff26a0e8377dec07e4a7230db7675bed1b9a6d03 ]
Sashiko points out that if end = 0 (start != 0) the current code will create a chain link to content type right after the wrap link:
This would create a chain where the wrap link points directly to another chain link. The scatterlist API sg_next iterator does not recursively resolve consecutive chain links.
meaning this is illegal input to crypto.
The wrapping link is unnecessary if end = 0. end is the entry after the last one used so end = 0 means there's nothing pushed after the wrap:
end start i
v v v
[ ]...[ ][ d ][ d ][ d ][ d ][rsv for wrap]
Skip the wrapping in this case.
TLS 1.3 can use the "wrapping slot" for it's chaining if end = 0. This avoids the chain-after-chain.
Move the wrap chaining before marking END and chaining off content type, that feels like more logical ordering to me, but should not matter from functional perspective.
--- net/tls/tls_sw.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
net/tls/tls_sw.c +18 -6
@@ -789,21 +789,33 @@ static int tls_push_record(struct sock *sk, int flags, i = msg_pl->sg.end;sk_msg_iter_var_prev (i); +/* msg_pl->sg.data is a ring; data[MAX+1] is reserved for the wrap +* link (frags won't use it). 'i' is now the last filled entry: +* +* i end start +* v v v [ rsv ] +* [ d ][ d ][ ][ ]...[ ][ d ][ d ][ d ][chain] +* ^ END v +* `-----------------------------------------' +* +* Note that SGL does not allow chain-after-chain, so for TLS 1.3, +* we must make sure we don't create the wrap entry and then chain +* link to content_type immediately at index 0. +*/ +if (i < msg_pl->sg.start) +sg_chain (msg_pl->sg.data,ARRAY_SIZE (msg_pl->sg.data), + msg_pl->sg.data); + rec->content_type = record_type;if (prot->version ==TLS_1_3_VERSION ) {/* Add content type to end of message. No padding added */ sg_set_buf (&rec->sg_content_type, &rec->content_type,1 );sg_mark_end (&rec->sg_content_type); -sg_chain (msg_pl->sg.data, msg_pl->sg.end +1 , - &rec->sg_content_type); +sg_chain (msg_pl->sg.data, i +2 , &rec->sg_content_type); }else {sg_mark_end (sk_msg_elem (msg_pl, i)); } -if (msg_pl->sg.end < msg_pl->sg.start) -sg_chain (msg_pl->sg.data,ARRAY_SIZE (msg_pl->sg.data), - msg_pl->sg.data); - i = msg_pl->sg.start;sg_chain (rec->sg_aead_in,2 , &msg_pl->sg.data[i]);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/186 net: phy: c45: add genphy_c45_pma_read_ext_abilities() function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 0c476157085fe2ad13b9bec70ea672e86647fa1a ]
Move part of the genphy_c45_pma_read_abilities() code to a separate function.
Some PHYs do not implement PMA/PMD status 2 register (Register 1.8) but do implement PMA/PMD extended ability register (Register 1.11). To make use of it, we need to be able to access this part of code separately.
Stable-dep-of: c78bdba7b966 ("net: phy: DP83TC811: add reading of abilities")
--- drivers/net/phy/phy-c45.c | 129 ++++++++++++++++++++++---------------- include/linux/phy.h | 1 + 2 files changed, 75 insertions(+), 55 deletions(-)
drivers/net/phy/phy-c45.c +74 -55
@@ -919,6 +919,79 @@ int genphy_c45_pma_baset1_read_abilities(struct phy_device *phydev) }EXPORT_SYMBOL_GPL (genphy_c45_pma_baset1_read_abilities); +/** +* genphy_c45_pma_read_ext_abilities - read supported link modes from PMA +* @phydev: target phy_device struct +* +* Read the supported link modes from the PMA/PMD extended ability register +* (Register 1.11). +*/ +int genphy_c45_pma_read_ext_abilities (struct phy_device *phydev) +{ +int val; + + val =phy_read_mmd (phydev,MDIO_MMD_PMAPMD ,MDIO_PMA_EXTABLE ); +if (val <0 ) +return val; + +linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseLRM_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10GBLRM ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10GBT ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10GBKX4 ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseKR_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10GBKR ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_1000baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_1000BT ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_1000BKX ); + +linkmode_mod_bit (ETHTOOL_LINK_MODE_100baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_100BTX ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_100baseT_Half_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_100BTX ); + +linkmode_mod_bit (ETHTOOL_LINK_MODE_10baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10BT ); +linkmode_mod_bit (ETHTOOL_LINK_MODE_10baseT_Half_BIT, + phydev->supported, + val &MDIO_PMA_EXTABLE_10BT ); + +if (val &MDIO_PMA_EXTABLE_NBT ) { + val =phy_read_mmd (phydev,MDIO_MMD_PMAPMD , +MDIO_PMA_NG_EXTABLE ); +if (val <0 ) +return val; + +linkmode_mod_bit (ETHTOOL_LINK_MODE_2500baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_NG_EXTABLE_2_5GBT ); + +linkmode_mod_bit (ETHTOOL_LINK_MODE_5000baseT_Full_BIT, + phydev->supported, + val &MDIO_PMA_NG_EXTABLE_5GBT ); + } + +if (val &MDIO_PMA_EXTABLE_BT1 ) { + val =genphy_c45_pma_baset1_read_abilities (phydev); +if (val <0 ) +return val; + } + +return 0 ; +} +EXPORT_SYMBOL_GPL (genphy_c45_pma_read_ext_abilities); +/** * genphy_c45_pma_read_abilities - read supported link modes from PMA * @phydev: target phy_device struct
@@ -962,63 +1035,9 @@ int genphy_c45_pma_read_abilities(struct phy_device *phydev) val & MDIO_PMA_STAT2_10GBER);if (val &MDIO_PMA_STAT2_EXTABLE ) { - val =phy_read_mmd (phydev,MDIO_MMD_PMAPMD ,MDIO_PMA_EXTABLE ); + val =genphy_c45_pma_read_ext_abilities (phydev);if (val <0 )return val; - -linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseLRM_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10GBLRM ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10GBT ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseKX4_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10GBKX4 ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_10000baseKR_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10GBKR ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_1000baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_1000BT ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_1000baseKX_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_1000BKX ); - -linkmode_mod_bit (ETHTOOL_LINK_MODE_100baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_100BTX ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_100baseT_Half_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_100BTX ); - -linkmode_mod_bit (ETHTOOL_LINK_MODE_10baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10BT ); -linkmode_mod_bit (ETHTOOL_LINK_MODE_10baseT_Half_BIT, - phydev->supported, - val &MDIO_PMA_EXTABLE_10BT ); - -if (val &MDIO_PMA_EXTABLE_NBT ) { - val =phy_read_mmd (phydev,MDIO_MMD_PMAPMD , -MDIO_PMA_NG_EXTABLE ); -if (val <0 ) -return val; - -linkmode_mod_bit (ETHTOOL_LINK_MODE_2500baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_NG_EXTABLE_2_5GBT ); - -linkmode_mod_bit (ETHTOOL_LINK_MODE_5000baseT_Full_BIT, - phydev->supported, - val &MDIO_PMA_NG_EXTABLE_5GBT ); - } - -if (val &MDIO_PMA_EXTABLE_BT1 ) { - val =genphy_c45_pma_baset1_read_abilities (phydev); -if (val <0 ) -return val; - } }/* This is optional functionality. If not supported, we may get an error
include/linux/phy.h +1 -0
@@ -1857,6 +1857,7 @@ int genphy_c45_an_config_aneg(struct phy_device *phydev);int genphy_c45_an_disable_aneg (struct phy_device *phydev);int genphy_c45_read_mdix (struct phy_device *phydev);int genphy_c45_pma_read_abilities (struct phy_device *phydev); +int genphy_c45_pma_read_ext_abilities (struct phy_device *phydev);int genphy_c45_pma_baset1_read_abilities (struct phy_device *phydev);int genphy_c45_read_eee_abilities (struct phy_device *phydev);int genphy_c45_pma_baset1_read_master_slave (struct phy_device *phydev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 147/186 net: phy: DP83TC811: add reading of abilities
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schuchmann <[email protected]>
[ Upstream commit c78bdba7b9666020c0832150a4fc4c0aebc7c6ac ]
At this time the driver is not listing any speeds
it supports. This should be ETHTOOL_LINK_MODE_100baseT1_Full_BIT for DP83TC811. Add the missing call for phylib to read the abilities.
--- drivers/net/phy/dp83tc811.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/dp83tc811.c +1 -0
@@ -393,6 +393,7 @@ static struct phy_driver dp83811_driver[] = { .config_init = dp83811_config_init, .config_aneg = dp83811_config_aneg, .soft_reset = dp83811_phy_reset, + .get_features = genphy_c45_pma_read_ext_abilities, .get_wol = dp83811_get_wol, .set_wol = dp83811_set_wol, .config_intr = dp83811_config_intr,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 148/186 x86/xen: Fix xen_e820_swap_entry_with_ram()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 28e03f78e69cf6628b81f24777799778528a84c1 ]
When swapping a not page-aligned E820 map entry with RAM, the start address of the modified entry is calculated wrong (the offset into the page is subtracted instead of being added to the page address).
Message-ID: <[email protected]>
--- arch/x86/xen/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/xen/setup.c +1 -1
@@ -656,7 +656,7 @@ static void __init xen_e820_swap_entry_with_ram(struct e820_entry *swap_entry)/* Fill new entry (keep size and page offset). */ entry->type = swap_entry->type; entry->addr = entry_end - swap_size + - swap_addr - swap_entry->addr; + swap_entry->addr - swap_addr; entry->size = swap_entry->size;/* Convert old entry to RAM, align to pages. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 149/186 tls: Preserve sk_err across recvmsg() when data has been copied
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit f508262ae9f21fe0e6c0749948b9dc7dd5a62a70 ]
The sk_err check in tls_rx_rec_wait() consumes the error via sock_error(), which clears sk_err atomically. When the caller (tls_sw_recvmsg, tls_sw_splice_read, or tls_sw_read_sock) already has bytes copied to userspace, it returns those bytes and discards the error from this call. sk_err is now zero on the socket, so the next read syscall observes only RCV_SHUTDOWN and reports a clean EOF instead of the actual error (typically -ECONNRESET).
The race is reachable when tls_read_flush_backlog()'s periodic sk_flush_backlog() triggers tcp_reset() in the middle of a multi-record read.
Pass a has_copied flag to tls_rx_rec_wait(). When has_copied is false, consume sk_err via sock_error() as before. When has_copied is true, report the error from READ_ONCE() but leave sk_err set:
the caller returns the byte count and discards the err from this call, and the next read syscall surfaces the preserved sk_err. This mirrors the tcp_recvmsg() preserve-and-surface pattern.
The decrypt-abort path is unaffected: tls_err_abort() raises sk_err to EBADMSG after tls_rx_rec_wait() returns, and nothing on the caller's return path consumes it, so the EBADMSG surfaces on the next read.
tls_sw_splice_read() passes has_copied=false: it processes one record per call, so no bytes have been copied within the function when tls_rx_rec_wait() runs. A reset that arrives between iterations of splice_direct_to_actor() (the sendfile() path) is still consumed by sock_error() in the later call, and the outer loop returns the prior iterations' byte count and drops the error. tcp_splice_read() exhibits the same pattern at the iteration boundary; addressing it belongs at the splice_direct_to_actor() layer and is out of scope here.
--- net/tls/tls_sw.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
net/tls/tls_sw.c +14 -6
@@ -1366,9 +1366,14 @@ void tls_sw_splice_eof(struct socket *sock)mutex_unlock (&tls_ctx->tx_lock); } +/* When has_copied is true the caller has already moved bytes to +* userspace. Report sk_err but leave it set so the next read +* surfaces it instead of a spurious EOF, otherwise sk_err is +* consumed via sock_error(). +*/ static int tls_rx_rec_wait (struct sock *sk,struct sk_psock *psock,bool nonblock, -bool released) +bool released,bool has_copied) {struct tls_context *tls_ctx =tls_get_ctx (sk);struct tls_sw_context_rx *ctx =tls_sw_ctx_rx (tls_ctx);
@@ -1382,8 +1387,11 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock,if (!sk_psock_queue_empty (psock))return 0 ; -if (sk->sk_err) +if (sk->sk_err) { +if (has_copied) +return -READ_ONCE (sk->sk_err);return sock_error (sk); + }if (ret <0 )return ret;
@@ -1419,7 +1427,7 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock, }if (unlikely (!tls_strp_msg_load (&ctx->strp, released))) -return tls_rx_rec_wait (sk, psock, nonblock, false); +return tls_rx_rec_wait (sk, psock, nonblock, false, has_copied);return 1 ; }
@@ -2077,7 +2085,7 @@ int tls_sw_recvmsg(struct sock *sk,int to_decrypt, chunk; err =tls_rx_rec_wait (sk, psock, flags &MSG_DONTWAIT , - released); + released, !!(decrypted + copied));if (err <=0 ) {if (psock) { chunk = sk_msg_recvmsg(sk, psock, msg, len,
@@ -2265,7 +2273,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,struct tls_decrypt_arg darg; err =tls_rx_rec_wait (sk,NULL , flags &SPLICE_F_NONBLOCK , - true); + true, false);if (err <=0 ) goto splice_read_end;
@@ -2351,7 +2359,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc, }else {struct tls_decrypt_arg darg; - err =tls_rx_rec_wait (sk,NULL , true, released); + err =tls_rx_rec_wait (sk,NULL , true, released, !!copied);if (err <=0 ) goto read_sock_end;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 150/186 net/mlx5: Do not restore destination-less TC rules
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeroen Massar <[email protected]>
[ Upstream commit 8d0a5af8b1ba598e7340761729801624e7a9330e ]
After IPsec policy/state TX rules are added, any TC flow rule, which forwards packets to uplink, is modified to forward to IPsec TX tables. As these tables are destroyed dynamically, whenever there is no reference to them, the destinations of this kind of rules must be restored to uplink, unless there is no destination for that rule.
The flow rules FLOW_ACTION_ACCEPT, DROP, TRAP, GOTO and SAMPLE do not have a destination port, and thus out_count = 0.
At cleanup time of the rules in mlx5_esw_ipsec_modify_flow_dests we call mlx5_eswitch_restore_ipsec_rule but as the above types do not have a destination we get an underflow of out_count, as the port is passed, which is esw_attr->out_count - 1.
This change avoids calling mlx5_eswitch_restore_ipsec_rule when there are no output destinations and thus avoids the underflow.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +2 -1
@@ -129,7 +129,8 @@ static int mlx5_esw_ipsec_modify_flow_dests(struct mlx5_eswitch *esw, attr = flow->attr; esw_attr = attr->esw_attr; -if (esw_attr->out_count - esw_attr->split_count >1 ) +if (!esw_attr->out_count || + esw_attr->out_count - esw_attr->split_count >1 )return 0 ; err = mlx5_eswitch_restore_ipsec_rule(esw, flow->rule[0], esw_attr,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 151/186 spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 496ba79b9496b8b3747cbc764ebd33ee7325e806 ]
When DMA read times out in mtk_snand_read_page_cache(), the original code erroneously jumped to cleanup label which skips DMA unmapping and ECC disable, causing a resource leak.
--- drivers/spi/spi-mtk-snfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-mtk-snfi.c +1 -1
@@ -961,7 +961,7 @@ static int mtk_snand_read_page_cache(struct mtk_snand *snf, &snf->op_done, usecs_to_jiffies(SNFI_POLL_INTERVAL))) {dev_err (snf->dev,"DMA timed out for reading from cache.\n" ); ret = -ETIMEDOUT ; - goto cleanup; + goto cleanup2; }// Wait for BUS_SEC_CNTR returning expected value
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 152/186 drm/msm/snapshot: fix dumping of the unaligned regions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 76824d2467feb1828b745d6add2541918d7be3da ]
The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msm_disp_state_dump_regs().
Patchwork: https://patchwork.freedesktop.org/patch/725449/
Message-ID: <[email protected]>
--- .../gpu/drm/msm/disp/msm_disp_snapshot_util.c | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +18 -6
@@ -9,7 +9,7 @@#include "msm_disp_snapshot.h" -static void msm_disp_state_dump_regs (u32 **reg,u32 aligned_len,void __iomem *base_addr) +static void msm_disp_state_dump_regs (u32 **reg,u32 len,void __iomem *base_addr) {u32 len_padded;u32 num_rows;
@@ -19,11 +19,11 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *bvoid __iomem *end_addr;int i; - len_padded = aligned_len *REG_DUMP_ALIGN ; - num_rows = aligned_len /REG_DUMP_ALIGN ; + len_padded =round_up (len,REG_DUMP_ALIGN ); + num_rows =DIV_ROUND_UP (len,REG_DUMP_ALIGN ); addr = base_addr; - end_addr = base_addr + aligned_len; + end_addr = base_addr + len;if (!(*reg)) *reg =kvzalloc (len_padded,GFP_KERNEL );
@@ -51,8 +51,8 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *bstatic void msm_disp_state_print_regs (const u32 *dump_addr,u32 len,void __iomem *base_addr,struct drm_printer *p) { +void __iomem *addr, *end_addr;int i; -void __iomem *addr;u32 num_rows;if (!dump_addr) {
@@ -61,6 +61,7 @@ static void msm_disp_state_print_regs(const u32 *dump_addr, u32 len, } addr = base_addr; + end_addr = base_addr + len; num_rows = len /REG_DUMP_ALIGN ;for (i =0 ; i < num_rows; i++) {
@@ -70,6 +71,17 @@ static void msm_disp_state_print_regs(const u32 *dump_addr, u32 len, dump_addr[i * 4 + 2], dump_addr[i * 4 + 3]); addr +=REG_DUMP_ALIGN ; } + +if (addr != end_addr) { +drm_printf (p,"0x%lx : %08x" , + (unsigned long )(addr - base_addr), + dump_addr[i *4 ]); +if (addr +0x4 < end_addr) +drm_printf (p," %08x" , dump_addr[i *4 +1 ]); +if (addr +0x8 < end_addr) +drm_printf (p," %08x" , dump_addr[i *4 +2 ]); +drm_printf (p,"\n" ); + } }void msm_disp_state_print (struct msm_disp_state *state,struct drm_printer *p)
@@ -189,7 +201,7 @@ void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,va_end (va);INIT_LIST_HEAD (&new_blk->node); - new_blk->size =ALIGN (len,REG_DUMP_ALIGN ); + new_blk->size = len; new_blk->base_addr = base_addr;msm_disp_state_dump_regs (&new_blk->state, new_blk->size, base_addr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 153/186 wifi: ath11k: fix peer resolution on rx path when peer_id=0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Leach <[email protected]>
[ Upstream commit 2a2451a34afdf563b3102d36a4b6cf335cf813e2 ]
It has been observed that on certain chipsets a peer can be assigned peer_id=0. For reception of non-aggregated MPDUs this is fine as ath11k_dp_rx_h_find_peer() has a fallback case where it locates the peer based upon the source MAC address. On an aggregated link, the mpdu_start header is only populated by hardware on the first sub-MSDU. This causes the peer resolution to be skipped for the subsequent MSDUs and the encryption type of these frames to be set to an incorrect value, resulting in these MSDUs being dropped by ieee80211.
ath11k_pci 0000:03:00.0: data rx skb 000000002f4b704d len 1534 peer xx:xx:xx:xx:xx:xx 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d1a fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 1 last_msdu 0 ath11k_pci 0000:03:00.0: data rx skb 0000000038acd580 len 1534 peer (null) 0 ucast sn 3063 he160 rate_idx 9 vht_nss 2 freq 5240 band 1 flag 0x40d00 fcs-err 0 mic-err 0 amsdu-more 0 peer_id 0 first_msdu 0 last_msdu 1
Remove the null peer_id checks in ath11k_dp_rx_h_find_peer() and ath11k_hal_rx_parse_mon_status_tlv(), allowing peers with an assigned ID of 0 to be resolved.
Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-- drivers/net/wireless/ath/ath11k/hal_rx.c | 5 +---- 2 files changed, 2 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -2
@@ -2217,8 +2217,7 @@ ath11k_dp_rx_h_find_peer(struct ath11k_base *ab, struct sk_buff *msdu)lockdep_assert_held (&ab->base_lock); -if (rxcb->peer_id) - peer =ath11k_peer_find_by_id (ab, rxcb->peer_id); + peer =ath11k_peer_find_by_id (ab, rxcb->peer_id);if (peer)return peer;
drivers/net/wireless/ath/ath11k/hal_rx.c +1 -4
@@ -1469,11 +1469,8 @@ ath11k_hal_rx_parse_mon_status_tlv(struct ath11k_base *ab,case HAL_RX_MPDU_START : {struct hal_rx_mpdu_info *mpdu_info = (struct hal_rx_mpdu_info *)tlv_data; -u16 peer_id; - peer_id =ath11k_hal_rx_mpduinfo_get_peerid (ab, mpdu_info); -if (peer_id) - ppdu_info->peer_id = peer_id; + ppdu_info->peer_id =ath11k_hal_rx_mpduinfo_get_peerid (ab, mpdu_info);break ; }case HAL_RXPCU_PPDU_END_INFO : {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 154/186 net: dsa: mt7530: fix FDB entries not aging out with short timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit e824e40d0e841fab66ab7897d6c7b14dc81c66a7 ]
The DSA forwarding selftests bridge_vlan_aware.sh and bridge_vlan_unaware.sh configure the bridge with ageing_time set to LOW_AGEING_TIME (1000 centiseconds, i.e. 10 seconds) and then run learning_test() in lib.sh, which expects a learned FDB entry to be removed after ageing_time + 10 seconds. On MT7530/MT7531 the entry persisted past the deadline and the "Found FDB record when should not" assertion failed.
With msecs=10000, the algorithm in mt7530_set_ageing_time() finds AGE_CNT=0 and AGE_UNIT=9 as the first exact match (starting the search from tmp_age_count=0). The per-entry aging counter is initialized to AGE_CNT when a MAC address is learned, so with AGE_CNT=0 new entries start with a counter value of 0, which the hardware treats as "already aged" and never removes, effectively disabling aging.
Fix this by starting the search from tmp_age_count=1 to ensure entries always have a non-zero initial aging counter. For a 10-second ageing time this yields AGE_CNT=1 and AGE_UNIT=4 instead:
the timer ticks every 5 seconds and entries are removed after 2 ticks.
Starting the search at AGE_CNT=1 raises the minimum representable ageing time from 1 to 2 seconds. Without bounds, a stale ageing_time of 1 second would now make the loop fall through without setting age_count and age_unit, leaving them uninitialized when written to the MT7530_AAC hardware register. Set ds->ageing_time_min and ds->ageing_time_max so the DSA core validates the range before the callback is invoked, and drop the now-redundant range check from mt7530_set_ageing_time().
--- drivers/net/dsa/mt7530.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/net/dsa/mt7530.c +14 -6
@@ -880,12 +880,16 @@ mt7530_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)unsigned int age_count;unsigned int age_unit; -/* Applied timer is (AGE_CNT + 1) * (AGE_UNIT + 1) seconds */ -if (secs <1 || secs > (AGE_CNT_MAX +1 ) * (AGE_UNIT_MAX +1 )) -return -ERANGE ; - -/* iterate through all possible age_count to find the closest pair */ -for (tmp_age_count =0 ; tmp_age_count <=AGE_CNT_MAX ; ++tmp_age_count) { +/* Applied timer is (AGE_CNT + 1) * (AGE_UNIT + 1) seconds. +* The DSA core has already validated the range using +* ds->ageing_time_min and ds->ageing_time_max. +* +* Iterate through all possible age_count values to find the closest +* pair. Start from 1 because the per-entry aging counter is +* initialized to AGE_CNT and a value of 0 means the entry will +* never be aged out. +*/ +for (tmp_age_count =1 ; tmp_age_count <=AGE_CNT_MAX ; ++tmp_age_count) {unsigned int tmp_age_unit = secs / (tmp_age_count +1 ) -1 ;if (tmp_age_unit <=AGE_UNIT_MAX ) {
@@ -2419,6 +2423,8 @@ mt7530_setup(struct dsa_switch *ds) ds->assisted_learning_on_cpu_port = true; ds->mtu_enforcement_ingress = true; + ds->ageing_time_min =2 *1000 ; + ds->ageing_time_max = (AGE_CNT_MAX +1 ) * (AGE_UNIT_MAX +1 ) *1000 ;if (priv->id ==ID_MT7530 ) {regulator_set_voltage (priv->core_pwr,1000000 ,1000000 );
@@ -2598,6 +2604,8 @@ mt7531_setup_common(struct dsa_switch *ds) ds->assisted_learning_on_cpu_port = true; ds->mtu_enforcement_ingress = true; + ds->ageing_time_min =2 *1000 ; + ds->ageing_time_max = (AGE_CNT_MAX +1 ) * (AGE_UNIT_MAX +1 ) *1000 ;mt753x_trap_frames (priv);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 155/186 net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arınç ÜNAL <[email protected]>
[ Upstream commit 7603a0c7d2210a253265394b50567c64fbb977e4 ]
The mt753x_bpdu_port_fw enum is globally used for manipulating the process of deciding the forwardable ports, specifically concerning the CPU port(s). Therefore, rename it and the values in it to mt753x_to_cpu_fw.
Change FOLLOW_MFC to SYSTEM_DEFAULT to be on par with the switch documents.
Stable-dep-of: 3ac85bcfd404 ("net: dsa: mt7530: preserve VLAN tags on trapped link-local frames")
--- drivers/net/dsa/mt7530.c | 44 ++++++++++------------- drivers/net/dsa/mt7530.h | 76 ++++++++++++++++++++-------------------- 2 files changed, 56 insertions(+), 64 deletions(-)
drivers/net/dsa/mt7530.c +18 -26
@@ -1178,42 +1178,34 @@ mt753x_trap_frames(struct mt7530_priv *priv)* VLAN-untagged. */ mt7530_rmw (priv,MT753X_BPC , -MT753X_PAE_BPDU_FR |MT753X_PAE_EG_TAG_MASK | -MT753X_PAE_PORT_FW_MASK |MT753X_BPDU_EG_TAG_MASK | -MT753X_BPDU_PORT_FW_MASK , -MT753X_PAE_BPDU_FR | -MT753X_PAE_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_PAE_PORT_FW (MT753X_BPDU_CPU_ONLY ) | -MT753X_BPDU_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_BPDU_CPU_ONLY ); +PAE_BPDU_FR |PAE_EG_TAG_MASK |PAE_PORT_FW_MASK | +BPDU_EG_TAG_MASK |BPDU_PORT_FW_MASK , +PAE_BPDU_FR |PAE_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +PAE_PORT_FW (TO_CPU_FW_CPU_ONLY ) | +BPDU_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +TO_CPU_FW_CPU_ONLY );/* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and egress * them VLAN-untagged. */ mt7530_rmw (priv,MT753X_RGAC1 , -MT753X_R02_BPDU_FR |MT753X_R02_EG_TAG_MASK | -MT753X_R02_PORT_FW_MASK |MT753X_R01_BPDU_FR | -MT753X_R01_EG_TAG_MASK |MT753X_R01_PORT_FW_MASK , -MT753X_R02_BPDU_FR | -MT753X_R02_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_R02_PORT_FW (MT753X_BPDU_CPU_ONLY ) | -MT753X_R01_BPDU_FR | -MT753X_R01_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_BPDU_CPU_ONLY ); +R02_BPDU_FR |R02_EG_TAG_MASK |R02_PORT_FW_MASK | +R01_BPDU_FR |R01_EG_TAG_MASK |R01_PORT_FW_MASK , +R02_BPDU_FR |R02_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R02_PORT_FW (TO_CPU_FW_CPU_ONLY ) |R01_BPDU_FR | +R01_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +TO_CPU_FW_CPU_ONLY );/* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and egress * them VLAN-untagged. */ mt7530_rmw (priv,MT753X_RGAC2 , -MT753X_R0E_BPDU_FR |MT753X_R0E_EG_TAG_MASK | -MT753X_R0E_PORT_FW_MASK |MT753X_R03_BPDU_FR | -MT753X_R03_EG_TAG_MASK |MT753X_R03_PORT_FW_MASK , -MT753X_R0E_BPDU_FR | -MT753X_R0E_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_R0E_PORT_FW (MT753X_BPDU_CPU_ONLY ) | -MT753X_R03_BPDU_FR | -MT753X_R03_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | -MT753X_BPDU_CPU_ONLY ); +R0E_BPDU_FR |R0E_EG_TAG_MASK |R0E_PORT_FW_MASK | +R03_BPDU_FR |R03_EG_TAG_MASK |R03_PORT_FW_MASK , +R0E_BPDU_FR |R0E_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R0E_PORT_FW (TO_CPU_FW_CPU_ONLY ) |R03_BPDU_FR | +R03_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +TO_CPU_FW_CPU_ONLY ); } static int
drivers/net/dsa/mt7530.h +38 -38
85 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 156/186 net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <[email protected]>
[ Upstream commit 3ac85bcfd404b588298c95c6fba8aad4ad334f57 ]
The BPC, RGAC1 and RGAC2 registers control the handling of link-local frames with reserved MAC DAs (01:80:C2:00:00:0x). These frames are correctly trapped to the CPU port, but the egress VLAN tag attribute was set to MT7530_VLAN_EG_UNTAGGED which causes the switch to strip any VLAN tags from trapped frames before they reach the CPU.
This causes VLAN-tagged link-local frames (STP BPDUs, LLDP, PTP Peer Delay Requests) to arrive at the CPU without their VLAN tag, so they are delivered to the base network interface instead of the VLAN sub-interface. The DSA local_termination selftest confirms this: all link-local protocol tests on VLAN upper interfaces fail.
Set the EG_TAG attribute to MT7530_VLAN_EG_DISABLED (system default) so that the switch does not modify VLAN tags in trapped frames. This way VLAN-tagged frames retain their original tag and are delivered to the correct VLAN sub-interface, matching the behavior of non-trapped frames which pass through without VLAN tag modification.
--- drivers/net/dsa/mt7530.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/net/dsa/mt7530.c +15 -12
@@ -1174,37 +1174,40 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface)static void mt753x_trap_frames (struct mt7530_priv *priv) { -/* Trap 802.1X PAE frames and BPDUs to the CPU port(s) and egress them -* VLAN-untagged. +/* Trap 802.1X PAE frames and BPDUs to the CPU port(s) and egress +* them with the EG_TAG attribute set to disabled (system default) +* so that any VLAN tags in the frame are not modified by the +* switch egress VLAN tag processing. This preserves VLAN tags +* for reception on VLAN sub-interfaces. */ mt7530_rmw (priv,MT753X_BPC ,PAE_BPDU_FR |PAE_EG_TAG_MASK |PAE_PORT_FW_MASK |BPDU_EG_TAG_MASK |BPDU_PORT_FW_MASK , -PAE_BPDU_FR |PAE_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +PAE_BPDU_FR |PAE_EG_TAG (MT7530_VLAN_EG_DISABLED ) |PAE_PORT_FW (TO_CPU_FW_CPU_ONLY ) | -BPDU_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +BPDU_EG_TAG (MT7530_VLAN_EG_DISABLED ) |TO_CPU_FW_CPU_ONLY ); -/* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and egress -* them VLAN-untagged. +/* Trap frames with :01 and :02 MAC DAs to the CPU port(s) and +* egress them with EG_TAG disabled. */ mt7530_rmw (priv,MT753X_RGAC1 ,R02_BPDU_FR |R02_EG_TAG_MASK |R02_PORT_FW_MASK |R01_BPDU_FR |R01_EG_TAG_MASK |R01_PORT_FW_MASK , -R02_BPDU_FR |R02_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R02_BPDU_FR |R02_EG_TAG (MT7530_VLAN_EG_DISABLED ) |R02_PORT_FW (TO_CPU_FW_CPU_ONLY ) |R01_BPDU_FR | -R01_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R01_EG_TAG (MT7530_VLAN_EG_DISABLED ) |TO_CPU_FW_CPU_ONLY ); -/* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and egress -* them VLAN-untagged. +/* Trap frames with :03 and :0E MAC DAs to the CPU port(s) and +* egress them with EG_TAG disabled. */ mt7530_rmw (priv,MT753X_RGAC2 ,R0E_BPDU_FR |R0E_EG_TAG_MASK |R0E_PORT_FW_MASK |R03_BPDU_FR |R03_EG_TAG_MASK |R03_PORT_FW_MASK , -R0E_BPDU_FR |R0E_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R0E_BPDU_FR |R0E_EG_TAG (MT7530_VLAN_EG_DISABLED ) |R0E_PORT_FW (TO_CPU_FW_CPU_ONLY ) |R03_BPDU_FR | -R03_EG_TAG (MT7530_VLAN_EG_UNTAGGED ) | +R03_EG_TAG (MT7530_VLAN_EG_DISABLED ) |TO_CPU_FW_CPU_ONLY ); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 157/186 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erni Sri Satya Vennela <[email protected]>
[ Upstream commit 35f0f0a2536a4d604b4dbad92c85c4a8fdebb870 ]
In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic.
DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation.
Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().
--- .../net/ethernet/microsoft/mana/hw_channel.c | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-)
drivers/net/ethernet/microsoft/mana/hw_channel.c +13 -10
@@ -75,21 +75,19 @@ static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq, }static void mana_hwc_handle_resp (struct hw_channel_context *hwc,u32 resp_len, -struct hwc_work_request *rx_req) +struct hwc_work_request *rx_req,u16 msg_id) {const struct gdma_resp_hdr *resp_msg = rx_req->buf_va;struct hwc_caller_ctx *ctx;int err; -if (!test_bit (resp_msg->response.hwc_msg_id, - hwc->inflight_msg_res.map)) { -dev_err (hwc->dev,"hwc_rx: invalid msg_id = %u\n" , - resp_msg->response.hwc_msg_id); +if (!test_bit (msg_id, hwc->inflight_msg_res.map)) { +dev_err (hwc->dev,"hwc_rx: invalid msg_id = %u\n" , msg_id);mana_hwc_post_rx_wqe (hwc->rxq, rx_req);return ; } - ctx = hwc->caller_ctx + resp_msg->response.hwc_msg_id; + ctx = hwc->caller_ctx + msg_id; err =mana_hwc_verify_resp_msg (ctx, resp_msg, resp_len);if (err) goto out;
@@ -218,6 +216,7 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id,struct gdma_sge *sge;u64 rq_base_addr;u64 rx_req_idx; +u16 msg_id;u8 *wqe;if (WARN_ON_ONCE (hwc_rxq->gdma_wq->id != gdma_rxq_id))
@@ -236,13 +235,17 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id, rx_req = &hwc_rxq->msg_buf->reqs[rx_req_idx]; resp = (struct gdma_resp_hdr *)rx_req->buf_va; -if (resp->response.hwc_msg_id >= hwc->num_inflight_msg) { -dev_err (hwc->dev,"HWC RX: wrong msg_id=%u\n" , - resp->response.hwc_msg_id); +/* Read msg_id once from DMA buffer to prevent TOCTOU: +* DMA memory is shared/unencrypted in CVMs - host can +* modify it between reads. +*/ + msg_id =READ_ONCE (resp->response.hwc_msg_id); +if (msg_id >= hwc->num_inflight_msg) { +dev_err (hwc->dev,"HWC RX: wrong msg_id=%u\n" , msg_id);return ; } -mana_hwc_handle_resp (hwc, rx_oob->tx_oob_data_size, rx_req); +mana_hwc_handle_resp (hwc, rx_oob->tx_oob_data_size, rx_req, msg_id);/* Can no longer use 'resp', because the buffer is posted to the HW * in mana_hwc_handle_resp() above.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 158/186 platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit e7a9a6ea40e352cd7977f6a8c80bdeadf65ad838 ]
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 adv_swbutton driver.
--- drivers/platform/x86/adv_swbutton.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/adv_swbutton.c +5 -1
@@ -48,10 +48,14 @@ static int adv_swbutton_probe(struct platform_device *device) {struct adv_swbutton *button;struct input_dev *input; -acpi_handle handle =ACPI_HANDLE (&device->dev); +acpi_handle handle;acpi_status status;int error; + handle =ACPI_HANDLE (&device->dev); +if (!handle) +return -ENODEV ; + button =devm_kzalloc (&device->dev,sizeof (*button),GFP_KERNEL );if (!button)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 159/186 platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit abfbe5ee8ae89f1f5449790423d5dd3e423545bd ]
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
Accordingly, add a requisite ACPI_COMPANION() check against NULL to the platform/x86 hp_accel driver.
--- drivers/platform/x86/hp/hp_accel.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/hp/hp_accel.c +3 -0
@@ -300,6 +300,9 @@ static int lis3lv02d_probe(struct platform_device *device)int ret; lis3_dev.bus_priv =ACPI_COMPANION (&device->dev); +if (!lis3_dev.bus_priv) +return -ENODEV ; + lis3_dev.init = lis3lv02d_acpi_init; lis3_dev.read = lis3lv02d_acpi_read; lis3_dev.write = lis3lv02d_acpi_write;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 160/186 platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 5c69e090ae5dd93d910f70db0796357080707d26 ]
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel-hid driver.
--- drivers/platform/x86/intel/hid.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/hid.c +5 -1
@@ -657,12 +657,16 @@ static bool button_array_present(struct platform_device *device)static int intel_hid_probe (struct platform_device *device) { -acpi_handle handle =ACPI_HANDLE (&device->dev);unsigned long long mode, dummy;struct intel_hid_priv *priv; +acpi_handle handle;acpi_status status;int err; + handle =ACPI_HANDLE (&device->dev); +if (!handle) +return -ENODEV ; +intel_hid_init_dsm (handle);if (!intel_hid_evaluate_method (handle,INTEL_HID_DSM_HDMM_FN , &mode)) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 161/186 platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit a9f305c5a355efeb240d406d378491d9eec02d07 ]
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
Accordingly, add a requisite ACPI_HANDLE() check against NULL to the platform/x86 intel-vbtn driver.
--- drivers/platform/x86/intel/vbtn.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/vbtn.c +5 -1
@@ -272,12 +272,16 @@ static bool intel_vbtn_has_switches(acpi_handle handle, bool dual_accel)static int intel_vbtn_probe (struct platform_device *device) { -acpi_handle handle =ACPI_HANDLE (&device->dev);bool dual_accel, has_buttons, has_switches;struct intel_vbtn_priv *priv; +acpi_handle handle;acpi_status status;int err; + handle =ACPI_HANDLE (&device->dev); +if (!handle) +return -ENODEV ; + dual_accel =dual_accel_detect (); has_buttons =acpi_has_method (handle,"VBDL" ); has_switches =intel_vbtn_has_switches (handle, dual_accel);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 162/186 RDMA/rtrs: Fix use-after-free in path file creation cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
[ Upstream commit 5b74373390113fba798a76b483837029ab010fef ]
In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path).
kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free.
This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved.
Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it.
This issue was found by a static analysis tool I am developing.
--- drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c +1 -1
@@ -295,8 +295,8 @@ int rtrs_srv_create_path_files(struct rtrs_srv_path *srv_path) put_kobj:kobject_del (&srv_path->kobj); destroy_root: -kobject_put (&srv_path->kobj);rtrs_srv_destroy_once_sysfs_root_folders (srv_path); +kobject_put (&srv_path->kobj);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 163/186 net: bridge: Flush multicast groups when snooping is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 68800bbf583f26f71491141e4b3c8582f9cfcbde ]
When forwarding multicast packets, the bridge takes MDB into account when IGMP / MLD snooping is enabled. Currently, when snooping is disabled, the MDB is retained, even though it is not used anymore.
At the same time, during the time that snooping is disabled, the IGMP / MLD control packets are obviously ignored, and after the snooping is reenabled, the administrator has to assume it is out of sync. In particular, missed join and leave messages would lead to traffic being forwarded to wrong interfaces.
Keeping the MDB entries around thus serves no purpose, and just takes memory. Note also that disabling per-VLAN snooping does actually flush the relevant MDB entries.
This patch flushes non-permanent MDB entries as global snooping is disabled.
Stable-dep-of: 4df78ff02629 ("bridge: mcast: Fix a possible use-after-free when removing a bridge port")
--- net/bridge/br_multicast.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/bridge/br_multicast.c +9 -0
@@ -4641,6 +4641,14 @@ static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,rcu_read_unlock (); } +static void br_multicast_del_grps (struct net_bridge *br) +{ +struct net_bridge_port *port; + +list_for_each_entry (port, &br->port_list, list) +__br_multicast_disable_port_ctx (&port->multicast_ctx); +} +int br_multicast_toggle (struct net_bridge *br,unsigned long val,struct netlink_ext_ack *extack) {
@@ -4661,6 +4669,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val,br_opt_toggle (br,BROPT_MULTICAST_ENABLED , !!val);if (!br_opt_get (br,BROPT_MULTICAST_ENABLED )) { change_snoopers = true; +br_multicast_del_grps (br); goto unlock; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 164/186 bridge: mcast: Fix a possible use-after-free when removing a bridge port
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 4df78ff02629c7729168f0696a7a2123c389818d ]
When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled.
When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled.
The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:
# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1
This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs.
After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1].
Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.
[1]
ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ>
__debug_check_no_obj_freed (lib/debugobjects.c:1116)
kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689)rcu_do_batch (kernel/rcu/tree.c:2617)rcu_core (kernel/rcu/tree.c:2869)handle_softirqs (kernel/softirq.c:622)__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>
--- net/bridge/br_multicast.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
net/bridge/br_multicast.c +17 -5
@@ -4641,10 +4641,24 @@ static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,rcu_read_unlock (); } -static void br_multicast_del_grps (struct net_bridge *br) +static void br_multicast_enable_all_ports (struct net_bridge *br) {struct net_bridge_port *port; +if (br_opt_get (br,BROPT_MCAST_VLAN_SNOOPING_ENABLED )) +return ; + +list_for_each_entry (port, &br->port_list, list) +__br_multicast_enable_port_ctx (&port->multicast_ctx); +} + +static void br_multicast_disable_all_ports (struct net_bridge *br) +{ +struct net_bridge_port *port; + +if (br_opt_get (br,BROPT_MCAST_VLAN_SNOOPING_ENABLED )) +return ; +list_for_each_entry (port, &br->port_list, list)__br_multicast_disable_port_ctx (&port->multicast_ctx); }
@@ -4652,7 +4666,6 @@ static void br_multicast_del_grps(struct net_bridge *br)int br_multicast_toggle (struct net_bridge *br,unsigned long val,struct netlink_ext_ack *extack) { -struct net_bridge_port *port;bool change_snoopers = false;int err =0 ;
@@ -4669,7 +4682,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val,br_opt_toggle (br,BROPT_MULTICAST_ENABLED , !!val);if (!br_opt_get (br,BROPT_MULTICAST_ENABLED )) { change_snoopers = true; -br_multicast_del_grps (br); +br_multicast_disable_all_ports (br); goto unlock; }
@@ -4677,8 +4690,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val, goto unlock;br_multicast_open (br); -list_for_each_entry (port, &br->port_list, list) -__br_multicast_enable_port_ctx (&port->multicast_ctx); +br_multicast_enable_all_ports (br); change_snoopers = true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 165/186 pds_core: fix error handling in pdsc_devcmd_wait
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil P. Rao <[email protected]>
[ Upstream commit 0e46b6635b03d29807f810c3b415c4755a3f958d ]
Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:
1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.
2. Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.
Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
--- drivers/net/ethernet/amd/pds_core/dev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/pds_core/dev.c +9 -2
@@ -162,12 +162,19 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds)dev_dbg (dev,"DEVCMD %d %s after %ld secs\n" , opcode,pdsc_devcmd_str (opcode), duration /HZ ); -if ((!done || timeout) && running) { +if (!running) { +dev_err (dev,"DEVCMD %d %s fw not running\n" , + opcode,pdsc_devcmd_str (opcode)); +pdsc_devcmd_clean (pdsc); +return -ENXIO ; + } + +if (!done || timeout) {dev_err (dev,"DEVCMD %d %s timeout, done %d timeout %d max_seconds=%d\n" , opcode,pdsc_devcmd_str (opcode), done, timeout, max_seconds); - err = -ETIMEDOUT ;pdsc_devcmd_clean (pdsc); +return -ETIMEDOUT ; } status =pdsc_devcmd_status (pdsc);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 166/186 pds_core: fix debugfs_lookup dentry leak and error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil P. Rao <[email protected]>
[ Upstream commit dc416e32baaeb620b9809e9e25fc7b30889686e9 ]
debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery.
Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.
--- drivers/net/ethernet/amd/pds_core/debugfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/amd/pds_core/debugfs.c +6 -1
@@ -64,9 +64,14 @@ DEFINE_SHOW_ATTRIBUTE(identity);void pdsc_debugfs_add_ident (struct pdsc *pdsc) { +struct dentry *dentry; +/* This file will already exist in the reset flow */ -if (debugfs_lookup ("identity" , pdsc->dentry)) + dentry =debugfs_lookup ("identity" , pdsc->dentry); +if (!IS_ERR_OR_NULL (dentry)) { +dput (dentry);return ; + }debugfs_create_file ("identity" ,0400 , pdsc->dentry, pdsc, &identity_fops);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 167/186 ptrace: Convert ptrace_attach() to use lock guards
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 5431fdd2c181dd2eac218e45b44deb2925fa48f0 ]
Created as testing for the conditional guard infrastructure. Specifically this makes use of the following form:
scoped_cond_guard (mutex_intr, return -ERESTARTNOINTR,
&task->signal->cred_guard_mutex) {
... }
...
return 0;
Stable-dep-of: 60a1969fae62 ("ALSA: seq: Serialize UMP output teardown with event_input")
--- include/linux/sched/task.h | 2 + include/linux/spinlock.h | 26 ++++++++ kernel/ptrace.c | 128 ++++++++++++++++++------------------- 3 files changed, 89 insertions(+), 67 deletions(-)
include/linux/sched/task.h +2 -0
@@ -227,4 +227,6 @@ static inline void task_unlock(struct task_struct *p)spin_unlock (&p->alloc_lock); } +DEFINE_GUARD(task_lock, struct task_struct *, task_lock(_T), task_unlock(_T)) +#endif /* _LINUX_SCHED_TASK_H */
include/linux/spinlock.h +26 -0
@@ -548,5 +548,31 @@ DEFINE_LOCK_GUARD_1(spinlock_irqsave, spinlock_t,DEFINE_LOCK_GUARD_1_COND (spinlock_irqsave, _try, spin_trylock_irqsave(_T->lock, _T->flags)) +DEFINE_LOCK_GUARD_1 (read_lock, rwlock_t, +read_lock (_T->lock), + read_unlock(_T->lock)) + +DEFINE_LOCK_GUARD_1 (read_lock_irq, rwlock_t, +read_lock_irq (_T->lock), + read_unlock_irq(_T->lock)) + +DEFINE_LOCK_GUARD_1 (read_lock_irqsave, rwlock_t, +read_lock_irqsave (_T->lock, _T->flags), +read_unlock_irqrestore (_T->lock, _T->flags), + unsigned long flags) + +DEFINE_LOCK_GUARD_1 (write_lock, rwlock_t, +write_lock (_T->lock), + write_unlock(_T->lock)) + +DEFINE_LOCK_GUARD_1 (write_lock_irq, rwlock_t, +write_lock_irq (_T->lock), + write_unlock_irq(_T->lock)) + +DEFINE_LOCK_GUARD_1 (write_lock_irqsave, rwlock_t, +write_lock_irqsave (_T->lock, _T->flags), +write_unlock_irqrestore (_T->lock, _T->flags), + unsigned long flags) +#undef __LINUX_INSIDE_SPINLOCK_H#endif /* __LINUX_SPINLOCK_H */
kernel/ptrace.c +61 -67
172 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 168/186 ALSA: seq: ump: Use guard() for locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 6487e363714c28c4b62ac149e7d907cfeeedb3ad ]
We can simplify the code gracefully with new guard() macro and co for automatic cleanup of locks.
Only the code refactoring, and no functional changes.
Stable-dep-of: 60a1969fae62 ("ALSA: seq: Serialize UMP output teardown with event_input")
--- sound/core/seq/seq_ump_client.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
sound/core/seq/seq_ump_client.c +5 -8
@@ -106,21 +106,19 @@ static int seq_ump_process_event(struct snd_seq_event *ev, int direct,static int seq_ump_client_open (struct seq_ump_client *client,int dir) {struct snd_ump_endpoint *ump = client->ump; -int err =0 ; +int err; -mutex_lock (&ump->open_mutex); +guard (mutex)(&ump->open_mutex);if (dir ==STR_OUT && !client->opened[dir]) { err =snd_rawmidi_kernel_open (&ump->core,0 ,SNDRV_RAWMIDI_LFLG_OUTPUT |SNDRV_RAWMIDI_LFLG_APPEND , &client->out_rfile);if (err <0 ) - goto unlock; +return err; } client->opened[dir]++; - unlock: -mutex_unlock (&ump->open_mutex); -return err; +return 0 ; }/* close the rawmidi */
@@ -128,11 +126,10 @@ static int seq_ump_client_close(struct seq_ump_client *client, int dir) {struct snd_ump_endpoint *ump = client->ump; -mutex_lock (&ump->open_mutex); +guard (mutex)(&ump->open_mutex);if (!--client->opened[dir])if (dir ==STR_OUT )snd_rawmidi_kernel_release (&client->out_rfile); -mutex_unlock (&ump->open_mutex);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 169/186 ALSA: seq: Serialize UMP output teardown with event_input
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <[email protected]>
[ Upstream commit 60a1969fae6209644698fca91c185d153674f631 ]
seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() and seq_ump_client_close().
The last output unuse can therefore drop opened[STR_OUT] to zero and release the rawmidi file while an in-flight event_input callback is still inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream runtime exposed to teardown before the write path has taken its own buffer reference.
Add a per-client rwlock for the event_input-visible output file. Publish a newly opened output file under the write side, and hold the read side from the output lookup through snd_rawmidi_kernel_write(). The last output close copies and clears the visible output file under the write side, then drops the lock and releases the saved rawmidi file. Use IRQ-safe rwlock guards because event_input can also be reached from atomic sequencer delivery.
The buggy scenario involves two paths, with each column showing the order within that path:
path A label: event_input path path B label: last unuse path
1. seq_ump_process_event() reads 1. seq_ump_client_close()
client->out_rfile.output. drops opened[STR_OUT] to zero.
2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()
has not yet pinned runtime. closes the output file.
3. The writer continues using 3. close_substream() frees
the borrowed substream. substream->runtime.
This keeps the output substream and runtime alive for the full event_input write while keeping rawmidi release outside the rwlock.
KASAN reproduced this as a slab-use-after-free in snd_rawmidi_kernel_write1(), with allocation through seq_ump_use()/snd_seq_port_connect() and free through seq_ump_unuse()/snd_seq_port_disconnect().
Validation reproduced this kernel report:
KASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d/0x400
RIP: 0033:0x7f5528af837f Read of size 8 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x650 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x1a7/0x340 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) snd_rawmidi_kernel_write1+0x9d/0x400 (?:?) __asan_load8+0x82/0xb0 (?:?) update_stack_state+0x1ef/0x2d0 (?:?) snd_rawmidi_kernel_write+0x1a/0x20 (?:?) seq_ump_process_event+0xd4/0x120 (sound/core/seq/seq_ump_client.c:82) __snd_seq_deliver_single_event+0x8a/0xe0 (?:?) snd_seq_deliver_from_ump+0x2b2/0xd60 (?:?) lock_acquire+0x14e/0x2e0 (?:?) find_held_lock+0x31/0x90 (?:?) snd_seq_port_use_ptr+0xa6/0xe0 (?:?) __kasan_check_write+0x18/0x20 (?:?) do_raw_read_unlock+0x32/0xa0 (?:?) _raw_read_unlock+0x26/0x50 (?:?) snd_seq_deliver_single_event+0x45c/0x4b0 (?:?) snd_seq_deliver_event+0x10d/0x1b0 (?:?) snd_seq_client_enqueue_event+0x192/0x240 (?:?) snd_seq_write+0x2cd/0x450 (?:?) apparmor_file_permission+0x20/0x30 (?:?) security_file_permission+0x51/0x60 (?:?) vfs_write+0x1ce/0x850 (?:?) __fget_files+0x12b/0x220 (?:?) lock_release+0xc8/0x2a0 (?:?) __rcu_read_unlock+0x74/0x2d0 (?:?) __fget_files+0x135/0x220 (?:?) ksys_write+0x15a/0x180 (?:?) rcu_is_watching+0x24/0x60 (?:?) __x64_sys_write+0x46/0x60 (?:?) x64_sys_call+0x7d/0x20d0 (?:?) do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
--- sound/core/seq/seq_ump_client.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
sound/core/seq/seq_ump_client.c +18 -4
@@ -37,6 +37,7 @@ struct seq_ump_client {struct snd_ump_endpoint *ump;/* assigned endpoint */ int seq_client;/* sequencer client id */ int opened[2 ];/* current opens for each direction */ +rwlock_t output_lock;/* protects out_rfile output access */ struct snd_rawmidi_file out_rfile;/* rawmidi for output */ struct seq_ump_input_buffer input;/* input parser context */ void *ump_info[SNDRV_UMP_MAX_BLOCKS +1 ];/* shadow of seq client ump_info */
@@ -88,6 +89,7 @@ static int seq_ump_process_event(struct snd_seq_event *ev, int direct,unsigned char type;int len; +guard (read_lock_irqsave)(&client->output_lock); substream = client->out_rfile.output;if (!substream)return -ENODEV ;
@@ -106,6 +108,7 @@ static int seq_ump_process_event(struct snd_seq_event *ev, int direct,static int seq_ump_client_open (struct seq_ump_client *client,int dir) {struct snd_ump_endpoint *ump = client->ump; +struct snd_rawmidi_file rfile = {};int err;guard (mutex)(&ump->open_mutex);
@@ -113,9 +116,11 @@ static int seq_ump_client_open(struct seq_ump_client *client, int dir) err =snd_rawmidi_kernel_open (&ump->core,0 ,SNDRV_RAWMIDI_LFLG_OUTPUT |SNDRV_RAWMIDI_LFLG_APPEND , - &client->out_rfile); + &rfile);if (err <0 )return err; +scoped_guard (write_lock_irqsave, &client->output_lock) + client->out_rfile = rfile; } client->opened[dir]++;return 0 ;
@@ -125,11 +130,19 @@ static int seq_ump_client_open(struct seq_ump_client *client, int dir)static int seq_ump_client_close (struct seq_ump_client *client,int dir) {struct snd_ump_endpoint *ump = client->ump; +struct snd_rawmidi_file rfile = {};guard (mutex)(&ump->open_mutex); -if (!--client->opened[dir]) -if (dir ==STR_OUT ) -snd_rawmidi_kernel_release (&client->out_rfile); +if (!--client->opened[dir]) { +if (dir ==STR_OUT ) { + scoped_guard(write_lock_irqsave, &client->output_lock) { + rfile = client->out_rfile; + client->out_rfile = (struct snd_rawmidi_file ){}; + } +if (rfile.rmidi) +snd_rawmidi_kernel_release (&rfile); + } + }return 0 ; }
@@ -430,6 +443,7 @@ static int snd_seq_ump_probe(struct device *_dev)INIT_WORK (&client->group_notify_work, handle_group_notify); client->ump = ump; +rwlock_init (&client->output_lock); client->seq_client = snd_seq_create_kernel_client(card, ump->core.device,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 170/186 tracing: Avoid NULL return from hist_field_name() on truncation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <[email protected]>
[ Upstream commit 576ec047d20b368b43c4d5db98c4f2e0f3c101ec ]
hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL:strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it.
system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path.
Keep the length check but leave field_name as "" on overflow.
--- kernel/trace/trace_events_hist.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace_events_hist.c +2 -4
@@ -1354,10 +1354,8 @@ static const char *hist_field_name(struct hist_field *field, len =snprintf (full_name,sizeof (full_name),"%s.%s.%s" , field->system, field->event_name, field->name); -if (len >=sizeof (full_name)) -return NULL ; - - field_name = full_name; +if (len <sizeof (full_name)) + field_name = full_name; }else field_name = field->name; }else if (field->flags &HIST_FIELD_FL_TIMESTAMP )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 171/186 Bluetooth: btmtk: add the function to get the fw name
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Wang <[email protected]>
[ Upstream commit 00f993fdec06c8f036a1b9c8ee6b004c17143bd1 ]
Include a shared function to get the firmware name, to prevent repeating code for similar chipsets.
Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths")
--- drivers/bluetooth/btmtk.c | 18 ++++++++++++++++++ drivers/bluetooth/btmtk.h | 8 ++++++++ 2 files changed, 26 insertions(+)
drivers/bluetooth/btmtk.c +18 -0
@@ -103,6 +103,24 @@ static void btmtk_coredump_notify(struct hci_dev *hdev, int state) } } +void btmtk_fw_get_filename (char *buf,size_t size,u32 dev_id,u32 fw_ver, +u32 fw_flavor) +{ +if (dev_id ==0x7925 ) +snprintf (buf, size, +"mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin" , + dev_id &0xffff , dev_id &0xffff , (fw_ver &0xff ) +1 ); +else if (dev_id ==0x7961 && fw_flavor) +snprintf (buf, size, +"mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin" , + dev_id &0xffff , (fw_ver &0xff ) +1 ); +else +snprintf (buf, size, +"mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin" , + dev_id &0xffff , (fw_ver &0xff ) +1 ); +} +EXPORT_SYMBOL_GPL (btmtk_fw_get_filename); +int btmtk_setup_firmware_79xx (struct hci_dev *hdev,const char *fwname,wmt_cmd_sync_func_t wmt_cmd_sync) {
drivers/bluetooth/btmtk.h +8 -0
@@ -160,6 +160,9 @@ int btmtk_register_coredump(struct hci_dev *hdev, const char *name, u32 fw_version);int btmtk_process_coredump (struct hci_dev *hdev,struct sk_buff *skb); + +void btmtk_fw_get_filename (char *buf,size_t size,u32 dev_id,u32 fw_ver, +u32 fw_flavor);#else static inline int btmtk_set_bdaddr(struct hci_dev *hdev,
@@ -194,4 +197,9 @@ static int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) {return -EOPNOTSUPP ; } + +static void btmtk_fw_get_filename (char *buf,size_t size,u32 dev_id, +u32 fw_ver,u32 fw_flavor) +{ +}#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 172/186 Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Qin <[email protected]>
[ Upstream commit 4c0c28f2bbec0c51395fd1f13c697da67483964b ]
Extract the function btusb_mtk_subsys_reset from the btusb_mtk_reset for the future handling of resetting bluetooth controller without the USB reset.
Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths")
--- drivers/bluetooth/btusb.c | 45 +++++++++++++++++++++++---------------- 1 file changed, 27 insertions(+), 18 deletions(-)
drivers/bluetooth/btusb.c +27 -18
@@ -3081,28 +3081,13 @@ static u32 btusb_mtk_reset_done(struct hci_dev *hdev)return val &MTK_BT_RST_DONE ; } -static int btusb_mtk_reset (struct hci_dev *hdev,void *rst_data) +static int btusb_mtk_subsys_reset (struct hci_dev *hdev,u32 dev_id) {struct btusb_data *data =hci_get_drvdata (hdev); -struct btmediatek_data *mediatek;u32 val;int err; -/* It's MediaTek specific bluetooth reset mechanism via USB */ -if (test_and_set_bit (BTUSB_HW_RESET_ACTIVE , &data->flags)) { -bt_dev_err (hdev,"last reset failed? Not resetting again" ); -return -EBUSY ; - } - - err =usb_autopm_get_interface (data->intf); -if (err <0 ) -return err; - -btusb_stop_traffic (data); -usb_kill_anchored_urbs (&data->tx_anchor); - mediatek =hci_get_priv (hdev); - -if (mediatek->dev_id ==0x7925 ) { +if (dev_id ==0x7925 ) {btusb_mtk_uhw_reg_read (data,MTK_BT_RESET_REG_CONNV3 , &val); val |= (1 <<5 );btusb_mtk_uhw_reg_write (data,MTK_BT_RESET_REG_CONNV3 , val);
@@ -3146,8 +3131,32 @@ static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)if (!val)bt_dev_err (hdev,"Can't get device id, subsys reset fail." ); -usb_queue_reset_device (data->intf); +return err; +} +static int btusb_mtk_reset (struct hci_dev *hdev,void *rst_data) +{ +struct btusb_data *data =hci_get_drvdata (hdev); +struct btmediatek_data *mtk_data; +int err; + +/* It's MediaTek specific bluetooth reset mechanism via USB */ +if (test_and_set_bit (BTUSB_HW_RESET_ACTIVE , &data->flags)) { +bt_dev_err (hdev,"last reset failed? Not resetting again" ); +return -EBUSY ; + } + + err =usb_autopm_get_interface (data->intf); +if (err <0 ) +return err; + +btusb_stop_traffic (data); +usb_kill_anchored_urbs (&data->tx_anchor); + mtk_data =hci_get_priv (hdev); + + err =btusb_mtk_subsys_reset (hdev, mtk_data->dev_id); + +usb_queue_reset_device (data->intf);clear_bit (BTUSB_HW_RESET_ACTIVE , &data->flags);return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 173/186 Bluetooth: btmtk: rename btmediatek_data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit d3e6236053958a8f1c7c7a885d9cecdd383e4615 ]
Rename btmediatek_data to have a consistent prefix throughout the driver.
Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths")
--- drivers/bluetooth/btmtk.c | 10 +++++----- drivers/bluetooth/btmtk.h | 2 +- drivers/bluetooth/btusb.c | 9 ++++----- 3 files changed, 10 insertions(+), 11 deletions(-)
drivers/bluetooth/btmtk.c +5 -5
@@ -64,7 +64,7 @@ static void btmtk_coredump(struct hci_dev *hdev)static void btmtk_coredump_hdr (struct hci_dev *hdev,struct sk_buff *skb) { -struct btmediatek_data *data =hci_get_priv (hdev); +struct btmtk_data *data =hci_get_priv (hdev);char buf[80 ]; snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
@@ -85,7 +85,7 @@ static void btmtk_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)static void btmtk_coredump_notify (struct hci_dev *hdev,int state) { -struct btmediatek_data *data =hci_get_priv (hdev); +struct btmtk_data *data =hci_get_priv (hdev);switch (state) {case HCI_DEVCOREDUMP_IDLE :
@@ -355,7 +355,7 @@ EXPORT_SYMBOL_GPL(btmtk_set_bdaddr);void btmtk_reset_sync (struct hci_dev *hdev) { -struct btmediatek_data *reset_work =hci_get_priv (hdev); +struct btmtk_data *reset_work =hci_get_priv (hdev);int err;hci_dev_lock (hdev);
@@ -371,7 +371,7 @@ EXPORT_SYMBOL_GPL(btmtk_reset_sync);int btmtk_register_coredump (struct hci_dev *hdev,const char *name,u32 fw_version) { -struct btmediatek_data *data =hci_get_priv (hdev); +struct btmtk_data *data =hci_get_priv (hdev);if (!IS_ENABLED (CONFIG_DEV_COREDUMP ))return -EOPNOTSUPP ;
@@ -387,7 +387,7 @@ EXPORT_SYMBOL_GPL(btmtk_register_coredump);int btmtk_process_coredump (struct hci_dev *hdev,struct sk_buff *skb) { -struct btmediatek_data *data =hci_get_priv (hdev); +struct btmtk_data *data =hci_get_priv (hdev);int err;bool complete = false;
drivers/bluetooth/btmtk.h +1 -1
@@ -135,7 +135,7 @@ struct btmtk_coredump_info {int state; }; -struct btmediatek_data { +struct btmtk_data {u32 dev_id;btmtk_reset_sync_func_t reset_sync;struct btmtk_coredump_info cd_info;
drivers/bluetooth/btusb.c +4 -5
@@ -3137,7 +3137,7 @@ static int btusb_mtk_subsys_reset(struct hci_dev *hdev, u32 dev_id)static int btusb_mtk_reset (struct hci_dev *hdev,void *rst_data) {struct btusb_data *data =hci_get_drvdata (hdev); -struct btmediatek_data *mtk_data; +struct btmtk_data *btmtk_data =hci_get_priv (hdev);int err;/* It's MediaTek specific bluetooth reset mechanism via USB */
@@ -3152,9 +3152,8 @@ static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)btusb_stop_traffic (data);usb_kill_anchored_urbs (&data->tx_anchor); - mtk_data =hci_get_priv (hdev); - err =btusb_mtk_subsys_reset (hdev, mtk_data->dev_id); + err =btusb_mtk_subsys_reset (hdev, btmtk_data->dev_id);usb_queue_reset_device (data->intf);clear_bit (BTUSB_HW_RESET_ACTIVE , &data->flags);
@@ -3176,7 +3175,7 @@ static int btusb_mtk_setup(struct hci_dev *hdev)char fw_bin_name[64 ];u32 fw_version =0 ;u8 param; -struct btmediatek_data *mediatek; +struct btmtk_data *mediatek; calltime =ktime_get ();
@@ -4434,7 +4433,7 @@ static int btusb_probe(struct usb_interface *intf, data->recv_event = btusb_recv_event_realtek; }else if (id->driver_info &BTUSB_MEDIATEK ) {/* Allocate extra space for Mediatek device */ - priv_size +=sizeof (struct btmediatek_data ); + priv_size +=sizeof (struct btmtk_data ); } data->recv_acl = hci_recv_frame;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 174/186 Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit d019930b0049fc2648a6b279893d8ad330596e81 ]
Move btusb_mtk_hci_wmt_sync from btusb.c to btmtk.c which holds vendor specific stuff and would make btusb.c clean.
Add usb.h header to btmtksdio.c/btmtkuart.c for usb related element defined in btmtk.h
Stable-dep-of: dd1dda6b8d6e ("Bluetooth: btmtk: fix urb->setup_packet leak in error paths")
--- drivers/bluetooth/btmtk.c | 265 +++++++++++++++++++++++++++++++ drivers/bluetooth/btmtk.h | 31 ++++ drivers/bluetooth/btmtksdio.c | 1 + drivers/bluetooth/btmtkuart.c | 1 + drivers/bluetooth/btusb.c | 290 +--------------------------------- 5 files changed, 305 insertions(+), 283 deletions(-)
drivers/bluetooth/btmtk.c +265 -0
@@ -4,6 +4,7 @@*/ #include <linux/module.h> #include <linux/firmware.h> +#include <linux/usb.h> #include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h>
@@ -435,6 +436,270 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) }EXPORT_SYMBOL_GPL (btmtk_process_coredump); +static void btmtk_usb_wmt_recv (struct urb *urb) +{ +struct hci_dev *hdev = urb->context; +struct btmtk_data *data =hci_get_priv (hdev); +struct sk_buff *skb; +int err; + +if (urb->status ==0 && urb->actual_length >0 ) { + hdev->stat.byte_rx += urb->actual_length; + +/* WMT event shouldn't be fragmented and the size should be +* less than HCI_WMT_MAX_EVENT_SIZE. +*/ + skb =bt_skb_alloc (HCI_WMT_MAX_EVENT_SIZE ,GFP_ATOMIC ); +if (!skb) { + hdev->stat.err_rx++; +kfree (urb->setup_packet); +return ; + } + +hci_skb_pkt_type (skb) =HCI_EVENT_PKT ; +skb_put_data (skb, urb->transfer_buffer, urb->actual_length); + +/* When someone waits for the WMT event, the skb is being cloned +* and being processed the events from there then. +*/ +if (test_bit (BTMTK_TX_WAIT_VND_EVT , &data->flags)) { + data->evt_skb =skb_clone (skb,GFP_ATOMIC ); +if (!data->evt_skb) { +kfree_skb (skb); +kfree (urb->setup_packet); +return ; + } + } + + err =hci_recv_frame (hdev, skb); +if (err <0 ) { +kfree_skb (data->evt_skb); + data->evt_skb =NULL ; +kfree (urb->setup_packet); +return ; + } + +if (test_and_clear_bit (BTMTK_TX_WAIT_VND_EVT , + &data->flags)) { +/* Barrier to sync with other CPUs */ +smp_mb__after_atomic (); +wake_up_bit (&data->flags, +BTMTK_TX_WAIT_VND_EVT ); + } +kfree (urb->setup_packet); +return ; + }else if (urb->status == -ENOENT ) { +/* Avoid suspend failed when usb_kill_urb */ +return ; + } + +usb_mark_last_busy (data->udev); + +/* The URB complete handler is still called with urb->actual_length = 0 +* when the event is not available, so we should keep re-submitting +* URB until WMT event returns, Also, It's necessary to wait some time +* between the two consecutive control URBs to relax the target device +* to generate the event. Otherwise, the WMT event cannot return from +* the device successfully. +*/ +udelay (500 ); + +usb_anchor_urb (urb, data->ctrl_anchor); + err =usb_submit_urb (urb,GFP_ATOMIC ); +if (err <0 ) { +kfree (urb->setup_packet); +/* -EPERM: urb is being killed; +* -ENODEV: device got disconnected +*/ +if (err != -EPERM && err != -ENODEV ) +bt_dev_err (hdev,"urb %p failed to resubmit (%d)" , + urb, -err); +usb_unanchor_urb (urb); + } +} + +static int btmtk_usb_submit_wmt_recv_urb (struct hci_dev *hdev) +{ +struct btmtk_data *data =hci_get_priv (hdev); +struct usb_ctrlrequest *dr; +unsigned char *buf; +int err, size =64 ; +unsigned int pipe; +struct urb *urb; + + urb =usb_alloc_urb (0 ,GFP_KERNEL ); +if (!urb) +return -ENOMEM ; + + dr =kmalloc (sizeof (*dr),GFP_KERNEL ); +if (!dr) { +usb_free_urb (urb); +return -ENOMEM ; + } + + dr->bRequestType =USB_TYPE_VENDOR |USB_DIR_IN ; + dr->bRequest =1 ; + dr->wIndex =cpu_to_le16 (0 ); + dr->wValue =cpu_to_le16 (48 ); + dr->wLength =cpu_to_le16 (size); + + buf =kmalloc (size,GFP_KERNEL ); +if (!buf) { +kfree (dr); +usb_free_urb (urb); +return -ENOMEM ; + } + + pipe =usb_rcvctrlpipe (data->udev,0 ); + +usb_fill_control_urb (urb, data->udev, pipe, (void *)dr, + buf, size, btmtk_usb_wmt_recv, hdev); + + urb->transfer_flags |=URB_FREE_BUFFER ; + +usb_anchor_urb (urb, data->ctrl_anchor); + err =usb_submit_urb (urb,GFP_KERNEL ); +if (err <0 ) { +if (err != -EPERM && err != -ENODEV ) +bt_dev_err (hdev,"urb %p submission failed (%d)" , + urb, -err); +usb_unanchor_urb (urb); + } + +usb_free_urb (urb); + +return err; +} + +int btmtk_usb_hci_wmt_sync (struct hci_dev *hdev, +struct btmtk_hci_wmt_params *wmt_params) +{ +struct btmtk_data *data =hci_get_priv (hdev); +struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc; +u32 hlen, status =BTMTK_WMT_INVALID ; +struct btmtk_hci_wmt_evt *wmt_evt; +struct btmtk_hci_wmt_cmd *wc; +struct btmtk_wmt_hdr *hdr; +int err; + +/* Send the WMT command and wait until the WMT event returns */ + hlen =sizeof (*hdr) + wmt_params->dlen; +if (hlen >255 ) +return -EINVAL ; + + wc =kzalloc (hlen,GFP_KERNEL ); +if (!wc) +return -ENOMEM ; + + hdr = &wc->hdr; + hdr->dir =1 ; + hdr->op = wmt_params->op; + hdr->dlen =cpu_to_le16 (wmt_params->dlen +1 ); + hdr->flag = wmt_params->flag; +memcpy (wc->data, wmt_params->data, wmt_params->dlen); + +set_bit (BTMTK_TX_WAIT_VND_EVT , &data->flags); + +/* WMT cmd/event doesn't follow up the generic HCI cmd/event handling, +* it needs constantly polling control pipe until the host received the +* WMT event, thus, we should require to specifically acquire PM counter +* on the USB to prevent the interface from entering auto suspended +* while WMT cmd/event in progress. +*/ + err =usb_autopm_get_interface (data->intf); +if (err <0 ) + goto err_free_wc; + + err =__hci_cmd_send (hdev,0xfc6f , hlen, wc); + +if (err <0 ) { +clear_bit (BTMTK_TX_WAIT_VND_EVT , &data->flags); +usb_autopm_put_interface (data->intf); + goto err_free_wc; + } + +/* Submit control IN URB on demand to process the WMT event */ + err =btmtk_usb_submit_wmt_recv_urb (hdev); + +usb_autopm_put_interface (data->intf); + +if (err <0 ) + goto err_free_wc; + +/* The vendor specific WMT commands are all answered by a vendor +* specific event and will have the Command Status or Command +* Complete as with usual HCI command flow control. +* +* After sending the command, wait for BTUSB_TX_WAIT_VND_EVT +* state to be cleared. The driver specific event receive routine +* will clear that state and with that indicate completion of the +* WMT command. +*/ + err =wait_on_bit_timeout (&data->flags,BTMTK_TX_WAIT_VND_EVT , +TASK_INTERRUPTIBLE ,HCI_INIT_TIMEOUT ); +if (err == -EINTR ) { +bt_dev_err (hdev,"Execution of wmt command interrupted" ); +clear_bit (BTMTK_TX_WAIT_VND_EVT , &data->flags); + goto err_free_wc; + } + +if (err) { +bt_dev_err (hdev,"Execution of wmt command timed out" ); +clear_bit (BTMTK_TX_WAIT_VND_EVT , &data->flags); + err = -ETIMEDOUT ; + goto err_free_wc; + } + +if (data->evt_skb ==NULL ) + goto err_free_wc; + +/* Parse and handle the return WMT event */ + wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data; +if (wmt_evt->whdr.op != hdr->op) { +bt_dev_err (hdev,"Wrong op received %d expected %d" , + wmt_evt->whdr.op, hdr->op); + err = -EIO ; + goto err_free_skb; + } + +switch (wmt_evt->whdr.op) { +case BTMTK_WMT_SEMAPHORE : +if (wmt_evt->whdr.flag ==2 ) + status =BTMTK_WMT_PATCH_UNDONE ; +else + status =BTMTK_WMT_PATCH_DONE ; +break ; +case BTMTK_WMT_FUNC_CTRL : + wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt; +if (be16_to_cpu (wmt_evt_funcc->status) ==0x404 ) + status =BTMTK_WMT_ON_DONE ; +else if (be16_to_cpu (wmt_evt_funcc->status) ==0x420 ) + status =BTMTK_WMT_ON_PROGRESS ; +else + status =BTMTK_WMT_ON_UNDONE ; +break ; +case BTMTK_WMT_PATCH_DWNLD : +if (wmt_evt->whdr.flag ==2 ) + status =BTMTK_WMT_PATCH_DONE ; +else if (wmt_evt->whdr.flag ==1 ) + status =BTMTK_WMT_PATCH_PROGRESS ; +else + status =BTMTK_WMT_PATCH_UNDONE ; +break ; + } + +if (wmt_params->status) + *wmt_params->status = status; + +err_free_skb: +kfree_skb (data->evt_skb); + data->evt_skb =NULL ; +err_free_wc: +kfree (wc); +return err; +} +EXPORT_SYMBOL_GPL (btmtk_usb_hci_wmt_sync); +MODULE_AUTHOR ("Sean Wang <[email protected]>" );MODULE_AUTHOR ("Mark Chen <[email protected]>" );MODULE_DESCRIPTION ("Bluetooth support for MediaTek devices ver " VERSION );
drivers/bluetooth/btmtk.h +31 -0
@@ -28,6 +28,18 @@#define MTK_COREDUMP_END_LEN (sizeof(MTK_COREDUMP_END))#define MTK_COREDUMP_NUM 255 +/* UHW CR mapping */ +#define MTK_BT_MISC 0x70002510 +#define MTK_BT_SUBSYS_RST 0x70002610 +#define MTK_UDMA_INT_STA_BT 0x74000024 +#define MTK_UDMA_INT_STA_BT1 0x74000308 +#define MTK_BT_WDT_STATUS 0x740003A0 +#define MTK_EP_RST_OPT 0x74011890 +#define MTK_EP_RST_IN_OUT_OPT 0x00010001 +#define MTK_BT_RST_DONE 0x00000100 +#define MTK_BT_RESET_REG_CONNV3 0x70028610 +#define MTK_BT_READ_DEV_ID 0x70010200 +enum {BTMTK_WMT_PATCH_DWNLD =0x1 ,BTMTK_WMT_TEST =0x2 ,
@@ -126,6 +138,10 @@ struct btmtk_hci_wmt_params {u32 *status; }; +enum { +BTMTK_TX_WAIT_VND_EVT , +}; +typedef int (*btmtk_reset_sync_func_t )(struct hci_dev *,void *);struct btmtk_coredump_info {
@@ -136,9 +152,15 @@ struct btmtk_coredump_info { };struct btmtk_data { +unsigned long flags;u32 dev_id;btmtk_reset_sync_func_t reset_sync;struct btmtk_coredump_info cd_info; + +struct usb_device *udev; +struct usb_interface *intf; +struct usb_anchor *ctrl_anchor; +struct sk_buff *evt_skb; }; typedef int (*wmt_cmd_sync_func_t)(struct hci_dev *,
@@ -163,6 +185,9 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb);void btmtk_fw_get_filename (char *buf,size_t size,u32 dev_id,u32 fw_ver,u32 fw_flavor); + +int btmtk_usb_hci_wmt_sync (struct hci_dev *hdev, +struct btmtk_hci_wmt_params *wmt_params);#else static inline int btmtk_set_bdaddr(struct hci_dev *hdev,
@@ -202,4 +227,10 @@ static void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver, u32 fw_flavor) { } + +static int btmtk_usb_hci_wmt_sync (struct hci_dev *hdev, +struct btmtk_hci_wmt_params *wmt_params) +{ +return -EOPNOTSUPP ; +}#endif
drivers/bluetooth/btmtksdio.c +1 -0
@@ -20,6 +20,7 @@#include <linux/of.h> #include <linux/pm_runtime.h> #include <linux/skbuff.h> +#include <linux/usb.h> #include <linux/mmc/host.h> #include <linux/mmc/sdio_ids.h>
drivers/bluetooth/btmtkuart.c +1 -0
@@ -22,6 +22,7 @@#include <linux/regulator/consumer.h> #include <linux/serdev.h> #include <linux/skbuff.h> +#include <linux/usb.h> #include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h>
drivers/bluetooth/btusb.c +7 -283
338 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 175/186 Bluetooth: btmtk: fix urb->setup_packet leak in error paths
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiajia Liu <[email protected]>
[ Upstream commit dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd ]
The setup_packet of control urb is not freed if usb_submit_urb fails or the submitted urb is killed. Add free in these two paths.
--- drivers/bluetooth/btmtk.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btmtk.c +2 -0
@@ -490,6 +490,7 @@ static void btmtk_usb_wmt_recv(struct urb *urb)return ; }else if (urb->status == -ENOENT ) {/* Avoid suspend failed when usb_kill_urb */ +kfree (urb->setup_packet);return ; }
@@ -563,6 +564,7 @@ static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)if (err != -EPERM && err != -ENODEV )bt_dev_err (hdev,"urb %p submission failed (%d)" , urb, -err); +kfree (dr);usb_unanchor_urb (urb); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 176/186 net: ag71xx: check error for platform_get_irq
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit e7c70bf97e90d974cd575e4c90f8f9b07d056da3 ]
Complete error handling for a failed platform_get_irq() call
--- drivers/net/ethernet/atheros/ag71xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/atheros/ag71xx.c +3 -0
@@ -1880,6 +1880,9 @@ static int ag71xx_probe(struct platform_device *pdev)return -ENOMEM ; ndev->irq =platform_get_irq (pdev,0 ); +if (ndev->irq <0 ) +return ndev->irq; + err =devm_request_irq (&pdev->dev, ndev->irq, ag71xx_interrupt,0x0 ,dev_name (&pdev->dev), ndev);if (err) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 177/186 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingwang Xiang <[email protected]>
[ Upstream commit ddf8029623a1af20e984c040e89ff918158397ab ]
sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls").
sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival:
tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready
-> saved_data_ready() = sk_psock_verdict_data_ready()
-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()
without calling tcp_eat_skb(), so copied_seq is not advanced.tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks thatfrag_list: use-after-free.
Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().
--- net/core/skmsg.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/skmsg.c +7 -2
@@ -1267,12 +1267,19 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb)static void sk_psock_verdict_data_ready (struct sock *sk) {const struct proto_ops *ops =NULL ; +struct sk_psock *psock;struct socket *sock;int copied;trace_sk_data_ready (sk);rcu_read_lock (); + psock =sk_psock (sk); +if (psock &&tls_sw_has_ctx_rx (sk)) { + psock->saved_data_ready (sk); +rcu_read_unlock (); +return ; + } sock =READ_ONCE (sk->sk_socket);if (likely (sock)) ops =READ_ONCE (sock->ops);
@@ -1282,8 +1289,6 @@ static void sk_psock_verdict_data_ready(struct sock *sk) copied = ops->read_skb (sk, sk_psock_verdict_recv);if (copied >=0 ) { -struct sk_psock *psock; -rcu_read_lock (); psock =sk_psock (sk);if (psock)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 178/186 string: add mem_is_zero() helper to check if memory area is all zeros
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 3942bb49728ad9e1f94d953a88af169a8f5d8099 ]
Almost two thirds of the memchr_inv() usages check if the memory area is all zeros, with no interest in where in the buffer the first non-zero byte is located. Checking for !memchr_inv(s, 0, n) is also not very intuitive or discoverable. Add an explicit mem_is_zero() helper for this use case.
Stable-dep-of: 3e6ccd790ed6 ("gpio: cdev: check if uAPI v2 config attributes are correctly zeroed")
--- include/linux/string.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)
include/linux/string.h +12 -0
@@ -212,6 +212,18 @@ static inline void memcpy_flushcache(void *dst, const void *src, size_t cnt)void *memchr_inv (const void *s,int c,size_t n);char *strreplace (char *str,char old,char new); +/** +* mem_is_zero - Check if an area of memory is all 0's. +* @s: The memory area +* @n: The size of the area +* +* Return: True if the area of memory is all 0's. +*/ +static inline bool mem_is_zero (const void *s,size_t n) +{ +return !memchr_inv (s,0 , n); +} +extern void kfree_const (const void *x);extern char *kstrdup (const char *s,gfp_t gfp) __malloc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 179/186 gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit e106b1dd38e723ec2bb2bf57ea9b2aff464b9423 ]
Use the mem_is_zero() helper where possible.
Stable-dep-of: 3e6ccd790ed6 ("gpio: cdev: check if uAPI v2 config attributes are correctly zeroed")
--- drivers/gpio/gpiolib-cdev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpio/gpiolib-cdev.c +4 -4
@@ -16,7 +16,6 @@#include <linux/hte.h> #include <linux/interrupt.h> #include <linux/irqreturn.h> -#include <linux/kernel.h> #include <linux/kfifo.h> #include <linux/module.h> #include <linux/mutex.h>
@@ -25,6 +24,7 @@#include <linux/rbtree.h> #include <linux/seq_file.h> #include <linux/spinlock.h> +#include <linux/string.h> #include <linux/timekeeping.h> #include <linux/uaccess.h> #include <linux/workqueue.h>
@@ -1381,7 +1381,7 @@ static int gpio_v2_line_config_validate(struct gpio_v2_line_config *lc,if (lc->num_attrs >GPIO_V2_LINE_NUM_ATTRS_MAX )return -EINVAL ; -if (memchr_inv (lc->padding,0 ,sizeof (lc->padding))) +if (!mem_is_zero (lc->padding,sizeof (lc->padding)))return -EINVAL ;for (i =0 ; i < num_lines; i++) {
@@ -1825,7 +1825,7 @@ static int linereq_create(struct gpio_device *gdev, void __user *ip)if ((ulr.num_lines ==0 ) || (ulr.num_lines >GPIO_V2_LINES_MAX ))return -EINVAL ; -if (memchr_inv (ulr.padding,0 ,sizeof (ulr.padding))) +if (!mem_is_zero (ulr.padding,sizeof (ulr.padding)))return -EINVAL ; lc = &ulr.config;
@@ -2619,7 +2619,7 @@ static int lineinfo_get(struct gpio_chardev_data *cdev, void __user *ip,if (copy_from_user (&lineinfo, ip,sizeof (lineinfo)))return -EFAULT ; -if (memchr_inv (lineinfo.padding,0 ,sizeof (lineinfo.padding))) +if (!mem_is_zero (lineinfo.padding,sizeof (lineinfo.padding)))return -EINVAL ; desc =gpiochip_get_desc (cdev->gdev->chip, lineinfo.offset);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 180/186 gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 3e6ccd790ed69bedd3d9626d01dd35cf9821c121 ]
We check the padding of other uAPI v2 structures but not that of line config attributes. For used attributes: check if their padding is zeroed, for unused: check if the entire structure is zeroed.
--- drivers/gpio/gpiolib-cdev.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/gpio/gpiolib-cdev.c +13 -0
@@ -1374,6 +1374,7 @@ static int gpio_v2_line_flags_validate(u64 flags)static int gpio_v2_line_config_validate (struct gpio_v2_line_config *lc,unsigned int num_lines) { +size_t unused_attrs;unsigned int i;u64 flags;int ret;
@@ -1381,9 +1382,21 @@ static int gpio_v2_line_config_validate(struct gpio_v2_line_config *lc,if (lc->num_attrs >GPIO_V2_LINE_NUM_ATTRS_MAX )return -EINVAL ; + unused_attrs =GPIO_V2_LINE_NUM_ATTRS_MAX - lc->num_attrs; +if (!mem_is_zero (lc->padding,sizeof (lc->padding)))return -EINVAL ; +for (i =0 ; i < lc->num_attrs; i++) { +if (lc->attrs[i].attr.padding !=0 ) +return -EINVAL ; + } + +if (unused_attrs) { +if (!mem_is_zero (&lc->attrs[lc->num_attrs], unused_attrs *sizeof (*lc->attrs))) +return -EINVAL ; + } +for (i =0 ; i < num_lines; i++) { flags =gpio_v2_line_config_flags (lc, i); ret =gpio_v2_line_flags_validate (flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 181/186 ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 18e7bd9f2446664053f8c34b72abd4606d22d858 ]
Use flush_work() instead of cancel_work_sync() to terminate pending IRQ work in cs35l56_sdw_remove(). And flush_work() again after masking the interrupts to flush any queueing that was racing with the masking. This is the same sequence as cs35l56_sdw_system_suspend().
cs35l56_sdw_interrupt() takes the pm_runtime to prevent the bus powering- down before the interrupt status can be read and handled. The work releases this pm_runtime. So cancelling it, instead of flushing, could leave an unbalanced pm_runtime.
--- sound/soc/codecs/cs35l56-sdw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/cs35l56-sdw.c +2 -1
@@ -524,10 +524,11 @@ static int cs35l56_sdw_remove(struct sdw_slave *peripheral)/* Disable SoundWire interrupts */ cs35l56->sdw_irq_no_unmask = true; -cancel_work_sync (&cs35l56->sdw_irq_work); +flush_work (&cs35l56->sdw_irq_work);sdw_write_no_pm (peripheral,CS35L56_SDW_GEN_INT_MASK_1 ,0 );sdw_read_no_pm (peripheral,CS35L56_SDW_GEN_INT_STAT_1 );sdw_write_no_pm (peripheral,CS35L56_SDW_GEN_INT_STAT_1 ,0xFF ); +flush_work (&cs35l56->sdw_irq_work);cs35l56_remove (cs35l56);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 182/186 net: mana: validate rx_req_idx to prevent out-of-bounds array access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <[email protected]>
[ Upstream commit b809d0409991b75a6cff846a5ac27c3062953f84 ]
In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds access into reqs[].
Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index the reqs[] array.
--- drivers/net/ethernet/microsoft/mana/hw_channel.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/microsoft/mana/hw_channel.c +6 -0
@@ -232,6 +232,12 @@ static void mana_hwc_rx_event_handler(void *ctx, u32 gdma_rxq_id, rq_base_addr = hwc_rxq->msg_buf->mem_info.dma_handle; rx_req_idx = (sge->address - rq_base_addr) / hwc->max_req_msg_size; +if (rx_req_idx >= hwc_rxq->msg_buf->num_reqs) { +dev_err (hwc->dev,"HWC RX: wrong rx_req_idx=%llu, num_reqs=%u\n" , + rx_req_idx, hwc_rxq->msg_buf->num_reqs); +return ; + } + rx_req = &hwc_rxq->msg_buf->reqs[rx_req_idx]; resp = (struct gdma_resp_hdr *)rx_req->buf_va;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 183/186 pds_core: add an error code check in pdsc_dl_info_get
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit a1e4c334cbc9a80578c3784f8a3e7076bb19578d ]
check the value of 'ret' after call 'devlink_info_version_stored_put'.
Stable-dep-of: 3d4432d34c19 ("pds_core: ensure null-termination for firmware version strings")
--- drivers/net/ethernet/amd/pds_core/devlink.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/amd/pds_core/devlink.c +2 -0
@@ -126,6 +126,8 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req,snprintf (buf,sizeof (buf),"fw.slot_%d" , i); err =devlink_info_version_stored_put (req, buf, fw_list.fw_names[i].fw_version); +if (err) +return err; } err = devlink_info_version_running_put(req,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 184/186 pds_core: ensure null-termination for firmware version strings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikhil P. Rao <[email protected]>
[ Upstream commit 3d4432d34c1992701289cbe12df9fd024f315998 ]
The driver passes fw_version directly to devlink_info_version_stored_put() without ensuring null-termination. While current firmware null-terminates these strings, the driver should not rely on this behavior. Add explicit null-termination to prevent potential issues if firmware behavior changes.
--- drivers/net/ethernet/amd/pds_core/devlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/pds_core/devlink.c +4 -2
@@ -120,12 +120,14 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req, listlen =min (fw_list.num_fw_slots,ARRAY_SIZE (fw_list.fw_names));for (i =0 ; i < listlen; i++) { +char *fw_ver = fw_list.fw_names[i].fw_version; +if (i <ARRAY_SIZE (fw_slotnames))strscpy (buf, fw_slotnames[i],sizeof (buf));else snprintf (buf,sizeof (buf),"fw.slot_%d" , i); - err =devlink_info_version_stored_put (req, buf, - fw_list.fw_names[i].fw_version); + fw_ver[sizeof (fw_list.fw_names[i].fw_version) -1 ] ='\0' ; + err =devlink_info_version_stored_put (req, buf, fw_ver);if (err)return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 185/186 net: gro: dont merge zcopy skbs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 4db79a322db8c97f7b73b8a347395ef4d685eb40 ]
skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag.
When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF.
When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
--- net/core/gro.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/gro.c +3 -0
@@ -110,6 +110,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)if (p->pp_recycle != skb->pp_recycle)return -ETOOMANYREFS ; +if (skb_zcopy (p) ||skb_zcopy (skb)) +return -ETOOMANYREFS ; +if (unlikely (p->len + len >=netif_get_gro_max_size (p->dev, p) ||NAPI_GRO_CB (skb)->flush))return -E2BIG ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 186/186 LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 1c856e158fd34ef2c4475a81c1dc386329989938 ]
KPROBE_HIT_SS and KPROBE_REENTER are two types of fatal recursions that can not be safely recovered in kprobes.
KPROBE_HIT_SS means that a kprobe is hit during single-stepping. At this point, the architecture-specific single-step context is already active. Nested single-stepping would corrupt the state, as the kprobe control block (kcb) and hardware registers cannot safely store multiple levels of stepping state.
KPROBE_REENTER means that a third-level recursion occurs when a probe is hit while the system is already handling a nested probe (second- level). The kcb only provides a single slot (prev_kprobe) to backup the state. When a third probe is hit, there is no more space to save the state without corrupting the first-level backup.
Kprobes work by replacing instructions with breakpoints. In order to execute the original instruction and continue, it must be moved to a temporary "single-step" slot. Since there is no backup space left to set up this slot safely, the CPU would be forced to return to the same original breakpoint address, triggering an endless loop.
Currently, the code only prints a warning and returns. This leads to an infinite re-entry loop as the CPU repeatedly hits the same trap and a "stuck" CPU core because preemption was disabled at the start of the handler and never re-enabled in this early return path.
Fix the logic by:
1. Merging KPROBE_HIT_SS and KPROBE_REENTER cases, as both represent fatal recursions that cannot be safely recovered.
2. Replacing WARN_ON_ONCE() with BUG() to terminate the system. This aligns LoongArch with other architectures (x86, arm64, riscv) and prevents stack overflow while providing diagnostic information.
--- arch/loongarch/kernel/kprobes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/loongarch/kernel/kprobes.c +2 -2
@@ -184,16 +184,16 @@ static bool reenter_kprobe(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb) {switch (kcb->kprobe_status) { -case KPROBE_HIT_SS :case KPROBE_HIT_SSDONE :case KPROBE_HIT_ACTIVE :kprobes_inc_nmissed_count (p);setup_singlestep (p, regs, kcb,1 );break ; +case KPROBE_HIT_SS :case KPROBE_REENTER :pr_warn ("Failed to recover from reentered kprobes.\n" );dump_kprobe (p); -WARN_ON_ONCE (1 ); +BUG ();break ;default :WARN_ON (1 );
Signature · 1 line
2.53.0
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 30 May 2026 19:48:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.142-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 8 lines · On Thu, 28 May 2026 21:48:00 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 30 May 2026 19:48:57 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64:
Thanks!
Cheers,
Miguel
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.6.142-rc1-ge3ea6021aaef #1 SMP PREEMPT_DYNAMIC Fri May 29 06:12:35 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.6.y
Best regards,
Pavel
Am 28.05.2026 um 21:48 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Build tested in our x86,arm64,loongarch,riscv config successfully without error.
BRs
Wentao Guan
Log:
Linux version 6.6.142-rc1-arm64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT Linux version 6.6.142-rc1-arm64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (aarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #2 SMP PREEMPT Fri May 29 23:37:09 CST 2026 Linux version 6.6.142-rc1-loong64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT Linux version 6.6.142-rc1-loong64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (loongarch64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #3 SMP PREEMPT Fri May 29 23:59:15 CST 2026 Linux version 6.6.142-rc1-riscv64-desktop-hwe+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP
Linux version 6.6.142-rc1-riscv64-desktop-hwe+ (guanwentao@uos-PC) (riscv64-linux-gnu-gcc-12 (Deepin 12.3.0-17deepin8) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #4 SMP Sat May 30 00:17:51 CST 2026 Linux version 6.6.142-rc1-amd64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) # SMP PREEMPT_DYNAMIC
Linux version 6.6.142-rc1-amd64-desktop-hwe-ge3ea6021aaef (guanwentao@uos-PC) (gcc (Deepin 12.3.0-17deepin15) 12.3.0, GNU ld (GNU Binutils for Deepin) 2.41) #1 SMP PREEMPT_DYNAMIC Fri May 29 23:12:32 CST 2026
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 30 May 2026 19:48:57 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.142-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.6.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.6.142 release. There are 186 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.