6.6.157-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 684/1424 usb: typec: ucsi: unregister debugfs entries on teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
[ Upstream commit eed73a65ab609b79d53de88cccc34b36dfe753c4 ]
ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them around until ucsi_destroy().
Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:
debugfs: 'pmic_glink.ucsi.0' already exists in 'ucsi'
Unregister debugfs entries as part of ucsi_unregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.
--- drivers/usb/typec/ucsi/debugfs.c | 1 + drivers/usb/typec/ucsi/ucsi.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/usb/typec/ucsi/debugfs.c +1 -0
@@ -89,6 +89,7 @@ void ucsi_debugfs_unregister(struct ucsi *ucsi)debugfs_remove_recursive (ucsi->debugfs->dentry);kfree (ucsi->debugfs); + ucsi->debugfs =NULL ; }void ucsi_debugfs_init (void )
drivers/usb/typec/ucsi/ucsi.c +2 -0
@@ -1760,6 +1760,8 @@ void ucsi_unregister(struct ucsi *ucsi)cancel_delayed_work_sync (&ucsi->work);cancel_work_sync (&ucsi->resume_work); +ucsi_debugfs_unregister (ucsi); +/* Disable notifications */ ucsi->ops->async_write (ucsi,UCSI_CONTROL , &cmd,sizeof (cmd));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 685/1424 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <[email protected]>
[ Upstream commit 41d541e3718db01668a4cd29815ee4b3b55f76d2 ]
If usb_add_gadget_udc() fails, r8a66597_probe() jumps to err_add_udc and frees ep0_req, then falls through to clean_up2 where ep0_req is freed again when it is non-NULL.
Remove the redundant free from err_add_udc and keep the cleanup in clean_up2 so the request is released exactly once.
Issue found using a prototype static analysis tool and confirmed by code review.
--- drivers/usb/gadget/udc/r8a66597-udc.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/gadget/udc/r8a66597-udc.c +0 -1
@@ -1951,7 +1951,6 @@ static int r8a66597_probe(struct platform_device *pdev)return 0 ; err_add_udc: -r8a66597_free_request (&r8a66597->ep[0 ].ep, r8a66597->ep0_req); clean_up2:if (r8a66597->pdata->on_chip)clk_disable_unprepare (r8a66597->clk);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 686/1424 udf: Mark LVID buffer as uptodate before marking it dirty
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
[ Upstream commit fb0601134c7e51728bd098abc6909315de1e5d86 ]
When an I/O error occurs while writing the Logical Volume Integrity Descriptor (LVID) buffer to the block device, the block layer's completion handler (end_buffer_write_sync()) clears the BH_Uptodate flag on the buffer. However, the buffer still contains valid LVID data in memory. If the filesystem is subsequently remounted read-write or synced, udf_open_lvid() or udf_sync_fs() will modify the LVID buffer and call mark_buffer_dirty(). This triggers a spurious WARN_ON_ONCE(!buffer_uptodate(bh)) warning in mark_buffer_dirty() because the buffer is not marked uptodate, even though its in-memory contents are valid and are about to be overwritten.
To prevent this spurious warning, unconditionally set the BH_Uptodate flag before calling mark_buffer_dirty() in udf_open_lvid() and udf_sync_fs(). This acknowledges that the in-memory buffer is valid and matches the workaround previously applied to udf_close_lvid() in commit 853a0c25baf9 ("udf: Mark LVID buffer as uptodate before marking it dirty"). Extending this workaround ensures consistent behavior across all LVID updates.
Buffer I/O error on dev loop0, logical block 128, lost sync page write
------------[ cut here ]------------ !buffer_uptodate(bh) WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087 ... Call Trace: <TASK> udf_open_lvid+0x369/0x5b0 fs/udf/super.c:2078 udf_reconfigure+0x336/0x540 fs/udf/super.c:679 reconfigure_super+0x232/0x8f0 fs/super.c:1080 vfs_cmd_reconfigure fs/fsopen.c:268 [inline] vfs_fsconfig_locked+0x171/0x320 fs/fsopen.c:297 __do_sys_fsconfig fs/fsopen.c:463 [inline] __se_sys_fsconfig+0x6b9/0x810 fs/fsopen.c:350 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 </TASK>
--- fs/udf/super.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
fs/udf/super.c +14 -9
@@ -2011,6 +2011,17 @@ static int udf_load_vrs(struct super_block *sb, struct udf_options *uopt,return 0 ; } +static void udf_mark_buffer_dirty (struct buffer_head *bh) +{ +/* +* We set buffer uptodate unconditionally here to avoid spurious +* warnings from mark_buffer_dirty() when previous EIO has marked +* the buffer as !uptodate +*/ +set_buffer_uptodate (bh); +mark_buffer_dirty (bh); +} +static void udf_finalize_lvid (struct logicalVolIntegrityDesc *lvid) {struct timespec64 ts;
@@ -2046,7 +2057,7 @@ static void udf_open_lvid(struct super_block *sb)UDF_SET_FLAG (sb,UDF_FLAG_INCONSISTENT );udf_finalize_lvid (lvid); -mark_buffer_dirty (bh); +udf_mark_buffer_dirty (bh); sbi->s_lvid_dirty =0 ;mutex_unlock (&sbi->s_alloc_mutex);/* Make opening of filesystem visible on the media immediately */
@@ -2079,14 +2090,8 @@ static void udf_close_lvid(struct super_block *sb)if (!UDF_QUERY_FLAG (sb,UDF_FLAG_INCONSISTENT )) lvid->integrityType =cpu_to_le32 (LVID_INTEGRITY_TYPE_CLOSE ); -/* -* We set buffer uptodate unconditionally here to avoid spurious -* warnings from mark_buffer_dirty() when previous EIO has marked -* the buffer as !uptodate -*/ -set_buffer_uptodate (bh);udf_finalize_lvid (lvid); -mark_buffer_dirty (bh); +udf_mark_buffer_dirty (bh); sbi->s_lvid_dirty =0 ;mutex_unlock (&sbi->s_alloc_mutex);/* Make closing of filesystem visible on the media immediately */
@@ -2379,7 +2384,7 @@ static int udf_sync_fs(struct super_block *sb, int wait)* Blockdevice will be synced later so we don't have to submit * the buffer for IO */ -mark_buffer_dirty (bh); +udf_mark_buffer_dirty (bh); sbi->s_lvid_dirty =0 ; }mutex_unlock (&sbi->s_alloc_mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 687/1424 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 92863e678070f57c17c868e4bfa2441a5c61ad2b ]
bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the bpf_verifier_lock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btf_parse_vmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutex_unlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire().
Acquire semantics are needed rather than a dependency-ordered READ_ONCE(): btf_parse_vmlinux() also populates globals outside the returned object (e.g. bpf_ctx_convert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.
--- kernel/bpf/verifier.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +16 -4
@@ -20511,13 +20511,25 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)struct btf *bpf_get_btf_vmlinux (void ) { -if (!btf_vmlinux &&IS_ENABLED (CONFIG_DEBUG_INFO_BTF )) { +/* Pairs with the smp_store_release() on the parse path below. */ +struct btf *btf =smp_load_acquire (&btf_vmlinux); + +if (!btf &&IS_ENABLED (CONFIG_DEBUG_INFO_BTF )) {mutex_lock (&bpf_verifier_lock); -if (!btf_vmlinux) - btf_vmlinux =btf_parse_vmlinux (); + btf = btf_vmlinux; +if (!btf) { + btf =btf_parse_vmlinux (); +/* +* Order the parsed BTF contents and the globals the +* parse populated (e.g. bpf_ctx_convert.t) before +* the pointer publication. Pairs with the acquire +* on the lockless fast path above. +*/ +smp_store_release (&btf_vmlinux, btf); + }mutex_unlock (&bpf_verifier_lock); } -return btf_vmlinux; +return btf; }int bpf_check (struct bpf_prog **prog,union bpf_attr *attr,bpfptr_t uattr,__u32 uattr_size)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 688/1424 efi: fix stale reference to efi_recover_from_page_fault()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 718ee46ba4d95d28d50d3f6437afbbe2be531175 ]
efi_recover_from_page_fault() was renamed to efi_crash_gracefully_on_page_fault(), but the comment above enum efi_rts_ids was not updated. Use the current name.
--- include/linux/efi.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/efi.h +2 -2
@@ -1236,8 +1236,8 @@ efi_call_acpi_prm_handler(efi_status_t (__efiapi *handler_addr)(u64, void *),/* * efi_runtime_service() function identifiers. -* "NONE" is used by efi_recover_from_page_fault() to check if the page -* fault happened while executing an efi runtime service. +* "NONE" is used by efi_crash_gracefully_on_page_fault() to check if the +* page fault happened while executing an efi runtime service. */ enum efi_rts_ids {EFI_NONE ,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 689/1424 bpf: Fix use-after-free on mm_struct in bpf_find_vma()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanghyun Park <[email protected]>
[ Upstream commit 47b079e2117a2ee52e21f8b72935900c702fc0b5 ]
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without holding a reference on the mm. On a foreign task, a concurrent exit_mm() can free the mm_struct between the lockless read and the trylock, resulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.
For the current task, task->mm is stable. For a foreign task, pin the mm under task->alloc_lock and release it with mmput_async(), mirroring commit d8e27d2d22b6 ("bpf: fix mm lifecycle in open-coded task_vma iterator"). Use spin_trylock() instead of get_task_mm() so BPF context does not block on alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the foreign-task path because dropping the mm reference is not safe there.
Race:
CPU0 (BPF program) CPU1 (exiting task)
============================ ==========================
bpf_find_vma(foreign_task):
mm = task->mm
exit_mm():
task->mm = NULL
mmput(mm) -> frees mm_struct
mmap_read_trylock(mm)
// UAF on mm--- kernel/bpf/task_iter.c | 36 +++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-)
kernel/bpf/task_iter.c +33 -3
@@ -783,6 +783,7 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,struct mmap_unlock_irq_work *work =NULL ;struct vm_area_struct *vma;bool irq_work_busy = false; +bool __maybe_unused mmput_needed = false;struct mm_struct *mm;int ret = -ENOENT ;
@@ -792,14 +793,38 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,if (!task)return -ENOENT ; - mm = task->mm; +if (task == current) { + mm = task->mm; + }else { +/* +* Foreign task: pin task->mm against a concurrent exit_mm(). +* Use trylock on alloc_lock instead of get_task_mm()'s +* blocking task_lock() to avoid deadlocking the target task. +*/ +if (!IS_ENABLED (CONFIG_MMU )) +return -EOPNOTSUPP ; +if (irqs_disabled ()) +return -EBUSY ; +if (!spin_trylock (&task->alloc_lock)) +return -EBUSY ; + mm = task->mm; +if (mm && !(task->flags &PF_KTHREAD )) { +mmget (mm); + mmput_needed = true; + }else { + mm =NULL ; + } +spin_unlock (&task->alloc_lock); + }if (!mm)return -ENOENT ; irq_work_busy =bpf_mmap_unlock_get_irq_work (&work); -if (irq_work_busy || !mmap_read_trylock (mm)) -return -EBUSY ; +if (irq_work_busy || !mmap_read_trylock (mm)) { + ret = -EBUSY ; + goto out; + } vma =find_vma (mm, start);
@@ -809,6 +834,11 @@ BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start, ret =0 ; }bpf_mmap_unlock_mm (work, mm); +out: +#ifdef CONFIG_MMU +if (mmput_needed) +mmput_async (mm); +#endif return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 690/1424 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 6f12862600bb70e599a614d706a095ea5f8f9858 ]
mhi_ep_create_device() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhi_ep_destroy_device() before the device itself is removed.
If dev_set_name() or device_add() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered.
Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from device_initialize().
--- drivers/bus/mhi/ep/main.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/bus/mhi/ep/main.c +10 -5
@@ -1323,14 +1323,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id) ret =dev_set_name (&mhi_dev->dev,"%s_%s" ,dev_name (&mhi_cntrl->mhi_dev->dev), mhi_dev->name); -if (ret) { -put_device (&mhi_dev->dev); -return ret; - } +if (ret) + goto err_put_channels; ret =device_add (&mhi_dev->dev);if (ret) -put_device (&mhi_dev->dev); + goto err_put_channels; + +return 0 ; + +err_put_channels: +put_device (&mhi_dev->dev);/* DL channel reference */ +put_device (&mhi_dev->dev);/* UL channel reference */ +put_device (&mhi_dev->dev);/* device_initialize() reference */ return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 691/1424 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akari Tsuyukusa <[email protected]>
[ Upstream commit aebaa93f3da1572877579c2e15ebf27be2dcc7fb ]
The mt2701_m4u_in_larb[] array contains 4 (for LARB0 to LARB3) elements, meaning mt2701_m4u_to_larb() can legitimately return 3. The current check if (larbid >= MT2701_LARB_NR_MAX) incorrectly rejects valid LARB3 with -EINVAL.
Fix this off-by-one error by updating MT2701_LARB_NR_MAX to 4.
Note that this does not cause immediate issues with the current mt2701.dtsi and mt7623n.dtsi because it only defines 3 LARBs:
mediatek,larbs = <&larb0 &larb1 &larb2>;
Thus, larbid never reaches 3 in the existing upstream device tree.
--- drivers/iommu/mtk_iommu_v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/mtk_iommu_v1.c +1 -1
@@ -78,7 +78,7 @@/* MTK generation one iommu HW only support 4K size mapping */ #define MT2701_IOMMU_PAGE_SHIFT 12#define MT2701_IOMMU_PAGE_SIZE (1UL << MT2701_IOMMU_PAGE_SHIFT) -#define MT2701_LARB_NR_MAX 3 +#define MT2701_LARB_NR_MAX 4/* * MTK m4u support 4GB iova address space, and only support 4K page
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 692/1424 iommu/msm: Return -ENOMEM on memory allocation failure in probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit b0d50c9016c4c2959dfa61bf9549cf98f9aa19cd ]
If dynamic memory allocation in driver's probe function execution fails, it should be reported to the driver's framework with -ENOMEM error code.
--- drivers/iommu/msm_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/msm_iommu.c +1 -1
@@ -707,7 +707,7 @@ static int msm_iommu_probe(struct platform_device *pdev) iommu =devm_kzalloc (&pdev->dev,sizeof (*iommu),GFP_KERNEL );if (!iommu) -return -ENODEV ; +return -ENOMEM ; iommu->dev = &pdev->dev;INIT_LIST_HEAD (&iommu->ctx_list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 693/1424 iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <[email protected]>
[ Upstream commit 854056480f9217568e3ab5edd81a9347a173ea79 ]
The check_ioapic_information() function validates IOAPICs against the IVRS table to safely disable Interrupt Remapping (IR) if the BIOS provides a broken topology.
Currently, the validation loop contains a bug: If an unmapped secondary IOAPIC is encountered, 'ret' is set to false. But if the Southbridge (SB) IOAPIC is enumerated after it in the MADT, the loop overwrites 'ret' to true.
This bypasses the validation failure and leaves IR enabled. When devices attached to the unmapped secondary IOAPIC fire interrupts, the IOMMU drops them due to the missing Requestor ID, leading to localized device hangs.
Fix this by initializing 'ret' to true and only toggling it to false upon encountering a validation error, ensuring failures are never erased.
--- drivers/iommu/amd/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/amd/init.c +2 -2
@@ -3029,7 +3029,7 @@ static bool __init check_ioapic_information(void)int idx; has_sb_ioapic = false; - ret = false; + ret = true;/* * If we have map overrides on the kernel command line the
@@ -3049,7 +3049,6 @@ static bool __init check_ioapic_information(void) ret = false; }else if (devid ==IOAPIC_SB_DEVID ) { has_sb_ioapic = true; - ret = true; } }
@@ -3063,6 +3062,7 @@ static bool __init check_ioapic_information(void)* device id for the IOAPIC in the system. */ pr_err ("%s: No southbridge IOAPIC found\n" , fw_bug); + ret = false; }if (!ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 694/1424 iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fu Hao <[email protected]>
[ Upstream commit 5beda8cadb1f072140e58b1edb7604444a42d955 ]
The SB IOAPIC is on the device 0xb from Hygon family 18h model 4h.
Stable-dep-of: 04fee302fac7 ("iommu/amd: Fix false positive in SB IOAPIC IVRS validation")
--- drivers/iommu/amd/init.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/iommu/amd/init.c +9 -1
@@ -3022,6 +3022,9 @@ static void __init free_iommu_resources(void)/* SB IOAPIC is always on this device in AMD systems */ #define IOAPIC_SB_DEVID ((0x00 << 8) | PCI_DEVFN(0x14, 0)) +/* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */ +#define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0)) +static bool __init check_ioapic_information (void ) {const char *fw_bug =FW_BUG ;
@@ -3047,7 +3050,12 @@ static bool __init check_ioapic_information(void)pr_err ("%s: IOAPIC[%d] not in IVRS table\n" , fw_bug, id); ret = false; - }else if (devid ==IOAPIC_SB_DEVID ) { + }else if (devid ==IOAPIC_SB_DEVID || + (boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON && + boot_cpu_data.x86 ==0x18 && + boot_cpu_data.x86_model >=0x4 && + boot_cpu_data.x86_model <=0xf && + devid ==IOAPIC_SB_DEVID_FAM18H_M4H )) { has_sb_ioapic = true; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 695/1424 iommu/amd: Fix false positive in SB IOAPIC IVRS validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <[email protected]>
[ Upstream commit 04fee302fac762a242ff1ad6810cff90c2a350ba ]
The check_ioapic_information() function is designed to prevent boot hangs by ensuring the Southbridge (SB) IOAPIC is properly mapped in the IVRS table before enabling Interrupt Remapping.
Currently, this check passes if *any* enumerated IOAPIC matches the expected SB IOAPIC device ID. If a buggy BIOS incorrectly assigns the SB IOAPIC's device ID to a secondary IOAPIC in the IVRS, while scrambling the true SB IOAPIC's mapping, the check hits a false positive and succeeds.
This erroneously enables Interrupt Remapping. Consequently, the IOMMU blocks unmapped interrupts from the actual SB IOAPIC, dropping the system timer and leading to a silent kernel boot hang.
Tighten the validation to verify the device ID specifically against the SB IOAPIC by matching their APIC IDs first. This prevents the validation check from being bypassed via device ID aliasing.
--- drivers/iommu/amd/init.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-)
drivers/iommu/amd/init.c +28 -4
@@ -3025,11 +3025,25 @@ static void __init free_iommu_resources(void)/* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */ #define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0)) +/* +* The Southbridge IOAPIC is assigned a GSI Base of 0 (handling interrupts +* 0 through 23). +*/ +static int __init get_sb_ioapic_id (void ) +{ +int idx =mp_find_ioapic (0 ); + +if (idx <0 ) +return -ENODEV ; + +return mpc_ioapic_id (idx); +} +static bool __init check_ioapic_information (void ) {const char *fw_bug =FW_BUG ;bool ret, has_sb_ioapic; -int idx; +int idx, sb_apicid; has_sb_ioapic = false; ret = true;
@@ -3042,6 +3056,16 @@ static bool __init check_ioapic_information(void)if (cmdline_maps) fw_bug ="" ; + sb_apicid =get_sb_ioapic_id (); +if (sb_apicid <0 ) { +/* +* Lack of SB IOAPIC registration is not a firmware bug, +* e.g. kernel booted with noapic or noacpi. +*/ + fw_bug ="" ; + goto out; + } +for (idx =0 ; idx < nr_ioapics; idx++) {int devid, id =mpc_ioapic_id (idx);
@@ -3050,16 +3074,16 @@ static bool __init check_ioapic_information(void)pr_err ("%s: IOAPIC[%d] not in IVRS table\n" , fw_bug, id); ret = false; - }else if (devid ==IOAPIC_SB_DEVID || + }else if (id == sb_apicid && (devid ==IOAPIC_SB_DEVID || (boot_cpu_data.x86_vendor ==X86_VENDOR_HYGON && boot_cpu_data.x86 ==0x18 && boot_cpu_data.x86_model >=0x4 && boot_cpu_data.x86_model <=0xf && - devid ==IOAPIC_SB_DEVID_FAM18H_M4H )) { + devid ==IOAPIC_SB_DEVID_FAM18H_M4H ))) { has_sb_ioapic = true; } } - +out:if (!has_sb_ioapic) {/* * We expect the SB IOAPIC to be listed in the IVRS
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 696/1424 leds: pca9532: Fix inverted GPIO output polarity
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmo Chou <[email protected]>
[ Upstream commit 65a38a28a0b04af19a5e1fbf3869051412eeac96 ]
The pca9532_gpio_set_value() function incorrectly mapped the requested value to PCA9532_ON and PCA9532_OFF, inverting the GPIO output polarity. A requested logical high (val=1) incorrectly enabled the LED output driver, which on this open-drain device pulls the pin low, while a requested logical low (val=0) released the pin.
Correct the mapping so that val=1 yields PCA9532_OFF (pin released / high-impedance) and val=0 yields PCA9532_ON (pin driven low).
pca9532_gpio_direction_input() is also updated to pass val=1 to pca9532_gpio_set_value() to align with the corrected polarity mapping, ensuring the pin remains not driven when configured as an input.
--- drivers/leds/leds-pca9532.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/leds/leds-pca9532.c +3 -3
@@ -283,9 +283,9 @@ static void pca9532_gpio_set_value(struct gpio_chip *gc, unsigned offset, int vastruct pca9532_led *led = &data->leds[offset];if (val) - led->state =PCA9532_ON ; -else led->state =PCA9532_OFF ; +else + led->state =PCA9532_ON ;pca9532_setled (led); }
@@ -303,7 +303,7 @@ static int pca9532_gpio_get_value(struct gpio_chip *gc, unsigned offset)static int pca9532_gpio_direction_input (struct gpio_chip *gc,unsigned offset) {/* To use as input ensure pin is not driven */ -pca9532_gpio_set_value (gc, offset,0 ); +pca9532_gpio_set_value (gc, offset,1 );return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 697/1424 platform/x86: dell-privacy: Fix race condition
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit ca9338dbc64759b30741b12017c050b33c94dfa2 ]
Accessing priv->features_present needs to happen with the list mutex being held, otherwise priv can be freed at any moment.
--- drivers/platform/x86/dell/dell-wmi-privacy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/dell-wmi-privacy.c +2 -2
@@ -69,11 +69,11 @@ bool dell_privacy_has_mic_mute(void) {struct privacy_wmi_data *priv; -mutex_lock (&list_mutex); +guard (mutex)(&list_mutex); + priv =list_first_entry_or_null (&wmi_list, struct privacy_wmi_data, list); -mutex_unlock (&list_mutex);return priv && (priv->features_present &BIT (DELL_PRIVACY_TYPE_AUDIO )); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 698/1424 platform/x86: dell-wmi-base: Fix resource leak on module load failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 072841e02cf9c00a7e8a9c567a14239e02ca47ad ]
We need to properly clean up the SMBIOS request and the privacy driver when the module load fails.
--- drivers/platform/x86/dell/dell-wmi-base.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/platform/x86/dell/dell-wmi-base.c +15 -2
@@ -839,9 +839,22 @@ static int __init dell_wmi_init(void) err =dell_privacy_register_driver ();if (err) -return err; + goto out_smbios; -return wmi_driver_register (&dell_wmi_driver); + err =wmi_driver_register (&dell_wmi_driver); +if (err) + goto out_privacy; + +return 0 ; + +out_privacy: +dell_privacy_unregister_driver (); + +out_smbios: +if (wmi_requires_smbios_request) +dell_wmi_events_set_enabled (false); + +return err; }late_initcall (dell_wmi_init);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 699/1424 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 8c952807c2cebd5e9e9b37146c9383229794c129 ]
When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In adsp_map_carveout, it does not release the reference.
--- drivers/remoteproc/qcom_q6v5_adsp.c | 1 + 1 file changed, 1 insertion(+)
drivers/remoteproc/qcom_q6v5_adsp.c +1 -0
@@ -362,6 +362,7 @@ static int adsp_map_carveout(struct rproc *rproc)return ret; sid = args.args[0 ] &SID_MASK_DEFAULT ; +of_node_put (args.np);/* Add SID configuration for ADSP Firmware to SMMU */ iova = adsp->mem_phys | (sid <<32 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 700/1424 hwspinlock: propagate errno when registering single lock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit e088ffa9a00eaaaf90da74763e774ca160969c26 ]
hwspin_lock_register_single() always returns 0 despite checking the result from radix_tree_insert(). Propagate the errno to make sanity checks in callers of this function actually meaningful.
--- drivers/hwspinlock/hwspinlock_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwspinlock/hwspinlock_core.c +1 -1
@@ -468,7 +468,7 @@ static int hwspin_lock_register_single(struct hwspinlock *hwlock, int id) out:mutex_unlock (&hwspinlock_tree_lock); -return 0 ; +return ret; }static struct hwspinlock *hwspin_lock_unregister_single (unsigned int id)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 701/1424 serial: ma35d1: Fix OF node reference leaks in console init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 8dfea56f350b3dc826f35711802ad6ae8fae0748 ]
ma35d1serial_console_init_port() stores matching UART device nodes in ma35d1serial_uart_nodes[] with an extra of_node_get() so that console setup can later read the "reg" property. However, the stored references are never released after console setup has finished using them.
Drop the stored node reference after ma35d1serial_console_setup() reads the "reg" property, and clear the array slot to avoid leaving a stale pointer behind. Also release the iterator reference before breaking out of for_each_matching_node(), since the normal iterator advance will not run in that path.
--- drivers/tty/serial/ma35d1_serial.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/tty/serial/ma35d1_serial.c +10 -2
@@ -608,8 +608,14 @@ static int __init ma35d1serial_console_setup(struct console *co, char *options)if (!np || !p)return -ENODEV ; -if (of_property_read_u32_array (np,"reg" , val32,ARRAY_SIZE (val32)) !=0 ) +if (of_property_read_u32_array (np,"reg" , val32,ARRAY_SIZE (val32)) !=0 ) { +of_node_put (np); + ma35d1serial_uart_nodes[co->index] =NULL ;return -EINVAL ; + } + +of_node_put (np); + ma35d1serial_uart_nodes[co->index] =NULL ; p->port.iobase = val32[1 ]; p->port.membase =ioremap (p->port.iobase,MA35_UART_REG_SIZE );
@@ -648,8 +654,10 @@ static void ma35d1serial_console_init_port(void)of_node_get (np); ma35d1serial_uart_nodes[i] = np; i++; -if (i ==MA35_UART_NR ) +if (i ==MA35_UART_NR ) { +of_node_put (np);break ; + } } } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 702/1424 usb: gadget: configfs: fix out-of-bounds read of qw_sign
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <[email protected]>
[ Upstream commit f63edb54d8f738f9c21e2068c777ae1c097df6b7 ]
os_desc_qw_sign_show() passes OS_STRING_QW_SIGN_LEN as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while OS_STRING_QW_SIGN_LEN (14) is the byte size of qw_sign[]. The array holds only OS_STRING_QW_SIGN_LEN / 2 (7) code units, so the conversion reads up to 7 units (14 bytes) past the end of qw_sign[] into the following members of struct gadget_info when the stored signature fills the array without a NUL terminator, exposing those bytes through the configfs attribute.
The store path halves the count for its input bound but passes the full byte count as the utf8s_to_utf16s() output limit; use the destination code-unit count in both directions.
--- drivers/usb/gadget/configfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/configfs.c +2 -2
@@ -1174,7 +1174,7 @@ static ssize_t os_desc_qw_sign_show(struct config_item *item, char *page)struct gadget_info *gi =os_desc_item_to_gadget_info (item);int res; - res =utf16s_to_utf8s ((wchar_t *) gi->qw_sign,OS_STRING_QW_SIGN_LEN , + res =utf16s_to_utf8s ((wchar_t *) gi->qw_sign,OS_STRING_QW_SIGN_LEN /2 ,UTF16_LITTLE_ENDIAN , page,PAGE_SIZE -1 ); page[res++] ='\n' ;
@@ -1196,7 +1196,7 @@ static ssize_t os_desc_qw_sign_store(struct config_item *item, const char *page,mutex_lock (&gi->lock); res =utf8s_to_utf16s (page, l,UTF16_LITTLE_ENDIAN , (wchar_t *) gi->qw_sign, -OS_STRING_QW_SIGN_LEN ); +OS_STRING_QW_SIGN_LEN /2 );if (res >0 ) res = len;mutex_unlock (&gi->lock);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 703/1424 usb: gadget: aspeed_udc: Convert to platform remove callback returning void
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 3d56e5aa6727f5055d1ad879342ad1a8acec2134 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.
To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().
ast_udc_remove() is one of these functions that return an error code after doing only a partial cleanup. Replace the core's error message by a more drastic one and still convert the driver to .remove_new(). Note the only semantic change here is the changed error message.
Stable-dep-of: 97cee53a94be ("usb: gadget: aspeed_udc: check endpoint DMA allocation")
--- drivers/usb/gadget/udc/aspeed_udc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/usb/gadget/udc/aspeed_udc.c +13 -6
@@ -1434,15 +1434,24 @@ static void ast_udc_init_hw(struct ast_udc_dev *udc)ast_udc_write (udc,0 ,AST_UDC_EP0_CTRL ); } -static int ast_udc_remove (struct platform_device *pdev) +static void ast_udc_remove (struct platform_device *pdev) {struct ast_udc_dev *udc =platform_get_drvdata (pdev);unsigned long flags;u32 ctrl;usb_del_gadget_udc (&udc->gadget); -if (udc->driver) -return -EBUSY ; +if (udc->driver) { +/* +* This is broken as only some cleanup is skipped, *udev is +* freed and the register mapping goes away. Any further usage +* probably crashes. Also the device is unbound, so the skipped +* cleanup is never catched up later. +*/ +dev_alert (&pdev->dev, +"Driver is busy and still going away. Fasten your seat belts!\n" ); +return ; + }spin_lock_irqsave (&udc->lock, flags);
@@ -1461,8 +1470,6 @@ static int ast_udc_remove(struct platform_device *pdev) udc->ep0_buf_dma); udc->ep0_buf =NULL ; - -return 0 ; }static int ast_udc_probe (struct platform_device *pdev)
@@ -1583,7 +1590,7 @@ MODULE_DEVICE_TABLE(of, ast_udc_of_dt_ids);static struct platform_driver ast_udc_driver = { .probe = ast_udc_probe, - .remove = ast_udc_remove, + .remove_new = ast_udc_remove, .driver = { .name =KBUILD_MODNAME , .of_match_table = ast_udc_of_dt_ids,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 704/1424 usb: gadget: aspeed_udc: check endpoint DMA allocation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 97cee53a94be3bd4fd8fbed6071bd2f32dad1ab1 ]
ast_udc_probe() allocates a coherent DMA buffer used as the backing store for endpoint buffers. ast_udc_init_ep() derives per-endpoint buffer pointers from udc->ep0_buf, so a failed allocation is dereferenced during probe.
Check the allocation before endpoint setup. The existing probe error path called ast_udc_remove(), which unregisters the gadget unconditionally and is not safe before usb_add_gadget_udc() succeeds. Add a local cleanup helper for probe failures so pre-registration failures only unwind the resources that were actually initialized.
This was found by a local static analysis checker for unchecked allocator returns while scanning Linux 6.16. The change was checked by applying it to current mainline and by running checkpatch. I do not have access to Aspeed UDC hardware, so no runtime testing was performed.
--- drivers/usb/gadget/udc/aspeed_udc.c | 50 ++++++++++++++++++----------- 1 file changed, 32 insertions(+), 18 deletions(-)
drivers/usb/gadget/udc/aspeed_udc.c +32 -18
@@ -1434,25 +1434,12 @@ static void ast_udc_init_hw(struct ast_udc_dev *udc)ast_udc_write (udc,0 ,AST_UDC_EP0_CTRL ); } -static void ast_udc_remove (struct platform_device *pdev) +static void ast_udc_cleanup (struct platform_device *pdev) {struct ast_udc_dev *udc =platform_get_drvdata (pdev);unsigned long flags;u32 ctrl; -usb_del_gadget_udc (&udc->gadget); -if (udc->driver) { -/* -* This is broken as only some cleanup is skipped, *udev is -* freed and the register mapping goes away. Any further usage -* probably crashes. Also the device is unbound, so the skipped -* cleanup is never catched up later. -*/ -dev_alert (&pdev->dev, -"Driver is busy and still going away. Fasten your seat belts!\n" ); -return ; - } -spin_lock_irqsave (&udc->lock, flags);/* Disable upstream port connection */
@@ -1472,6 +1459,26 @@ static void ast_udc_remove(struct platform_device *pdev) udc->ep0_buf =NULL ; } +static void ast_udc_remove (struct platform_device *pdev) +{ +struct ast_udc_dev *udc =platform_get_drvdata (pdev); + +usb_del_gadget_udc (&udc->gadget); +if (udc->driver) { +/* +* This is broken as only some cleanup is skipped, *udev is +* freed and the register mapping goes away. Any further usage +* probably crashes. Also the device is unbound, so the skipped +* cleanup is never catched up later. +*/ +dev_alert (&pdev->dev, +"Driver is busy and still going away. Fasten your seat belts!\n" ); +return ; + } + +ast_udc_cleanup (pdev); +} +static int ast_udc_probe (struct platform_device *pdev) {enum usb_device_speed max_speed;
@@ -1524,6 +1531,12 @@ static int ast_udc_probe(struct platform_device *pdev)AST_UDC_NUM_ENDPOINTS , &udc->ep0_buf_dma, GFP_KERNEL); +if (!udc->ep0_buf) { +clk_disable_unprepare (udc->clk); + rc = -ENOMEM ; + goto err; + } + udc->gadget.speed =USB_SPEED_UNKNOWN ; udc->gadget.max_speed =USB_SPEED_HIGH ; udc->creq = udc->reg +AST_UDC_SETUP0 ;
@@ -1553,20 +1566,20 @@ static int ast_udc_probe(struct platform_device *pdev) udc->irq =platform_get_irq (pdev,0 );if (udc->irq <0 ) { rc = udc->irq; - goto err; + goto err_cleanup; } rc =devm_request_irq (&pdev->dev, udc->irq, ast_udc_isr,0 ,KBUILD_MODNAME , udc);if (rc) {dev_err (&pdev->dev,"Failed to request interrupt\n" ); - goto err; + goto err_cleanup; } rc =usb_add_gadget_udc (&pdev->dev, &udc->gadget);if (rc) {dev_err (&pdev->dev,"Failed to add gadget udc\n" ); - goto err; + goto err_cleanup; } dev_info(&pdev->dev, "Initialized udc in USB%s mode\n",
@@ -1574,9 +1587,10 @@ static int ast_udc_probe(struct platform_device *pdev)return 0 ; +err_cleanup: +ast_udc_cleanup (pdev); err:dev_err (&pdev->dev,"Failed to udc probe, rc:0x%x\n" , rc); -ast_udc_remove (pdev);return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 705/1424 USB: core: Use device_driver directly in struct usb_driver and usb_device_driver
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yajun Deng <[email protected]>
[ Upstream commit 49a78b05d5ca1e23fd737747a8757b8bdc319b30 ]
There is usbdrv_wrap in struct usb_driver and usb_device_driver, it contains device_driver and for_devices. for_devices is used to distinguish between device drivers and interface drivers.
Like the is_usb_device(), it tests the type of the device. We can test that if the probe of device_driver is equal to usb_probe_device in is_usb_device_driver(), and then the struct usbdrv_wrap is no longer needed.
Clean up struct usbdrv_wrap, use device_driver directly in struct usb_driver and usb_device_driver. This makes the code cleaner.
Stable-dep-of: ef8154d8b52d ("usb: fix UAF when probe runs concurrent to dyn ID removal")
--- drivers/bluetooth/btusb.c | 6 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +- .../broadcom/brcm80211/brcmfmac/usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/usb.c | 2 +- drivers/usb/core/driver.c | 59 ++++++++++--------- drivers/usb/core/usb.c | 2 +- drivers/usb/core/usb.h | 8 +-- drivers/usb/misc/onboard_usb_hub.c | 2 +- drivers/usb/serial/bus.c | 2 +- drivers/usb/serial/usb-serial.c | 2 +- drivers/usb/storage/uas.c | 2 +- drivers/usb/usbip/stub_main.c | 8 +-- include/linux/usb.h | 24 +++----- 13 files changed, 53 insertions(+), 68 deletions(-)
drivers/bluetooth/btusb.c +2 -4
@@ -4348,10 +4348,8 @@ static struct usb_driver btusb_driver = { .disable_hub_initiated_lpm = 1,#ifdef CONFIG_DEV_COREDUMP - .drvwrap = { - .driver = { - .coredump = btusb_coredump, - }, + .driver = { + .coredump = btusb_coredump, },#endif };
drivers/net/can/usb/peak_usb/pcan_usb_core.c +1 -1
@@ -1142,7 +1142,7 @@ static void __exit peak_usb_exit(void)int err;/* last chance do send any synchronous commands here */ - err =driver_for_each_device (&peak_usb_driver.drvwrap.driver,NULL , + err =driver_for_each_device (&peak_usb_driver.driver,NULL ,NULL , peak_usb_do_device_exit);if (err) pr_err("%s: failed to stop all can devices (err %d)\n",
drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +1 -1
@@ -1586,7 +1586,7 @@ static int brcmf_usb_reset_device(struct device *dev, void *notused)void brcmf_usb_exit (void ) { -struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver; +struct device_driver *drv = &brcmf_usbdrvr.driver;int ret;brcmf_dbg (USB ,"Enter\n" );
drivers/net/wireless/marvell/mwifiex/usb.c +1 -1
@@ -687,7 +687,7 @@ static struct usb_driver mwifiex_usb_driver = { .suspend = mwifiex_usb_suspend, .resume = mwifiex_usb_resume, .soft_unbind = 1, - .drvwrap.driver = { + .driver = { .coredump = mwifiex_usb_coredump, }, };
drivers/usb/core/driver.c +31 -28
134 lines not on this page · raw message
drivers/usb/core/usb.c +1 -1
@@ -431,7 +431,7 @@ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)struct device *dev; argb.minor = minor; - argb.drv = &drv->drvwrap.driver; + argb.drv = &drv->driver; dev =bus_find_device (&usb_bus_type,NULL , &argb, __find_interface);
drivers/usb/core/usb.h +1 -7
@@ -175,13 +175,7 @@ static inline int is_root_hub(struct usb_device *udev)return (udev->parent ==NULL ); } -/* Do the same for device drivers and interface drivers. */ - -static inline int is_usb_device_driver (struct device_driver *drv) -{ - return container_of(drv, struct usbdrv_wrap, driver)-> - for_devices; -} +extern bool is_usb_device_driver (const struct device_driver *drv);/* for labeling diagnostics */ extern const char *usbcore_name;
drivers/usb/misc/onboard_usb_hub.c +1 -1
@@ -233,7 +233,7 @@ static void onboard_hub_attach_usb_driver(struct work_struct *work) {int err; - err =driver_attach (&onboard_hub_usbdev_driver.drvwrap.driver); + err =driver_attach (&onboard_hub_usbdev_driver.driver);if (err)pr_err ("Failed to attach USB driver: %d\n" , err); }
drivers/usb/serial/bus.c +1 -1
@@ -113,7 +113,7 @@ static ssize_t new_id_store(struct device_driver *driver,if (retval >=0 && usb_drv->usb_driver !=NULL ) retval =usb_store_new_id (&usb_drv->usb_driver->dynids, usb_drv->usb_driver->id_table, - &usb_drv->usb_driver->drvwrap.driver, + &usb_drv->usb_driver->driver, buf, count);return retval; }
drivers/usb/serial/usb-serial.c +1 -1
@@ -1516,7 +1516,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]/* Now set udriver's id_table and look for matches */ udriver->id_table = id_table; - rc =driver_attach (&udriver->drvwrap.driver); + rc =driver_attach (&udriver->driver);return 0 ; err_deregister_drivers:
drivers/usb/storage/uas.c +1 -1
@@ -1257,7 +1257,7 @@ static struct usb_driver uas_driver = { .suspend = uas_suspend, .resume = uas_resume, .reset_resume = uas_reset_resume, - .drvwrap.driver.shutdown = uas_shutdown, + .driver.shutdown = uas_shutdown, .id_table = uas_usb_ids, };
drivers/usb/usbip/stub_main.c +4 -4
@@ -377,14 +377,14 @@ static int __init usbip_host_init(void) goto err_usb_register; } - ret =driver_create_file (&stub_driver.drvwrap.driver, + ret =driver_create_file (&stub_driver.driver, &driver_attr_match_busid);if (ret) {pr_err ("driver_create_file failed\n" ); goto err_create_file; } - ret =driver_create_file (&stub_driver.drvwrap.driver, + ret =driver_create_file (&stub_driver.driver, &driver_attr_rebind);if (ret) {pr_err ("driver_create_file failed\n" );
@@ -402,10 +402,10 @@ static int __init usbip_host_init(void) static void __exit usbip_host_exit(void) { -driver_remove_file (&stub_driver.drvwrap.driver, +driver_remove_file (&stub_driver.driver, &driver_attr_match_busid); -driver_remove_file (&stub_driver.drvwrap.driver, +driver_remove_file (&stub_driver.driver, &driver_attr_rebind);/*
include/linux/usb.h +7 -17
@@ -1145,16 +1145,6 @@ extern ssize_t usb_store_new_id(struct usb_dynids *dynids,extern ssize_t usb_show_dynids (struct usb_dynids *dynids,char *buf); -/** -* struct usbdrv_wrap - wrapper for driver-model structure -* @driver: The driver-model core driver structure. -* @for_devices: Non-zero for device drivers, 0 for interface drivers. -*/ -struct usbdrv_wrap { -struct device_driver driver; -int for_devices; -}; -/** * struct usb_driver - identifies USB interface driver to usbcore * @name: The driver name should be unique among USB drivers,
@@ -1195,7 +1185,7 @@ struct usbdrv_wrap {* is bound to the driver. * @dynids: used internally to hold the list of dynamically added device * ids for this driver. -* @drvwrap: Driver-model core structure wrapper. +* @driver: The driver-model core driver structure. * @no_dynamic_id: if set to 1, the USB core will not allow dynamic ids to be * added to this driver by preventing the sysfs file from being created. * @supports_autosuspend: if set to 0, the USB core will not allow autosuspend
@@ -1243,13 +1233,13 @@ struct usb_driver {const struct attribute_group **dev_groups;struct usb_dynids dynids; -struct usbdrv_wrap drvwrap; +struct device_driver driver; unsigned int no_dynamic_id:1; unsigned int supports_autosuspend:1; unsigned int disable_hub_initiated_lpm:1; unsigned int soft_unbind:1; }; -#define to_usb_driver (d) container_of(d, struct usb_driver, drvwrap.driver) +#define to_usb_driver (d) container_of(d, struct usb_driver, driver)/** * struct usb_device_driver - identifies USB device driver to usbcore
@@ -1267,7 +1257,7 @@ struct usb_driver {* @resume: Called when the device is being resumed by the system. * @dev_groups: Attributes attached to the device that will be created once it * is bound to the driver. -* @drvwrap: Driver-model core structure wrapper. +* @driver: The driver-model core driver structure. * @id_table: used with @match() to select better matching driver at * probe() time. * @supports_autosuspend: if set to 0, the USB core will not allow autosuspend
@@ -1276,7 +1266,7 @@ struct usb_driver {* resume and suspend functions will be called in addition to the driver's * own, so this part of the setup does not need to be replicated. * -* USB drivers must provide all the fields listed above except drvwrap, +* USB drivers must provide all the fields listed above except driver, * match, and id_table. */ struct usb_device_driver {
@@ -1289,13 +1279,13 @@ struct usb_device_driver {int (*suspend) (struct usb_device *udev,pm_message_t message);int (*resume) (struct usb_device *udev,pm_message_t message);const struct attribute_group **dev_groups; -struct usbdrv_wrap drvwrap; +struct device_driver driver;const struct usb_device_id *id_table; unsigned int supports_autosuspend:1; unsigned int generic_subclass:1; };#define to_usb_device_driver (d) container_of(d, struct usb_device_driver, \ - drvwrap.driver) + driver)/** * struct usb_class_driver - identifies a USB driver that wants to use the USB major number
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 706/1424 USB: make single lock for all usb dynamic id lists
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 0b3144da31f855fce652303f588416a60991bdef ]
There are a number of places where we accidentally pass in a constant structure to later cast it off to a dynamic one, and then attempt to grab a lock on it, which is not a good idea. To help resolve this, move the dynamic id lock out of the dynamic id structure for the driver and into one single lock for all USB dynamic ids. As this lock should never have any real contention (it's only every accessed when a device is added or removed, which is always serialized) there should not be any difference except for some memory savings.
Note, this just converts the existing use of the dynamic id lock to the new static lock, there is one place that is accessing the dynamic id list without grabbing the lock, that will be fixed up in a follow-on change.
Stable-dep-of: ef8154d8b52d ("usb: fix UAF when probe runs concurrent to dyn ID removal")
--- drivers/usb/common/common.c | 3 +++ drivers/usb/core/driver.c | 15 +++++---------- drivers/usb/serial/bus.c | 4 +--- drivers/usb/serial/usb-serial.c | 4 +--- include/linux/usb.h | 2 +- 5 files changed, 11 insertions(+), 17 deletions(-)
drivers/usb/common/common.c +3 -0
@@ -417,6 +417,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_companion_dev);struct dentry *usb_debug_root;EXPORT_SYMBOL_GPL (usb_debug_root); +DEFINE_MUTEX (usb_dynids_lock); +EXPORT_SYMBOL_GPL (usb_dynids_lock); +static int __init usb_common_init (void ) { usb_debug_root =debugfs_create_dir ("usb" ,NULL );
drivers/usb/core/driver.c +5 -10
@@ -95,9 +95,9 @@ ssize_t usb_store_new_id(struct usb_dynids *dynids, } } -spin_lock (&dynids->lock); +mutex_lock (&usb_dynids_lock);list_add_tail (&dynid->node, &dynids->list); -spin_unlock (&dynids->lock); +mutex_unlock (&usb_dynids_lock); retval =driver_attach (driver);
@@ -160,7 +160,7 @@ static ssize_t remove_id_store(struct device_driver *driver, const char *buf,if (fields <2 )return -EINVAL ; -spin_lock (&usb_driver->dynids.lock); +guard (mutex)(&usb_dynids_lock);list_for_each_entry_safe (dynid, n, &usb_driver->dynids.list, node) {struct usb_device_id *id = &dynid->id;
@@ -171,7 +171,6 @@ static ssize_t remove_id_store(struct device_driver *driver, const char *buf,break ; } } -spin_unlock (&usb_driver->dynids.lock);return count; }
@@ -220,12 +219,11 @@ static void usb_free_dynids(struct usb_driver *usb_drv) {struct usb_dynid *dynid, *n; -spin_lock (&usb_drv->dynids.lock); +guard (mutex)(&usb_dynids_lock);list_for_each_entry_safe (dynid, n, &usb_drv->dynids.list, node) {list_del (&dynid->node);kfree (dynid); } -spin_unlock (&usb_drv->dynids.lock); } static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *intf,
@@ -233,14 +231,12 @@ static const struct usb_device_id *usb_match_dynamic_id(struct usb_interface *in {struct usb_dynid *dynid; -spin_lock (&drv->dynids.lock); +guard (mutex)(&usb_dynids_lock);list_for_each_entry (dynid, &drv->dynids.list, node) {if (usb_match_one_id (intf, &dynid->id)) { -spin_unlock (&drv->dynids.lock);return &dynid->id; } } -spin_unlock (&drv->dynids.lock);return NULL ; }
@@ -1059,7 +1055,6 @@ int usb_register_driver(struct usb_driver *new_driver, struct module *owner, new_driver->driver.owner = owner; new_driver->driver.mod_name = mod_name; new_driver->driver.dev_groups = new_driver->dev_groups; -spin_lock_init (&new_driver->dynids.lock);INIT_LIST_HEAD (&new_driver->dynids.list); retval =driver_register (&new_driver->driver);
drivers/usb/serial/bus.c +1 -3
@@ -136,12 +136,11 @@ static void free_dynids(struct usb_serial_driver *drv) {struct usb_dynid *dynid, *n; -spin_lock (&drv->dynids.lock); +guard (mutex)(&usb_dynids_lock);list_for_each_entry_safe (dynid, n, &drv->dynids.list, node) {list_del (&dynid->node);kfree (dynid); } -spin_unlock (&drv->dynids.lock); }const struct bus_type usb_serial_bus_type = {
@@ -157,7 +156,6 @@ int usb_serial_bus_register(struct usb_serial_driver *driver)int retval; driver->driver.bus = &usb_serial_bus_type; -spin_lock_init (&driver->dynids.lock);INIT_LIST_HEAD (&driver->dynids.list); retval =driver_register (&driver->driver);
drivers/usb/serial/usb-serial.c +1 -3
@@ -706,14 +706,12 @@ static const struct usb_device_id *match_dynamic_id(struct usb_interface *intf, {struct usb_dynid *dynid; -spin_lock (&drv->dynids.lock); +guard (mutex)(&usb_dynids_lock);list_for_each_entry (dynid, &drv->dynids.list, node) {if (usb_match_one_id (intf, &dynid->id)) { -spin_unlock (&drv->dynids.lock);return &dynid->id; } } -spin_unlock (&drv->dynids.lock);return NULL ; }
include/linux/usb.h +1 -1
@@ -1128,8 +1128,8 @@ static inline int usb_make_path(struct usb_device *dev, char *buf, size_t size)/* ----------------------------------------------------------------------- */ /* Stuff for dynamic usb ids */ +extern struct mutex usb_dynids_lock;struct usb_dynids { -spinlock_t lock;struct list_head list; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 707/1424 USB: make to_usb_driver() use container_of_const()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 2f3aab7aecb827ba93c6222646eb0faa8228d590 ]
Turns out that we have some const pointers being passed to to_usb_driver() but were not catching this. Change the macro to properly propagate the const-ness of the pointer so that we will notice when we try to write to memory that we shouldn't be writing to.
This requires fixing up the usb_match_dynamic_id() function as well, because it can handle a const * to struct usb_driver.
Stable-dep-of: ef8154d8b52d ("usb: fix UAF when probe runs concurrent to dyn ID removal")
--- drivers/usb/core/driver.c | 4 ++-- include/linux/usb.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/usb/core/driver.c +2 -2
@@ -227,7 +227,7 @@ static void usb_free_dynids(struct usb_driver *usb_drv) }static const struct usb_device_id *usb_match_dynamic_id (struct usb_interface *intf, -struct usb_driver *drv) +const struct usb_driver *drv) {struct usb_dynid *dynid;
@@ -873,7 +873,7 @@ static int usb_device_match(struct device *dev, struct device_driver *drv) }else if (is_usb_interface (dev)) {struct usb_interface *intf; -struct usb_driver *usb_drv; +const struct usb_driver *usb_drv;const struct usb_device_id *id;/* device drivers never match interfaces */
include/linux/usb.h +1 -1
@@ -1239,7 +1239,7 @@ struct usb_driver { unsigned int disable_hub_initiated_lpm:1; unsigned int soft_unbind:1; }; -#define to_usb_driver (d) container_of(d, struct usb_driver, driver) +#define to_usb_driver (d) container_of_const(d, struct usb_driver, driver)/** * struct usb_device_driver - identifies USB device driver to usbcore
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 708/1424 usb: fix UAF when probe runs concurrent to dyn ID removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gary Guo <[email protected]>
[ Upstream commit ef8154d8b52d60338c1fd8d793cd8e891c604c14 ]
Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held, as remove_id_store can free the node. Thus, make a copy in usb_probe_interface. Clarify the documentation that the id parameter is only valid during the probe.
USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.
--- drivers/usb/core/driver.c | 12 ++++++++---- include/linux/usb.h | 3 ++- 2 files changed, 10 insertions(+), 5 deletions(-)
drivers/usb/core/driver.c +8 -4
@@ -227,14 +227,16 @@ static void usb_free_dynids(struct usb_driver *usb_drv) }static const struct usb_device_id *usb_match_dynamic_id (struct usb_interface *intf, -const struct usb_driver *drv) +const struct usb_driver *drv, +struct usb_device_id *id_copy) {struct usb_dynid *dynid;guard (mutex)(&usb_dynids_lock);list_for_each_entry (dynid, &drv->dynids.list, node) {if (usb_match_one_id (intf, &dynid->id)) { -return &dynid->id; + *id_copy = dynid->id; +return id_copy; } }return NULL ;
@@ -317,6 +319,7 @@ static int usb_probe_interface(struct device *dev)struct usb_interface *intf =to_usb_interface (dev);struct usb_device *udev =interface_to_usbdev (intf);const struct usb_device_id *id; +struct usb_device_id id_copy;int error = -ENODEV ;int lpm_disable_error = -ENODEV ;
@@ -336,7 +339,7 @@ static int usb_probe_interface(struct device *dev)return error; } - id =usb_match_dynamic_id (intf, driver); + id =usb_match_dynamic_id (intf, driver, &id_copy);if (!id) id =usb_match_id (intf, driver->id_table);if (!id)
@@ -875,6 +878,7 @@ static int usb_device_match(struct device *dev, struct device_driver *drv)struct usb_interface *intf;const struct usb_driver *usb_drv;const struct usb_device_id *id; +struct usb_device_id id_copy;/* device drivers never match interfaces */ if (is_usb_device_driver (drv))
@@ -887,7 +891,7 @@ static int usb_device_match(struct device *dev, struct device_driver *drv)if (id)return 1 ; - id =usb_match_dynamic_id (intf, usb_drv); + id =usb_match_dynamic_id (intf, usb_drv, &id_copy);if (id)return 1 ; }
include/linux/usb.h +2 -1
@@ -1155,7 +1155,8 @@ extern ssize_t usb_show_dynids(struct usb_dynids *dynids, char *buf);* interface. It may also use usb_set_interface() to specify the * appropriate altsetting. If unwilling to manage the interface, * return -ENODEV, if genuine IO errors occurred, an appropriate -* negative errno value. +* negative errno value. The usb_device_id parameter is only valid during +* probe. * @disconnect: Called when the interface is no longer accessible, usually * because its device has been (or is being) disconnected or the * driver module is being unloaded.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 709/1424 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit c38cce70adef874c2a7b5132c14d6c221401deff ]
Every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device's ACPI companion object need to verify its presence.
mlxbf_pmc_probe() passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference.
Accordingly, add a requisite ACPI_COMPANION() check against NULL to the mlxbf-pmc driver and return -ENODEV when the companion is missing.
--- drivers/platform/mellanox/mlxbf-pmc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/platform/mellanox/mlxbf-pmc.c +8 -2
@@ -1385,13 +1385,19 @@ static int mlxbf_pmc_map_counters(struct device *dev)static int mlxbf_pmc_probe (struct platform_device *pdev) { -struct acpi_device *acpi_dev =ACPI_COMPANION (&pdev->dev); -const char *hid =acpi_device_hid (acpi_dev);struct device *dev = &pdev->dev; +struct acpi_device *acpi_dev;struct arm_smccc_res res; +const char *hid;guid_t guid;int ret; + acpi_dev =ACPI_COMPANION (&pdev->dev); +if (!acpi_dev) +return -ENODEV ; + + hid =acpi_device_hid (acpi_dev); +/* Ensure we have the UUID we expect for this service. */ arm_smccc_smc (MLXBF_PMC_SIP_SVC_UID ,0 ,0 ,0 ,0 ,0 ,0 ,0 , &res);guid_parse (mlxbf_pmc_svc_uuid_str, &guid);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 710/1424 platform/surface: acpi-notify: Check ACPI companion before use
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 2b3a5dabe89e330413af403246b648c1890f368f ]
Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence.
san_probe() dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler, so force-binding the driver to a device without an ACPI companion leads to a NULL pointer dereference. The dereference was introduced when the probe function was switched from ACPI_HANDLE() to ACPI_COMPANION().
Check the ACPI companion against NULL and return -ENODEV when it is missing, like commit e4865a56d013 ("ACPI: driver: Check ACPI_COMPANION() against NULL during probe") does for the core ACPI platform drivers.
--- drivers/platform/surface/surface_acpi_notify.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/platform/surface/surface_acpi_notify.c +5 -1
@@ -801,12 +801,16 @@ static int san_consumer_links_setup(struct platform_device *pdev)static int san_probe (struct platform_device *pdev) { -struct acpi_device *san =ACPI_COMPANION (&pdev->dev);struct ssam_controller *ctrl; +struct acpi_device *san;struct san_data *data;acpi_status astatus;int status; + san =ACPI_COMPANION (&pdev->dev); +if (!san) +return -ENODEV ; + ctrl =ssam_client_bind (&pdev->dev);if (IS_ERR (ctrl))return PTR_ERR (ctrl) == -ENODEV ? -EPROBE_DEFER :PTR_ERR (ctrl);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 711/1424 usb: mtu3: allow system suspend during active gadget connection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fei Shao <[email protected]>
[ Upstream commit e69027c25361b6044c7928715667586cc5469063 ]
When operating in gadget mode connected to a USB host, system suspend fails with -EBUSY because active peripheral connections block suspend entry.
Fix this by restricting the -EBUSY check to runtime autosuspend (PMSG_IS_AUTO). For system suspend (!PMSG_IS_AUTO), perform soft disconnect to disconnect from the bus and allow MAC sleep.
--- drivers/usb/mtu3/mtu3_core.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/mtu3/mtu3_core.c +10 -1
@@ -1037,9 +1037,14 @@ int ssusb_gadget_suspend(struct ssusb_mtk *ssusb, pm_message_t msg)if (!mtu->gadget_driver)return 0 ; -if (mtu->connected) +/* Prevent runtime suspend when active connection exists */ +if (mtu->connected &&PMSG_IS_AUTO (msg))return -EBUSY ; +/* Perform soft disconnect for system suspend */ +if (mtu->softconnect && !PMSG_IS_AUTO (msg)) +mtu3_dev_on_off (mtu,0 ); +mtu3_dev_suspend (mtu);synchronize_irq (mtu->irq);
@@ -1055,5 +1060,9 @@ int ssusb_gadget_resume(struct ssusb_mtk *ssusb, pm_message_t msg)mtu3_dev_resume (mtu); +/* Restore soft connect for system resume */ +if (mtu->softconnect && !PMSG_IS_AUTO (msg)) +mtu3_dev_on_off (mtu,1 ); +return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 712/1424 usb: renesas_usbhs: Fix power-off ordering on unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 589b9e6f96be6bd8dd0d45fda8e948c31dc2fe94 ]
Move the usbhsc_power_ctrl() call to before hardware_exit() and reset_control_assert() in usbhs_remove(), so the PHY is powered off while priv->phy is still valid, rather than after hardware_exit() has already cleared it.
--- drivers/usb/renesas_usbhs/common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/renesas_usbhs/common.c +3 -3
@@ -798,9 +798,6 @@ static void usbhs_remove(struct platform_device *pdev)flush_delayed_work (&priv->notify_hotplug_work); -usbhs_platform_call (priv, hardware_exit, pdev); -reset_control_assert (priv->rsts); -/* * Explicitly free the IRQ to ensure the interrupt handler is * disabled and synchronized before freeing resources.
@@ -817,6 +814,9 @@ static void usbhs_remove(struct platform_device *pdev)if (!usbhs_get_dparam (priv, runtime_pwctrl))usbhsc_power_ctrl (priv,0 ); +usbhs_platform_call (priv, hardware_exit, pdev); +reset_control_assert (priv->rsts); +usbhsc_clk_put (priv);pm_runtime_disable (&pdev->dev); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 713/1424 drm/panel: samsung-s6d16d0: Power off on prepare failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <[email protected]>
[ Upstream commit a9f950adfe2147318d75e7a6eab5e814851802ac ]
If enabling tearing mode or exiting sleep mode fails after the regulator is enabled, s6d16d0_prepare() returns without asserting reset or disabling the supply. Since the DRM panel core leaves the panel unprepared, a later unprepare call skips the driver callback and the supply remains enabled.
Assert reset and disable the supply before returning the DSI command error.
--- drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-samsung-s6d16d0.c +8 -2
@@ -89,16 +89,22 @@ static int s6d16d0_prepare(struct drm_panel *panel) MIPI_DSI_DCS_TEAR_MODE_VBLANK);if (ret) {dev_err (s6->dev,"failed to enable vblank TE (%d)\n" , ret); -return ret; + goto err_power_off; }/* Exit sleep mode and power on */ ret =mipi_dsi_dcs_exit_sleep_mode (dsi);if (ret) {dev_err (s6->dev,"failed to exit sleep mode (%d)\n" , ret); -return ret; + goto err_power_off; }return 0 ; + +err_power_off: +gpiod_set_value_cansleep (s6->reset_gpio,1 ); +regulator_disable (s6->supply); + +return ret; }static int s6d16d0_enable (struct drm_panel *panel)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 714/1424 perf metricgroup: Fix metric expression copy leaks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Peng <[email protected]>
[ Upstream commit ef3af1df4f3372bd8ad47619452a283048b3bc8d ]
metricgroup__copy_metric_events() allocates a new metric expression and duplicates metric_name before linking the expression into the destination metric event.
Free new_expr when strdup() fails, and free the duplicated metric_name on the later error paths.
--- tools/perf/util/metricgroup.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
tools/perf/util/metricgroup.c +6 -1
@@ -1810,8 +1810,10 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp, new_expr->metric_expr = old_expr->metric_expr; new_expr->metric_threshold = old_expr->metric_threshold; new_expr->metric_name =strdup (old_expr->metric_name); -if (!new_expr->metric_name) +if (!new_expr->metric_name) { +free (new_expr);return -ENOMEM ; + } new_expr->metric_unit = old_expr->metric_unit; new_expr->runtime = old_expr->runtime;
@@ -1823,6 +1825,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp, alloc_size =sizeof (*new_expr->metric_refs); new_expr->metric_refs =calloc (nr +1 , alloc_size);if (!new_expr->metric_refs) { +zfree (&new_expr->metric_name);free (new_expr);return -ENOMEM ; }
@@ -1839,6 +1842,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp, alloc_size =sizeof (*new_expr->metric_events); new_expr->metric_events =calloc (nr +1 , alloc_size);if (!new_expr->metric_events) { +zfree (&new_expr->metric_name);zfree (&new_expr->metric_refs);free (new_expr);return -ENOMEM ;
@@ -1849,6 +1853,7 @@ int metricgroup__copy_metric_events(struct evlist *evlist, struct cgroup *cgrp, evsel = old_expr->metric_events[idx]; evsel =evlist__find_evsel (evlist, evsel->core.idx);if (evsel ==NULL ) { +zfree (&new_expr->metric_name);zfree (&new_expr->metric_events);zfree (&new_expr->metric_refs);free (new_expr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 715/1424 soc: qcom: rpmh-rsc: manage PM notifiers with devres
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 75e918aa876440d8ad559a11d6ab87bddb1ed79a ]
rpmh_rsc_probe() registers CPU PM or genpd notifiers before populating child devices. If child population fails, the CPU PM notifier path is not unwound and the genpd path needs open-coded cleanup.
Use devm_pm_runtime_enable() for the genpd path and devm_add_action_or_reset() for both notifier registrations. This makes probe failure and driver detach use the same cleanup model while keeping devm_of_platform_populate() responsible for child devices.
--- drivers/soc/qcom/rpmh-rsc.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +26 -11
@@ -944,17 +944,30 @@ static int rpmh_rsc_pd_callback(struct notifier_block *nfb,return NOTIFY_OK ; } +static void rpmh_rsc_pd_detach (void *data) +{ +dev_pm_genpd_remove_notifier (data); +} +static int rpmh_rsc_pd_attach (struct rsc_drv *drv,struct device *dev) {int ret; -pm_runtime_enable (dev); + ret =devm_pm_runtime_enable (dev); +if (ret) +return ret; + drv->genpd_nb.notifier_call = rpmh_rsc_pd_callback; ret =dev_pm_genpd_add_notifier (dev, &drv->genpd_nb);if (ret) -pm_runtime_disable (dev); +return ret; -return ret; +return devm_add_action_or_reset (dev, rpmh_rsc_pd_detach, dev); +} + +static void rpmh_rsc_cpu_pm_unregister (void *data) +{ +cpu_pm_unregister_notifier (data); }static int rpmh_probe_tcs_config (struct platform_device *pdev,struct rsc_drv *drv)
@@ -1110,7 +1123,15 @@ static int rpmh_rsc_probe(struct platform_device *pdev)return ret; }else { drv->rsc_pm.notifier_call = rpmh_rsc_cpu_pm_callback; -cpu_pm_register_notifier (&drv->rsc_pm); + ret =cpu_pm_register_notifier (&drv->rsc_pm); +if (ret) +return ret; + + ret =devm_add_action_or_reset (&pdev->dev, + rpmh_rsc_cpu_pm_unregister, + &drv->rsc_pm); +if (ret) +return ret; } }
@@ -1125,13 +1146,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev)dev_set_drvdata (&pdev->dev, drv); drv->dev = &pdev->dev; - ret =devm_of_platform_populate (&pdev->dev); -if (ret && pdev->dev.pm_domain) { -dev_pm_genpd_remove_notifier (&pdev->dev); -pm_runtime_disable (&pdev->dev); - } - -return ret; +return devm_of_platform_populate (&pdev->dev); }static const struct of_device_id rpmh_drv_match[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 716/1424 bus: qcom-ebi2: use managed resources for clocks and children
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit d19a46f7ed8eb54fea61e0eaf7db53ff7babb03c ]
qcom_ebi2_probe() enables the EBI2 clocks manually and populates child devices manually. Several later failure paths can then return without disabling the clocks or without relying on the driver core to undo child population.
Use devm_clk_get_enabled() for both clocks and devm_of_platform_populate() for children. This lets the driver core unwind the resources automatically and removes the hand-written error labels.
--- drivers/bus/qcom-ebi2.c | 50 +++++++++-------------------------------- 1 file changed, 11 insertions(+), 39 deletions(-)
drivers/bus/qcom-ebi2.c +11 -39
@@ -302,41 +302,23 @@ static int qcom_ebi2_probe(struct platform_device *pdev)u32 val;int ret; - ebi2xclk =devm_clk_get (dev,"ebi2x" ); + ebi2xclk =devm_clk_get_enabled (dev,"ebi2x" );if (IS_ERR (ebi2xclk))return PTR_ERR (ebi2xclk); - ret =clk_prepare_enable (ebi2xclk); -if (ret) { -dev_err (dev,"could not enable EBI2X clk (%d)\n" , ret); -return ret; - } - - ebi2clk =devm_clk_get (dev,"ebi2" ); -if (IS_ERR (ebi2clk)) { - ret =PTR_ERR (ebi2clk); - goto err_disable_2x_clk; - } - - ret =clk_prepare_enable (ebi2clk); -if (ret) { -dev_err (dev,"could not enable EBI2 clk\n" ); - goto err_disable_2x_clk; - } + ebi2clk =devm_clk_get_enabled (dev,"ebi2" ); +if (IS_ERR (ebi2clk)) +return PTR_ERR (ebi2clk); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); ebi2_base =devm_ioremap_resource (dev, res); -if (IS_ERR (ebi2_base)) { - ret =PTR_ERR (ebi2_base); - goto err_disable_clk; - } +if (IS_ERR (ebi2_base)) +return PTR_ERR (ebi2_base); res =platform_get_resource (pdev,IORESOURCE_MEM ,1 ); ebi2_xmem =devm_ioremap_resource (dev, res); -if (IS_ERR (ebi2_xmem)) { - ret =PTR_ERR (ebi2_xmem); - goto err_disable_clk; - } +if (IS_ERR (ebi2_xmem)) +return PTR_ERR (ebi2_xmem);/* Allegedly this turns the power save mode off */ writel (0UL , ebi2_xmem +EBI2_XMEM_CFG );
@@ -353,7 +335,7 @@ static int qcom_ebi2_probe(struct platform_device *pdev)/* Figure out the chipselect */ ret =of_property_read_u32 (child,"reg" , &csindex);if (ret) - goto err_disable_clk; +return ret;if (csindex >5 ) { dev_err(dev,
@@ -372,20 +354,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) have_children = true; } -if (have_children) { - ret =of_platform_default_populate (np,NULL , dev); -if (ret) - goto err_disable_clk; - } +if (have_children) +return devm_of_platform_populate (dev);return 0 ; - -err_disable_clk: -clk_disable_unprepare (ebi2clk); -err_disable_2x_clk: -clk_disable_unprepare (ebi2xclk); - -return ret; }static const struct of_device_id qcom_ebi2_of_match[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 717/1424 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mert Seftali <[email protected]>
[ Upstream commit aa58ecc73466d0cb8c418de98e2225490bf600e3 ]
Reading the in_accel_scale attribute on the DMARD09 has always returned -EINVAL: the channels advertise scale via info_mask_shared_by_type so the IIO core exposes the attribute, but dmard09_read_raw() only handles IIO_CHAN_INFO_RAW, so a SCALE read falls through to 'default: return -EINVAL':
$ cat .../iio:deviceX/in_accel_scale
cat: in_accel_scale: Invalid argumentleaving userspace with raw counts it cannot convert to m/s^2.
The driver was written from a vendor source [1] without a datasheet, and the scale was declared but never implemented. The vendor source carries the sensitivity: its conversion is
acc = raw * GRAVITY_EARTH_1000 / sensitivity (then / 1000 -> m/s^2)
with sensitivity = 32 and GRAVITY_EARTH_1000 = 9807 ("about (9.80665)*1000"), i.e. 32 counts correspond to 1 g.
That sensitivity applies to the value this driver already reports as raw:
the vendor reduces each 16-bit sample to a signed 9-bit value, and the preparation in dmard09_read_raw() yields the same value. It is
self-consistent: 256 counts / 32 = 8 g full scale, matching the +/-8g range.
Implement the scale derived from that sensitivity using standard gravity:
scale = 9.80665 / 32 = 0.3064578125 m/s^2 per LSB
--- drivers/iio/accel/dmard09.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/iio/accel/dmard09.c +7 -0
@@ -8,6 +8,7 @@#include <asm/unaligned.h> #include <linux/module.h> #include <linux/i2c.h> +#include <linux/units.h> #include <linux/iio/iio.h> #define DMARD09_DRV_NAME "dmard09"
@@ -79,6 +80,12 @@ static int dmard09_read_raw(struct iio_dev *indio_dev, *val = accel;return IIO_VAL_INT ; +case IIO_CHAN_INFO_SCALE : + *val =0 ; +/* 1 g / 32 LSB, in m/s^2 */ + *val2 =IIO_G_TO_M_S_2 (NANO /32 ); + +return IIO_VAL_INT_PLUS_NANO ;default :return -EINVAL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 718/1424 RDMA/core: Wait for RCU callbacks before unloading ib_core
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 7d75592114d1664623c8cf191a12b38052c04483 ]
put_gid_ndev() is queued with call_rcu() and implemented in ib_core. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code has been unloaded.
synchronize_rcu() does not wait for callbacks. Wait for them after all producers have stopped.
--- drivers/infiniband/core/device.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/core/device.c +1 -0
@@ -2913,6 +2913,7 @@ static void __exit ib_core_cleanup(void)/* Make sure that any pending umem accounting work is done. */ destroy_workqueue (ib_wq);destroy_workqueue (ib_unreg_wq); +rcu_barrier ();WARN_ON (!xa_empty (&clients));WARN_ON (!xa_empty (&devices)); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 719/1424 RDMA/mlx5: Drain RCU callbacks during module teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit e37cdd75f8d61c1123d324ae5667ac3da562290e ]
devx_free_subscription() can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5_ib can then unload before the callback runs.
Registration error unwind has the same risk because driver registration can attach existing devices before failing. Wait after all drivers have stopped.
--- drivers/infiniband/hw/mlx5/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/mlx5/main.c +2 -0
@@ -4603,6 +4603,7 @@ static int __init mlx5_ib_init(void) mp_err:mlx5r_rep_cleanup (); rep_err: +rcu_barrier ();mlx5_ib_qp_event_cleanup (); qp_event_err:destroy_workqueue (mlx5_ib_event_wq);
@@ -4615,6 +4616,7 @@ static void __exit mlx5_ib_cleanup(void)auxiliary_driver_unregister (&mlx5r_driver);auxiliary_driver_unregister (&mlx5r_mp_driver);mlx5r_rep_cleanup (); +rcu_barrier ();mlx5_ib_qp_event_cleanup ();destroy_workqueue (mlx5_ib_event_wq);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 720/1424 RDMA/ipoib: Drain RCU callbacks during module teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 31b7c700670830a0e8a4cdcd451c88a13cc5dc48 ]
IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ib_ipoib while its code is still executing.
Client registration failure can also remove already-added devices and queue callbacks. Wait after client and workqueue teardown.
--- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/ulp/ipoib/ipoib_main.c +2 -0
@@ -2675,6 +2675,7 @@ static int __init ipoib_init_module(void) err_sa:ib_sa_unregister_client (&ipoib_sa_client);destroy_workqueue (ipoib_workqueue); +rcu_barrier (); err_fs:ipoib_unregister_debugfs ();
@@ -2692,6 +2693,7 @@ static void __exit ipoib_cleanup_module(void)ib_sa_unregister_client (&ipoib_sa_client);ipoib_unregister_debugfs ();destroy_workqueue (ipoib_workqueue); +rcu_barrier (); }module_init (ipoib_init_module);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 721/1424 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <[email protected]>
[ Upstream commit 15ae32c4a3551c4c9da457370bdfdd65d171e512 ]
When do_complete() finds the QP in the error state it returns RESPST_CHK_RESOURCE. Before commit 49dc9c1f0c7e ("RDMA/rxe: Cleanup reset state handling in rxe_resp.c") this was the flush loop:check_resource() had an error-state branch that fetched each remaining recv WQE and completed it with IB_WC_WR_FLUSH_ERR, without touching the current packet. That commit removed the error-state branch from check_resource() (draining is now done at rxe_receiver() entry) but kept the do_complete() error-state return.
As a result, when a QP moves to the error state while a packet is being completed - e.g. an rdma_cm disconnect racing with receive processing - the responder state machine loops back into the request processing chain with the already-completed packet still in hand:check_resource() fetches a fresh recv WQE, execute()/send_data_in() copies the same packet payload again, do_complete() posts another IB_WC_SUCCESS CQE (qp->resp.status is still 0), and control returns to the error-state check. The loop re-executes the same packet once per posted recv WQE (observed: ~1000 duplicate IB_WC_SUCCESS completions of one SEND, one per ~8us, matching the RQ occupancy) until the RQ is exhausted, after which qp->resp.wqe is NULL and send_data_in() dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000014 Workqueue: rxe_wq do_work RIP: copy_data+0x29/0x1f0 Call Trace: send_data_in+0x25/0x50 rxe_receiver+0xf36/0x1dd0
The duplicate completions are indistinguishable from real receives to the ULP. During an rds stress test, the message was accepted as new and delivered the same datagram to user space hundreds of times, corrupting the stream; any ULP that relies on RC exactly-once delivery is affected.
A live packet reaching the error-state check in do_complete() has been executed and completed exactly once and must be consumed, not re-processed. Return RESPST_CLEANUP for it (dequeue and free); keep returning RESPST_CHK_RESOURCE for the pkt == NULL case.
--- drivers/infiniband/sw/rxe/rxe_resp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_resp.c +8 -1
@@ -1198,7 +1198,14 @@ static enum resp_states do_complete(struct rxe_qp *qp,spin_lock_irqsave (&qp->state_lock, flags);if (unlikely (qp_state (qp) ==IB_QPS_ERR )) {spin_unlock_irqrestore (&qp->state_lock, flags); -return RESPST_CHK_RESOURCE ; +/* The packet was executed and completed before the QP +* moved to ERROR; it must be consumed exactly once. +* Re-entering the request chain with the stale packet +* would copy it into every remaining recv WQE as a new +* completion. Remaining WQEs are flushed by the drain +* path at rxe_receiver() entry. +*/ +return pkt ?RESPST_CLEANUP :RESPST_CHK_RESOURCE ; }spin_unlock_irqrestore (&qp->state_lock, flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 722/1424 hwrng: ks-sa - access private data via struct hwrng
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit b8f836cbe12bccf2beeadd638e1696f4acaa39c3 ]
This driver uses a struct ks_sa_rng for its private data. It contains a struct hwrng. Call container_of to get from hwrng to ks_sa_rng.
Stable-dep-of: 1c17b601fafb ("hwrng: ks-sa - Fix runtime PM cleanup on registration failure")
--- drivers/char/hw_random/ks-sa-rng.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/char/hw_random/ks-sa-rng.c +4 -11
@@ -113,8 +113,7 @@ static unsigned int refill_delay_ns(unsigned long clk_rate)static int ks_sa_rng_init (struct hwrng *rng) {u32 value; -struct device *dev = (struct device *)rng->priv; -struct ks_sa_rng *ks_sa_rng =dev_get_drvdata (dev); + struct ks_sa_rng *ks_sa_rng = container_of(rng, struct ks_sa_rng, rng);unsigned long clk_rate =clk_get_rate (ks_sa_rng->clk);/* Enable RNG module */
@@ -153,8 +152,7 @@ static int ks_sa_rng_init(struct hwrng *rng)static void ks_sa_rng_cleanup (struct hwrng *rng) { -struct device *dev = (struct device *)rng->priv; -struct ks_sa_rng *ks_sa_rng =dev_get_drvdata (dev); + struct ks_sa_rng *ks_sa_rng = container_of(rng, struct ks_sa_rng, rng);/* Disable RNG */ writel (0 , &ks_sa_rng->reg_rng->control);
@@ -164,8 +162,7 @@ static void ks_sa_rng_cleanup(struct hwrng *rng)static int ks_sa_rng_data_read (struct hwrng *rng,u32 *data) { -struct device *dev = (struct device *)rng->priv; -struct ks_sa_rng *ks_sa_rng =dev_get_drvdata (dev); + struct ks_sa_rng *ks_sa_rng = container_of(rng, struct ks_sa_rng, rng);/* Read random data */ data[0 ] =readl (&ks_sa_rng->reg_rng->output_l);
@@ -179,8 +176,7 @@ static int ks_sa_rng_data_read(struct hwrng *rng, u32 *data)static int ks_sa_rng_data_present (struct hwrng *rng,int wait) { -struct device *dev = (struct device *)rng->priv; -struct ks_sa_rng *ks_sa_rng =dev_get_drvdata (dev); + struct ks_sa_rng *ks_sa_rng = container_of(rng, struct ks_sa_rng, rng);u64 now =ktime_get_ns ();u32 ready;
@@ -225,7 +221,6 @@ static int ks_sa_rng_probe(struct platform_device *pdev) .data_present = ks_sa_rng_data_present, .cleanup = ks_sa_rng_cleanup, }; - ks_sa_rng->rng.priv = (unsigned long )dev; ks_sa_rng->reg_rng =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (ks_sa_rng->reg_rng))
@@ -252,8 +247,6 @@ static int ks_sa_rng_probe(struct platform_device *pdev)return ret; } -platform_set_drvdata (pdev, ks_sa_rng); -return devm_hwrng_register (&pdev->dev, &ks_sa_rng->rng); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 723/1424 hwrng: ks-sa - Fix runtime PM cleanup on registration failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 1c17b601fafb09c9ec074fd097737d20eafe7d63 ]
ks_sa_rng_probe() enables runtime PM and resumes the device before registering the hwrng. If devm_hwrng_register() fails, probe returns without dropping the runtime PM usage count or disabling runtime PM.
Unwind the runtime PM state on the registration failure path, matching the cleanup done by remove().
--- drivers/char/hw_random/ks-sa-rng.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/char/hw_random/ks-sa-rng.c +8 -1
@@ -247,7 +247,14 @@ static int ks_sa_rng_probe(struct platform_device *pdev)return ret; } -return devm_hwrng_register (&pdev->dev, &ks_sa_rng->rng); + ret =devm_hwrng_register (dev, &ks_sa_rng->rng); +if (ret) { +pm_runtime_put_sync (dev); +pm_runtime_disable (dev); +return ret; + } + +return 0 ; }static int ks_sa_rng_remove (struct platform_device *pdev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 724/1424 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc ]
The depth check in xfrm6_input_addr() is off by one:
if (1 + sp->len == XFRM_MAX_DEPTH)
goto drop;
...
sp->xvec[sp->len++] = x;xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode receive path re-enters IPv6 input via xfrm_trans_reinject() with that secpath preserved. If the inner packet carries a destination-options HAO option or a type-2 routing header, xfrm6_input_addr() is called with sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS flags it and panics under panic_on_warn.
Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also restores one chain level the old check rejected at sp->len == 5.
UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10 index 6 is out of range for type 'xfrm_state *[6]'
--- net/ipv6/xfrm6_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/xfrm6_input.c +1 -1
@@ -193,7 +193,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, goto drop; } -if (1 + sp->len ==XFRM_MAX_DEPTH ) { +if (sp->len >=XFRM_MAX_DEPTH ) {XFRM_INC_STATS (net,LINUX_MIB_XFRMINBUFFERERROR ); goto drop; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 725/1424 ALSA: hpi: Check transport errors during HPI6000 adapter initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evgenii Burenchev <[email protected]>
[ Upstream commit cc15c329663e3ef1aeed0b68e49a5d5ce4ae0d5c ]
create_adapter_obj() retrieves adapter information by calling hpi6000_message_response_sequence(). This function reports transport-level errors through its return value and DSP-reported errors via hr0.error.
The current code only checks hr0.error, causing transport-level errors to be ignored. As a result, adapter initialization may continue with an invalid response.
Check the return value of hpi6000_message_response_sequence() before examining hr0.error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/pci/asihpi/hpi6000.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/pci/asihpi/hpi6000.c +5 -0
@@ -537,6 +537,11 @@ static short create_adapter_obj(struct hpi_adapter_obj *pao, hr1.size =sizeof (hr1); error =hpi6000_message_response_sequence (pao,0 , &hm, &hr0); +if (error) { +HPI_DEBUG_LOG (ERROR ,"message transport error %d\n" , + error); +return error; + }if (hr0.error) {HPI_DEBUG_LOG (DEBUG ,"message error %d\n" , hr0.error);return hr0.error;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 726/1424 pmdomain: bcm: bcm2835: handle genpd provider registration errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit a1d9d3b958d69a13783613304f524f489fecdd1f ]
bcm2835_power_probe() initializes all power domains and then registers the onecell genpd provider, but ignores of_genpd_add_provider_onecell() failures. Probe can therefore return success even though no provider was published.
Check the provider registration return value and jump to the existing cleanup path on failure.
--- drivers/pmdomain/bcm/bcm2835-power.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/pmdomain/bcm/bcm2835-power.c +6 -1
@@ -682,7 +682,12 @@ static int bcm2835_power_probe(struct platform_device *pdev)if (ret) goto fail; -of_genpd_add_provider_onecell (dev->parent->of_node, &power->pd_xlate); + ret =of_genpd_add_provider_onecell (dev->parent->of_node, + &power->pd_xlate); +if (ret) { +dev_err_probe (dev, ret,"failed to add genpd provider\n" ); + goto fail; + }dev_info (dev,"Broadcom BCM2835 power domains driver" );return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 727/1424 misc: rtsx_usb: avoid USB I/O in runtime autosuspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Rhodes <[email protected]>
[ Upstream commit 483c948324a3823871c004560a92545759d3253c ]
The runtime autosuspend callback currently queries card status and clears OCP by issuing USB register accesses. This can run from the USB runtime-PM path itself, which is the wrong place to start more device I/O.
Keep a cached copy of the card-status bits from normal status reads instead. During runtime autosuspend, use that cached value only to preserve the existing Memory Stick autosuspend deferral.
Do not treat raw SD_CD as an autosuspend blocker, because tray-based SD readers can assert SD_CD with an empty tray. A real SD card is protected by the SD/MMC child runtime-PM usage once powered.
Also stop clearing OCP from the runtime autosuspend callback, so the callback does not issue USB commands.
--- drivers/misc/cardreader/rtsx_usb.c | 23 ++++++++++++++++++++--- include/linux/rtsx_usb.h | 3 +++ 2 files changed, 23 insertions(+), 3 deletions(-)
drivers/misc/cardreader/rtsx_usb.c +20 -3
@@ -312,6 +312,9 @@ int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)if (ret <0 )return ret; + ucr->card_status_cache = *status; + ucr->card_status_valid = true; +return 0 ; }EXPORT_SYMBOL_GPL (rtsx_usb_get_card_status);
@@ -619,6 +622,7 @@ static int rtsx_usb_probe(struct usb_interface *intf, {struct usb_device *usb_dev =interface_to_usbdev (intf);struct rtsx_ucr *ucr; +u16 status;int ret; dev_dbg(&intf->dev,
@@ -655,6 +659,9 @@ static int rtsx_usb_probe(struct usb_interface *intf,if (ret) goto out_init_fail; +/* Prime cached status for runtime autosuspend decisions. */ +rtsx_usb_get_card_status (ucr, &status); +/* initialize USB SG transfer timer */ timer_setup (&ucr->sg_timer, rtsx_usb_sg_timed_out,0 );
@@ -709,17 +716,27 @@ static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message)struct rtsx_ucr *ucr = (struct rtsx_ucr *)usb_get_intfdata (intf);u16 val =0 ; +bool valid = false;dev_dbg (&intf->dev,"%s called with pm message 0x%04x\n" , __func__, message.event);if (PMSG_IS_AUTO (message)) {if (mutex_trylock (&ucr->dev_mutex)) { -rtsx_usb_get_card_status (ucr, &val); + valid = ucr->card_status_valid; +if (valid) + val = ucr->card_status_cache;mutex_unlock (&ucr->dev_mutex); -/* Defer the autosuspend if card exists */ -if (val & (SD_CD |MS_CD )) { +/* +* Do not issue USB commands from runtime autosuspend. +* Raw SD_CD is not authoritative on tray-based readers, +* while a real SD card is protected by the SD/MMC child +* runtime-PM reference once the card is powered. Keep +* the historical Memory Stick autosuspend deferral when +* the cached status says MS media is present. +*/ +if (valid && (val &MS_CD )) {device_for_each_child (&intf->dev,NULL , rtsx_usb_resume_child);return -EAGAIN ; }
include/linux/rtsx_usb.h +3 -0
@@ -57,6 +57,9 @@ struct rtsx_ucr {struct timer_list sg_timer;struct mutex dev_mutex; + +u16 card_status_cache; +bool card_status_valid; };/* buffer size */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 728/1424 RDMA/hfi1: Preserve unit 0 on allocation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 2e3809ad8911f5d5581b3f046bd628417bface76 ]
hfi1_free_devdata() assumes that the device was inserted into the unit table and unconditionally erases dd->unit. If xa_alloc_irq() fails, the zero-initialized unit remains zero, so full cleanup can remove an unrelated device from index 0.
Release only the rdmavt allocation and return immediately while the unit table has not acquired the device.
--- drivers/infiniband/hw/hfi1/init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hfi1/init.c +3 -2
@@ -1228,8 +1228,9 @@ static struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, GFP_KERNEL);if (ret <0 ) {dev_err (&pdev->dev, -"Could not allocate unit ID: error %d\n" , -ret); - goto bail; +"Could not allocate unit ID: error %pe\n" ,ERR_PTR (ret)); +rvt_dealloc_device (&dd->verbs_dev.rdi); +return ERR_PTR (ret); }rvt_set_ibdev_name (&dd->verbs_dev.rdi,"%s_%d" ,class_name (), dd->unit);/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 729/1424 RDMA/hfi1: Free RX data on late probe failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 8e17e101e04a3dc062e2719da57ff78c1c060632 ]
hfi1_init_dd() allocates the shared AIP/VNIC RX support before returning. If hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears down the device data without calling hfi1_free_rx(). This leaks netdev_rx and its dummy netdev.
Free the RX support after IB unregistration and before postinit_cleanup(), as done on normal device removal.
--- drivers/infiniband/hw/hfi1/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/init.c +1 -0
@@ -1679,6 +1679,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)hfi1_device_remove (dd);if (!ret)hfi1_unregister_ib_device (dd); +hfi1_free_rx (dd);postinit_cleanup (dd);if (initfail) ret = initfail;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 730/1424 RDMA/hfi1: Remove redundant PCI device ID validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit af9117d02f50514c998714b23820de71d0aa5d24 ]
The PCI core calls init_one() only after pci_match_device() has selected an ID. For normal probing, hfi1_pci_tbl already restricts matches to the two supported Intel device IDs. Dynamic IDs and driver_override are explicit requests to attempt binding, so the probe should not second-guess the PCI core's decision.
Remove the redundant check.
Stable-dep-of: 9f674ba674a0 ("RDMA/hfi1: Allocate device data after PCI initialization")
--- drivers/infiniband/hw/hfi1/init.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/infiniband/hw/hfi1/init.c +0 -9
@@ -1564,15 +1564,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)/* First, lock the non-writable module parameters */ HFI1_CAP_LOCK (); -/* Validate dev ids */ -if (!(ent->device ==PCI_DEVICE_ID_INTEL0 || - ent->device ==PCI_DEVICE_ID_INTEL1 )) { -dev_err (&pdev->dev,"Failing on unknown Intel deviceid 0x%x\n" , - ent->device); - ret = -ENODEV ; - goto bail; - } -/* Allocate the dd so we can get to work */ dd =hfi1_alloc_devdata (pdev,NUM_IB_PORTS *sizeof (struct hfi1_pportdata ));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 731/1424 RDMA/hfi1: Create workqueues before device initialization
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 0d5618c1b2fc9dd4fc086f0226acd8a077ab6c1b ]
create_workqueues() only needs fields set up by hfi1_alloc_devdata(). Call it before hfi1_init_dd() so a workqueue allocation failure happens before chip resources are initialized.
To keep the reordered error paths safe, make init_one() own hfi1_devdata. hfi1_init_dd() unwinds its partial setup but leaves the allocation for the caller to free. If device initialization fails, destroy the workqueues before freeing the device data.
Stable-dep-of: 9f674ba674a0 ("RDMA/hfi1: Allocate device data after PCI initialization")
--- drivers/infiniband/hw/hfi1/chip.c | 4 +--- drivers/infiniband/hw/hfi1/hfi.h | 2 -- drivers/infiniband/hw/hfi1/init.c | 19 ++++++++++--------- 3 files changed, 11 insertions(+), 14 deletions(-)
drivers/infiniband/hw/hfi1/chip.c +1 -3
@@ -15065,7 +15065,7 @@ int hfi1_init_dd(struct hfi1_devdata *dd)*/ ret =hfi1_pcie_ddinit (dd, pdev);if (ret <0 ) - goto bail_free; + goto bail;/* Save PCI space registers to rewrite after device reset */ ret =save_pci_variables (dd);
@@ -15320,8 +15320,6 @@ int hfi1_init_dd(struct hfi1_devdata *dd) bail_cleanup:hfi1_free_rx (dd);hfi1_pcie_ddcleanup (dd); -bail_free: -hfi1_free_devdata (dd); bail:return ret; }
drivers/infiniband/hw/hfi1/hfi.h +0 -2
@@ -2044,9 +2044,7 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd)/* waiting for an urgent packet to arrive */ #define HFI1_CTXT_WAITING_URG 4 -/* free up any allocated data at closes */ int hfi1_init_dd (struct hfi1_devdata *dd); -void hfi1_free_devdata (struct hfi1_devdata *dd);/* LED beaconing functions */ void hfi1_start_led_override(struct hfi1_pportdata *ppd, unsigned int timeon,
drivers/infiniband/hw/hfi1/init.c +10 -9
@@ -630,8 +630,6 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd, ppd->sm_trap_qp =0x0 ; ppd->sa_qp =0x1 ; - ppd->hfi1_wq =NULL ; -spin_lock_init (&ppd->cca_timer_lock);for (i =0 ; i <OPA_MAX_SLS ; i++) {
@@ -1165,7 +1163,7 @@ static void finalize_asic_data(struct hfi1_devdata *dd,* It cleans up and frees all data structures set up by * by hfi1_alloc_devdata(). */ -void hfi1_free_devdata (struct hfi1_devdata *dd) +static void hfi1_free_devdata (struct hfi1_devdata *dd) {struct hfi1_asic_data *ad;unsigned long flags;
@@ -1617,17 +1615,17 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)if (ret) goto bail; + ret =create_workqueues (dd); +if (ret) + goto free_devdata; +/* * Do device-specific initialization, function table setup, dd * allocation, etc. */ ret =hfi1_init_dd (dd);if (ret) - goto clean_bail;/* error already printed */ - - ret =create_workqueues (dd); -if (ret) - goto clean_bail; + goto destroy_workqueues;/* error already printed */ /* do the generic initialization */ initfail =hfi1_init (dd,0 );
@@ -1681,7 +1679,10 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)return 0 ; -clean_bail: +destroy_workqueues: +destroy_workqueues (dd); +free_devdata: +hfi1_free_devdata (dd);hfi1_pcie_cleanup (pdev); bail:return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 732/1424 RDMA/hfi1: Stop flushing the global IB workqueue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit d43b1c17f9e1b9d34a0d742f569c00d84147ebc0 ]
hfi1 does not queue work on ib_wq. QSFP and link work run on the per-port link_wq, while the remaining device work uses hfi1_wq or dedicated queues. The probe failure path destroys both per-port workqueues, and normal device removal flushes them in shutdown_device() before destroying them.
Remove the flushes of the core-owned global workqueue. Waiting for unrelated core or other device work is not part of hfi1 teardown.
--- drivers/infiniband/hw/hfi1/init.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/infiniband/hw/hfi1/init.c +0 -4
@@ -1651,7 +1651,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)if (initfail || ret) {msix_clean_up_interrupts (dd);stop_timers (dd); -flush_workqueue (ib_wq);for (pidx =0 ; pidx < dd->num_pports; ++pidx) {hfi1_quiet_serdes (dd->pport + pidx); ppd = dd->pport + pidx;
@@ -1728,9 +1727,6 @@ static void remove_one(struct pci_dev *pdev)stop_timers (dd); -/* wait until all of our (qsfp) queue_work() calls complete */ -flush_workqueue (ib_wq); -postinit_cleanup (dd); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 733/1424 RDMA/hfi1: Initialize debugfs after probe completes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit bb18740b302f6f222ce3d5a7e5c45a52a90df805 ]
Commit ed6f653fe430 ("staging/rdma/hfi1: Fix debugfs access race") moved debugfs creation after device initialization and IB registration so users cannot access the files before the driver is ready. However, init_one() still creates them before character device creation and SDMA startup finish.
Move hfi1_dbg_ibdev_init() to the end of the successful probe path, matching hfi1_dbg_ibdev_exit() as the first action in remove_one().
--- drivers/infiniband/hw/hfi1/init.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hfi1/init.c +2 -4
@@ -1638,11 +1638,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)* we still create devices, so diags, etc. can be used * to determine cause of problem. */ -if (!initfail && !ret) { +if (!initfail && !ret) dd->flags |=HFI1_INITTED ; -/* create debufs files after init and ib register */ -hfi1_dbg_ibdev_init (&dd->verbs_dev); - } j =hfi1_device_create (dd);if (j)
@@ -1675,6 +1672,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) }sdma_start (dd); +hfi1_dbg_ibdev_init (&dd->verbs_dev);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 734/1424 ASoC: apple: mca: increase SERDES reset delay
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Calligeros <[email protected]>
[ Upstream commit cccd721e5aab03e92234faee72b363c9ba60611c ]
The SERDES clusters in this peripheral take a long time to warm up. We tried polling the reset bit until cleared, however this is not a reliable signal of readiness to be configured. Only waiting ~25 us to give the cluster a chance to settle makes it work reliably.
Increase the 2 us delay to 25 us and hope we never have to do this again.
--- sound/soc/apple/mca.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/apple/mca.c +3 -3
@@ -210,10 +210,10 @@ static void mca_fe_early_trigger(struct snd_pcm_substream *substream, int cmd,SERDES_STATUS_EN |SERDES_STATUS_RST , SERDES_STATUS_RST);/* -* Experiments suggest that it takes at most ~1 us -* for the bit to clear, so wait 2 us for good measure. +* The SERDES cluster needs a bit of time to reset itself +* and settle before we start poking it. This is... slow... */ -udelay (2 ); +udelay (25 );WARN_ON (readl_relaxed (cl->base + serdes_unit +REG_SERDES_STATUS ) &SERDES_STATUS_RST ); mca_modify(cl, serdes_conf, SERDES_CONF_SYNC_SEL,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 735/1424 isofs: fix out-of-bounds page array access on empty zisofs block
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 68d4d3e78150c7ed7d1195af63ad1e6ace30c661 ]
zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only [poffset, PAGE_SIZE) of the first page, matching the decompression path. The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290) Read of size 8 at addr ffff88800f5eac48 by task exploit/142 zisofs_read_folio (fs/isofs/compress.c:290) read_pages (mm/readahead.c:184) ... filemap_read (mm/filemap.c:2814) vfs_read (fs/read_write.c:574) __x64_sys_pread64 (fs/read_write.c:769) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address is located 0 bytes to the right of the allocated 8-byte region in the kmalloc-8 cache
--- fs/isofs/compress.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/isofs/compress.c +4 -2
@@ -65,12 +65,14 @@ static loff_t zisofs_uncompress_block(struct inode *inode, loff_t block_start,/* Empty block? */ if (block_size ==0 ) {for ( i =0 ; i < pcount ; i++ ) { +unsigned int off = i ?0 : poffset; +if (!pages[i])continue ; -memzero_page (pages[i],0 ,PAGE_SIZE ); +memzero_page (pages[i], off,PAGE_SIZE - off);SetPageUptodate (pages[i]); } -return ((loff_t )pcount) <<PAGE_SHIFT ; +return (((loff_t )pcount) <<PAGE_SHIFT ) - poffset; }/* Because zlib is not thread-safe, do all the I/O at the top. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 736/1424 media: v4l: async: Drop useless list move operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
[ Upstream commit bec3db03911bd85da29c1c8ee556162153002c9a ]
v4l2_async_unbind_subdev_one(), which is called in the line following the list_move() operation contains list_move_tail() for the same entry and overrides anything list_move() did. Thus it can be removed.
Stable-dep-of: 4e72f13d58c4 ("media: v4l2-async: Unregister sub-device if asc_list is empty")
--- drivers/media/v4l2-core/v4l2-async.c | 3 --- 1 file changed, 3 deletions(-)
drivers/media/v4l2-core/v4l2-async.c +0 -3
@@ -895,9 +895,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd)if (sd->asc_list.next) {list_for_each_entry_safe (asc, asc_tmp, &sd->asc_list, asc_subdev_entry) { -list_move (&asc->asc_entry, - &asc->notifier->waiting_list); -v4l2_async_unbind_subdev_one (asc->notifier, asc); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 737/1424 media: v4l2-async: Unregister sub-device if asc_list is empty
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 4e72f13d58c4245c177a9d5f54579345554f354d ]
When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes.
The cause is that the tvp5150 i2c module uses v4l2_async, but the em28xx driver does not since it predates v4l2_async.
In that corner case sd->asc_list is empty, so v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev().
Modify the code so that, if sd->asc_list is empty, v4l2_device_unregister_subdev() is still called.
--- drivers/media/v4l2-core/v4l2-async.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/media/v4l2-core/v4l2-async.c +12 -3
@@ -893,9 +893,18 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) sd->subdev_notifier =NULL ;if (sd->asc_list.next) { -list_for_each_entry_safe (asc, asc_tmp, &sd->asc_list, - asc_subdev_entry) { -v4l2_async_unbind_subdev_one (asc->notifier, asc); +if (list_empty (&sd->asc_list)) { +/* +* If the sub-device was registered through other means +* than v4l2-async, there are no async connections but +* the sub-device may still well be registered. +* Unregister it now. +*/ +v4l2_device_unregister_subdev (sd); + }else { +list_for_each_entry_safe (asc, asc_tmp, &sd->asc_list, + asc_subdev_entry) +v4l2_async_unbind_subdev_one (asc->notifier, asc); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 738/1424 rpmsg: glink: remove duplicate code for rpmsg device remove
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit 112766cdf2e5ea0a0f72b0304d57a6f74c066670 ]
rpmsg device remove code is duplicated in at-least 2-3 places, add a helper function to remove this duplicated code.
Stable-dep-of: 5a5a48e788e0 ("rpmsg: glink: fix deadlock in endpoint destroy during driver detach")
--- drivers/rpmsg/qcom_glink_native.c | 43 ++++++++++++------------------- 1 file changed, 16 insertions(+), 27 deletions(-)
drivers/rpmsg/qcom_glink_native.c +16 -27
@@ -1313,11 +1313,23 @@ static int qcom_glink_announce_create(struct rpmsg_device *rpdev)return 0 ; } +static void qcom_glink_remove_rpmsg_device (struct qcom_glink *glink,struct glink_channel *channel) +{ +struct rpmsg_channel_info chinfo; + +if (channel->rpdev) { +strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); + chinfo.src =RPMSG_ADDR_ANY ; + chinfo.dst =RPMSG_ADDR_ANY ; +rpmsg_unregister_device (glink->dev, &chinfo); + } + channel->rpdev =NULL ; +} +static void qcom_glink_destroy_ept (struct rpmsg_endpoint *ept) {struct glink_channel *channel =to_glink_channel (ept);struct qcom_glink *glink = channel->glink; -struct rpmsg_channel_info chinfo;unsigned long flags;spin_lock_irqsave (&channel->recv_lock, flags);
@@ -1325,14 +1337,7 @@ static void qcom_glink_destroy_ept(struct rpmsg_endpoint *ept)spin_unlock_irqrestore (&channel->recv_lock, flags);/* Decouple the potential rpdev from the channel */ -if (channel->rpdev) { -strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); - chinfo.src =RPMSG_ADDR_ANY ; - chinfo.dst =RPMSG_ADDR_ANY ; - -rpmsg_unregister_device (glink->dev, &chinfo); - } - channel->rpdev =NULL ; +qcom_glink_remove_rpmsg_device (glink, channel);qcom_glink_send_close_req (glink, channel); }
@@ -1610,7 +1615,6 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,static void qcom_glink_rx_close (struct qcom_glink *glink,unsigned int rcid) { -struct rpmsg_channel_info chinfo;struct glink_channel *channel;unsigned long flags;
@@ -1623,14 +1627,7 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)/* cancel pending rx_done work */ cancel_work_sync (&channel->intent_work); -if (channel->rpdev) { -strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); - chinfo.src =RPMSG_ADDR_ANY ; - chinfo.dst =RPMSG_ADDR_ANY ; - -rpmsg_unregister_device (glink->dev, &chinfo); - } - channel->rpdev =NULL ; +qcom_glink_remove_rpmsg_device (glink, channel);qcom_glink_send_close_ack (glink, channel->rcid);
@@ -1644,7 +1641,6 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)static void qcom_glink_rx_close_ack (struct qcom_glink *glink,unsigned int lcid) { -struct rpmsg_channel_info chinfo;struct glink_channel *channel;unsigned long flags;
@@ -1663,14 +1659,7 @@ static void qcom_glink_rx_close_ack(struct qcom_glink *glink, unsigned int lcid)spin_unlock_irqrestore (&glink->idr_lock, flags);/* Decouple the potential rpdev from the channel */ -if (channel->rpdev) { -strscpy (chinfo.name, channel->name,sizeof (chinfo.name)); - chinfo.src =RPMSG_ADDR_ANY ; - chinfo.dst =RPMSG_ADDR_ANY ; - -rpmsg_unregister_device (glink->dev, &chinfo); - } - channel->rpdev =NULL ; +qcom_glink_remove_rpmsg_device (glink, channel);kref_put (&channel->refcount, qcom_glink_channel_release); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 739/1424 rpmsg: glink: fix deadlock in endpoint destroy during driver detach
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Santhosh <[email protected]>
[ Upstream commit 5a5a48e788e02fd8a8eb7188ce440572d6c12418 ]
During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely.
The deadlock manifests with the following call chain:
[<0>] device_del+0x44/0x414 <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c
The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered:
- Driver detach path: the driver core already tears down the rpmsg device.
- Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached.
Remove the redundant unregistration to fix the deadlock.
--- drivers/rpmsg/qcom_glink_native.c | 3 --- 1 file changed, 3 deletions(-)
drivers/rpmsg/qcom_glink_native.c +0 -3
@@ -1336,9 +1336,6 @@ static void qcom_glink_destroy_ept(struct rpmsg_endpoint *ept) channel->ept.cb =NULL ;spin_unlock_irqrestore (&channel->recv_lock, flags); -/* Decouple the potential rpdev from the channel */ -qcom_glink_remove_rpmsg_device (glink, channel); -qcom_glink_send_close_req (glink, channel); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 740/1424 cxl/mbox: Break poison list loop on an empty payload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 8b301c4afbce4bc3f94528441d8d5ce1366504ad ]
A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration never advances nr_records, so the max_errors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared _FLAG_MORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case.
Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan.
--- drivers/cxl/core/mbox.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/cxl/core/mbox.c +5 -0
@@ -1333,6 +1333,11 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len,if (rc)break ; +if (!le16_to_cpu (po->count)) { +dev_dbg (&cxlmd->dev,"Poison empty payload!\n" ); +break ; + } +for (int i =0 ; i <le16_to_cpu (po->count); i++) trace_cxl_poison(cxlmd, cxlr, &po->record[i], po->flags, po->overflow_ts,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 741/1424 cxl/pci: Store the endpoints Component Register mappings in struct cxl_dev_state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Richter <[email protected]>
[ Upstream commit 2dd18279202f6247904e6e23738c1ec6a86b24b1 ]
Same as for ports and dports, also store the endpoint's Component Register mappings, use struct cxl_dev_state for that.
Keep the Component Register base address @component_reg_phys a bit to not break functionality. It will be removed after the transition in a later patch.
Stable-dep-of: 430c502c80e5 ("cxl/pci: Honor -EPROBE_DEFER from component register setup")
--- drivers/cxl/core/mbox.c | 2 ++ drivers/cxl/cxlmem.h | 2 ++ drivers/cxl/pci.c | 9 +++++---- 3 files changed, 9 insertions(+), 4 deletions(-)
drivers/cxl/core/mbox.c +2 -0
@@ -1404,6 +1404,8 @@ struct cxl_memdev_state *cxl_memdev_state_create(struct device *dev)mutex_init (&mds->mbox_mutex);mutex_init (&mds->event.log_lock); mds->cxlds.dev = dev; + mds->cxlds.reg_map.host = dev; + mds->cxlds.reg_map.resource =CXL_RESOURCE_NONE ; mds->cxlds.type =CXL_DEVTYPE_CLASSMEM ;return mds;
drivers/cxl/cxlmem.h +2 -0
@@ -400,6 +400,7 @@ enum cxl_devtype {* * @dev: The device associated with this CXL state * @cxlmd: The device representing the CXL.mem capabilities of @dev +* @reg_map: component and ras register mapping parameters * @regs: Parsed register blocks * @cxl_dvsec: Offset to the PCIe device DVSEC * @rcd: operating in RCD mode (CXL 3.0 9.11.8 CXL Devices Attached to an RCH)
@@ -414,6 +415,7 @@ enum cxl_devtype {struct cxl_dev_state {struct device *dev;struct cxl_memdev *cxlmd; +struct cxl_register_map reg_map;struct cxl_regs regs;int cxl_dvsec;bool rcd;
drivers/cxl/pci.c +5 -4
@@ -825,15 +825,16 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)* still be useful for management functions so don't return an error. */ cxlds->component_reg_phys =CXL_RESOURCE_NONE ; - rc =cxl_pci_setup_regs (pdev,CXL_REGLOC_RBI_COMPONENT , &map); + rc =cxl_pci_setup_regs (pdev,CXL_REGLOC_RBI_COMPONENT , + &cxlds->reg_map);if (rc)dev_warn (&pdev->dev,"No component registers (%d)\n" , rc); -else if (!map.component_map.ras.valid) +else if (!cxlds->reg_map.component_map.ras.valid)dev_dbg (&pdev->dev,"RAS registers not found\n" ); - cxlds->component_reg_phys = map.resource; + cxlds->component_reg_phys = cxlds->reg_map.resource; - rc =cxl_map_component_regs (&map, &cxlds->regs.component, + rc =cxl_map_component_regs (&cxlds->reg_map, &cxlds->regs.component,BIT (CXL_CM_CAP_CAP_ID_RAS ));if (rc)dev_dbg (&pdev->dev,"Failed to map RAS capability.\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 742/1424 cxl/pci: Honor -EPROBE_DEFER from component register setup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 430c502c80e542e77bcf97db13ec0e8cdf9addb0 ]
cxl_pci_setup_regs() for CXL_REGLOC_RBI_COMPONENT can return -EPROBE_DEFER on a Restricted CXL Host (RCD) when the upstream port has not yet been enumerated and the Component Registers must be extracted from the RCRB. cxl_pci_probe() treats every non-zero return from that call as the benign "component registers not found" case, logs a warning, and continues. The rc is then immediately overwritten by the subsequent cxl_pci_type3_init_mailbox() call, so the deferral is silently swallowed.
Return -EPROBE_DEFER instead of continuing so the probe is retried once the upstream port is available.
--- drivers/cxl/pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/cxl/pci.c +5 -2
@@ -827,10 +827,13 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) cxlds->component_reg_phys =CXL_RESOURCE_NONE ; rc =cxl_pci_setup_regs (pdev,CXL_REGLOC_RBI_COMPONENT , &cxlds->reg_map); -if (rc) +if (rc) { +if (rc == -EPROBE_DEFER ) +return rc;dev_warn (&pdev->dev,"No component registers (%d)\n" , rc); -else if (!cxlds->reg_map.component_map.ras.valid) + }else if (!cxlds->reg_map.component_map.ras.valid) {dev_dbg (&pdev->dev,"RAS registers not found\n" ); + } cxlds->component_reg_phys = cxlds->reg_map.resource;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 743/1424 fs/ntfs3: Add more checks in mi_enum_attr (part 2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit a8f659ce14f8f734894227ba2c5ca78c8451501e ]
Add offset check before access to attr->non_res field as mentioned in [1].
[1] https://lore.kernel.org/ntfs3/[email protected]/
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
--- fs/ntfs3/record.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
fs/ntfs3/record.c +13 -3
@@ -212,7 +212,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)return NULL ;if (off >= used || off <MFTRECORD_FIXUP_OFFSET_1 || - !IS_ALIGNED (off,4 )) { + !IS_ALIGNED (off,8 )) {return NULL ; }
@@ -236,8 +236,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) off += asize; } -/* Can we use the first field (attr->type). */ -/* NOTE: this code also checks attr->size availability. */ +/* +* Can we use the first fields: +* attr->type, +* attr->size +*/ if (off +8 > used) {static_assert (ALIGN (sizeof (enum ATTR_TYPE ),8 ) ==8 );return NULL ;
@@ -259,10 +262,17 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) asize =le32_to_cpu (attr->size); +if (!IS_ALIGNED (asize,8 )) +return NULL ; +/* Check overflow and boundary. */ if (off + asize < off || off + asize > used)return NULL ; +/* Can we use the field attr->non_res. */ +if (off +9 > used) +return NULL ; +/* Check size of attribute. */ if (!attr->non_res) {/* Check resident fields. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 744/1424 fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <[email protected]>
[ Upstream commit 2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e ]
Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
--- fs/ntfs3/attrib.c | 11 ++++--- fs/ntfs3/frecord.c | 59 ++++++++++++++++++---------------- fs/ntfs3/ntfs_fs.h | 21 ++++++------ fs/ntfs3/record.c | 79 ++++++++++++++++++++++++---------------------- 4 files changed, 90 insertions(+), 80 deletions(-)
fs/ntfs3/attrib.c +6 -5
@@ -790,7 +790,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,if (err) goto out; - attr =mi_find_attr (mi,NULL , type, name, name_len, &le->id); + attr =mi_find_attr (ni, mi,NULL , type, name, name_len, + &le->id);if (!attr) { err = -EINVAL ; goto bad_inode;
@@ -1198,7 +1199,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, goto out; } - attr =mi_find_attr (mi,NULL ,ATTR_DATA ,NULL ,0 , &le->id); + attr =mi_find_attr (ni, mi,NULL ,ATTR_DATA ,NULL ,0 , &le->id);if (!attr) { err = -EINVAL ; goto out;
@@ -1834,7 +1835,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, goto out; } - attr =mi_find_attr (mi,NULL ,ATTR_DATA ,NULL ,0 , + attr =mi_find_attr (ni, mi,NULL ,ATTR_DATA ,NULL ,0 , &le->id);if (!attr) { err = -EINVAL ;
@@ -2079,8 +2080,8 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) }/* Look for required attribute. */ - attr =mi_find_attr (mi,NULL ,ATTR_DATA ,NULL , -0 , &le->id); + attr =mi_find_attr (ni, mi,NULL ,ATTR_DATA , +NULL ,0 , &le->id);if (!attr) { err = -EINVAL ; goto out;
fs/ntfs3/frecord.c +31 -28
226 lines not on this page · raw message
fs/ntfs3/ntfs_fs.h +11 -10
@@ -740,23 +740,24 @@ int mi_get(struct ntfs_sb_info *sbi, CLST rno, struct mft_inode **mi);void mi_put (struct mft_inode *mi);int mi_init (struct mft_inode *mi,struct ntfs_sb_info *sbi,CLST rno);int mi_read (struct mft_inode *mi,bool is_mft); -struct ATTRIB *mi_enum_attr (struct mft_inode *mi,struct ATTRIB *attr); -// TODO: id? -struct ATTRIB *mi_find_attr (struct mft_inode *mi,struct ATTRIB *attr, -enum ATTR_TYPE type,const __le16 *name, -u8 name_len,const __le16 *id); -static inline struct ATTRIB *rec_find_attr_le (struct mft_inode *rec, +struct ATTRIB *mi_enum_attr (struct ntfs_inode *ni,struct mft_inode *mi, +struct ATTRIB *attr); +struct ATTRIB *mi_find_attr (struct ntfs_inode *ni,struct mft_inode *mi, +struct ATTRIB *attr,enum ATTR_TYPE type, +const __le16 *name,u8 name_len,const __le16 *id); +static inline struct ATTRIB *rec_find_attr_le (struct ntfs_inode *ni, +struct mft_inode *rec,struct ATTR_LIST_ENTRY *le) { -return mi_find_attr (rec,NULL , le->type,le_name (le), le->name_len, +return mi_find_attr (ni, rec,NULL , le->type,le_name (le), le->name_len, &le->id); }int mi_write (struct mft_inode *mi,int wait);int mi_format_new (struct mft_inode *mi,struct ntfs_sb_info *sbi,CLST rno,__le16 flags,bool is_mft); -struct ATTRIB *mi_insert_attr (struct mft_inode *mi,enum ATTR_TYPE type, -const __le16 *name,u8 name_len,u32 asize, -u16 name_off); +struct ATTRIB *mi_insert_attr (struct ntfs_inode *ni,struct mft_inode *mi, +enum ATTR_TYPE type,const __le16 *name, +u8 name_len,u32 asize,u16 name_off);bool mi_remove_attr (struct ntfs_inode *ni,struct mft_inode *mi,struct ATTRIB *attr);
fs/ntfs3/record.c +42 -37
216 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 745/1424 fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirbhay Sharma <[email protected]>
[ Upstream commit 5f33da04e6ceee849e76e6592cc283c72fef7af9 ]
The call to kmalloc() to allocate the attribute list buffer is given a size of al_aligned(rs). This size can be larger than the data subsequently copied into the buffer, leaving trailing bytes uninitialized.
This can trigger a KMSAN "uninit-value" warning if that memory is later accessed.
Fix this by using kzalloc() instead, which ensures the entire allocated buffer is zero-initialized, preventing the warning.
Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()")
--- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/frecord.c +1 -1
@@ -824,7 +824,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)* Skip estimating exact memory requirement. * Looks like one record_size is always enough. */ - le =kmalloc (al_aligned (rs),GFP_NOFS ); + le =kzalloc (al_aligned (rs),GFP_NOFS );if (!le)return -ENOMEM ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 746/1424 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: HE WEI（ギカク） <[email protected]>
[ Upstream commit 7c4841e2a62794a3bab7c1ff0540580f387e377f ]
ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against the end of the buffer; the total size is only computed after the loop.
A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24) bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32) bytes in the list. Because the number of attributes in a record is not bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless minimum-size attributes), a crafted record packed with such attributes produces a list larger than record_size and overflows the heap buffer.
This is reachable from a crafted, loop-mounted NTFS image: opening the file and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() -> ni_create_attr_list().
BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058 Write of size 4 at addr ffff000008984c00 by task setfattr/345 ni_create_attr_list+0xc48/0x1058 ni_ins_attr_ext+0x510/0x7c0 ni_insert_attr+0x3f8/0x70c ni_insert_resident+0xc8/0x3b0 ntfs_set_ea+0x66c/0xd28 ntfs_setxattr+0x4d8/0x5b0 __arm64_sys_setxattr+0xa4/0x124 Allocated by task 345: ni_create_attr_list+0x188/0x1058 The buggy address belongs to the cache kmalloc-1k of size 1024 (the write lands at object+1024).
Size the buffer from the actual attributes instead of assuming a single record_size is always enough.
--- fs/ntfs3/frecord.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
fs/ntfs3/frecord.c +16 -4
@@ -821,10 +821,23 @@ int ni_create_attr_list(struct ntfs_inode *ni) rs = sbi->record_size;/* -* Skip estimating exact memory requirement. -* Looks like one record_size is always enough. +* Compute the exact size of the attribute list. Each attribute in the +* record yields one ATTR_LIST_ENTRY of le_size(name_len) bytes. The +* minimum on-disk attribute is SIZEOF_RESIDENT (0x18) bytes, but an +* unnamed one expands to le_size(0) (0x20) here, so a record crafted +* with many such attributes needs more than a single record_size; the +* previous fixed kzalloc(record_size) could therefore be overflowed by +* an attacker-controlled record. */ - le =kzalloc (al_aligned (rs),GFP_NOFS ); + lsize =0 ; + attr =NULL ; +while ((attr =mi_enum_attr (ni, &ni->mi, attr))) + lsize +=le_size (attr->name_len); + +if (!lsize) +return -EINVAL ; + + le =kzalloc (al_aligned (lsize),GFP_NOFS );if (!le)return -ENOMEM ;
@@ -834,7 +847,6 @@ int ni_create_attr_list(struct ntfs_inode *ni) attr =NULL ; nb =0 ; free_b =0 ; - attr =NULL ;for (; (attr =mi_enum_attr (ni, &ni->mi, attr)); le =Add2Ptr (le, sz)) { sz =le_size (attr->name_len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 747/1424 hfsplus: validate thread record before delete key rebuild
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
[ Upstream commit e2ea5cac61acfc11dad22f1d2d4bc71d56c52a20 ]
hfsplus_delete_cat() is called with str == NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed. In that case, the function finds the catalog thread by CNID and rebuilds the catalog key from thread.nodeName.
That reconstruction path reads thread.nodeName.length directly from the catalog B-tree into fd.search_key and then copies length * 2 bytes into fd.search_key->cat.name.unicode. It does not first check that the found record is a thread record or that its size matches the thread name.
A corrupted image can therefore provide an oversized thread name length and make hfs_bnode_read() write past the catalog search-key allocation.
Read the CNID record through hfsplus_brec_read_cat(), which bounds the record read to sizeof(hfsplus_cat_entry) and verifies that a thread record's size exactly matches nodeName.length. Together, these checks ensure an accepted thread name fits HFSPLUS_MAX_STRLEN. Reject non-thread records before building the delete key from the validated thread name.
Share the thread-record-type helper between hfsplus_find_cat() and hfsplus_delete_cat().
--- fs/hfsplus/catalog.c | 25 ++++++++++++------------- fs/hfsplus/hfsplus_fs.h | 6 ++++++ 2 files changed, 18 insertions(+), 13 deletions(-)
fs/hfsplus/catalog.c +12 -13
@@ -204,7 +204,7 @@ int hfsplus_find_cat(struct super_block *sb, u32 cnid,return err; type =be16_to_cpu (tmp.type); -if (type !=HFSPLUS_FOLDER_THREAD && type !=HFSPLUS_FILE_THREAD ) { +if (!is_hfs_thread_record_type (type)) {pr_err ("found bad thread record in catalog\n" );return -EIO ; }
@@ -350,23 +350,22 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str) goto out;if (!str) { -int len; +hfsplus_cat_entry entry = {0 };hfsplus_cat_build_key_with_cnid (sb, fd.search_key, cnid); - err =hfs_brec_find (&fd, hfs_find_rec_by_key); + err =hfsplus_brec_read_cat (&fd, &entry);if (err) goto out; - off = fd.entryoffset + - offsetof(struct hfsplus_cat_thread , nodeName); - fd.search_key->cat.parent =cpu_to_be32 (dir->i_ino); -hfs_bnode_read (fd.bnode, - &fd.search_key->cat.name.length, off,2 ); - len =be16_to_cpu (fd.search_key->cat.name.length) *2 ; -hfs_bnode_read (fd.bnode, - &fd.search_key->cat.name.unicode, - off +2 , len); - fd.search_key->key_len =cpu_to_be16 (6 + len); + type =be16_to_cpu (entry.type); +if (!is_hfs_thread_record_type (type)) { +pr_err ("found bad thread record in catalog\n" ); + err = -EIO ; + goto out; + } + +hfsplus_cat_build_key_uni (fd.search_key, dir->i_ino, + &entry.thread.nodeName); }else { err =hfsplus_cat_build_key (sb, fd.search_key, dir->i_ino, str);if (unlikely (err))
fs/hfsplus/hfsplus_fs.h +6 -0
@@ -542,6 +542,12 @@ static inline u32 hfsplus_cat_thread_size(const struct hfsplus_cat_thread *threabe16_to_cpu (thread->nodeName.length) *sizeof (hfsplus_unichr); } +static inline +bool is_hfs_thread_record_type (u16 type) +{ +return type ==HFSPLUS_FOLDER_THREAD || type ==HFSPLUS_FILE_THREAD ; +} +int hfsplus_brec_read_cat (struct hfs_find_data *fd,hfsplus_cat_entry *entry);/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 748/1424 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 12b09e478aa7459b7893a695ef77682202f2da83 ]
ath11k can receive HT/VHT/HE frames whose reported MCS is above the maximum that can be expressed in the corresponding mac80211 rate space (e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).
The frame itself is valid and decodes correctly, but for such a frame ath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range value and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches mac80211 it trips the rate sanity check and the frame is dropped with a splat:
ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12
WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]
Dropping the frame would discard otherwise valid data, so instead cap the reported MCS to the maximum the rate space can express and deliver the frame. Set rx_status->encoding before the range check and assign rate_idx from the capped value, so a frame with an out-of-range MCS no longer leaves partial or bogus rate metadata behind. Also downgrade the logging level since they are not treated as invalid frames now. The only loss is that such a frame is reported as the capped MCS in the rx rate statistics.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 30 ++++++++++++------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +15 -15
@@ -2335,10 +2335,10 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,case RX_MSDU_START_PKT_TYPE_11N : rx_status->encoding =RX_ENC_HT ;if (rate_mcs >ATH11K_HT_MCS_MAX ) { -ath11k_warn (ar->ab, -"Received with invalid mcs in HT mode %d\n" , - rate_mcs); -break ; +ath11k_dbg (ar->ab,ATH11K_DBG_DP_RX , +"Received HT frame with out-of-range mcs %d, capping to %d\n" , + rate_mcs,ATH11K_HT_MCS_MAX ); + rate_mcs =ATH11K_HT_MCS_MAX ; } rx_status->rate_idx = rate_mcs + (8 * (nss -1 ));if (sgi)
@@ -2347,13 +2347,13 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc,break ;case RX_MSDU_START_PKT_TYPE_11AC : rx_status->encoding =RX_ENC_VHT ; - rx_status->rate_idx = rate_mcs;if (rate_mcs >ATH11K_VHT_MCS_MAX ) { -ath11k_warn (ar->ab, -"Received with invalid mcs in VHT mode %d\n" , - rate_mcs); -break ; +ath11k_dbg (ar->ab,ATH11K_DBG_DP_RX , +"Received VHT frame with out-of-range mcs %d, capping to %d\n" , + rate_mcs,ATH11K_VHT_MCS_MAX ); + rate_mcs =ATH11K_VHT_MCS_MAX ; } + rx_status->rate_idx = rate_mcs; rx_status->nss = nss;if (sgi) rx_status->enc_flags |=RX_ENC_FLAG_SHORT_GI ;
@@ -2363,14 +2363,14 @@ static void ath11k_dp_rx_h_rate(struct ath11k *ar, struct hal_rx_desc *rx_desc, rx_status->enc_flags |=RX_ENC_FLAG_LDPC ;break ;case RX_MSDU_START_PKT_TYPE_11AX : - rx_status->rate_idx = rate_mcs; + rx_status->encoding =RX_ENC_HE ;if (rate_mcs >ATH11K_HE_MCS_MAX ) { -ath11k_warn (ar->ab, -"Received with invalid mcs in HE mode %d\n" , - rate_mcs); -break ; +ath11k_dbg (ar->ab,ATH11K_DBG_DP_RX , +"Received HE frame with out-of-range mcs %d, capping to %d\n" , + rate_mcs,ATH11K_HE_MCS_MAX ); + rate_mcs =ATH11K_HE_MCS_MAX ; } - rx_status->encoding =RX_ENC_HE ; + rx_status->rate_idx = rate_mcs; rx_status->nss = nss; rx_status->he_gi =ath11k_mac_he_gi_to_nl80211_he_gi (sgi); rx_status->bw =ath11k_mac_bw_to_mac80211_bw (bw);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 749/1424 firmware: arm_scmi: Unregister device notifier before IDR teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 66a0bbf30cc14140fe13f63cd594a7c1ee352b75 ]
The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR. During remove, unregister the notifier before releasing and destroying active_protocols so no notifier callback can race with the IDR teardown.
Keep the bus notifier registered until after the protocol state is torn down, matching the existing remove ordering for SCMI bus users.
--- drivers/firmware/arm_scmi/driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/firmware/arm_scmi/driver.c +3 -2
@@ -2936,6 +2936,9 @@ static int scmi_remove(struct platform_device *pdev)list_del (&info->node);mutex_unlock (&scmi_list_mutex); +blocking_notifier_chain_unregister (&scmi_requested_devices_nh, + &info->dev_req_nb); +scmi_notification_exit (&info->handle);mutex_lock (&info->protocols_mtx);
@@ -2946,8 +2949,6 @@ static int scmi_remove(struct platform_device *pdev)of_node_put (child);idr_destroy (&info->active_protocols); -blocking_notifier_chain_unregister (&scmi_requested_devices_nh, - &info->dev_req_nb);bus_unregister_notifier (&scmi_bus_type, &info->bus_nb);/* Safe to free channels since no more users */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 750/1424 firmware: arm_scmi: Free transport channel on IDR failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit d72e7e5f24687c0490aabf317653caffe0447aeb ]
If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific resources such as IRQs, mailbox channels and mapped shared memory are released consistently with the normal teardown path.
--- drivers/firmware/arm_scmi/driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/arm_scmi/driver.c +1 -0
@@ -2463,6 +2463,7 @@ static int scmi_chan_setup(struct scmi_info *info, struct device_node *of_node, "unable to allocate SCMI idr slot err %d\n", ret);/* Destroy channel and device only if created by this call. */ if (tdev) { + info->desc->ops->chan_free (prot_id, cinfo, idr);of_node_put (of_node);scmi_device_destroy (info->dev, prot_id, name);devm_kfree (info->dev, cinfo);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 751/1424 firmware: arm_scmi: Avoid IDR updates while cleaning channels
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit c38b1e19485aaa820e52cfe162525a8af67563da ]
scmi_cleanup_channels() walks the TX/RX channel IDRs with idr_for_each() to free transport resources and destroy the dedicated transport devices before calling idr_destroy().
The destroy callback removed each entry from the same IDR being walked. That is not needed for this cleanup path, and it is unsafe because idr_for_each() has not advanced its radix-tree iterator while the callback is running. Removing the current entry from the callback can invalidate the iterator state. The callback also cannot be protected by rcu_read_lock(), because scmi_device_destroy() may sleep.
Leave IDR teardown to the following idr_destroy() call and keep the callback limited to device destruction.
--- drivers/firmware/arm_scmi/driver.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/firmware/arm_scmi/driver.c +1 -3
@@ -2539,7 +2539,7 @@ static int scmi_channels_setup(struct scmi_info *info)return 0 ; } -static int scmi_chan_destroy (int id,void *p,void *idr) +static int scmi_chan_destroy (int id,void *p,void *data) {struct scmi_chan_info *cinfo = p;
@@ -2552,8 +2552,6 @@ static int scmi_chan_destroy(int id, void *p, void *idr) cinfo->dev =NULL ; } -idr_remove (idr, id); -return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 752/1424 firmware: arm_scmi: Reject out of range DT protocol IDs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 59407ccb52130f2c81f4b3cbe4f14114afceb54f ]
SCMI protocol IDs carried in message headers are limited by MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then kept processing the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8 protocol ID, where it can be truncated and/or treated as a different protocol.
For channel setup, two different out-of-range values can also be used as distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID field before setting up channels or creating protocol devices.
--- drivers/firmware/arm_scmi/driver.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/firmware/arm_scmi/driver.c +6 -2
@@ -2525,9 +2525,11 @@ static int scmi_channels_setup(struct scmi_info *info)if (of_property_read_u32 (child,"reg" , &prot_id))continue ; -if (!FIELD_FIT (MSG_PROTOCOL_ID_MASK , prot_id)) +if (!FIELD_FIT (MSG_PROTOCOL_ID_MASK , prot_id)) {dev_err (info->dev,"Out of range protocol %d\n" , prot_id); +continue ; + } ret =scmi_txrx_setup (info, child, prot_id);if (ret) {
@@ -2876,8 +2878,10 @@ static int scmi_probe(struct platform_device *pdev)if (of_property_read_u32 (child,"reg" , &prot_id))continue ; -if (!FIELD_FIT (MSG_PROTOCOL_ID_MASK , prot_id)) +if (!FIELD_FIT (MSG_PROTOCOL_ID_MASK , prot_id)) {dev_err (dev,"Out of range protocol %d\n" , prot_id); +continue ; + }if (!scmi_is_protocol_implemented (handle, prot_id)) { dev_err(dev, "SCMI protocol %d not implemented\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 753/1424 firmware: arm_scmi: Use channel ID for transport teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit a71a3d4d8a6e9e399fd988c0e6da47a6ee21c99e ]
SCMI protocols can share the BASE transport channel when firmware does not describe a dedicated channel for the protocol. In that case multiple IDR entries can point at the same scmi_chan_info, whose owning transport device was created with cinfo->id.
scmi_chan_destroy() used the IDR iterator key when destroying the transport device. If an alias entry is visited before the owning channel entry, the lookup can miss the device because the iterator key does not match the protocol ID used when the transport device was created. The code then clears cinfo->dev, so the later owning entry skips teardown and leaks the transport device.
Destroy the transport device using cinfo->id, which is the protocol ID that owns the channel and was used when creating the transport device.
--- drivers/firmware/arm_scmi/driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/driver.c +1 -1
@@ -2550,7 +2550,7 @@ static int scmi_chan_destroy(int id, void *p, void *data)struct scmi_device *sdev =to_scmi_dev (cinfo->dev);of_node_put (cinfo->dev->of_node); -scmi_device_destroy (info->dev, id, sdev->name); +scmi_device_destroy (info->dev, cinfo->id, sdev->name); cinfo->dev =NULL ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 754/1424 firmware: arm_scmi: Protect device request lookup with RCU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit e6a0e7a49d83e4fa4e1db68d74f99282eb97aa49 ]
The SCMI device request notifier looks up protocol OF nodes from the active_protocols IDR. The IDR lookup can run concurrently with protocol activation while probe is still registering protocols and creating their SCMI devices.
Wrap the lookup in an RCU read-side critical section as required by the IDR API for lockless readers.
--- drivers/firmware/arm_scmi/driver.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/arm_scmi/driver.c +3 -0
@@ -31,6 +31,7 @@#include <linux/of.h> #include <linux/platform_device.h> #include <linux/processor.h> +#include <linux/rcupdate.h> #include <linux/refcount.h> #include <linux/slab.h>
@@ -2613,7 +2614,9 @@ static int scmi_device_request_notifier(struct notifier_block *nb,struct scmi_device_id *id_table = data;struct scmi_info *info =req_nb_to_scmi_info (nb); +rcu_read_lock (); np =idr_find (&info->active_protocols, id_table->protocol_id); +rcu_read_unlock ();if (!np)return NOTIFY_DONE ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 755/1424 firmware: arm_scmi: Drop handle on protocol bind failures
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit e3a5c30d233ca5d3e799a80da806554c703bda13 ]
The SCMI bus notifier acquires an SCMI handle when the driver core emits BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe callback. The protocol probe path only checks whether sdev->handle is set.
If device_link_add() fails after the handle has been acquired, the protocol device can still bind with a valid handle but without the dependency link to the SCMI parent. A concurrent parent unbind can then miss the child and tear down the SCMI instance while the child still holds a handle into it.
If the protocol driver probe later fails, for example with -EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind leaked the SCMI instance users refcount and left sdev->handle set after the failed probe.
Make the link helper report failure and drop the acquired handle if the link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the same cleanup path used for unbind so failed probes balance the earlier BUS_NOTIFY_BIND_DRIVER acquisition.
--- drivers/firmware/arm_scmi/driver.c | 31 ++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-)
drivers/firmware/arm_scmi/driver.c +23 -8
@@ -2287,21 +2287,31 @@ static int scmi_handle_put(const struct scmi_handle *handle)return 0 ; } -static void scmi_device_link_add (struct device *consumer, +static bool scmi_device_link_add (struct device *consumer,struct device *supplier) {struct device_link *link; link =device_link_add (consumer, supplier,DL_FLAG_AUTOREMOVE_CONSUMER ); -WARN_ON (!link); +return !WARN_ON (!link); +} + +static void scmi_clear_handle (struct scmi_device *scmi_dev) +{ +if (!scmi_dev->handle) +return ; + +scmi_handle_put (scmi_dev->handle); + scmi_dev->handle =NULL ; }static void scmi_set_handle (struct scmi_device *scmi_dev) { scmi_dev->handle =scmi_handle_get (&scmi_dev->dev); -if (scmi_dev->handle) -scmi_device_link_add (&scmi_dev->dev, scmi_dev->handle->dev); +if (scmi_dev->handle && + !scmi_device_link_add (&scmi_dev->dev, scmi_dev->handle->dev)) +scmi_clear_handle (scmi_dev); } static int __scmi_xfer_info_init(struct scmi_info *sinfo,
@@ -2581,6 +2591,7 @@ static int scmi_bus_notifier(struct notifier_block *nb, {struct scmi_info *info =bus_nb_to_scmi_info (nb);struct scmi_device *sdev =to_scmi_dev (data); +const char *status;/* Skip transport devices and devices of different SCMI instances */ if (!strncmp(sdev->name, "__scmi_transport_device", 23) ||
@@ -2591,18 +2602,22 @@ static int scmi_bus_notifier(struct notifier_block *nb,case BUS_NOTIFY_BIND_DRIVER :/* setup handle now as the transport is ready */ scmi_set_handle (sdev); + status ="about to be BOUND." ; +break ; +case BUS_NOTIFY_DRIVER_NOT_BOUND : +scmi_clear_handle (sdev); + status ="NOT BOUND." ;break ;case BUS_NOTIFY_UNBOUND_DRIVER : -scmi_handle_put (sdev->handle); - sdev->handle =NULL ; +scmi_clear_handle (sdev); + status ="UNBOUND." ;break ;default :return NOTIFY_DONE ; }dev_dbg (info->dev,"Device %s (%s) is now %s\n" ,dev_name (&sdev->dev), - sdev->name, action ==BUS_NOTIFY_BIND_DRIVER ? -"about to be BOUND." :"UNBOUND." ); + sdev->name, status);return NOTIFY_OK ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 756/1424 libnvdimm/labels: Bound the on-media label size before the shift
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <[email protected]>
[ Upstream commit 18f9124248ed7a9da1c31973b629dceef76a9b0c ]
For a v1.2+ index, __nd_label_validate() computes the label size as 1 << (7 + nsindex[i]->labelsize), where labelsize is a u8 read from the label storage medium. A value of 25 or more makes the shift count reach or exceed the width of int -- undefined behavior -- and 24 already shifts into the sign bit. Only 0 (128-byte) and 1 (256-byte) are valid.
Reject a labelsize above 1 before the shift. The result was rejected by the following size comparison anyway, so this only removes the undefined shift on a crafted or corrupted medium; conforming labels are unaffected.
--- drivers/nvdimm/label.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/nvdimm/label.c +13 -2
@@ -145,10 +145,21 @@ static int __nd_label_validate(struct nvdimm_drvdata *ndd)/* label sizes larger than 128 arrived with v1.2 */ version =__le16_to_cpu (nsindex[i]->major) *100 +__le16_to_cpu (nsindex[i]->minor); -if (version >=102 ) +if (version >=102 ) { +/* +* labelsize feeds the shift below; only 0 (128-byte) +* and 1 (256-byte) are valid -- a larger value would +* overflow or exceed the width of int. +*/ +if (nsindex[i]->labelsize >1 ) { +dev_dbg (dev,"nsindex%d labelsize: %d invalid\n" , + i, nsindex[i]->labelsize); +continue ; + } labelsize =1 << (7 + nsindex[i]->labelsize); -else + }else { labelsize =128 ; + }if (labelsize !=sizeof_namespace_label (ndd)) { dev_dbg(dev, "nsindex%d labelsize %d invalid\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 757/1424 dax: read holder_ops once in dax_holder_notify_failure()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Groves <[email protected]>
[ Upstream commit 7ae9d15bdcde0f2955ae13b6a95587f9e23b2359 ]
dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() -- once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (kill_dax() also clears holder_ops, but only after synchronize_srcu(), so it cannot race a reader that is inside dax_read_lock(); fs_put_dax() does no such synchronization.)
Fetch holder_ops once into a local with READ_ONCE() so the NULL check and the indirect call observe the same value.
--- drivers/dax/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/dax/super.c +10 -2
@@ -232,6 +232,7 @@ EXPORT_SYMBOL_GPL(dax_recovery_write);int dax_holder_notify_failure (struct dax_device *dax_dev,u64 off,u64 len,int mf_flags) { +const struct dax_holder_operations *ops;int rc, id; id =dax_read_lock ();
@@ -240,12 +241,19 @@ int dax_holder_notify_failure(struct dax_device *dax_dev, u64 off, goto out; } -if (!dax_dev->holder_ops) { +/* +* Read holder_ops once: a concurrent fs_put_dax() can clear it without +* synchronizing against readers. Without the single fetch the compiler +* could reload between the NULL check and the call and dereference a +* NULL ops. +*/ + ops =READ_ONCE (dax_dev->holder_ops); +if (!ops) { rc = -EOPNOTSUPP ; goto out; } - rc = dax_dev->holder_ops->notify_failure (dax_dev, off, len, mf_flags); + rc = ops->notify_failure (dax_dev, off, len, mf_flags); out:dax_read_unlock (id);return rc;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 758/1424 cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 6a9e0e0f7592313ace66303cf5eca68e04c10f30 ]
The clk_get_parent() function doesn't return error pointers, it returns NULL on error. Update the error checking to match.
--- drivers/cpufreq/spear-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/spear-cpufreq.c +2 -2
@@ -79,9 +79,9 @@ static int spear1340_set_cpu_rate(struct clk *sys_pclk, unsigned long newfreq)int ret =0 ; sys_clk =clk_get_parent (spear_cpufreq.clk); -if (IS_ERR (sys_clk)) { +if (!sys_clk) {pr_err ("failed to get cpu's parent (sys) clock\n" ); -return PTR_ERR (sys_clk); +return -EINVAL ; }/* Set the rate of the source clock before changing the parent */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 759/1424 PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
[ Upstream commit fddf72ed7b52c91da37fe5f1d4faed11251b714f ]
XGENE_PCIE_IP_VER_UNKN is only refered to when probing for the original XGene PCIe implementation, and get immediately overridden if the device has the "apm,xgene-pcie" compatible string.
Given that the only way to get there is by finding this very string in the DT, it is obvious that we will always overwrite the version with XGENE_PCIE_IP_VER_1.
Drop the whole thing.
Stable-dep-of: 4869db344e76 ("PCI: xgene: Drop unnecessary OF node reference")
--- drivers/pci/controller/pci-xgene.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/pci/controller/pci-xgene.c +1 -5
@@ -53,7 +53,6 @@#define XGENE_V1_PCI_EXP_CAP 0x40/* PCIe IP version */ -#define XGENE_PCIE_IP_VER_UNKN 0#define XGENE_PCIE_IP_VER_1 1#define XGENE_PCIE_IP_VER_2 2
@@ -609,10 +608,7 @@ static int xgene_pcie_probe(struct platform_device *pdev) port->node =of_node_get (dn); port->dev = dev; - - port->version =XGENE_PCIE_IP_VER_UNKN ; -if (of_device_is_compatible (port->node,"apm,xgene-pcie" )) - port->version =XGENE_PCIE_IP_VER_1 ; + port->version =XGENE_PCIE_IP_VER_1 ; ret =xgene_pcie_map_reg (port, pdev);if (ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 760/1424 PCI: xgene: Drop unnecessary OF node reference
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 4869db344e76c9adfb1d9654df442db5371fac71 ]
xgene_pcie_probe() stores dev->of_node in port->node with of_node_get(), but the cached node is only used during probe by xgene_pcie_parse_map_dma_ranges(). The driver never releases the extra reference, so the node reference is leaked.
There is no need for private OF node ownership here. Use the device's existing of_node directly in xgene_pcie_parse_map_dma_ranges() and remove the cached port->node pointer.
--- drivers/pci/controller/pci-xgene.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/pci/controller/pci-xgene.c +1 -4
@@ -58,7 +58,6 @@ #if defined(CONFIG_PCI_XGENE) || (defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)) struct xgene_pcie { - struct device_node *node; struct device *dev; struct clk *clk; void __iomem *csr_base;
@@ -527,7 +526,7 @@ static void xgene_pcie_setup_ib_reg(struct xgene_pcie *port,static int xgene_pcie_parse_map_dma_ranges (struct xgene_pcie *port) { -struct device_node *np = port->node; +struct device_node *np = port->dev->of_node;struct of_pci_range range;struct of_pci_range_parser parser;struct device *dev = port->dev;
@@ -595,7 +594,6 @@ static struct pci_ops xgene_pcie_ops = {static int xgene_pcie_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev; -struct device_node *dn = dev->of_node;struct xgene_pcie *port;struct pci_host_bridge *bridge;int ret;
@@ -606,7 +604,6 @@ static int xgene_pcie_probe(struct platform_device *pdev) port =pci_host_bridge_priv (bridge); - port->node =of_node_get (dn); port->dev = dev; port->version =XGENE_PCIE_IP_VER_1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 761/1424 irqdomain: Introduce irq_domain_free()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 89b37541ca38954f8ac01c2ca25405b140cfc8eb ]
In preparation of the introduction of the irq domain instantiation, introduce irq_domain_free() to avoid code duplication on later modifications.
This new function is an extraction of the current operations performed to free the irq domain. No functional change intended.
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- kernel/irq/irqdomain.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
kernel/irq/irqdomain.c +10 -6
@@ -236,6 +236,15 @@ static void __irq_domain_publish(struct irq_domain *domain)pr_debug ("Added domain %s\n" , domain->name); } +static void irq_domain_free (struct irq_domain *domain) +{ +fwnode_dev_initialized (domain->fwnode, false); +fwnode_handle_put (domain->fwnode); +if (domain->flags &IRQ_DOMAIN_NAME_ALLOCATED ) +kfree (domain->name); +kfree (domain); +} +/** * __irq_domain_add() - Allocate a new irq_domain data structure * @fwnode: firmware node for the interrupt controller
@@ -291,12 +300,7 @@ void irq_domain_remove(struct irq_domain *domain)mutex_unlock (&irq_domain_mutex);pr_debug ("Removed domain %s\n" , domain->name); - -fwnode_dev_initialized (domain->fwnode, false); -fwnode_handle_put (domain->fwnode); -if (domain->flags &IRQ_DOMAIN_NAME_ALLOCATED ) -kfree (domain->name); -kfree (domain); +irq_domain_free (domain); }EXPORT_SYMBOL_GPL (irq_domain_remove);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 762/1424 irqdomain: Introduce irq_domain_instantiate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 299d623f5c9ab48e53255cf6b510627f1ef26dfe ]
The existing irq_domain_add_*() functions used to instantiate an IRQ domain are wrappers built on top of __irq_domain_add() and describe the domain properties using a bunch of parameters.
Adding more parameters and wrappers to hide new parameters in the existing code lead to more and more code without any relevant value and without any flexibility.
Introduce irq_domain_instantiate() where the interrupt domain properties are given using a irq_domain_info structure instead of the bunch of parameters to allow flexibility and easy evolution.
irq_domain_instantiate() performs the same operation as the one done by __irq_domain_add(). For compatibility reason with existing code, keep __irq_domain_add() but convert it to irq_domain_instantiate().
[ tglx: Fixed up struct initializer coding style ]
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irqdomain.h | 21 +++++++++++++++++++++ kernel/irq/irqdomain.c | 39 ++++++++++++++++++++++++++++++++------- 2 files changed, 53 insertions(+), 7 deletions(-)
include/linux/irqdomain.h +21 -0
@@ -257,6 +257,27 @@ static inline struct fwnode_handle *irq_domain_alloc_fwnode(phys_addr_t *pa) }void irq_domain_free_fwnode (struct fwnode_handle *fwnode); +/** +* struct irq_domain_info - Domain information structure +* @fwnode: firmware node for the interrupt controller +* @size: Size of linear map; 0 for radix mapping only +* @hwirq_max: Maximum number of interrupts supported by controller +* @direct_max: Maximum value of direct maps; +* Use ~0 for no limit; 0 for no direct mapping +* @ops: Domain operation callbacks +* @host_data: Controller private data pointer +*/ +struct irq_domain_info { +struct fwnode_handle *fwnode; +unsigned int size; +irq_hw_number_t hwirq_max; +int direct_max; +const struct irq_domain_ops *ops; +void *host_data; +}; + +struct irq_domain *irq_domain_instantiate (const struct irq_domain_info *info); + struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, irq_hw_number_t hwirq_max, int direct_max, const struct irq_domain_ops *ops,
kernel/irq/irqdomain.c +32 -7
@@ -245,6 +245,27 @@ static void irq_domain_free(struct irq_domain *domain)kfree (domain); } +/** +* irq_domain_instantiate() - Instantiate a new irq domain data structure +* @info: Domain information pointer pointing to the information for this domain +* +* Return: A pointer to the instantiated irq domain or an ERR_PTR value. +*/ +struct irq_domain *irq_domain_instantiate (const struct irq_domain_info *info) +{ +struct irq_domain *domain; + + domain =__irq_domain_create (info->fwnode, info->size, info->hwirq_max, + info->direct_max, info->ops, info->host_data); +if (!domain) +return ERR_PTR (-ENOMEM ); + +__irq_domain_publish (domain); + +return domain; +} +EXPORT_SYMBOL_GPL (irq_domain_instantiate); +/** * __irq_domain_add() - Allocate a new irq_domain data structure * @fwnode: firmware node for the interrupt controller
@@ -263,14 +284,18 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int sconst struct irq_domain_ops *ops, void *host_data) { - struct irq_domain *domain; - - domain =__irq_domain_create (fwnode, size, hwirq_max, direct_max, - ops, host_data); -if (domain) -__irq_domain_publish (domain); + struct irq_domain_info info = { + .fwnode = fwnode, + .size = size, + .hwirq_max = hwirq_max, + .direct_max = direct_max, + .ops = ops, + .host_data = host_data, + }; +struct irq_domain *d; -return domain; + d =irq_domain_instantiate (&info); +return IS_ERR (d) ?NULL : d; }EXPORT_SYMBOL_GPL (__irq_domain_add);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 763/1424 irqdomain: Handle additional domain flags in irq_domain_instantiate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 757398541c30a5e898169763b43f08dab71ea3bd ]
In order to use irq_domain_instantiate() from several places such as irq_domain_create_hierarchy(), irq_domain_instantiate() needs to handle additional domain flags.
Add the required infrastructure.
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irqdomain.h | 2 ++ kernel/irq/irqdomain.c | 2 ++ 2 files changed, 4 insertions(+)
include/linux/irqdomain.h +2 -0
@@ -260,6 +260,7 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode);/** * struct irq_domain_info - Domain information structure * @fwnode: firmware node for the interrupt controller +* @domain_flags: Additional flags to add to the domain flags * @size: Size of linear map; 0 for radix mapping only * @hwirq_max: Maximum number of interrupts supported by controller * @direct_max: Maximum value of direct maps;
@@ -269,6 +270,7 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode);*/ struct irq_domain_info {struct fwnode_handle *fwnode; +unsigned int domain_flags;unsigned int size;irq_hw_number_t hwirq_max;int direct_max;
kernel/irq/irqdomain.c +2 -0
@@ -260,6 +260,8 @@ struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info)if (!domain)return ERR_PTR (-ENOMEM ); + domain->flags |= info->domain_flags; +__irq_domain_publish (domain);return domain;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 764/1424 irqdomain: Handle domain hierarchy parent in irq_domain_instantiate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 419e3778ff295c00aa158d9f2854a70b47ba1136 ]
To use irq_domain_instantiate() from irq_domain_create_hierarchy(), irq_domain_instantiate() needs to handle the domain hierarchy parent.
Add the required functionality.
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irqdomain.h | 6 ++++++ kernel/irq/irqdomain.c | 7 +++++++ 2 files changed, 13 insertions(+)
include/linux/irqdomain.h +6 -0
@@ -276,6 +276,12 @@ struct irq_domain_info {int direct_max;const struct irq_domain_ops *ops;void *host_data; +#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY +/** +* @parent: Pointer to the parent irq domain used in a hierarchy domain +*/ +struct irq_domain *parent; +#endif };struct irq_domain *irq_domain_instantiate (const struct irq_domain_info *info);
kernel/irq/irqdomain.c +7 -0
@@ -262,6 +262,13 @@ struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info) domain->flags |= info->domain_flags; +#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY +if (info->parent) { + domain->root = info->parent->root; + domain->parent = info->parent; + } +#endif +__irq_domain_publish (domain);return domain;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 765/1424 irqdomain: Introduce init() and exit() hooks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit 44b68de9b8e3dfde12308e8567548799d7ded0de ]
The current API does not allow additional initialization before the domain is published. This can lead to a race condition between consumers and supplier as a domain can be available for consumers before being fully ready.
Introduce the init() hook to allow additional initialization before plublishing the domain. Also introduce the exit() hook to revert operations done in init() on domain removal.
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irqdomain.h | 8 ++++++++ kernel/irq/irqdomain.c | 15 +++++++++++++++ 2 files changed, 23 insertions(+)
include/linux/irqdomain.h +8 -0
@@ -141,6 +141,7 @@ struct irq_domain_chip_generic;* purposes related to the irq domain. * @parent: Pointer to parent irq_domain to support hierarchy irq_domains * @msi_parent_ops: Pointer to MSI parent domain methods for per device domain init +* @exit: Function called when the domain is destroyed * * Revmap data, used internally by the irq domain code: * @revmap_size: Size of the linear map table @revmap[]
@@ -169,6 +170,7 @@ struct irq_domain {#ifdef CONFIG_GENERIC_MSI_IRQ const struct msi_parent_ops *msi_parent_ops;#endif +void (*exit)(struct irq_domain *d);/* reverse map data. The linear map gets appended to the irq_domain */ irq_hw_number_t hwirq_max;
@@ -267,6 +269,10 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode);* Use ~0 for no limit; 0 for no direct mapping * @ops: Domain operation callbacks * @host_data: Controller private data pointer +* @init: Function called when the domain is created. +* Allow to do some additional domain initialisation. +* @exit: Function called when the domain is destroyed. +* Allow to do some additional cleanup operation. */ struct irq_domain_info {struct fwnode_handle *fwnode;
@@ -282,6 +288,8 @@ struct irq_domain_info {*/ struct irq_domain *parent;#endif +int (*init)(struct irq_domain *d); +void (*exit)(struct irq_domain *d); };struct irq_domain *irq_domain_instantiate (const struct irq_domain_info *info);
kernel/irq/irqdomain.c +15 -0
@@ -254,6 +254,7 @@ static void irq_domain_free(struct irq_domain *domain)struct irq_domain *irq_domain_instantiate (const struct irq_domain_info *info) {struct irq_domain *domain; +int err; domain =__irq_domain_create (info->fwnode, info->size, info->hwirq_max, info->direct_max, info->ops, info->host_data);
@@ -261,6 +262,7 @@ struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info)return ERR_PTR (-ENOMEM ); domain->flags |= info->domain_flags; + domain->exit = info->exit;#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY if (info->parent) {
@@ -269,9 +271,19 @@ struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info) }#endif +if (info->init) { + err = info->init (domain); +if (err) + goto err_domain_free; + } +__irq_domain_publish (domain);return domain; + +err_domain_free: +irq_domain_free (domain); +return ERR_PTR (err); }EXPORT_SYMBOL_GPL (irq_domain_instantiate);
@@ -318,6 +330,9 @@ EXPORT_SYMBOL_GPL(__irq_domain_add);*/ void irq_domain_remove (struct irq_domain *domain) { +if (domain->exit) + domain->exit (domain); +mutex_lock (&irq_domain_mutex);debugfs_remove_domain_dir (domain);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 766/1424 genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit e25f553a92973eaf59ff3a00fe7f61ab01b2877f ]
The existing __irq_alloc_domain_generic_chips() uses a bunch of parameters to describe the generic chips that need to be allocated.
Adding more parameters and wrappers to hide new parameters in the existing code leads to more and more code without any relevant values and without any flexibility.
Introduce irq_domain_alloc_generic_chips() where the generic chips description is done using the irq_domain_chip_generic_info structure instead of the bunch of parameters to allow flexibility and easy evolution.
Also introduce irq_domain_remove_generic_chips() to revert the operations done by irq_domain_alloc_generic_chips().
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irq.h | 25 +++++++++++ kernel/irq/generic-chip.c | 91 +++++++++++++++++++++++++++++---------- 2 files changed, 93 insertions(+), 23 deletions(-)
include/linux/irq.h +25 -0
@@ -1117,6 +1117,27 @@ struct irq_domain_chip_generic {struct irq_chip_generic *gc[]; }; +/** +* struct irq_domain_chip_generic_info - Generic chip information structure +* @name: Name of the generic interrupt chip +* @handler: Interrupt handler used by the generic interrupt chip +* @irqs_per_chip: Number of interrupts each chip handles (max 32) +* @num_ct: Number of irq_chip_type instances associated with each +* chip +* @irq_flags_to_clear: IRQ_* bits to clear in the mapping function +* @irq_flags_to_set: IRQ_* bits to set in the mapping function +* @gc_flags: Generic chip specific setup flags +*/ +struct irq_domain_chip_generic_info { +const char *name; +irq_flow_handler_t handler; +unsigned int irqs_per_chip; +unsigned int num_ct; +unsigned int irq_flags_to_clear; +unsigned int irq_flags_to_set; +enum irq_gc_flags gc_flags; +}; +/* Generic chip callback functions */ void irq_gc_noop (struct irq_data *d);void irq_gc_mask_disable_reg (struct irq_data *d);
@@ -1153,6 +1174,10 @@ int devm_irq_setup_generic_chip(struct device *dev, struct irq_chip_generic *gc,struct irq_chip_generic *irq_get_domain_generic_chip (struct irq_domain *d,unsigned int hw_irq); +int irq_domain_alloc_generic_chips (struct irq_domain *d, +const struct irq_domain_chip_generic_info *info); +void irq_domain_remove_generic_chips (struct irq_domain *d); + int __irq_alloc_domain_generic_chips(struct irq_domain *d, int irqs_per_chip, int num_ct, const char *name, irq_flow_handler_t handler,
kernel/irq/generic-chip.c +68 -23
129 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 767/1424 irqdomain: Add support for generic irq chips creation before publishing a domain
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <[email protected]>
[ Upstream commit e6f67ce32e8e6dcbadf42dc435fbc9002cabf1f9 ]
The current API functions create an irq_domain and also publish this newly created to domain. Once an irq_domain is published, consumers can request IRQ in order to use them.
Some interrupt controller drivers have to perform some more operations with the created irq_domain in order to have it ready to be used. For instance:
- Allocate generic irq chips with irq_alloc_domain_generic_chips()
- Retrieve the generic irq chips with irq_get_domain_generic_chip()
- Initialize retrieved chips: set register base address and offsets, set several hooks such as irq_mask, irq_unmask, ...
With the newly introduced irq_domain_alloc_generic_chips(), an interrupt controller driver can use the irq_domain_chip_generic_info structure and set the init() hook to perform its generic chips initialization.
In order to avoid a window where the domain is published but not yet ready to be used, handle the generic chip creation (i.e the irq_domain_alloc_generic_chips() call) before the domain is published.
Stable-dep-of: 616dd89d81ad ("irqchip/renesas-irqc: Fix generic interrupt chip leak on remove")
--- include/linux/irqdomain.h | 9 +++++++++ kernel/irq/irqdomain.c | 14 +++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-)
include/linux/irqdomain.h +9 -0
@@ -210,6 +210,9 @@ enum {/* Irq domain is a MSI device domain */ IRQ_DOMAIN_FLAG_MSI_DEVICE = (1 <<9 ), +/* Irq domain must destroy generic chips when removed */ + IRQ_DOMAIN_FLAG_DESTROY_GC = (1 << 10), +/* * Flags starting from IRQ_DOMAIN_FLAG_NONCORE are reserved * for implementation specific purposes and ignored by the
@@ -259,6 +262,9 @@ static inline struct fwnode_handle *irq_domain_alloc_fwnode(phys_addr_t *pa) }void irq_domain_free_fwnode (struct fwnode_handle *fwnode); + +struct irq_domain_chip_generic_info ; +/** * struct irq_domain_info - Domain information structure * @fwnode: firmware node for the interrupt controller
@@ -269,6 +275,8 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode);* Use ~0 for no limit; 0 for no direct mapping * @ops: Domain operation callbacks * @host_data: Controller private data pointer +* @dgc_info: Geneneric chip information structure pointer used to +* create generic chips for the domain if not NULL. * @init: Function called when the domain is created. * Allow to do some additional domain initialisation. * @exit: Function called when the domain is destroyed.
@@ -288,6 +296,7 @@ struct irq_domain_info {*/ struct irq_domain *parent;#endif +struct irq_domain_chip_generic_info *dgc_info;int (*init)(struct irq_domain *d);void (*exit)(struct irq_domain *d); };
kernel/irq/irqdomain.c +13 -1
@@ -271,16 +271,25 @@ struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info) }#endif +if (info->dgc_info) { + err =irq_domain_alloc_generic_chips (domain, info->dgc_info); +if (err) + goto err_domain_free; + } +if (info->init) { err = info->init (domain);if (err) - goto err_domain_free; + goto err_domain_gc_remove; }__irq_domain_publish (domain);return domain; +err_domain_gc_remove: +if (info->dgc_info) +irq_domain_remove_generic_chips (domain); err_domain_free:irq_domain_free (domain);return ERR_PTR (err);
@@ -348,6 +357,9 @@ void irq_domain_remove(struct irq_domain *domain)mutex_unlock (&irq_domain_mutex); +if (domain->flags &IRQ_DOMAIN_FLAG_DESTROY_GC ) +irq_domain_remove_generic_chips (domain); +pr_debug ("Removed domain %s\n" , domain->name);irq_domain_free (domain); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 768/1424 irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingshuang Fu <[email protected]>
[ Upstream commit 616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba ]
The driver allocates domain generic chips probe. However, on driver removal, the generic chips are not automatically freed when the interrupt domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global list and may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the interrupt domain; this lets the interrupt domain core automatically release all generic chips when irq_domain_remove() is invoked, removing the need for manual cleanup calls in error paths and remove callback.
--- drivers/irqchip/irq-renesas-irqc.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-renesas-irqc.c +1 -0
@@ -176,6 +176,7 @@ static int irqc_probe(struct platform_device *pdev) goto err_runtime_pm_disable; } + p->irq_domain->flags |=IRQ_DOMAIN_FLAG_DESTROY_GC ; ret =irq_alloc_domain_generic_chips (p->irq_domain, p->number_of_irqs,1 ,"irqc" , handle_level_irq,0 ,0 ,IRQ_GC_INIT_NESTED_LOCK );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 769/1424 media: i2c: rdacm21: Fix missing media_entity_cleanup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <[email protected]>
[ Upstream commit 04c053379c3a33460b581953c4f5b36de39439ac ]
The driver misses calling media_entity_cleanup() on the probe error path and during remove, leaking resources if probe fails after entity initialization or when the driver is unloaded.
Fix this by adding media_entity_cleanup() to the rdacm21_probe() error handling path and to rdacm21_remove().
--- drivers/media/i2c/rdacm21.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/i2c/rdacm21.c +4 -1
@@ -589,10 +589,12 @@ static int rdacm21_probe(struct i2c_client *client) ret =v4l2_async_register_subdev (&dev->sd);if (ret) - goto error_free_ctrls; + goto error_entity_cleanup;return 0 ; +error_entity_cleanup: +media_entity_cleanup (&dev->sd.entity); error_free_ctrls:v4l2_ctrl_handler_free (&dev->ctrls); error:
@@ -607,6 +609,7 @@ static void rdacm21_remove(struct i2c_client *client)v4l2_async_unregister_subdev (&dev->sd);v4l2_ctrl_handler_free (&dev->ctrls); +media_entity_cleanup (&dev->sd.entity);i2c_unregister_device (dev->isp); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 770/1424 cpufreq: intel_pstate: Fix setting minimum P-state at init time
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit db53c573d31d07d5d782c5312d37cb33be788eba ]
If HWP is enabled, writes to MSR_IA32_PERF_CTL have no effect, so intel_pstate_get_cpu_pstates() should not attempt to call intel_pstate_set_min_pstate() to set the minimum P-state for the given CPU in that case.
Accordingly, remove the intel_pstate_set_min_pstate() call from intel_pstate_get_cpu_pstates() and make both intel_pstate_cpu_init() and intel_cpufreq_cpu_init() call that function in their non-HWP code paths.
The HWP code path in intel_pstate_cpu_init() does not need to update the current P-state of the CPU directly at all because it is taken care of the processor automatically, but the HWP code path of intel_cpufreq_cpu_init() should update it in principle to initialize the DESIRED_PERF field in MSR_HWP_REQUEST. For this purpose, make it call intel_cpufreq_hwp_update() and pass the minimum P-state limit to it as the current target value along with the current minimum and maximum limits.
--- drivers/cpufreq/intel_pstate.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/cpufreq/intel_pstate.c +11 -8
@@ -2047,8 +2047,6 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)if (pstate_funcs.get_vid) pstate_funcs.get_vid (cpu); - -intel_pstate_set_min_pstate (cpu); }/*
@@ -2746,6 +2744,7 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)static int intel_pstate_cpu_init (struct cpufreq_policy *policy) {int ret =__intel_pstate_cpu_init (policy); +struct cpudata *cpu;if (ret)return ret;
@@ -2756,11 +2755,11 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)*/ policy->policy =CPUFREQ_POLICY_POWERSAVE ; -if (hwp_active) { -struct cpudata *cpu = all_cpu_data[policy->cpu]; - + cpu = all_cpu_data[policy->cpu]; +if (hwp_active) cpu->epp_cached =intel_pstate_get_epp (cpu,0 ); - } +else +intel_pstate_set_min_pstate (cpu);return 0 ; }
@@ -2983,8 +2982,6 @@ static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)return ret; policy->cpuinfo.transition_latency =INTEL_CPUFREQ_TRANSITION_LATENCY ; -/* This reflects the intel_pstate_get_cpu_pstates() setting. */ - policy->cur = policy->cpuinfo.min_freq; req =kcalloc (2 ,sizeof (*req),GFP_KERNEL );if (!req) {
@@ -3005,9 +3002,15 @@ static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)WRITE_ONCE (cpu->hwp_req_cached, value); cpu->epp_cached =intel_pstate_get_epp (cpu, value); + +intel_cpufreq_hwp_update (cpu, cpu->pstate.min_pstate, + cpu->pstate.max_pstate, + cpu->pstate.min_pstate, false); }else { policy->transition_delay_us =INTEL_CPUFREQ_TRANSITION_DELAY ; +intel_pstate_set_min_pstate (cpu); } + policy->cur = policy->cpuinfo.min_freq; freq =DIV_ROUND_UP (cpu->pstate.turbo_freq * global.min_perf_pct,100 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 771/1424 cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongqiu Han <[email protected]>
[ Upstream commit db6a017c91b774c15b1b890db45981eacfff540e ]
The kerneldoc of sugov_iowait_apply() says the IO boost value is increased in sugov_iowait_apply() and, in the same sentence, that it is decreased by the same function. That is self-contradictory, and the first part is wrong:sugov_iowait_apply() only decreases the boost.
The boost is actually increased in sugov_iowait_boost(). Fix the comment to name sugov_iowait_boost() as the place where the boost is increased, so it matches the code.
No functional change.
--- kernel/sched/cpufreq_schedutil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/cpufreq_schedutil.c +1 -1
@@ -317,7 +317,7 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,* A CPU running a task which woken up after an IO operation can have its * utilization boosted to speed up the completion of those IO operations. * The IO boost value is increased each time a task wakes up from IO, in -* sugov_iowait_apply(), and it's instead decreased by this function, +* sugov_iowait_boost(), and it's instead decreased by this function, * each time an increase has not been requested (!iowait_boost_pending). * * A CPU which also appears to have been idle for at least one tick has also
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 772/1424 remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday Khare <[email protected]>
[ Upstream commit 44f4911ab8e6f4d69afad5f2571bbd2da421c918 ]
In qcom_add_glink_subdev(), the device node reference acquired via of_get_child_by_name() is stored in glink->node. If the subsequent kstrdup_const() allocation for glink->ssr_name fails, the function returns early without calling of_node_put() on glink->node, leaking the reference count.
Fix this by adding of_node_put(glink->node) on the error path before returning.
--- drivers/remoteproc/qcom_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/remoteproc/qcom_common.c +3 -1
@@ -240,8 +240,10 @@ void qcom_add_glink_subdev(struct rproc *rproc, struct qcom_rproc_glink *glink,return ; glink->ssr_name =kstrdup_const (ssr_name,GFP_KERNEL ); -if (!glink->ssr_name) +if (!glink->ssr_name) { +of_node_put (glink->node);return ; + } glink->dev = dev; glink->subdev.start = glink_subdev_start;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 773/1424 drm/bridge: tc358767: clamp the reported AUX read size to the request
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit ec6444a00c49e6c2b5e9a507272a28126677f9ee ]
tc_aux_transfer() clamps an AUX read to the payload limit:
size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
After the transfer it replaces size with the byte count the controller reports in AUX_BYTES:
if (size) size = FIELD_GET(AUX_BYTES, auxstatus);
AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it back to the request. tc_aux_read_data() reads that many bytes into the 16-byte auxrdata stack buffer, then copies them into the caller buffer. A reported count of 255 makes the read run to 256 bytes and overruns both.
The controller should never report more than it was asked to transfer, so this is defense in depth rather than a live hole. The reported count is only lightly trusted, and the check is cheap. Clamp it back to the request, the same way ti-sn65dsi86 does in commit aca58eac52b8 ("drm/bridge:
ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer").
--- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358767.c +1 -1
@@ -441,7 +441,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux,* address-only transfer */ if (size) - size =FIELD_GET (AUX_BYTES , auxstatus); + size =min_t (size_t, size,FIELD_GET (AUX_BYTES , auxstatus)); msg->reply =FIELD_GET (AUX_STATUS , auxstatus);switch (request) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 774/1424 arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 569413a98a1761782a0770aa85d20a2c78893279 ]
Update the 'enable-gpio' property name to 'enable-gpios' to conform to the bindings for the TI DRV2604 haptics module. While at it, use the GPIO_ACTIVE_HIGH define instead of the raw literal.
--- arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts +1 -1
@@ -39,7 +39,7 @@ &blsp2_i2c3 { haptics: drv2604@5a { compatible = "ti,drv2604"; reg = <0x5a>; - enable-gpio = <&tlmm 93 0x00>; + enable-gpios = <&tlmm 93 GPIO_ACTIVE_HIGH>; mode = <DRV260X_LRA_MODE>; library-sel = <DRV260X_LIB_LRA>; pinctrl-names = "default","sleep";
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 775/1424 arm64: dts: qcom: sm8250: sort out Iris power domains
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d5c8efda722eb1f67cfe299b71f13dab93746934 ]
On SM8250 Iris core requires two power rails to function, MX (for PLLs) and MMCX (for everything else). The commit fa245b3f06cd ("arm64: dts:
qcom: sm8250: Add venus DT node") added only MX power rail, but omitted MMCX voltage levels.
Add MMCX domain to the Iris device node.
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/qcom/sm8250.dtsi +14 -6
@@ -3950,8 +3950,12 @@ venus: video-codec@aa00000 { interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&videocc MVS0C_GDSC>, <&videocc MVS0_GDSC>, - <&rpmhpd RPMHPD_MX>; - power-domain-names = "venus", "vcodec0", "mx"; + <&rpmhpd RPMHPD_MX>, + <&rpmhpd RPMHPD_MMCX>; + power-domain-names = "venus", + "vcodec0", + "mx", + "mmcx"; operating-points-v2 = <&venus_opp_table>; clocks = <&gcc GCC_VIDEO_AXI0_CLK>,
@@ -3985,22 +3989,26 @@ venus_opp_table: opp-table { opp-720000000 { opp-hz = /bits/ 64 <720000000>; - required-opps = <&rpmhpd_opp_low_svs>; + required-opps = <&rpmhpd_opp_svs>, + <&rpmhpd_opp_low_svs>; }; opp-1014000000 { opp-hz = /bits/ 64 <1014000000>; - required-opps = <&rpmhpd_opp_svs>; + required-opps = <&rpmhpd_opp_svs>, + <&rpmhpd_opp_svs>; }; opp-1098000000 { opp-hz = /bits/ 64 <1098000000>; - required-opps = <&rpmhpd_opp_svs_l1>; + required-opps = <&rpmhpd_opp_svs_l1>, + <&rpmhpd_opp_svs_l1>; }; opp-1332000000 { opp-hz = /bits/ 64 <1332000000>; - required-opps = <&rpmhpd_opp_nom>; + required-opps = <&rpmhpd_opp_svs_l1>, + <&rpmhpd_opp_nom>; }; }; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 776/1424 arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 68ea007df9293fcb29d38219d73094bbf4b59673 ]
The OPP table for the Iris core is wrong, it copies the VDD table from the downstream kernel, but that table is written for the video_cc_mvs0_clk_src, while the upstream uses video_cc_mvs0_clk for OPP rate setting (which is clk_src divided by 3). Specify correct frequencies in the OPP table.
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm64/boot/dts/qcom/sm8250.dtsi +8 -8
@@ -3987,26 +3987,26 @@ video-encoder { venus_opp_table: opp-table { compatible = "operating-points-v2"; - opp-720000000 { - opp-hz = /bits/ 64 <720000000>; + opp-240000000 { + opp-hz = /bits/ 64 <240000000>; required-opps = <&rpmhpd_opp_svs>, <&rpmhpd_opp_low_svs>; }; - opp-1014000000 { - opp-hz = /bits/ 64 <1014000000>; + opp-338000000 { + opp-hz = /bits/ 64 <338000000>; required-opps = <&rpmhpd_opp_svs>, <&rpmhpd_opp_svs>; }; - opp-1098000000 { - opp-hz = /bits/ 64 <1098000000>; + opp-366000000 { + opp-hz = /bits/ 64 <366000000>; required-opps = <&rpmhpd_opp_svs_l1>, <&rpmhpd_opp_svs_l1>; }; - opp-1332000000 { - opp-hz = /bits/ 64 <1332000000>; + opp-444000000 { + opp-hz = /bits/ 64 <444000000>; required-opps = <&rpmhpd_opp_svs_l1>, <&rpmhpd_opp_nom>; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 777/1424 perf jevents: Add more components to the metric sorting order
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 557f8b3ca8c8e58d5bc3084734bc7a470b043922 ]
Nazar Kazakov reported non-deterministic builds due to the metrics being reordered in the jevents.py output. The metrics were largely only being sorted by name, add in the expressions and descriptions.
--- tools/perf/pmu-events/jevents.py | 5 +++-- tools/perf/pmu-events/metric.py | 6 +++++- 2 files changed, 8 insertions(+), 3 deletions(-)
tools/perf/pmu-events/jevents.py +3 -2
@@ -503,13 +503,14 @@ const struct pmu_table_entry {_pending_events_tblname}[] = {{ def print_pending_metrics() -> None: """Optionally close metrics table.""" - def metric_cmp_key(j: JsonEvent) -> Tuple[bool, str, str]: + def metric_cmp_key(j: JsonEvent) -> Tuple[str, str, str, str]: def fix_none(s: Optional[str]) -> str: if s is None: return '' return s - return (j.desc is not None, fix_none(j.pmu), fix_none(j.metric_name)) + return (fix_none(j.pmu), fix_none(j.metric_name), j.metric_expr.ToPerfJson(), + fix_none(j.desc)) global _pending_metrics if not _pending_metrics:
tools/perf/pmu-events/metric.py +5 -1
@@ -445,7 +445,11 @@ class Metric: def __lt__(self, other): """Sort order.""" - return self.name < other.name + if self.name != other.name: + return self.name < other.name + if not self.expr.Equals(other.expr): + return self.expr.ToPerfJson() < other.expr.ToPerfJson() + return self.description < other.description def AddToMetricGroup(self, group): """Callback used when being added to a MetricGroup."""
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 778/1424 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 71e67b4b59337b2f9f4fef976a27de2dad7aabf2 ]
The loop counter 'count' was declared as u8 while num_pc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates potentially causing an infinite loop or reading past the allocated pc_data array.
Change the declaration to u32 to match num_pc.
--- drivers/net/wireless/intel/iwlwifi/fw/dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/fw/dump.c +1 -1
@@ -488,7 +488,7 @@ static void iwl_fwrt_dump_fseq_regs(struct iwl_fw_runtime *fwrt)void iwl_fwrt_dump_error_logs (struct iwl_fw_runtime *fwrt) {struct iwl_pc_data *pc_data; -u8 count; +u32 count;if (!test_bit (STATUS_DEVICE_ENABLED , &fwrt->trans->status)) { IWL_ERR(fwrt,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 779/1424 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit f6a6c01cbc046f68e6916a7e047a1bc881c8c9ab ]
iwl_mvm_frob_txf_key_iter() tracks the last matched byte position in loop variable 'i'. When a full key match is found (match == keylen), 'i' points at the last byte of the matched key. The memset start offset should therefore be i + 1 - keylen, not i - keylen; the current code zeroes one byte before the match and leaves the final key byte un-sanitised.
--- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +1 -1
@@ -858,7 +858,7 @@ static void iwl_mvm_frob_txf_key_iter(struct ieee80211_hw *hw, } match++;if (match == keylen) { -memset (txf->buf + i - keylen,0xAA , keylen); +memset (txf->buf + i +1 - keylen,0xAA , keylen); match =0 ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 780/1424 wifi: iwlwifi: mei: add support for SAP version 4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 27c8f12e972d3647e9d759d7cafd4c34fa513432 ]
SAP version 4 uses larger Host to MEI notification queue. Since it is unknown which SAP version is used by the CSME firmware when the driver loads, try version 4 first. In case the CSME firmware uses version 3, the memory allocation will fail. In this case the driver will try again to allocate the memory for version 3.
Stable-dep-of: 7d8cc301bcba ("wifi: iwlwifi: mei: check SAP message length before reading it")
--- .../net/wireless/intel/iwlwifi/mei/iwl-mei.h | 10 ++++ drivers/net/wireless/intel/iwlwifi/mei/main.c | 58 ++++++++++++++----- 2 files changed, 53 insertions(+), 15 deletions(-)
drivers/net/wireless/intel/iwlwifi/mei/iwl-mei.h +10 -0
@@ -283,6 +283,16 @@ struct iwl_mei_colloc_info {u8 bssid[ETH_ALEN ]; }; +/** +* enum iwl_mei_sap_version - SAP version +* @IWL_MEI_SAP_VERSION_3: SAP version 3 +* @IWL_MEI_SAP_VERSION_4: SAP version 4 +*/ +enum iwl_mei_sap_version { +IWL_MEI_SAP_VERSION_3 =3 , +IWL_MEI_SAP_VERSION_4 =4 , +}; +/* * struct iwl_mei_ops - driver's operations called by iwlmei * Operations will not be called more than once concurrently.
drivers/net/wireless/intel/iwlwifi/mei/main.c +43 -15
130 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 781/1424 wifi: iwlwifi: mei: check SAP message length before reading it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 7d8cc301bcba233f31b589a45f4c1c97f2bb90d6 ]
Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow.
--- drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/wireless/intel/iwlwifi/mei/main.c +6 -0
@@ -1,6 +1,7 @@// SPDX-License-Identifier: GPL-2.0-only /* * Copyright (C) 2021-2024 Intel Corporation +* Copyright (C) 2026 Intel Corporation */ #include <linux/etherdevice.h>
@@ -1147,6 +1148,11 @@ static void iwl_mei_handle_sap_rx_cmd(struct mei_cl_device *cldev,iwl_mei_read_from_q (q_head, q_sz, &rd, wr, hdr,sizeof (*hdr)); valid_rx_sz -=sizeof (*hdr); len =le16_to_cpu (hdr->len); +if (len +sizeof (*hdr) >PAGE_SIZE ) { +dev_err (&cldev->dev, +"SAP message is too big: %u\n" , len); +break ; + }if (valid_rx_sz < len)break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 782/1424 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 9318bc0c41b24705690cf80d1596cf6b711e7027 ]
Make sure we don't end-up with a num_frags = 0 situation. For that, check that the required size is not 0 and put a checker on num_frags as well.
--- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +7 -1
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2018-2025 Intel Corporation +* Copyright (C) 2018-2026 Intel Corporation */ #include <linux/firmware.h> #include "iwl-drv.h"
@@ -603,6 +603,9 @@ static int iwl_dbg_tlv_alloc_fragments(struct iwl_fw_runtime *fwrt, cpu_to_le32(IWL_FW_INI_LOCATION_DRAM_PATH))return 0 ; +if (!fw_mon_cfg->req_size) +return -EIO ; + num_frags =le32_to_cpu (fw_mon_cfg->max_frags_num);if (fwrt->trans->trans_cfg->device_family <IWL_DEVICE_FAMILY_AX210 ) {if (alloc_id !=IWL_FW_INI_ALLOCATION_ID_DBGC1 )
@@ -613,6 +616,9 @@ static int iwl_dbg_tlv_alloc_fragments(struct iwl_fw_runtime *fwrt,return -EIO ; } +if (!num_frags) +return -EIO ; + remain_pages =DIV_ROUND_UP (le32_to_cpu (fw_mon_cfg->req_size),PAGE_SIZE ); num_frags =min_t (u32, num_frags,BUF_ALLOC_MAX_NUM_FRAGS );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 783/1424 wifi: iwlwifi: mei: pass correct argument to function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 905f57aefde4f4092a411c8a55856182fb1c7598 ]
The first argument to iwl_mei_write_cyclic_buf() should be the cldev but the q_head pointer is passed instead. Fix it.
--- drivers/net/wireless/intel/iwlwifi/mei/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mei/main.c +1 -1
@@ -458,7 +458,7 @@ static int iwl_mei_send_sap_msg_payload(struct mei_cl_device *cldev, notif_q = &dir->q_ctrl_blk[SAP_QUEUE_IDX_NOTIF ]; q_head = mei->shared_mem.q_head[SAP_DIRECTION_HOST_TO_ME ][SAP_QUEUE_IDX_NOTIF ]; q_sz = mei->shared_mem.q_size[SAP_DIRECTION_HOST_TO_ME ][SAP_QUEUE_IDX_NOTIF ]; - ret =iwl_mei_write_cyclic_buf (q_head, notif_q, q_head, hdr, q_sz); + ret =iwl_mei_write_cyclic_buf (cldev, notif_q, q_head, hdr, q_sz);if (ret <0 )return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 784/1424 gpu: host1x: Fix offset calculation in trace_write_gather
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit eb896850964d3dfce291b4fdff9c2d42d85e564b ]
When a gather longer than 2*TRACE_MAX_LENGTH (256) words is traced through host1x_cdma_push_gather, the reported BO offset drifts from the third iteration onward.
Fix the calculation by properly calculating the value on each loop rather than accumulating.
In reality, gathers tend to be pretty short so this is unlikely to ever have been observed.
--- drivers/gpu/host1x/hw/channel_hw.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/host1x/hw/channel_hw.c +2 -3
@@ -36,10 +36,9 @@ static void trace_write_gather(struct host1x_cdma *cdma, struct host1x_bo *bo,for (i =0 ; i < words; i +=TRACE_MAX_LENGTH ) {u32 num_words =min (words - i,TRACE_MAX_LENGTH ); - offset += i *sizeof (u32); -trace_host1x_cdma_push_gather (dev_name (dev), bo, - num_words, offset, + num_words, + offset + i *sizeof (u32), mem); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 785/1424 gpu: host1x: Avoid stack over-read in debug output helpers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikko Perttunen <[email protected]>
[ Upstream commit bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6 ]
host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit.
This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur.
Fix by switching to vscnprintf(), which returns the number of bytes actually written.
--- drivers/gpu/host1x/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/host1x/debug.c +2 -2
@@ -31,7 +31,7 @@ void host1x_debug_output(struct output *o, const char *fmt, ...)int len;va_start (args, fmt); - len =vsnprintf (o->buf,sizeof (o->buf), fmt, args); + len =vscnprintf (o->buf,sizeof (o->buf), fmt, args);va_end (args); o->fn (o->ctx, o->buf, len, false);
@@ -43,7 +43,7 @@ void host1x_debug_cont(struct output *o, const char *fmt, ...)int len;va_start (args, fmt); - len =vsnprintf (o->buf,sizeof (o->buf), fmt, args); + len =vscnprintf (o->buf,sizeof (o->buf), fmt, args);va_end (args); o->fn (o->ctx, o->buf, len, true);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 786/1424 drm/msm/a6xx: Fix stale rpmh votes after suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Rawat <[email protected]>
[ Upstream commit d9108bfdb746edacdb05bd27959a4ae63c6c7f3f ]
There are stale RPMH votes (BCM votes) observed after GMU suspend. This is because the rpmh stop sequences are skipped during gmu suspend. Fix this and also move GMU to reset state to avoid any further activity.
Patchwork: https://patchwork.freedesktop.org/patch/730652/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -1
@@ -492,7 +492,7 @@ static void a6xx_rpmh_stop(struct a6xx_gmu *gmu)int ret;u32 val; -if (test_and_clear_bit (GMU_STATUS_FW_START , &gmu->status)) +if (!test_and_clear_bit (GMU_STATUS_FW_START , &gmu->status))return ;gmu_write (gmu,REG_A6XX_GMU_RSCC_CONTROL_REQ ,1 );
@@ -1100,6 +1100,9 @@ static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu)/* Stop the interrupts and mask the hardware */ a6xx_gmu_irq_disable (gmu); +/* Halt the gmu cm3 core */ +gmu_write (gmu,REG_A6XX_GMU_CM3_SYSRESET ,1 ); +/* Tell RPMh to power off the GPU */ a6xx_rpmh_stop (gmu);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 787/1424 bpf: Sync tail_call_reachable with callee state on entry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
[ Upstream commit 3513ea9dab6c1a3d2dc8e6160c41f690206948b6 ]
Currently in check_max_stack_depth_subprog, when the verifier enters a new callee branch, the local tail_call_reachable is not properly synchronized with the callee's state.
Consider a main prog branching into multiple subprogs:
subprog0 -> tailcall
main <
subprog1 -> subprog2When the verifier finishes checking subprog0 and backtracks to main prog, the local tail_call_reachable state is left as true. As it proceeds to subprog1, this uncleared state leaks into the new branch, falsely marking subprog1 and subprog2 as tailcall reachable.
Fix this by explicitly syncing tail_call_reachable with the callee's has_tail_call state on entry. The caller's state is safely preserved and restored via the existing backtracking logic.
--- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +2 -2
@@ -6027,8 +6027,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx) i = next_insn; idx = sidx; -if (subprog[idx].has_tail_call) - tail_call_reachable = true; +/* sync tail_call_reachable with callee state on entry */ + tail_call_reachable = subprog[idx].has_tail_call; frame++;if (frame >=MAX_CALL_FRAMES ) {
Signature · 1 line
2.53.0
Re: [PATCH 6.6 0787/1424] bpf: Sync tail_call_reachable with callee state on entry
Please hold this patch unless a 6.6 backport of upstream commit 54c27ea6dadb ("bpf: Fix tail_call_reachable leak") can also be included.
This patch resets tail_call_reachable on callee entry, but 6.6 lacks the parent-state restoration it relies on. Returning from a clean callee can leave the root program falsely unmarked and make the x86 JIT omit required tail-call counter handling.
I reproduced this on 6.6.157-rc1 in QEMU: Linux permits 33 successful tail calls, so the test must stop after 34 program entries including the initial invocation. The unmodified rc1 reached 35, bypassing the limit.
With the applicable 54c27ea6dadb hunk applied, the same test stopped at the expected 34 entries.
Thanks,
Karl
Greg Kroah-Hartman
maintainerPATCH 788/1424 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit 3ae59a2eba64b3648f069aa52eeaaeefdfe4bb2f ]
sg_dma_len() is only valid after mapping the scatterlist with dma_map_sg(). However, sl3516_ce_need_fallback() checks it before the source and destination scatterlists are mapped. Thus, a stale DMA length that is not a multiple of 16 could incorrectly force a software fallback when CONFIG_NEED_SG_DMA_LENGTH=y.
Remove the invalid checks; the existing scatterlist length checks are sufficient.
--- drivers/crypto/gemini/sl3516-ce-cipher.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/crypto/gemini/sl3516-ce-cipher.c +0 -8
@@ -56,10 +56,6 @@ static bool sl3516_ce_need_fallback(struct skcipher_request *areq) ce->fallback_mod16++;return true; } -if ((sg_dma_len (sg) %16 ) !=0 ) { - ce->fallback_mod16++; -return true; - }if (!IS_ALIGNED (sg->offset,16 )) { ce->fallback_align16++;return true;
@@ -72,10 +68,6 @@ static bool sl3516_ce_need_fallback(struct skcipher_request *areq) ce->fallback_mod16++;return true; } -if ((sg_dma_len (sg) %16 ) !=0 ) { - ce->fallback_mod16++; -return true; - }if (!IS_ALIGNED (sg->offset,16 )) { ce->fallback_align16++;return true;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 789/1424 ACPI: processor: idle: Expand _LPI package sanity checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d5c13047a132162d2649be876906ead691d12948 ]
The _LPI package sanity checks in acpi_processor_evaluate_lpi() miss a couple of things, so expand them by adding a buffer size check before retrieving a struct acpi_power_register from it (and skip the given state if the buffer is not large enough to hold a register structure) and making the function avoid copying the state description from the ACPI table if there are too few elements in the package supposed to hold it.
While at it, relocate and rephrase a comment about skipping _LPI state package elements [7-8].
--- drivers/acpi/processor_idle.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/acpi/processor_idle.c +21 -7
@@ -950,6 +950,13 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,if (obj->type ==ACPI_TYPE_BUFFER ) {struct acpi_power_register *reg; +if (obj->buffer.length <sizeof (*reg)) { +acpi_handle_debug (handle, +"Invalid register data for _LPI state %d\n" , + state_idx); +continue ; + } + reg = (struct acpi_power_register *)obj->buffer.pointer;if (reg->space_id !=ACPI_ADR_SPACE_SYSTEM_IO && reg->space_id !=ACPI_ADR_SPACE_FIXED_HARDWARE )
@@ -966,13 +973,6 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,continue ; } -/* elements[7,8] skipped for now i.e. Residency/Usage counter*/ - - obj = pkg_elem +9 ; -if (obj->type ==ACPI_TYPE_STRING ) -strscpy (lpi_state->desc, obj->string.pointer, -ACPI_CX_DESC_LEN ); - lpi_state->index = state_idx;if (obj_get_integer (pkg_elem +0 , &lpi_state->min_residency)) {pr_debug ("No min. residency found, assuming 10 us\n" );
@@ -995,6 +995,20 @@ static int acpi_processor_evaluate_lpi(acpi_handle handle,if (obj_get_integer (pkg_elem +5 , &lpi_state->enable_parent_state)) lpi_state->enable_parent_state =0 ; + +/* Skip elements [7-8] i.e. Residency/Usage counters. */ + +/* +* Avoid out-of-bounds access if the size of the package is less +* than expected. +*/ +if (element->package.count <10 ) +continue ; + + obj = pkg_elem +9 ; +if (obj->type ==ACPI_TYPE_STRING ) +strscpy (lpi_state->desc, obj->string.pointer, +ACPI_CX_DESC_LEN ); }acpi_handle_debug (handle,"Found %d power states\n" , state_idx);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 790/1424 usb: gadget: f_uac1_legacy: remove broken string configfs attributes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 590d74ec8f488e06b9f1c0f8f0941f45531f3a55 ]
The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value.
This means every write attempt returns -ENOMEM on success and dereferences a NULL pointer on allocation failure. The attributes have been broken and unused for many years.
Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE, FILE_CONTROL) set in f_audio_alloc_inst() are unaffected.
--- .../testing/configfs-usb-gadget-uac1_legacy | 3 - Documentation/usb/gadget-testing.rst | 3 - drivers/usb/gadget/function/f_uac1_legacy.c | 56 ------------------- drivers/usb/gadget/function/u_uac1_legacy.h | 3 - 4 files changed, 65 deletions(-)
Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy +0 -3
@@ -5,8 +5,5 @@ Description: The attributes: audio_buf_size - audio buffer size - fn_cap - capture pcm device file name - fn_cntl - control device file name - fn_play - playback pcm device file name req_buf_size - ISO OUT endpoint request buffer size req_count - ISO OUT endpoint request count
Documentation/usb/gadget-testing.rst +0 -3
@@ -702,9 +702,6 @@ The uac1 function provides these attributes in its function directory: =============== ==================================== audio_buf_size audio buffer size - fn_cap capture pcm device file name - fn_cntl control device file name - fn_play playback pcm device file name req_buf_size ISO OUT endpoint request buffer size req_count ISO OUT endpoint request count =============== ====================================
drivers/usb/gadget/function/f_uac1_legacy.c +0 -56
72 lines not on this page · raw message
drivers/usb/gadget/function/u_uac1_legacy.h +0 -3
@@ -62,9 +62,6 @@ struct f_uac1_legacy_opts {char *fn_cap;char *fn_cntl; unsigned bound:1; - unsigned fn_play_alloc:1; - unsigned fn_cap_alloc:1; - unsigned fn_cntl_alloc:1;struct mutex lock;int refcnt; };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 791/1424 tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
[ Upstream commit 782f4dbd1794b4f30dc116a7ca42c5962c409be8 ]
hvc_dcc drives the JTAG DCC via the ARMv6/v7 CP14 debug registers (mrc/mcr p14, 0, rX, c0, c1/c5, 0 in asm/dcc.h). That encoding is undefined on older ARM cores, and also on ARMv7-M, but HVC_DCC only depends on ARM, so it can be enabled on e.g. ARM926 (ARCH_MULTI_V5), where hvc_dcc_console_init() runs __dcc_putchar() at boot and takes an undefined-instruction trap before the console is up:
Internal error: Oops - undefined instruction: 0 [#1] ARM PC is at hvc_dcc_check+0x50/0x8c hvc_dcc_check from hvc_dcc_console_init+0x18/0x48 hvc_dcc_console_init from console_init+0x58/0x170 Kernel panic - not syncing: Fatal exception
Restrict HVC_DCC to the CPUs where that encoding is valid: the CPU_V6 || CPU_V6K || CPU_V7 set that arch/arm/include/debug/icedcc.S guards it with, plus ARM64.
--- drivers/tty/hvc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/hvc/Kconfig +1 -1
@@ -79,7 +79,7 @@ config HVC_UDBG config HVC_DCC bool "ARM JTAG DCC console" - depends on ARM || ARM64 + depends on (ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || ARM64 select HVC_DRIVER select SERIAL_CORE_CONSOLE help
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 792/1424 UDF symlink pathComponent header OOB read
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lee <[email protected]>
[ Upstream commit d23eb7380d1594cda31a5dc8487dd2a5c8def8c7 ]
udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header.
Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed symlink data that would otherwise make udf_pc_to_char() perform an out-of-bounds read.
--- fs/udf/symlink.c | 2 ++ 1 file changed, 2 insertions(+)
fs/udf/symlink.c +2 -0
@@ -36,6 +36,8 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,/* Reserve one byte for terminating \0 */ tolen--;while (elen < fromlen) { +if (fromlen - elen <sizeof (struct pathComponent )) +return -EIO ; pc = (struct pathComponent *)(from + elen); elen +=sizeof (struct pathComponent );switch (pc->componentType) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 793/1424 uio: Fix stale info pointer in failed registration path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 67b6fc084b034a91c3ec7907a3fed89a2450f30b ]
After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info.
That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory.
Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
--- drivers/uio/uio.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/uio/uio.c +5 -0
@@ -990,6 +990,11 @@ int __uio_register_device(struct module *owner, err_request_irq:uio_dev_del_attributes (idev); err_uio_dev_add_attributes: +mutex_lock (&idev->info_lock); + idev->info =NULL ; +mutex_unlock (&idev->info_lock); +wake_up_interruptible (&idev->wait); +kill_fasync (&idev->async_queue,SIGIO ,POLL_HUP );device_del (&idev->dev); err_device_create:uio_free_minor (idev->minor);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 794/1424 accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit bce0e640623372520d9d90c42f33ddbfb576ce69 ]
snprintf() returns the "number of characters which *would* be generated for the given input", not the size *really* generated.
In order to avoid too large values for 'len' (and potential negative values for "sizeof(buf) - (len - 1)") use scnprintf() instead of snprintf().
--- drivers/accessibility/speakup/kobjects.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/accessibility/speakup/kobjects.c +3 -3
@@ -92,9 +92,9 @@ static void report_char_chartab_status(int reset, int received, int used,if (reset) {pr_info ("%s reset to defaults\n" , object_type[do_characters]); }else if (received) { - len =snprintf (buf,sizeof (buf), -" updated %d of %d %s\n" , - used, received, object_type[do_characters]); + len =scnprintf (buf,sizeof (buf), +" updated %d of %d %s\n" , + used, received, object_type[do_characters]);if (rejected) snprintf(buf + (len - 1), sizeof(buf) - (len - 1), " with %d reject%s\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 795/1424 speakup: keyhelp: guard letter_offsets possible out-of-range indexing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit 6a19ad4d68c95185308cd9e5d169b10a2cf236c8 ]
help_init() builds letter_offsets[] by using the first byte of each function name as an index via (start & 31) - 1. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write.
Function names can be overridden with the following commands as root:
modprobe speakup_soft
echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty
This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.
--- drivers/accessibility/speakup/keyhelp.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/accessibility/speakup/keyhelp.c +12 -5
@@ -8,6 +8,7 @@*/ #include <linux/keyboard.h> +#include <linux/ctype.h> #include "spk_priv.h" #include "speakup.h"
@@ -111,7 +112,7 @@ static void say_key(int key) spk_msg_get(MSG_KEYNAMES_START + (key - 1))); } -static int help_init (void ) +static void help_init (void ) {char start =SPACE ;int i;
@@ -120,13 +121,19 @@ static int help_init(void) state_tbl = spk_our_keys[0 ] +SHIFT_TBL_SIZE +2 ;for (i =0 ; i < num_funcs; i++) {char *cur_funcname =spk_msg_get (MSG_FUNCNAMES_START + i); +char first_letter; -if (start == *cur_funcname) + first_letter =tolower (*cur_funcname); + +/* Accept only 'a'..'z' to index letter_offsets[] safely */ +if (first_letter <'a' || first_letter >'z' ) +continue ; + +if (start == first_letter)continue ; - start = *cur_funcname; + start = first_letter; letter_offsets[(start &31 ) -1 ] = i; } -return 0 ; }int spk_handle_help (struct vc_data *vc,u_char type,u_char ch,u_short key)
@@ -144,7 +151,7 @@ int spk_handle_help(struct vc_data *vc, u_char type, u_char ch, u_short key)synth_printf ("%s\n" ,spk_msg_get (MSG_LEAVING_HELP ));return 1 ; } - ch |=32 ;/* lower case */ + ch =tolower (ch);if (ch <'a' || ch >'z' )return -1 ;if (letter_offsets[ch -'a' ] ==-1 ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 796/1424 misc: bcm-vk: Use acquire/release for msgq_inited
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
[ Upstream commit 61b101c6a150057b6d512421ed108aed16e822ea ]
bcm_vk_sync_msgq() fills the message queue information and then sets msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the message queues and their cached queue information.
atomic_set()/atomic_read() do not order those accesses. A reader can see msgq_inited set while still seeing stale queue information. Use release when publishing the initialized queues and acquire when checking the gate.
Keep the clear in bcm_vk_blk_drv_access() as atomic_set(). It closes the gate and does not publish queue state to readers.
--- drivers/misc/bcm-vk/bcm_vk_msg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/misc/bcm-vk/bcm_vk_msg.c +4 -2
@@ -108,7 +108,8 @@ u32 msgq_avail_space(const struct bcm_vk_msgq __iomem *msgq,bool bcm_vk_drv_access_ok (struct bcm_vk *vk) { -return (!!atomic_read (&vk->msgq_inited)); +/* Pair with the release store after message queue initialization. */ +return !!atomic_read_acquire (&vk->msgq_inited); }void bcm_vk_set_host_alert (struct bcm_vk *vk,u32 bit_mask)
@@ -501,7 +502,8 @@ int bcm_vk_sync_msgq(struct bcm_vk *vk, bool force_sync) msgq++; } } -atomic_set (&vk->msgq_inited,1 ); +/* Publish message queue info before allowing driver access. */ +atomic_set_release (&vk->msgq_inited,1 );return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 797/1424 misc: rtsx: add missing write register handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Markov <[email protected]>
[ Upstream commit 655faba1ccf195e22a7a83146ef6015e3271233c ]
If an error occurs at the stage of working with registers in conjunction with MCU_Block, it will not be processed.
The occurrence of errors at this stage may signal an impact on writes to the device's PCI registers and is a more global problem than a driver-level security problem, but adding a handler would be a good practice.
Add a missing error handling.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/misc/cardreader/rtsx_pcr.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/cardreader/rtsx_pcr.c +2 -0
@@ -1230,6 +1230,8 @@ static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)/* Gating real mcu clock */ err =rtsx_pci_write_register (pcr,RTS5261_FW_CFG1 ,RTS5261_MCU_CLOCK_GATING ,0 ); +if (err <0 ) +return err; err =rtsx_pci_write_register (pcr,RTS5261_REG_FPDCTL ,SSC_POWER_DOWN ,0 ); }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 798/1424 misc: ad525x_dpot: use driver core groups for sysfs files
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit e3a8557e88eb26278eda60bf64f2ef33ce7de8bf ]
ad_dpot_probe() creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state and makes remove responsible for matching every file that probe created.
Move the device attributes into driver core dev_groups for the I2C and SPI drivers and use an is_visible() callback to expose only the attributes supported by the probed device. With this shape, the driver core creates the sysfs files only after probe succeeds and removes them before the remove callback frees the driver data.
--- drivers/misc/ad525x_dpot-i2c.c | 1 + drivers/misc/ad525x_dpot-spi.c | 1 + drivers/misc/ad525x_dpot.c | 177 ++++++++++++++++++++------------- drivers/misc/ad525x_dpot.h | 3 + 4 files changed, 112 insertions(+), 70 deletions(-)
drivers/misc/ad525x_dpot-i2c.c +1 -0
@@ -105,6 +105,7 @@ MODULE_DEVICE_TABLE(i2c, ad_dpot_id);static struct i2c_driver ad_dpot_i2c_driver = { .driver = { .name ="ad_dpot" , + .dev_groups = ad_dpot_groups, }, .probe = ad_dpot_i2c_probe, .remove = ad_dpot_i2c_remove,
drivers/misc/ad525x_dpot-spi.c +1 -0
@@ -131,6 +131,7 @@ MODULE_DEVICE_TABLE(spi, ad_dpot_spi_id);static struct spi_driver ad_dpot_spi_driver = { .driver = { .name ="ad_dpot" , + .dev_groups = ad_dpot_groups, }, .probe = ad_dpot_spi_probe, .remove = ad_dpot_spi_remove,
drivers/misc/ad525x_dpot.c +107 -70
224 lines not on this page · raw message
drivers/misc/ad525x_dpot.h +3 -0
@@ -10,6 +10,8 @@#include <linux/types.h> +struct attribute_group ; +#define DPOT_CONF (features, wipers, max_pos, uid) \ (((features) << 18) | (((wipers) & 0xFF) << 10) | \ ((max_pos & 0xF) << 6) | (uid & 0x3F))
@@ -210,5 +212,6 @@ struct ad_dpot_bus_data {int ad_dpot_probe (struct device *dev,struct ad_dpot_bus_data *bdata,unsigned long devid,const char *name);void ad_dpot_remove (struct device *dev); +extern const struct attribute_group *ad_dpot_groups[];#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 799/1424 cacheinfo: dont propagate DT/ACPI error when arch supplies info (arm64)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit 274259391c14166fcabae74f9fc0104223ff27a1 ]
cache_setup_properties() sets use_arch_info = true when DT/ACPI provide no cache nodes and the arch can derive the topology from CPU registers (e.g. arm64 reading CLIDR_EL1), but still returns the original -ENOENT. cache_shared_cpu_map_setup() bails on that error before the new flag can take effect, so the first CPU brought online always trips a misleading warning:
cacheinfo: Unable to detect cache hierarchy for CPU 0
Subsequent CPUs skip cache_setup_properties() entirely because use_arch_info is now true, which is why only CPU0 hits it. This is reproducible on arm64 with the QEMU 'virt' machine, whose default DT has no cache nodes.
Clear ret after setting use_arch_info so the caller proceeds and populates the shared cpu map via the arch-supplied leaves.
--- drivers/base/cacheinfo.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/base/cacheinfo.c +7 -2
@@ -347,9 +347,14 @@ static int cache_setup_properties(unsigned int cpu)else if (!acpi_disabled) ret =cache_setup_acpi (cpu); -// Assume there is no cache information available in DT/ACPI from now. -if (ret &&use_arch_cache_info ()) +/* +* No DT/ACPI cache nodes; fall back to arch-derived topology (e.g. +* arm64 CLIDR_EL1) and clear the error to avoid a spurious warning. +*/ +if (ret &&use_arch_cache_info ()) { use_arch_info = true; + ret =0 ; + }return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 800/1424 ppdev: prevent overflow when setting port timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 3c0cf801ea2fa40daa5e7d1e6d32adca5ff75ad9 ]
PPSETTIME64 supplies the timeval fields as s64 values, but pp_set_timeout() narrows tv_usec to int and calculates tv_sec * HZ in a signed long. Large positive values can therefore be truncated or overflow and install an unintended timeout.
Keep both fields as s64, reject a non-canonical microsecond value, and use timespec64_to_jiffies() to cap excessively large timeouts at MAX_JIFFY_OFFSET. This is a behavior change because both PPSETTIME ioctls could previously accept values with tv_usec >= USEC_PER_SEC. The validation follows the precedent set by sock_set_timeout().
--- drivers/char/ppdev.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/char/ppdev.c +6 -4
@@ -340,15 +340,17 @@ static enum ieee1284_phase init_phase(int mode)return IEEE1284_PH_FWD_IDLE ; } -static int pp_set_timeout (struct pardevice *pdev,long tv_sec,int tv_usec) +static int pp_set_timeout (struct pardevice *pdev,s64 tv_sec,s64 tv_usec) { +struct timespec64 ts;long to_jiffies; -if ((tv_sec <0 ) || (tv_usec <0 )) +if (tv_sec <0 || tv_usec <0 || tv_usec >=USEC_PER_SEC )return -EINVAL ; - to_jiffies =usecs_to_jiffies (tv_usec); - to_jiffies += tv_sec *HZ ; + ts.tv_sec = tv_sec; + ts.tv_nsec = tv_usec *NSEC_PER_USEC ; + to_jiffies =timespec64_to_jiffies (&ts);if (to_jiffies <=0 )return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 801/1424 tty: ipoctal: convert to u8 and size_t
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 2f982313279baa066f03f4816f3fa3521a4d41cb ]
Switch character types to u8 and sizes to size_t. To conform to characters/sizes in the rest of the tty layer.
Stable-dep-of: b6b5d64cb161 ("ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove")
--- drivers/ipack/devices/ipoctal.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/ipack/devices/ipoctal.c +6 -8
@@ -158,9 +158,7 @@ static int ipoctal_get_icount(struct tty_struct *tty,static void ipoctal_irq_rx (struct ipoctal_channel *channel,u8 sr) {struct tty_port *port = &channel->tty_port; -unsigned char value; -unsigned char flag; -u8 isr; +u8 isr, value, flag; do { value = ioread8(&channel->regs->r.rhr);
@@ -202,8 +200,8 @@ static void ipoctal_irq_rx(struct ipoctal_channel *channel, u8 sr)static void ipoctal_irq_tx (struct ipoctal_channel *channel) { -unsigned char value;unsigned int *pointer_write = &channel->pointer_write; +u8 value;if (channel->nb_bytes ==0 )return ;
@@ -436,11 +434,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,return res; } -static inline int ipoctal_copy_write_buffer (struct ipoctal_channel *channel, -const u8 *buf,int count) +static inline size_t ipoctal_copy_write_buffer (struct ipoctal_channel *channel, +const u8 *buf,size_t count) {unsigned long flags; -int i; +size_t i;unsigned int *pointer_read = &channel->pointer_read;/* Copy the bytes from the user buffer to the internal one */
@@ -462,7 +460,7 @@ static ssize_t ipoctal_write_tty(struct tty_struct *tty, const u8 *buf, size_t count) {struct ipoctal_channel *channel = tty->driver_data; -unsigned int char_copied; +size_t char_copied; char_copied =ipoctal_copy_write_buffer (channel, buf, count);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 802/1424 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit b6b5d64cb161a28347d64dc3168a636c4abb68d5 ]
Three issues arise when the device is removed while a tty session is still active:
1. UAF of struct ipoctal: the remove callback frees ipoctal via kfree() while tty ops may still access it. Fix by introducing kref-based lifetime management — kref is taken in install() when a tty is opened and released in cleanup() when the tty is finally destroyed; remove() uses kref_put() instead of kfree().
2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove() frees xmit_buf via tty_port_free_xmit_buf() while a userspace process may still hold the tty fd and call write(). Fix by checking for NULL xmit_buf in ipoctal_write_tty().
3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev) dereferences ipoctal->dev after the ipack_device has been freed by ipack_device_del(). Fix by caching ipoctal->carrier_owner during probe() and calling module_put() on the cached pointer directly in cleanup(), avoiding any access to ipoctal->dev.
Also introduce a "removed" flag in struct ipoctal, set at the start of __ipoctal_remove(), and checked in every tty op that accesses hardware resources (port_activate, write_tty, set_termios, hangup, shutdown). This prevents page faults when devm_ioremap() regions are unmapped after remove() returns.
--- drivers/ipack/devices/ipoctal.c | 56 ++++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 4 deletions(-)
drivers/ipack/devices/ipoctal.c +52 -4
@@ -10,6 +10,7 @@#include <linux/device.h> #include <linux/module.h> #include <linux/interrupt.h> +#include <linux/kref.h> #include <linux/sched.h> #include <linux/tty.h> #include <linux/serial.h>
@@ -25,6 +26,8 @@static const struct tty_operations ipoctal_fops; +static void ipoctal_release (struct kref *kref); +struct ipoctal_channel {struct ipoctal_stats stats;unsigned int nb_bytes;
@@ -49,6 +52,9 @@ struct ipoctal {struct tty_driver *tty_drv;u8 __iomem *mem8_space;u8 __iomem *int_space; +struct kref kref; +struct module *carrier_owner; +bool removed; }; static inline struct ipoctal *chan_to_ipoctal(struct ipoctal_channel *chan,
@@ -70,8 +76,14 @@ static void ipoctal_reset_channel(struct ipoctal_channel *channel)static int ipoctal_port_activate (struct tty_port *port,struct tty_struct *tty) {struct ipoctal_channel *channel; +struct ipoctal *ipoctal; channel =dev_get_drvdata (tty->dev); + ipoctal =chan_to_ipoctal (channel, tty->index); + + +if (ipoctal->removed) +return -ENODEV ;/* * Enable RX. TX will be enabled when
@@ -95,6 +107,7 @@ static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)if (res) goto err_put_carrier; +kref_get (&ipoctal->kref); tty->driver_data = channel;return 0 ;
@@ -460,8 +473,13 @@ static ssize_t ipoctal_write_tty(struct tty_struct *tty, const u8 *buf, size_t count) {struct ipoctal_channel *channel = tty->driver_data; +struct ipoctal *ipoctal =chan_to_ipoctal (channel, tty->index);size_t char_copied; + +if (ipoctal->removed || !channel->tty_port.xmit_buf) +return 0 ; + char_copied =ipoctal_copy_write_buffer (channel, buf, count);/* As the IP-OCTAL 485 only supports half duplex, do it manually */
@@ -501,8 +519,13 @@ static void ipoctal_set_termios(struct tty_struct *tty,unsigned char mr2 =0 ;unsigned char csr =0 ;struct ipoctal_channel *channel = tty->driver_data; +struct ipoctal *ipoctal =chan_to_ipoctal (channel, tty->index);speed_t baud; + +if (ipoctal->removed) +return ; + cflag = tty->termios.c_cflag;/* Disable and reset everything before change the setup */
@@ -631,10 +654,16 @@ static void ipoctal_hangup(struct tty_struct *tty) {unsigned long flags;struct ipoctal_channel *channel = tty->driver_data; +struct ipoctal *ipoctal;if (channel ==NULL )return ; + ipoctal =chan_to_ipoctal (channel, tty->index); + +if (ipoctal->removed) +return ; +spin_lock_irqsave (&channel->lock, flags); channel->nb_bytes =0 ; channel->pointer_read =0 ;
@@ -651,10 +680,16 @@ static void ipoctal_hangup(struct tty_struct *tty)static void ipoctal_shutdown (struct tty_struct *tty) {struct ipoctal_channel *channel = tty->driver_data; +struct ipoctal *ipoctal;if (channel ==NULL )return ; + ipoctal =chan_to_ipoctal (channel, tty->index); + +if (ipoctal->removed) +return ; +ipoctal_reset_channel (channel);tty_port_set_initialized (&channel->tty_port, false); }
@@ -664,8 +699,9 @@ static void ipoctal_cleanup(struct tty_struct *tty)struct ipoctal_channel *channel = tty->driver_data;struct ipoctal *ipoctal =chan_to_ipoctal (channel, tty->index); -/* release the carrier driver */ -ipack_put_carrier (ipoctal->dev); +/* release the carrier driver via cached owner */ +module_put (ipoctal->carrier_owner); +kref_put (&ipoctal->kref, ipoctal_release); }static const struct tty_operations ipoctal_fops = {
@@ -683,6 +719,13 @@ static const struct tty_operations ipoctal_fops = { .cleanup = ipoctal_cleanup, }; +static void ipoctal_release (struct kref *kref) +{ + struct ipoctal *ipoctal = container_of(kref, struct ipoctal, kref); + +kfree (ipoctal); +} +static int ipoctal_probe (struct ipack_device *dev) {int res;
@@ -692,7 +735,10 @@ static int ipoctal_probe(struct ipack_device *dev)if (ipoctal ==NULL )return -ENOMEM ; +kref_init (&ipoctal->kref); + ipoctal->dev = dev; + ipoctal->carrier_owner = dev->bus->owner; res =ipoctal_inst_slot (ipoctal, dev->bus->bus_nr, dev->slot);if (res) goto out_uninst;
@@ -701,7 +747,7 @@ static int ipoctal_probe(struct ipack_device *dev)return 0 ; out_uninst: -kfree (ipoctal); +kref_put (&ipoctal->kref, ipoctal_release);return res; }
@@ -709,6 +755,8 @@ static void __ipoctal_remove(struct ipoctal *ipoctal) {int i; + ipoctal->removed = true; + ipoctal->dev->bus->ops->free_irq (ipoctal->dev);for (i =0 ; i <NR_CHANNELS ; i++) {
@@ -725,7 +773,7 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)tty_unregister_driver (ipoctal->tty_drv);kfree (ipoctal->tty_drv->name);tty_driver_kref_put (ipoctal->tty_drv); -kfree (ipoctal); +kref_put (&ipoctal->kref, ipoctal_release); }static void ipoctal_remove (struct ipack_device *idev)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 803/1424 char: xilinx_hwicap: unregister class on init errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
[ Upstream commit e7e12b4cc0f0c3a2782aea084d4215e23f5512b3 ]
hwicap_module_init() registers icap_class before reserving the character-device region and registering the platform driver. If either of those later steps fails, the init path must undo the successful class registration before returning an error.
Route the chrdev registration failure through a class unwind label, and let the platform-driver registration failure fall through the existing chrdev unwind before unregistering the class. The normal module exit path is unchanged.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
--- drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/char/xilinx_hwicap/xilinx_hwicap.c +4 -1
@@ -860,7 +860,7 @@ static int __init hwicap_module_init(void)HWICAP_DEVICES , DRIVER_NAME);if (retval <0 ) -return retval; + goto failed_class; retval =platform_driver_register (&hwicap_platform_driver);if (retval)
@@ -871,6 +871,9 @@ static int __init hwicap_module_init(void) failed:unregister_chrdev_region (devt,HWICAP_DEVICES ); + failed_class: +class_unregister (&icap_class); +return retval; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 804/1424 vfio/pci: clear vdev->msi_perm after freeing it on init failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit dc77acfeb979dded39b247b60fef0399536bfa77 ]
vfio_msi_cap_len() lazily allocates the per-device MSI permission table:
vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;
ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open.
That leads to two use-after-frees on the same device:
1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers.
2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object.
Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free().
BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ...
Followed on device close by a double free of the same object:
Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception--- drivers/vfio/pci/vfio_pci_config.c | 1 + 1 file changed, 1 insertion(+)
drivers/vfio/pci/vfio_pci_config.c +1 -0
@@ -1257,6 +1257,7 @@ static int vfio_msi_cap_len(struct vfio_pci_core_device *vdev, u8 pos) ret =init_pci_cap_msi_perm (vdev->msi_perm, len, flags);if (ret) {kfree (vdev->msi_perm); + vdev->msi_perm =NULL ;return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 805/1424 soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Md Shofiqul Islam <[email protected]>
[ Upstream commit 10a1969353b20caa50c320717e054601631c0d3e ]
Implement the TODO in knav_queue_remove() by stopping PDSPs and freeing queue regions and queue ranges before disabling runtime PM, mirroring the cleanup performed in the probe error path.
Set device_ready to false before cleanup to prevent any further use of the device during teardown.
This ensures resources are released on driver unbind and avoids leaking queue/region state.
Stable-dep-of: 3c8178627599 ("soc: ti: knav_qmss: Remove debugfs file on teardown")
--- drivers/soc/ti/knav_qmss_queue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/soc/ti/knav_qmss_queue.c +6 -1
@@ -1886,7 +1886,12 @@ static int knav_queue_probe(struct platform_device *pdev)static int knav_queue_remove (struct platform_device *pdev) { -/* TODO: Free resources */ +struct knav_device *kdev =platform_get_drvdata (pdev); + + device_ready = false; +knav_queue_stop_pdsps (kdev); +knav_queue_free_regions (kdev); +knav_free_queue_ranges (kdev);pm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 806/1424 soc: ti: knav_qmss: Remove debugfs file on teardown
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 3c817862759913097f11467ed4ed2bbf974dabaf ]
knav_queue_probe() creates the global qmss debugfs file whose show callback reads the global knav_qdev state. knav_queue_remove() tears down the queue manager resources but leaves the debugfs file published.
Save the debugfs dentry in struct knav_device and remove it during teardown before the resources used by the show callback are released. While touching the debugfs_create_file() call, spell the unchanged read- only file mode as 0444.
--- drivers/soc/ti/knav_qmss.h | 1 + drivers/soc/ti/knav_qmss_queue.c | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/soc/ti/knav_qmss.h +1 -0
@@ -304,6 +304,7 @@ struct knav_device {struct list_head pools;struct list_head pdsps;struct list_head qmgrs; +struct dentry *debugfs_file;enum qmss_version version; };
drivers/soc/ti/knav_qmss_queue.c +5 -2
@@ -1870,8 +1870,9 @@ static int knav_queue_probe(struct platform_device *pdev) goto err; } -debugfs_create_file ("qmss" ,S_IFREG |S_IRUGO ,NULL ,NULL , - &knav_queue_debug_fops); + knav_qdev->debugfs_file = +debugfs_create_file ("qmss" ,0444 ,NULL ,NULL , + &knav_queue_debug_fops); device_ready = true;return 0 ;
@@ -1889,6 +1890,8 @@ static int knav_queue_remove(struct platform_device *pdev)struct knav_device *kdev =platform_get_drvdata (pdev); device_ready = false; +debugfs_remove (kdev->debugfs_file); + kdev->debugfs_file =NULL ;knav_queue_stop_pdsps (kdev);knav_queue_free_regions (kdev);knav_free_queue_ranges (kdev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 807/1424 mtd: mtdswap: Avoid freeing registered blktrans device twice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 779aa4c66a96bf43d2d62982ea1a9096a9128d87 ]
In mtdswap_add_mtd(), debugfs setup failure after successful blktrans registration can free mbd_dev twice.
add_mtd_blktrans_dev() initializes the blktrans device reference and publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the disk down and drops the blktrans reference; when that reference reaches zero, blktrans_dev_release() frees the mtd_blktrans_dev.
The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell through the common cleanup label and called kfree(mbd_dev) again. Clear the local pointer after deregistration so the common cleanup can still release the mtdswap state without freeing the blktrans object twice.
This issue was found by a static analysis checker and confirmed by manual source review.
--- drivers/mtd/mtdswap.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/mtdswap.c +1 -0
@@ -1452,6 +1452,7 @@ static void mtdswap_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) debugfs_failed:del_mtd_blktrans_dev (mbd_dev); + mbd_dev =NULL ; cleanup:mtdswap_cleanup (d);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 808/1424 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhouminqiang <[email protected]>
[ Upstream commit b759d5bb6265419344ee9729fd0dc07ad85719d8 ]
mtd_add_partition() does not reject the special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior.
Commit 5daa7b21496a ("mtd: prepare partition add and del functions for ioctl requests") introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") later added MTDPART_OFS_RETAIN (-3) for the static
partition table path without updating mtd_add_partition() to also reject this value.
With offset=-3 passed via BLKPG, the RETAIN size calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via goto, skipping erasesize initialization. This results in erasesize=0, which triggers:
WARN_ON((!mtd->erasesize || !master->_erase) &&
!(mtd->flags & MTD_NO_ERASE))
in add_mtd_device(). If the underflow result appears to leave enough space, a bogus partition size is calculated, but the "out of reach" sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0) instead of returning an error.
Fix this by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK.
--- drivers/mtd/mtdpart.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/mtdpart.c +2 -1
@@ -254,7 +254,8 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,/* the direct offset is expected */ if (offset ==MTDPART_OFS_APPEND || - offset ==MTDPART_OFS_NXTBLK ) + offset ==MTDPART_OFS_NXTBLK || + offset ==MTDPART_OFS_RETAIN )return -EINVAL ;if (length ==MTDPART_SIZ_FULL )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 809/1424 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit d5fdde1c426922efabe86a515f0782b3eba40577 ]
Fixes heap corruption by initializing the options and actions arrays before the pstack allocation check, preventing an uninitialized stack pointer from being passed to free_popup_options() if the allocation fails.
--- tools/perf/ui/browsers/hists.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/ui/browsers/hists.c +3 -3
@@ -3005,15 +3005,15 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h browser->min_pcnt = min_pcnt;hist_browser__update_nr_entries (browser); +memset (options,0 ,sizeof (options)); +memset (actions,0 ,sizeof (actions)); + browser->pstack =pstack__new (3 );if (browser->pstack ==NULL ) goto out;ui_helpline__push (helpline); -memset (options,0 ,sizeof (options)); -memset (actions,0 ,sizeof (actions)); -if (symbol_conf.col_width_list_str)perf_hpp__set_user_width (symbol_conf.col_width_list_str);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 810/1424 software node: Fix software_node_get_reference_args() with index -1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alban Bedel <[email protected]>
[ Upstream commit ba3dedcf3bd47017307595a7e54924198f018246 ]
The bounds check for the index passed to software_node_get_reference_args() was failing when passed UINT_MAX, this in turn would lead to an out of bound access in the property array. Fix the bound check to also cover the UINT_MAX case.
--- drivers/base/swnode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/swnode.c +1 -1
@@ -518,7 +518,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,if (prop->is_inline)return -EINVAL ; -if ((index +1 ) *sizeof (*ref) > prop->length) +if (index >= prop->length /sizeof (*ref))return -ENOENT ; ref_array = prop->pointer;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 811/1424 driver core: soc: Unregister bus on early device registration failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit 45dfa004893dfeae182ec27eddbd153c6d4ddbf9 ]
soc_bus_register() registers the SoC bus before registering a deferred early SoC device. If soc_device_register() fails in that path, the function returns the error directly and leaves the bus registered.
Store the returned SoC device pointer explicitly so the success and error cases are handled separately. On failure, clear soc_bus_registered and unregister the bus before returning the error.
--- drivers/base/soc.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/base/soc.c +13 -2
@@ -194,6 +194,7 @@ EXPORT_SYMBOL_GPL(soc_device_unregister);static int __init soc_bus_register (void ) { +struct soc_device *soc_dev;int ret; ret =bus_register (&soc_bus_type);
@@ -201,10 +202,20 @@ static int __init soc_bus_register(void)return ret; soc_bus_registered = true; -if (early_soc_dev_attr) -return PTR_ERR (soc_device_register (early_soc_dev_attr)); +if (early_soc_dev_attr) { + soc_dev =soc_device_register (early_soc_dev_attr); +if (IS_ERR (soc_dev)) { + ret =PTR_ERR (soc_dev); + goto err_unregister_bus; + } + }return 0 ; + +err_unregister_bus: + soc_bus_registered = false; +bus_unregister (&soc_bus_type); +return ret; }core_initcall (soc_bus_register);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 812/1424 dmaengine: dw-edma: Terminate all descriptors without callbacks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit 99109a51efd28c9a661fbfb9469b023c517b31d1 ]
The DMA Engine client documentation says in the "Terminate APIs" section of Documentation/driver-api/dmaengine/client.rst:
"No callback functions will be called for any incomplete transfers."
dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler. This schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. A late callback after dmaengine_terminate_sync() can dereference client state that has already been freed, while leftover descriptors may later restart into reused buffers or leak.
Move all issued and submitted descriptors to the terminated list whenever termination completes. For a pending STOP, do this from both the DONE and ABORT paths. Complete their cookies in order without scheduling callbacks.
A STOP can remain pending until the running transfer raises an interrupt. Make device_synchronize() wait for such a pending STOP to complete before releasing terminated descriptors. Reuse it from free_chan_resources(), then release the remaining virt-dma resources. Sleep instead of busy-polling while waiting, and warn if the existing timeout expires.
--- drivers/dma/dw-edma/dw-edma-core.c | 90 +++++++++++++++++++++++++----- 1 file changed, 76 insertions(+), 14 deletions(-)
drivers/dma/dw-edma/dw-edma-core.c +76 -14
@@ -7,6 +7,7 @@*/ #include <linux/module.h> +#include <linux/delay.h> #include <linux/device.h> #include <linux/kernel.h> #include <linux/dmaengine.h>
@@ -212,6 +213,35 @@ static int dw_edma_start_transfer(struct dw_edma_chan *chan)return 1 ; } +static void dw_edma_terminate_vdesc (struct virt_dma_desc *vd) +{ +list_del (&vd->node); +dma_cookie_complete (&vd->tx); +vchan_terminate_vdesc (vd); +} + +static void dw_edma_terminate_vdesc_list (struct list_head *head) +{ +struct virt_dma_desc *vd, *_vd; + +list_for_each_entry_safe (vd, _vd, head, node) +dw_edma_terminate_vdesc (vd); +} + +/* Must be called with vc.lock held. */ +static void dw_edma_terminate_all_descs (struct dw_edma_chan *chan) +{ +/* +* This order must not be reversed. Cookies are assigned when +* descriptors are submitted, so desc_issued contains older cookies +* than desc_submitted. Completing desc_submitted first could move +* chan->vc.chan.completed_cookie backwards when desc_issued is +* terminated afterwards. +*/ +dw_edma_terminate_vdesc_list (&chan->vc.desc_issued); +dw_edma_terminate_vdesc_list (&chan->vc.desc_submitted); +} +static void dw_edma_device_caps (struct dma_chan *dchan,struct dma_slave_caps *caps) {
@@ -283,20 +313,22 @@ static int dw_edma_device_terminate_all(struct dma_chan *dchan)struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan);int err =0 ; +guard (spinlock_irqsave)(&chan->vc.lock); +if (!chan->configured) { -/* Do nothing */ +dw_edma_terminate_all_descs (chan); }else if (chan->status ==EDMA_ST_PAUSE ) { +dw_edma_terminate_all_descs (chan); chan->status =EDMA_ST_IDLE ; - chan->configured = false; }else if (chan->status ==EDMA_ST_IDLE ) { - chan->configured = false; +dw_edma_terminate_all_descs (chan); }else if (dw_edma_core_ch_status (chan) ==DMA_COMPLETE ) {/* * The channel is in a false BUSY state, probably didn't * receive or lost an interrupt */ +dw_edma_terminate_all_descs (chan); chan->status =EDMA_ST_IDLE ; - chan->configured = false; }else if (chan->request >EDMA_REQ_PAUSE ) { err = -EPERM ; }else {
@@ -652,8 +684,7 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)break ;case EDMA_REQ_STOP : -list_del (&vd->node); -vchan_cookie_complete (vd); +dw_edma_terminate_all_descs (chan); chan->request =EDMA_REQ_NONE ; chan->status =EDMA_ST_IDLE ;break ;
@@ -672,7 +703,9 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)spin_lock_irqsave (&chan->vc.lock, flags); vd =vchan_next_desc (&chan->vc); -if (vd) { +if (vd && chan->request ==EDMA_REQ_STOP ) { +dw_edma_terminate_all_descs (chan); + }else if (vd) {dw_hdma_set_callback_result (vd,DMA_TRANS_ABORTED );list_del (&vd->node);vchan_cookie_complete (vd);
@@ -720,21 +753,49 @@ static int dw_edma_alloc_chan_resources(struct dma_chan *dchan)return 0 ; } -static void dw_edma_free_chan_resources (struct dma_chan *dchan) +static void dw_edma_wait_termination (struct dma_chan *dchan) { +struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan);unsigned long timeout = jiffies +msecs_to_jiffies (5000 ); -int ret; +bool stopping; +/* +* A STOP may be deferred to a later interrupt while the channel is still +* running. Wait until that handler completes the termination. +*/ while (time_before (jiffies, timeout)) { - ret =dw_edma_device_terminate_all (dchan); -if (!ret) -break ; +scoped_guard (spinlock_irqsave, &chan->vc.lock) + stopping = chan->request == EDMA_REQ_STOP; -if (time_after_eq (jiffies, timeout)) +if (!stopping)return ; -cpu_relax (); +fsleep (1000 ); } + +dev_warn (chan->dw->chip->dev, +"timeout waiting for channel termination\n" ); +} + +static void dw_edma_device_synchronize (struct dma_chan *dchan) +{ +struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan); + +dw_edma_wait_termination (dchan); +vchan_synchronize (&chan->vc); +} + +static void dw_edma_free_chan_resources (struct dma_chan *dchan) +{ +struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan); + +dw_edma_device_terminate_all (dchan); +dw_edma_device_synchronize (dchan); + +scoped_guard (spinlock_irqsave, &chan->vc.lock) + chan->configured = false; + +vchan_free_chan_resources (&chan->vc); }static int dw_edma_channel_setup (struct dw_edma *dw,u32 wr_alloc,u32 rd_alloc)
@@ -830,6 +891,7 @@ static int dw_edma_channel_setup(struct dw_edma *dw, u32 wr_alloc, u32 rd_alloc) dma->device_pause = dw_edma_device_pause; dma->device_resume = dw_edma_device_resume; dma->device_terminate_all = dw_edma_device_terminate_all; + dma->device_synchronize = dw_edma_device_synchronize; dma->device_issue_pending = dw_edma_device_issue_pending; dma->device_tx_status = dw_edma_device_tx_status; dma->device_prep_slave_sg = dw_edma_device_prep_slave_sg;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 813/1424 dmaengine: dw-edma: Serialize abort state updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit dd80e259f65d932634e26d366570d71669ef6654 ]
dw_edma_abort_interrupt() drops vc.lock before changing request and status. issue_pending() can acquire the lock in that small window, observe the old busy state, and skip starting queued descriptors. Then the abort handler overwrites the channel status as idle, leaving the new descriptors stranded for good.
Keep descriptor completion and the state transition in the same critical section.
--- drivers/dma/dw-edma/dw-edma-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/dw-edma/dw-edma-core.c +1 -1
@@ -710,9 +710,9 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)list_del (&vd->node);vchan_cookie_complete (vd); } -spin_unlock_irqrestore (&chan->vc.lock, flags); chan->request =EDMA_REQ_NONE ; chan->status =EDMA_ST_IDLE ; +spin_unlock_irqrestore (&chan->vc.lock, flags); }static inline irqreturn_t dw_edma_interrupt_write (int irq,void *data)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 814/1424 dmaengine: dw-edma: Serialize channel state checks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit f7d1619f3e10c619b62c6cd6d95371b5c526c85a ]
pause() and resume() read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks so that request, status, and configured stay consistent.
For example, pause() can observe EDMA_ST_BUSY right before the interrupt handler completes the final descriptor and moves the channel to EDMA_ST_IDLE, and then record EDMA_REQ_PAUSE on an already idle channel. No further interrupt will acknowledge the request, and since issue_pending() requires EDMA_REQ_NONE, the channel is wedged for good: terminate_all() leaves the stale request behind, so even reconfiguring the channel does not recover it.
issue_pending() already runs under vc.lock, but it tests configured before taking it. Move that test under the lock as well, so configured, request, and status are evaluated as one channel-state snapshot.
--- drivers/dma/dw-edma/dw-edma-core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/dma/dw-edma/dw-edma-core.c +6 -4
@@ -276,6 +276,8 @@ static int dw_edma_device_pause(struct dma_chan *dchan)struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan);int err =0 ; +guard (spinlock_irqsave)(&chan->vc.lock); +if (!chan->configured) err = -EPERM ;else if (chan->status !=EDMA_ST_BUSY )
@@ -293,6 +295,8 @@ static int dw_edma_device_resume(struct dma_chan *dchan)struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan);int err =0 ; +guard (spinlock_irqsave)(&chan->vc.lock); +if (!chan->configured) { err = -EPERM ; }else if (chan->status !=EDMA_ST_PAUSE ) {
@@ -343,11 +347,9 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan)struct dw_edma_chan *chan =dchan2dw_edma_chan (dchan);unsigned long flags; -if (!chan->configured) -return ; -spin_lock_irqsave (&chan->vc.lock, flags); -if (vchan_issue_pending (&chan->vc) && chan->request ==EDMA_REQ_NONE && +if (chan->configured &&vchan_issue_pending (&chan->vc) && + chan->request ==EDMA_REQ_NONE && chan->status ==EDMA_ST_IDLE ) { chan->status =EDMA_ST_BUSY ;dw_edma_start_transfer (chan);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 815/1424 dmaengine: dw-edma: Clear stale requests on termination
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koichiro Den <[email protected]>
[ Upstream commit c0d9c6275adcca7c0ca5f4270bf88026f9864bd1 ]
terminate_all() can finish immediately when the channel is unconfigured, paused, idle, or already stopped in hardware. A pending PAUSE request can survive these paths and block issue_pending() even after termination.
Clear the request whenever termination leaves the channel idle. A running channel keeps its STOP request until the interrupt handler consumes it.
--- drivers/dma/dw-edma/dw-edma-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/dw-edma/dw-edma-core.c +2 -0
@@ -338,6 +338,8 @@ static int dw_edma_device_terminate_all(struct dma_chan *dchan) }else { chan->request =EDMA_REQ_STOP ; } +if (chan->status ==EDMA_ST_IDLE ) + chan->request =EDMA_REQ_NONE ;return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 816/1424 ASoC: meson: Keep link pointers valid on realloc failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 2aaa41cf974f83a6fb105422bac4e2f107150774 ]
meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls and updates the owner pointers only after both calls have succeeded.
A successful krealloc() may move the data: it frees the old block and returns a new one. When that happens for the link array and the second krealloc() then fails, card->dai_link still points to the block that krealloc() already freed, and the error path frees the new block too. The probe error path then calls meson_card_clean_references(), which dereferences card->dai_link and kfree()s it again, resulting in a use-after-free and a double free.
Commit card->dai_link and card->num_links right after the first krealloc() succeeds, so the pointer always refers to a valid allocation that meson_card_clean_references() can walk and free. krealloc() with __GFP_ZERO zero-initializes the added entries, so walking them on the error path is safe. With both failure paths reduced to a plain return, drop the goto labels and the error message.
--- sound/soc/meson/meson-card-utils.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
sound/soc/meson/meson-card-utils.c +6 -11
@@ -50,25 +50,20 @@ int meson_card_reallocate_links(struct snd_soc_card *card, num_links *sizeof (*priv->card.dai_link), GFP_KERNEL | __GFP_ZERO);if (!links) - goto err_links; +return -ENOMEM ; + + priv->card.dai_link = links; + priv->card.num_links = num_links; ldata =krealloc (priv->link_data, num_links *sizeof (*priv->link_data),GFP_KERNEL | __GFP_ZERO); +/* meson_card_clean_references() will free the links on this error path */ if (!ldata) - goto err_ldata; +return -ENOMEM ; - priv->card.dai_link = links; priv->link_data = ldata; - priv->card.num_links = num_links;return 0 ; - -err_ldata: -kfree (links); -err_links: -dev_err (priv->card.dev,"failed to allocate links\n" ); -return -ENOMEM ; - }EXPORT_SYMBOL_GPL (meson_card_reallocate_links);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 817/1424 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Peng <[email protected]>
[ Upstream commit 97bed336f6a25c9d1115ca95e3aa00e05c3bc271 ]
stf_dphy_probe() enables runtime PM before registering the PHY provider. If devm_of_phy_provider_register() fails, probe returns with runtime PM still enabled.
The driver also has no remove callback, so runtime PM is left enabled on driver unbind after a successful probe.
Use devm_pm_runtime_enable() so runtime PM is disabled automatically on later probe failures and on driver unbind.
--- drivers/phy/starfive/phy-jh7110-dphy-rx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/phy/starfive/phy-jh7110-dphy-rx.c +4 -1
@@ -155,6 +155,7 @@ static int stf_dphy_probe(struct platform_device *pdev) {struct phy_provider *phy_provider;struct stf_dphy *dphy; +int ret; dphy =devm_kzalloc (&pdev->dev,sizeof (*dphy),GFP_KERNEL );if (!dphy)
@@ -195,7 +196,9 @@ static int stf_dphy_probe(struct platform_device *pdev)return PTR_ERR (dphy->phy); } -pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) +return ret;phy_set_drvdata (dphy->phy, dphy); phy_provider = devm_of_phy_provider_register(&pdev->dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 818/1424 arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jun Yan <[email protected]>
[ Upstream commit 7f1d0cc86cb70fa550163b6f70fd1d484c03218e ]
The PCIe PHY node references mipi_pcie_analog_dphy via its phys property. Enable this analog PHY node to make PCIe functionally viable.
--- arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/amlogic/meson-axg-s400.dts +4 -0
@@ -433,6 +433,10 @@ gpio_speaker: gpio-controller@1f { }; }; +&mipi_pcie_analog_dphy { + status = "okay"; +}; + &pdm { pinctrl-0 = <&pdm_dclk_a14_pins>, <&pdm_din0_pins>, <&pdm_din1_pins>, <&pdm_din2_pins>, <&pdm_din3_pins>;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 819/1424 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danila Chernetsov <[email protected]>
[ Upstream commit 091c6162c022cbdfb64219708a71728cfd1d4600 ]
set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg().
If sdma_txinit_ahg() fails, it returns before initializing tx->txreq. However, set_txreq_header_ahg() ignores the error and returns the AHG change count, causing the caller to continue processing the request as though initialization had succeeded.
Propagate sdma_txinit_ahg() failures to the caller and abort request processing when initialization fails.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/hfi1/user_sdma.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/infiniband/hw/hfi1/user_sdma.c +8 -5
@@ -1028,6 +1028,7 @@ static int set_txreq_header_ahg(struct user_sdma_request *req, struct user_sdma_txreq *tx, u32 datalen) {u32 ahg[AHG_KDETH_ARRAY_SIZE ]; +int ret;int idx =0 ;u8 omfactor;/* KDETH.OM */ struct hfi1_user_sdma_pkt_q *pq = req->pq;
@@ -1132,11 +1133,13 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,trace_hfi1_sdma_user_header_ahg (pq->dd, pq->ctxt, pq->subctxt, req->info.comp_idx, req->sde->this_idx, req->ahg_idx, ahg, idx, tidval); -sdma_txinit_ahg (&tx->txreq, -SDMA_TXREQ_F_USE_AHG , - datalen, req->ahg_idx, idx, - ahg,sizeof (req->hdr), - user_sdma_txreq_cb); + ret =sdma_txinit_ahg (&tx->txreq, +SDMA_TXREQ_F_USE_AHG , + datalen, req->ahg_idx, idx, + ahg,sizeof (req->hdr), + user_sdma_txreq_cb); +if (ret) +return ret;return idx; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 820/1424 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <[email protected]>
[ Upstream commit 126c757e4cd46f866ddc283143b58eb4d9bf52cd ]
For a user QP, qp->sq.queue is a ring the application writes directly, so rxe_post_send() takes the is_user branch and only schedules send_task without validating the WQE. rxe_requester() consumes it in place via req_next_wqe() and calls copy_data(), which indexes &wqe->dma.sge[cur_sge] with the attacker-controlled num_sge/cur_sge. Only the kernel path bounds num_sge (validate_send_wr()); the user WQE is never checked, so a local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge and force an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read, local DoS).
Bound num_sge to qp->sq.max_sge in rxe_requester() before use, the way get_srq_wqe() already guards SRQ entries, and bound cur_sge only when the WQE carries payload (dma.resid): copy_data() returns early on a zero-length copy before touching dma->sge[], so a zero-payload WQE -- the only kind a max_sge == 0 QP can post -- stays valid.
Reproduced under KASAN; the vmalloc-out-of-bounds in copy_data() is gone.
--- drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/infiniband/sw/rxe/rxe_req.c +15 -0
@@ -732,6 +732,21 @@ int rxe_requester(struct rxe_qp *qp)if (unlikely (!wqe)) goto exit; +/* +* Don't trust user space data: a user QP's WQE comes from an mmap'd +* ring, so num_sge/cur_sge are attacker-controlled. Bound num_sge like +* get_srq_wqe(); bound cur_sge only when payload exists (dma.resid), +* since copy_data() skips dma->sge[] on a zero-length copy (all a +* max_sge == 0 QP can post). +*/ +if (unlikely (wqe->dma.num_sge > qp->sq.max_sge || + (wqe->dma.resid && + wqe->dma.cur_sge >= qp->sq.max_sge))) { +rxe_dbg_qp (qp,"invalid num_sge/cur_sge in send wqe\n" ); + wqe->status =IB_WC_LOC_QP_OP_ERR ; + goto err; + } +if (rxe_wqe_is_fenced (qp, wqe)) { qp->req.wait_fence =1 ; goto exit;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 821/1424 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: TanZheng <[email protected]>
[ Upstream commit b38f98e176050850f41bb6415f3a71400056623e ]
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/infiniband/ulp/srpt/ib_srpt.c +7 -0
@@ -959,6 +959,7 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,struct srpt_rdma_ch *ch = ioctx->ch;struct scatterlist *prev =NULL ;unsigned prev_nents; +u8 n_rdma, n_rw_ctx;int ret, i;if (nbufs ==1 ) {
@@ -970,6 +971,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,return -ENOMEM ; } + n_rw_ctx = ioctx->n_rw_ctx; + n_rdma = ioctx->n_rdma; +for (i = ioctx->n_rw_ctx; i < nbufs; i++, db++) {struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i];u64 remote_addr =be64_to_cpu (db->va);
@@ -1016,6 +1020,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, }if (ioctx->rw_ctxs != &ioctx->s_rw_ctx)kfree (ioctx->rw_ctxs); + ioctx->rw_ctxs =NULL ; + ioctx->n_rw_ctx = n_rw_ctx; + ioctx->n_rdma = n_rdma;return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 822/1424 kcsan: avoid unintended access checking in NMIs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit a8488ecbd7ba44d65b912dfe88a73f438eba2447 ]
If a watcher deliberately disables interrupts (either by user choice, or because we're dealing with a scoped reordered access) to avoid detecting any data races in interrupts, NMIs are still able to fire.
When we set up a watchpoint on a scoped reordered access, we disabled interrupts because the same CPU cannot observe reordering of its own accesses. To ensure we observe no false positives from NMIs, disable access checking for interrupt contexts as well.
--- kernel/kcsan/core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/kcsan/core.c +10 -2
@@ -585,8 +585,14 @@ kcsan_setup_watchpoint(const volatile void *ptr, size_t size, int type, unsigned* information is lost if dirtied by KCSAN. */ kcsan_save_irqtrace (current); -if (!interrupt_watcher) +if (!interrupt_watcher) {local_irq_save (irq_flags); +/* +* NMIs can still fire, disable checking for all interrupt +* contexts. +*/ +raw_cpu_ptr (&kcsan_cpu_ctx)->disable_count++; + } watchpoint =insert_watchpoint ((unsigned long )ptr, size, is_write);if (watchpoint ==NULL ) {
@@ -699,8 +705,10 @@ kcsan_setup_watchpoint(const volatile void *ptr, size_t size, int type, unsignedatomic_long_dec (&kcsan_counters[KCSAN_COUNTER_USED_WATCHPOINTS ]); out_unlock: -if (!interrupt_watcher) +if (!interrupt_watcher) { +raw_cpu_ptr (&kcsan_cpu_ctx)->disable_count--;local_irq_restore (irq_flags); + }kcsan_restore_irqtrace (current); ctx->disable_scoped--;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 823/1424 selftests/bpf: Silence array bounds warning in global_map_resize
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit dcd164ec67f89e0db5ee025ee9e91280052eb737 ]
When compiling BPF selftests with -O2, GCC reports an array bounds violation warning in global_map_resize test:
In function ‘global_map_resize_bss_subtest’,
inlined from ‘test_global_map_resize’ at /bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:228:3:
/bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:64:33: error: array subscript 1 is above array bounds of ‘int[1]’ [-Werror=array-bounds=]
64 | skel->bss->array[i] = 1;
| ~~~~~~~~~~~~~~~~^~~
In file included from /bpf-next/tools/testing/selftests/bpf/prog_tests/global_map_resize.c:6:
./test_global_map_resize.skel.h: In function ‘test_global_map_resize’:
./test_global_map_resize.skel.h:44:21: note: while referencing ‘array’
44 | int array[1];
| ^~~~~
This is a false positive because array (a BPF map) has been resized from within the BPF program. GCC doesn't know that so let us silence the warning by accessing the array via a plain pointer.
--- .../testing/selftests/bpf/prog_tests/global_map_resize.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/prog_tests/global_map_resize.c +6 -2
@@ -23,6 +23,7 @@ static void global_map_resize_bss_subtest(void)struct bpf_map *map;const __u32 desired_sz =sizeof (skel->bss->sum) +sysconf (_SC_PAGE_SIZE) *2 ;size_t array_len, actual_sz, new_sz; +int *array; skel =test_global_map_resize__open ();if (!ASSERT_OK_PTR (skel,"test_global_map_resize__open" ))
@@ -58,10 +59,13 @@ static void global_map_resize_bss_subtest(void) goto teardown;/* fill the newly resized array with ones, -* skipping the first element which was previously set +* skipping the first element which was previously set; +* access through a plain pointer to avoid -Warray-bounds +* since the array was resized beyond its declared length. */ + array = skel->bss->array;for (int i =1 ; i < array_len; i++) - skel->bss->array[i] =1 ; + array[i] =1 ;/* set global const values before loading */ skel->rodata->pid =getpid ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 824/1424 irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit 325ff3e78c64cd619d52b99f7c8b09a3f31e1495 ]
When its_irq_gic_domain_alloc() fails, the following its_vpe_irq_domain_free() fails to invoke its_vep_teardown() for the corresponding interrupt, which leaks the resource.
Invoke its_vpe_teardown() in the error handling path to avoid the leak.
[ tglx: Massaged change log ]
--- drivers/irqchip/irq-gic-v3-its.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/irqchip/irq-gic-v3-its.c +10 -1
@@ -4474,6 +4474,13 @@ static int its_vpe_init(struct its_vpe *vpe)static void its_vpe_teardown (struct its_vpe *vpe) { +/* +* If vpt_page is NULL, then its_vpe_init() has failed, and +* there is nothing to do as no resource has been allocated. +*/ +if (vpe->vpt_page ==NULL ) +return ; +its_vpe_db_proxy_unmap (vpe);its_vpe_id_free (vpe->vpe_id);its_free_pending_table (vpe->vpt_page);
@@ -4553,8 +4560,10 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virqirqd_set_resend_when_in_progress (irq_get_irq_data (virq + i)); } -if (err) +if (err) { +its_vpe_teardown (vm->vpes[i]);its_vpe_irq_domain_free (domain, virq, i); + }return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 825/1424 RDMA/nldev: validate dynamic counter attribute length
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 74f49255492a62658f36bf2578d7916f1c6ffad1 ]
RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, so it does not establish the fixed shape of each child.
Require every child payload to be exactly one u32 before reading it.
--- drivers/infiniband/core/nldev.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/core/nldev.c +5 -0
@@ -1990,6 +1990,11 @@ static int nldev_stat_set_counter_dynamic_doit(struct nlattr *tb[],nla_for_each_nested (entry_attr, tb[RDMA_NLDEV_ATTR_STAT_HWCOUNTERS ], rem) { +if (nla_len (entry_attr) !=sizeof (u32)) { + ret = -EINVAL ; + goto out; + } + index =nla_get_u32 (entry_attr);if ((index >= stats->num_counters) || !(stats->descs[index].flags &IB_STAT_FLAG_OPTIONAL )) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 826/1424 ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Ling <[email protected]>
[ Upstream commit e71bdbce27dcaa7f467a3a198cbe723924f05569 ]
EC event delivery uses either a GPE or, on ACPI reduced hardware platforms, a GpioInt resource. The GPE path does not have a provider lookup that can defer, but acpi_dev_gpio_irq_get() can return -EPROBE_DEFER for the GpioInt path.
ec_install_handlers() currently installs the EC address space handler and executes _REG before looking up the GPIO IRQ. If the GPIO lookup then defers, acpi_ec_setup() tears the handlers down again. Removing the EC address space handler causes ACPICA to execute _REG for disconnect, so firmware may observe an EC OpRegion connected -> disconnected transition during one failed probe attempt.
This is observable when the namespace EC reuses a boot EC that has already installed the EC address space handler. A deferred namespace EC probe can disconnect the already usable boot EC OpRegion until a later reprobe connects it again. AML that gates EC field accesses on _REG state can then return fallback values to other drivers during that window.
Prepare the GPIOInt IRQ before publishing EC OpRegion availability to AML. This leaves the GPE path unchanged, keeps non-deferred GPIO lookup errors non-fatal as before, and still lets the existing acpi_ec_setup() error path clean up real handler installation failures.
--- drivers/acpi/ec.c | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-)
drivers/acpi/ec.c +26 -14
@@ -1510,6 +1510,24 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec) "ACPI EC", ec) >= 0; } +static int ec_prepare_gpio_irq (struct acpi_ec *ec,struct acpi_device *device) +{ +int irq; + +if (!device || ec->gpe >=0 || ec->irq >=0 ) +return 0 ; + +/* ACPI reduced hardware platforms use a GpioInt from _CRS. */ + irq =acpi_dev_gpio_irq_get (device,0 ); +if (irq == -EPROBE_DEFER ) +return irq; + +if (irq >=0 ) + ec->irq = irq; + +return 0 ; +} +/** * ec_install_handlers - Install service callbacks and register query methods. * @ec: Target EC.
@@ -1524,7 +1542,6 @@ static bool install_gpio_irq_event_handler(struct acpi_ec *ec)* Return: * -ENODEV if the address space handler cannot be installed, which means * "unable to handle transactions", -* -EPROBE_DEFER if GPIO IRQ acquisition needs to be deferred, * or 0 (success) otherwise. */ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,
@@ -1557,19 +1574,6 @@ static int ec_install_handlers(struct acpi_ec *ec, struct acpi_device *device,if (!device)return 0 ; -if (ec->gpe <0 ) { -/* ACPI reduced hardware platforms use a GpioInt from _CRS. */ -int irq =acpi_dev_gpio_irq_get (device,0 ); -/* -* Bail out right away for deferred probing or complete the -* initialization regardless of any other errors. -*/ -if (irq == -EPROBE_DEFER ) -return -EPROBE_DEFER ; -else if (irq >=0 ) - ec->irq = irq; - } -if (!test_bit (EC_FLAGS_QUERY_METHODS_INSTALLED , &ec->flags)) {/* Find and register all query methods */ acpi_walk_namespace(ACPI_TYPE_METHOD, ec->handle, 1,
@@ -1647,6 +1651,14 @@ static int acpi_ec_setup(struct acpi_ec *ec, struct acpi_device *device, bool ca {int ret; +/* +* GPIO IRQ lookup can defer. Do it before publishing the EC +* OpRegion to AML to avoid a spurious _REG(disconnect). +*/ + ret =ec_prepare_gpio_irq (ec, device); +if (ret) +return ret; +/* First EC capable of handling transactions */ if (!first_ec) first_ec = ec;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 827/1424 ACPI: processor: validate MADT IOAPIC entry bounds
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 2c50ffdc73f3a70d745d249f509fc290754121e6 ]
The IOAPIC hotplug lookup parses both MADT and _MAT records directly. The MADT walk previously used a subtable's declared length to advance the cursor after only locating a generic header. The _MAT path likewise passed a generic header to the IOAPIC helper.
Validate that a current record has a complete generic header, that its declared length is contained in the available record range, and that a typed IOAPIC record contains the full fixed IOAPIC body before reading its fields. Use the same relation for both MADT and _MAT provider paths.
--- drivers/acpi/processor_core.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-)
drivers/acpi/processor_core.c +25 -6
@@ -320,11 +320,26 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)EXPORT_SYMBOL_GPL (acpi_get_cpuid);#ifdef CONFIG_ACPI_HOTPLUG_IOAPIC -static int get_ioapic_id (struct acpi_subtable_header *entry,u32 gsi_base, +static bool madt_entry_is_valid (struct acpi_subtable_header *entry, +unsigned long end) +{ +unsigned long start = (unsigned long )entry; + +if (start >= end || end - start <sizeof (*entry)) +return false; + +return entry->length >=sizeof (*entry) && entry->length <= end - start; +} + +static int get_ioapic_id (struct acpi_subtable_header *entry, +const unsigned long end,u32 gsi_base,u64 *phys_addr,int *ioapic_id) {struct acpi_madt_io_apic *ioapic = (struct acpi_madt_io_apic *)entry; +if (!madt_entry_is_valid (entry, end) ||BAD_MADT_ENTRY (ioapic, end)) +return 0 ; +if (ioapic->global_irq_base != gsi_base)return 0 ;
@@ -345,17 +360,19 @@ static int parse_madt_ioapic_entry(u32 gsi_base, u64 *phys_addr)return apic_id; entry = (unsigned long )madt; +if (madt->header.length <sizeof (*madt)) +return apic_id; madt_end = entry + madt->header.length;/* Parse all entries looking for a match. */ entry +=sizeof (struct acpi_table_madt ); -while (entry +sizeof (struct acpi_subtable_header ) < madt_end) { +while (madt_entry_is_valid ((struct acpi_subtable_header *)entry, + madt_end)) { hdr = (struct acpi_subtable_header *)entry;if (hdr->type ==ACPI_MADT_TYPE_IO_APIC && -get_ioapic_id (hdr, gsi_base, phys_addr, &apic_id)) +get_ioapic_id (hdr, madt_end, gsi_base, phys_addr, &apic_id))break ; -else - entry += hdr->length; + entry += hdr->length; }return apic_id;
@@ -382,7 +399,9 @@ static int parse_mat_ioapic_entry(acpi_handle handle, u32 gsi_base, header = (struct acpi_subtable_header *)obj->buffer.pointer;if (header->type ==ACPI_MADT_TYPE_IO_APIC ) -get_ioapic_id (header, gsi_base, phys_addr, &apic_id); +get_ioapic_id (header, + (unsigned long )header + obj->buffer.length, + gsi_base, phys_addr, &apic_id); exit:kfree (buffer.pointer);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 828/1424 ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Pei <[email protected]>
[ Upstream commit 8a742141f7ab84975aa758b775567ef4740ef0cf ]
acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Both failure paths reach the end: label where root is kfree()'d, but only the pci_acpi_scan_root() path clears driver_data first.
When dmar_device_add() fails during a hot-add, root is freed while device->driver_data still points at it. The ACPI core does not clear driver_data on attach failure, so a later acpi_pci_find_root() call may dereference this dangling pointer.
acpi_pci_root_remove() has the same problem: it frees root without clearing device->driver_data, leaving a dangling pointer behind after the root bridge is removed.
Move the NULL assignment to the shared end: label so every error path in acpi_pci_root_add() clears driver_data before freeing root, and clear it in acpi_pci_root_remove() as well, so the object is never left reachable through driver_data after being freed.
--- drivers/acpi/pci_root.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/acpi/pci_root.c +2 -1
@@ -735,7 +735,6 @@ static int acpi_pci_root_add(struct acpi_device *device,dev_err (&device->dev,"Bus %04x:%02x not present in PCI namespace\n" , root->segment, (unsigned int )root->secondary.start); - device->driver_data =NULL ; result = -ENODEV ; goto remove_dmar; }
@@ -771,6 +770,7 @@ static int acpi_pci_root_add(struct acpi_device *device,if (hotadd)dmar_device_remove (handle); end: + device->driver_data =NULL ;kfree (root);return result; }
@@ -794,6 +794,7 @@ static void acpi_pci_root_remove(struct acpi_device *device)pci_unlock_rescan_remove (); + device->driver_data =NULL ;kfree (root); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 829/1424 ext4: fix circular lock dependency in ext4_ext_migrate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <[email protected]>
[ Upstream commit a897682793eba5de51ee6f3152760374afa629cf ]
Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection).
The deadlock scenario:
CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount)
---- ----
ext4_ext_migrate()
ext4_writepages_down_write()
s_writepages_rwsem (write)
ext4_evict_inode()
sb_start_intwrite() [sb_internal]
...
ext4_writepages()
s_writepages_rwsem (read) [BLOCKED]
iput(tmp_inode)
ext4_evict_inode()
sb_start_intwrite() [BLOCKED]The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.
--- fs/ext4/migrate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/migrate.c +2 -1
@@ -458,6 +458,7 @@ int ext4_ext_migrate(struct inode *inode)if (IS_ERR (tmp_inode)) { retval =PTR_ERR (tmp_inode);ext4_journal_stop (handle); + tmp_inode =NULL ; goto out_unlock; }/*
@@ -585,9 +586,9 @@ int ext4_ext_migrate(struct inode *inode)ext4_journal_stop (handle); out_tmp_inode:unlock_new_inode (tmp_inode); -iput (tmp_inode); out_unlock:ext4_writepages_up_write (inode->i_sb, alloc_ctx); +iput (tmp_inode);return retval; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 830/1424 ext4: fix out-of-bounds read in ext4_read_inline_dir()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
[ Upstream commit 9333cc809f0a89e001b814155a6cb8903a6274df ]
ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry Read of size 2 at addr ffff88800f3dd23c by task exploit/148 ... __ext4_check_dir_entry ext4_read_inline_dir iterate_dir
The dirent payload lives in a buffer of exactly inline_size bytes:
dir_buf = kmalloc(inline_size, GFP_NOFS);
but iteration runs in a position space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic "." and ".." land at their block-dir offsets. A dirent is formed at "dir_buf + pos - extra_offset", yet the ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.
Reject a position whose minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer.
--- fs/ext4/inline.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/ext4/inline.c +10 -1
@@ -1551,6 +1551,8 @@ int ext4_read_inline_dir(struct file *file,/* for other entry, the real offset in * the buf has to be tuned accordingly. */ +if (i +ext4_dir_rec_len (1 ,NULL ) > extra_size) +break ; de = (struct ext4_dir_entry_2 *) (dir_buf + i - extra_offset);/* It's too expensive to do a full
@@ -1585,10 +1587,17 @@ int ext4_read_inline_dir(struct file *file,continue ; } +/* +* de lives at dir_buf + ctx->pos - extra_offset, within the +* kmalloc(inline_size) buffer. Make sure its header fits before +* ext4_check_dir_entry() dereferences de->rec_len. +*/ +if (ctx->pos +ext4_dir_rec_len (1 ,NULL ) > extra_size) + goto out; de = (struct ext4_dir_entry_2 *) (dir_buf + ctx->pos - extra_offset);if (ext4_check_dir_entry (inode, file, de, iloc.bh, dir_buf, - extra_size, ctx->pos)) + inline_size, ctx->pos)) goto out; if (le32_to_cpu(de->inode)) { if (!dir_emit(ctx, de->name, de->name_len,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 831/1424 ext4: skip extra isize expansion during mount to prevent deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <[email protected]>
[ Upstream commit 7461c60b9c6a839b13ad4c3490681a0cf5aa0637 ]
ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency:
s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem
This can be triggered via:
ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()
or:
ext4_evict_inode() -> ext4_mark_inode_dirty()
-> ext4_try_to_expand_extra_isize()
Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
--- fs/ext4/inode.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/ext4/inode.c +10 -0
@@ -6015,6 +6015,16 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode,if (ext4_test_inode_state (inode,EXT4_STATE_NO_EXPAND ))return -EOVERFLOW ; +/* +* Skip expansion during mount (!SB_ACTIVE). Expanding extra isize +* may move xattrs to external blocks and release ea_inodes via iput. +* When !SB_ACTIVE, iput triggers write_inode_now() which acquires +* s_writepages_rwsem, causing a deadlock with the caller's active +* jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle). +*/ +if (unlikely (!(inode->i_sb->s_flags &SB_ACTIVE ))) +return -EBUSY ; +/* * In nojournal mode, we can immediately attempt to expand * the inode. When journaled, we first need to obtain extra
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 832/1424 libbpf: Search /lib64 and /lib in resolve_full_path()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 7b5ae0481efdac040cea72b4fabd1398109f975b ]
attach_probe/uprobe-lib and uprobe_autoattach selftests fail with "failed to resolve full path for libc.so.6" on older non-usrmerged distros, where libc.so.6 lives under a top-level /lib64 or /lib rather than /usr/lib64 or /usr/lib. Add /lib64:/lib to the search paths, alongside the existing /usr/lib64:/usr/lib and Debian multiarch entries.
--- tools/lib/bpf/libbpf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/lib/bpf/libbpf.c +2 -1
@@ -11234,13 +11234,14 @@ static const char *arch_specific_lib_paths(void)/* Get full path to program/shared library. */ static int resolve_full_path (const char *file,char *result,size_t result_sz) { -const char *search_paths[3 ] = {}; +const char *search_paths[4 ] = {};int i, perm;if (str_has_sfx (file,".so" ) ||strstr (file,".so." )) { search_paths[0 ] =getenv ("LD_LIBRARY_PATH" ); search_paths[1 ] ="/usr/lib64:/usr/lib" ; search_paths[2 ] =arch_specific_lib_paths (); + search_paths[3 ] ="/lib64:/lib" ; perm =R_OK ; }else { search_paths[0 ] =getenv ("PATH" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 833/1424 RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit ef63cc441703412628a517dda354f3e51fe2dc92 ]
srpt_handle_cmd() maps the initiator-supplied srp_cmd->task_attr into cmd->sam_task_attr, but then hands a hardcoded TCM_SIMPLE_TAG to target_init_cmd().
Pass the already mapped cmd->sam_task_attr instead, so target core sees the attribute the initiator requested.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
@@ -1603,7 +1603,7 @@ static void srpt_handle_cmd(struct srpt_rdma_ch *ch, rc =target_init_cmd (cmd, ch->sess, &send_ioctx->sense_data[0 ],scsilun_to_int (&srp_cmd->lun), data_len, -TCM_SIMPLE_TAG , dir,TARGET_SCF_ACK_KREF ); + cmd->sam_task_attr, dir,TARGET_SCF_ACK_KREF );if (rc !=0 ) {pr_debug ("target_submit_cmd() returned %d for tag %#llx\n" , rc, srp_cmd->tag);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 834/1424 PCI: j721e: Fix incorrect max_lanes for J7200
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takuma Fujiwara <[email protected]>
[ Upstream commit 7147a7bfce47acd48c3738130bf0bd692bfd80de ]
The PCIe Controller in the J7200 SoC supports a 4-lane configuration. However, j7200_pcie_rc_data and j7200_pcie_ep_data incorrectly set .max_lanes = 2, limiting operation to fewer lanes than the hardware supports.
Set .max_lanes = 4 for both j7200_pcie_rc_data and j7200_pcie_ep_data to match the hardware capability.
See J7200 Technical Reference Manual (SPRUIU1D), section 12.2.3.1.1 for further details: https://www.ti.com/lit/pdf/spruiu1d
--- drivers/pci/controller/cadence/pci-j721e.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/cadence/pci-j721e.c +2 -2
@@ -374,14 +374,14 @@ static const struct j721e_pcie_data j7200_pcie_rc_data = { .quirk_detect_quiet_flag = true, .linkdown_irq_regfield = J7200_LINK_DOWN, .byte_access_allowed = true, - .max_lanes = 2, + .max_lanes = 4, };static const struct j721e_pcie_data j7200_pcie_ep_data = { .mode =PCI_MODE_EP , .quirk_detect_quiet_flag = true, .quirk_disable_flr = true, - .max_lanes =2 , + .max_lanes =4 , };static const struct j721e_pcie_data am64_pcie_rc_data = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 835/1424 RDMA/erdma: Fix CEQ tasklet use-after-free on removal
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <[email protected]>
[ Upstream commit 0ca79979384f031d710c4b3bae065dcb5d95aca3 ]
Each CEQ interrupt handler only schedules eqc->tasklet. The tasklet calls erdma_ceq_completion_handler(), which reads the DMA-coherent EQ ring through get_next_valid_eqe() and updates eq->dbrec through notify_eq().
erdma_ceqs_uninit() frees each CEQ IRQ and then destroys its EQ. free_irq() prevents another hard IRQ and waits for an in-flight handler, but it does not drain a tasklet that the handler already scheduled. The tasklet can therefore access eq->qbuf or eq->dbrec after erdma_eq_destroy() frees them.
Clearing ceq_cb->ready does not synchronize with a tasklet that already passed the check at the start of erdma_ceq_completion_handler().
Kill the tasklet after free_irq(), when no handler can schedule it again, and before erdma_ceq_uninit_one() releases the EQ buffers.
--- drivers/infiniband/hw/erdma/erdma_eq.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/erdma/erdma_eq.c +1 -0
@@ -204,6 +204,7 @@ static void erdma_free_ceq_irq(struct erdma_dev *dev, u16 ceqn)irq_set_affinity_hint (eqc->irq.msix_vector,NULL );free_irq (eqc->irq.msix_vector, eqc); +tasklet_kill (&eqc->tasklet); }static int create_eq_cmd (struct erdma_dev *dev,u32 eqn,struct erdma_eq *eq)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 836/1424 RDMA/core: Add support to set privileged QKEY parameter
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 465d6b42f1a3b855c06da1d4d3b09907d261af69 ]
Add netlink command that enables/disables privileged QKEY by default.
It is disabled by default, since according to IB spec only privileged users are allowed to use privileged QKEY.
According to the IB specification rel-1.6, section 3.5.3:
"QKEYs with the most significant bit set are considered controlled QKEYs, and a HCA does not allow a consumer to arbitrarily specify a controlled QKEY."
Using rdma tool,
$rdma system set privileged-qkey on
When enabled non-privileged users would be able to use controlled QKEYs which are considered privileged.
Using rdma tool,
$rdma system set privileged-qkey off
When disabled only privileged users would be able to use controlled QKEYs.
You can also use the command below to check the parameter state:
$rdma system show
netns shared privileged-qkey off copy-on-fork on
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
--- drivers/infiniband/core/core_priv.h | 1 + drivers/infiniband/core/nldev.c | 63 ++++++++++++++++++++++++---- drivers/infiniband/core/uverbs_cmd.c | 3 +- include/uapi/rdma/rdma_netlink.h | 2 + 4 files changed, 60 insertions(+), 9 deletions(-)
drivers/infiniband/core/core_priv.h +1 -0
@@ -376,4 +376,5 @@ void rdma_umap_priv_init(struct rdma_umap_priv *priv,void ib_cq_pool_cleanup (struct ib_device *dev); +bool rdma_nl_get_privileged_qkey (void );#endif /* _CORE_PRIV_H */
drivers/infiniband/core/nldev.c +55 -8
103 lines not on this page · raw message
drivers/infiniband/core/uverbs_cmd.c +2 -1
@@ -1859,7 +1859,8 @@ static int modify_qp(struct uverbs_attr_bundle *attrs,if (cmd->base.attr_mask &IB_QP_PATH_MIG_STATE ) attr->path_mig_state = cmd->base.path_mig_state;if (cmd->base.attr_mask &IB_QP_QKEY ) { -if (cmd->base.qkey &IB_QP_SET_QKEY && !capable (CAP_NET_RAW )) { +if (cmd->base.qkey &IB_QP_SET_QKEY && + !rdma_nl_get_privileged_qkey ()) { ret = -EPERM ; goto release_qp; }
include/uapi/rdma/rdma_netlink.h +2 -0
@@ -554,6 +554,8 @@ enum rdma_nldev_attr {RDMA_NLDEV_ATTR_STAT_HWCOUNTER_INDEX ,/* u32 */ RDMA_NLDEV_ATTR_STAT_HWCOUNTER_DYNAMIC ,/* u8 */ + RDMA_NLDEV_SYS_ATTR_PRIVILEGED_QKEY_MODE, /* u8 */ +/* * Always the end */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 837/1424 RDMA/core: Add an option to display driver-specific QPs in the rdmatool
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chiara Meiohas <[email protected]>
[ Upstream commit e18fa0bbcedf82aaa1db27079ef6a43e11367592 ]
Utilize the -dd flag (driver-specific details) in the rdmatool to view driver-specific QPs which are not exposed yet.
Add the netlink attribute to mark request to convey driver details and use it to return QP subtype as a string.
$ rdma resource show qp link ibp8s0f1 link ibp8s0f1/1 lqpn 360 type UD state RTS sq-psn 0 comm [mlx5_ib] link ibp8s0f1/1 lqpn 0 type SMI state RTS sq-psn 0 comm [ib_core] link ibp8s0f1/1 lqpn 1 type GSI state RTS sq-psn 0 comm [ib_core]
$ rdma resource show qp link ibp8s0f1 -dd link ibp8s0f1/1 lqpn 360 type UD state RTS sq-psn 0 comm [mlx5_ib] link ibp8s0f1/1 lqpn 465 type DRIVER subtype REG_UMR state RTS sq-psn 0 comm [mlx5_ib] link ibp8s0f1/1 lqpn 0 type SMI state RTS sq-psn 0 comm [ib_core] link ibp8s0f1/1 lqpn 1 type GSI state RTS sq-psn 0 comm [ib_core]
$ rdma resource show 0: ibp8s0f0: pd 3 cq 4 qp 3 cm_id 0 mr 0 ctx 0 srq 2 1: ibp8s0f1: pd 3 cq 4 qp 3 cm_id 0 mr 0 ctx 0 srq 2
$ rdma resource show -dd 0: ibp8s0f0: pd 3 cq 4 qp 4 cm_id 0 mr 0 ctx 0 srq 2 1: ibp8s0f1: pd 3 cq 4 qp 4 cm_id 0 mr 0 ctx 0 srq 2
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
--- drivers/infiniband/core/nldev.c | 23 +++++++++++++++++++---- drivers/infiniband/core/restrack.c | 12 ++++++++++-- include/rdma/restrack.h | 7 +++++-- include/uapi/rdma/rdma_netlink.h | 6 ++++++ 4 files changed, 40 insertions(+), 8 deletions(-)
drivers/infiniband/core/nldev.c +19 -4
@@ -137,6 +137,8 @@ static const struct nla_policy nldev_policy[RDMA_NLDEV_ATTR_MAX] = { [RDMA_NLDEV_ATTR_RES_SUMMARY_ENTRY_NAME]= { .type = NLA_NUL_STRING, .len = RDMA_NLDEV_ATTR_EMPTY_STRING }, [RDMA_NLDEV_ATTR_RES_TYPE] = { .type = NLA_U8 }, + [RDMA_NLDEV_ATTR_RES_SUBTYPE] = { .type = NLA_NUL_STRING, + .len = RDMA_NLDEV_ATTR_EMPTY_STRING }, [RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY]= { .type = NLA_U32 }, [RDMA_NLDEV_ATTR_RES_USECNT] = { .type = NLA_U64 }, [RDMA_NLDEV_ATTR_RES_SRQ] = { .type = NLA_NESTED },
@@ -164,6 +166,7 @@ static const struct nla_policy nldev_policy[RDMA_NLDEV_ATTR_MAX] = { [RDMA_NLDEV_ATTR_STAT_HWCOUNTER_INDEX] = { .type = NLA_U32 }, [RDMA_NLDEV_ATTR_STAT_HWCOUNTER_DYNAMIC] = { .type = NLA_U8 }, [RDMA_NLDEV_SYS_ATTR_PRIVILEGED_QKEY_MODE] = { .type = NLA_U8 }, + [RDMA_NLDEV_ATTR_DRIVER_DETAILS] = { .type = NLA_U8 }, }; static int put_driver_name_print_type(struct sk_buff *msg, const char *name,
@@ -400,7 +403,8 @@ static int fill_res_info_entry(struct sk_buff *msg,return -EMSGSIZE ; } -static int fill_res_info (struct sk_buff *msg,struct ib_device *device) +static int fill_res_info (struct sk_buff *msg,struct ib_device *device, +bool show_details) {static const char *const names[RDMA_RESTRACK_MAX ] = { [RDMA_RESTRACK_PD ] ="pd" ,
@@ -425,7 +429,7 @@ static int fill_res_info(struct sk_buff *msg, struct ib_device *device)for (i =0 ; i <RDMA_RESTRACK_MAX ; i++) {if (!names[i])continue ; - curr =rdma_restrack_count (device, i); + curr =rdma_restrack_count (device, i, show_details); ret =fill_res_info_entry (msg, names[i], curr);if (ret) goto err;
@@ -1288,6 +1292,7 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, struct netlink_ext_ack *extack) {struct nlattr *tb[RDMA_NLDEV_ATTR_MAX ]; +bool show_details = false;struct ib_device *device;struct sk_buff *msg;u32 index;
@@ -1303,6 +1308,9 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,if (!device)return -EINVAL ; +if (tb[RDMA_NLDEV_ATTR_DRIVER_DETAILS ]) + show_details =nla_get_u8 (tb[RDMA_NLDEV_ATTR_DRIVER_DETAILS ]); + msg =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_KERNEL );if (!msg) { ret = -ENOMEM ;
@@ -1317,7 +1325,7 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, goto err_free; } - ret =fill_res_info (msg, device); + ret =fill_res_info (msg, device, show_details);if (ret) goto err_free;
@@ -1347,7 +1355,7 @@ static int _nldev_res_get_dumpit(struct ib_device *device,RDMA_NL_GET_TYPE (RDMA_NL_NLDEV ,RDMA_NLDEV_CMD_RES_GET ), 0, NLM_F_MULTI); -if (!nlh ||fill_res_info (skb, device)) { +if (!nlh ||fill_res_info (skb, device, false)) {nlmsg_cancel (skb, nlh); goto out; }
@@ -1518,6 +1526,7 @@ static int res_get_common_dumpit(struct sk_buff *skb,struct rdma_restrack_entry *res;struct rdma_restrack_root *rt;int err, ret =0 , idx =0 ; +bool show_details = false;struct nlattr *table_attr;struct nlattr *entry_attr;struct ib_device *device;
@@ -1546,6 +1555,9 @@ static int res_get_common_dumpit(struct sk_buff *skb,if (!device)return -EINVAL ; +if (tb[RDMA_NLDEV_ATTR_DRIVER_DETAILS ]) + show_details =nla_get_u8 (tb[RDMA_NLDEV_ATTR_DRIVER_DETAILS ]); +/* * If no PORT_INDEX is supplied, we will return all QPs from that device */
@@ -1583,6 +1595,9 @@ static int res_get_common_dumpit(struct sk_buff *skb,* objects. */ xa_for_each (&rt->xa, id, res) { +if (xa_get_mark (&rt->xa, res->id,RESTRACK_DD ) && !show_details) + goto next; +if (idx < start || !rdma_restrack_get (res)) goto next;
drivers/infiniband/core/restrack.c +10 -2
@@ -59,8 +59,10 @@ void rdma_restrack_clean(struct ib_device *dev)* rdma_restrack_count() - the current usage of specific object * @dev: IB device * @type: actual type of object to operate +* @show_details: count driver specific objects */ -int rdma_restrack_count (struct ib_device *dev,enum rdma_restrack_type type) +int rdma_restrack_count (struct ib_device *dev,enum rdma_restrack_type type, +bool show_details) {struct rdma_restrack_root *rt = &dev->res[type];struct rdma_restrack_entry *e;
@@ -68,8 +70,11 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type)u32 cnt =0 ;xa_lock (&rt->xa); -xas_for_each (&xas, e,U32_MAX ) +xas_for_each (&xas, e,U32_MAX ) { +if (xa_get_mark (&rt->xa, e->id,RESTRACK_DD ) && !show_details) +continue ; cnt++; + }xa_unlock (&rt->xa);return cnt; }
@@ -198,6 +203,9 @@ void rdma_restrack_add(struct rdma_restrack_entry *res) ret =xa_insert (&rt->xa, res->id, res,GFP_KERNEL );if (ret) res->id =0 ; + +if (qp->qp_type >=IB_QPT_DRIVER ) +xa_set_mark (&rt->xa, res->id,RESTRACK_DD ); }else if (res->type ==RDMA_RESTRACK_COUNTER ) {/* Special case to ensure that cntn points to right counter */ struct rdma_counter *counter;
include/rdma/restrack.h +5 -2
@@ -14,6 +14,9 @@#include <uapi/rdma/rdma_netlink.h> #include <linux/xarray.h> +/* Mark entry as containing driver specific details, it is used to provide QP subtype for now */ +#define RESTRACK_DD XA_MARK_1 +struct ib_device ;struct sk_buff ;
@@ -116,8 +119,8 @@ struct rdma_restrack_entry {u32 id; }; -int rdma_restrack_count (struct ib_device *dev, -enum rdma_restrack_type type); +int rdma_restrack_count (struct ib_device *dev,enum rdma_restrack_type type, +bool show_details);/** * rdma_is_kernel_res() - check the owner of resource * @res: resource entry
include/uapi/rdma/rdma_netlink.h +6 -0
@@ -556,6 +556,12 @@ enum rdma_nldev_attr {RDMA_NLDEV_SYS_ATTR_PRIVILEGED_QKEY_MODE ,/* u8 */ +RDMA_NLDEV_ATTR_DRIVER_DETAILS ,/* u8 */ +/* +* QP subtype string, used for driver QPs +*/ + RDMA_NLDEV_ATTR_RES_SUBTYPE, /* string */ +/* * Always the end */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 838/1424 RDMA/restrack: Fix typos in the comments
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalesh AP <[email protected]>
[ Upstream commit d43358cda7c4696e08880aaa58a7df82e471fa7c ]
Fix couple of occurrences of the misspelled word "reource" in the comments with the correct spelling "resource".
Stable-dep-of: 709ba0e5311b ("RDMA/core: Fix use after free in ib_query_qp()")
--- drivers/infiniband/core/restrack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/restrack.c +2 -2
@@ -173,7 +173,7 @@ void rdma_restrack_new(struct rdma_restrack_entry *res,EXPORT_SYMBOL (rdma_restrack_new);/** -* rdma_restrack_add() - add object to the reource tracking database +* rdma_restrack_add() - add object to the resource tracking database * @res: resource entry */ void rdma_restrack_add (struct rdma_restrack_entry *res)
@@ -275,7 +275,7 @@ int rdma_restrack_put(struct rdma_restrack_entry *res)EXPORT_SYMBOL (rdma_restrack_put);/** -* rdma_restrack_del() - delete object from the reource tracking database +* rdma_restrack_del() - delete object from the resource tracking database * @res: resource entry */ void rdma_restrack_del (struct rdma_restrack_entry *res)
Signature · 1 line
2.53.0