5.10.271-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.10.271-rc1 review
This is the start of the stable review cycle for the 5.10.271 release. There are 595 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Oct 2026 15:23:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.271-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.271-rc1
Pengpeng Hou <[email protected]>
can: ems_usb: validate CPC message lengths
Guangshuo Li <[email protected]>
drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
Rengarajan S <[email protected]>
lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
Rengarajan S <[email protected]>
lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
Hui Peng <[email protected]>
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
Aldo Ariel Panzardo <[email protected]>
Bluetooth: L2CAP: validate frame length before control and FCS access
Aldo Ariel Panzardo <[email protected]>
Bluetooth: hci_sock: reject out-of-range OCF values
Aldo Ariel Panzardo <[email protected]>
Bluetooth: hci_sock: validate event length before filtering
Vineeth Vijayan <[email protected]>
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
Myeonghun Pak <[email protected]>
pinctrl: single: free the IRQ on domain creation failure
Yehyeong Lee <[email protected]>
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
Doruk Tan Ozturk <[email protected]>
nfc: port100: reject frames whose declared length exceeds the received data
Aamir Ahmed <[email protected]>
nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
Luxiao Xu <[email protected]>
nfc: fix use-after-free in nfc_get_local_general_bytes
Luxiao Xu <[email protected]>
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
Weiming Shi <[email protected]>
netfilter: ip6t_rpfilter: reject routes without inet6_dev
Ming Wang <[email protected]>
net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
Gajdos Tamás <[email protected]>
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
Gajdos Tamás <[email protected]>
net: atl1c: fix soft lockup on out-of-range tpd_cons read
Ilya Maximets <[email protected]>
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
Wentao Liang <[email protected]>
net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
Gajdos Tamás <[email protected]>
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
Zijie Huang <[email protected]>
net: arp: terminate device name before lookup
Weiming Shi <[email protected]>
net/sched: reject IDR error pointers when deleting actions
Wentao Liang <[email protected]>
net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
Wei Jie LAW <[email protected]>
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
Junjie Cao <[email protected]>
HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
Chen Changcheng <[email protected]>
HID: alps: fix use-after-free on input2 registration failure
Wentao Liang <[email protected]>
drm/nouveau: Fix gem reference leak in validate_init()
Peiyang He <[email protected]>
drm/nouveau: fix double-free in nvif_vmm_dtor
Wentao Liang <[email protected]>
drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
Guangshuo Li <[email protected]>
drm/nouveau: fix autosuspend cleanup during teardown
Dongliang Qin <[email protected]>
rds: ib: Clear the sg list when mapping an MR fails
Zixuan Chai <[email protected]>
llc: reserve device headroom for allocated frames
Ridham Khurana <[email protected]>
gpio: zynq: fix runtime PM leak on request error path
Wentao Liang <[email protected]>
gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
Hui Peng <[email protected]>
ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
Norbert Szetei <[email protected]>
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
Wentao Liang <[email protected]>
fsl/fman: Fix clk reference leak in read_dts_node()
Pavankumar Kondeti <[email protected]>
workqueue: Fix NULL current_pwq deref in flush dependency check
Hui Peng <[email protected]>
fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
Dairui Zhang <[email protected]>
af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
Aohan Mei <[email protected]>
sctp: discard the rest of the packet on a stale-cookie error
Eric Dumazet <[email protected]>
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
Mario Limonciello <[email protected]>
x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
Eric Dumazet <[email protected]>
net: preserve skb_end_offset() in skb_unclone_keeptruesize()
Eric Dumazet <[email protected]>
net: add skb_set_end_offset() helper
Eric Dumazet <[email protected]>
net: add and use skb_unclone_keeptruesize() helper
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
Pablo Neira Ayuso <[email protected]>
rculist: add list_splice_rcu() for private lists
Hui Peng <[email protected]>
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
Eric Dumazet <[email protected]>
vlan: ensure sufficient headroom in vlan_dev_hard_header()
Eric Dumazet <[email protected]>
net/sched: sch_teql: fix shadowed err in __teql_resolve()
Eric Dumazet <[email protected]>
bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
Eric Dumazet <[email protected]>
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
Ginger Li <[email protected]>
tipc: Fix a data race on mon->peer_cnt in mon_timeout()
Norbert Szetei <[email protected]>
net: xps: reject an out of range traffic class
Sanghyun Park <[email protected]>
vxlan: use one headroom snapshot for neighbour replies
Xuanqiang Luo <[email protected]>
ip_gre: Reject enabling collect metadata through changelink
Shihuang Liu <[email protected]>
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
Victor Nogueira <[email protected]>
net/sched: act_gate: budget the per-entry list in get_fill_size
Nam Cao <[email protected]>
hrtimers: Introduce hrtimer_setup() to replace hrtimer_init()
Nam Cao <[email protected]>
hrtimers: Add missing hrtimer_init() trace points
Baowen Zheng <[email protected]>
flow_offload: rename offload functions with offload instead of flow
Deepanshu Kartikey <[email protected]>
nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
Ömer Mete Kaya <[email protected]>
nfc: llcp: fix slab-out-of-bounds reads when logging service names
Ömer Mete Kaya <[email protected]>
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
Ömer Mete Kaya <[email protected]>
nfc: llcp: fix -ENOMEM on connect with zero-length service name
Pengpeng Hou <[email protected]>
nfc: st21nfca: validate ISO15693 inventory length
Cong Nguyen <[email protected]>
nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
Lee Jones <[email protected]>
nfc: llcp: Fix race condition in accept_queue lifecycle
Aldo Ariel Panzardo <[email protected]>
nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
Pengpeng Hou <[email protected]>
nfc: st21nfca: validate received frame size
Colin Ian King <[email protected]>
nfc: st21nfca: remove redundant assignment to variable i
Pengpeng Hou <[email protected]>
nfc: nfcmrvl: validate helper command length before pull
Maxime Chevallier <[email protected]>
net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
Andrew Halaney <[email protected]>
net: stmmac: Remove some unnecessary void pointers
Maxime Chevallier <[email protected]>
net: stmmac: selftests: Capture all packets for vlan checks
Maxime Chevallier <[email protected]>
net: stmmac: selftests: Check the dev->features for S-TAG offload testing
Maxime Chevallier <[email protected]>
net: stmmac: selftests: Support running selftests on DSA conduits
Emil Tsalapatis <[email protected]>
bpf: Fix bpf_sock context code generation
bui duc phuc <[email protected]>
net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
Myeonghun Pak <[email protected]>
tg3: clean up PHYLIB resources on probe failure
Pengpeng Hou <[email protected]>
net: usb: sr9700: include receive overhead in the length check
Hui Peng <[email protected]>
Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
Hui Peng <[email protected]>
Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
Junrui Luo <[email protected]>
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Junrui Luo <[email protected]>
drm/virtio: fix object leak when drm_gem_handle_create() fails
Jamal Hadi Salim <[email protected]>
net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
Aamir Ahmed <[email protected]>
net: usb: catc: bound the RX packet length in catc_rx_done()
Yiqi Sun <[email protected]>
sctp: avoid livelock while updating retransmit path
Kuniyuki Iwashima <[email protected]>
ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
Jérémy Jean <[email protected]>
net: gue: reject invalid REMCSUM offsets
Nguyen Ngoc Thang <[email protected]>
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
Francesco Magazzu <[email protected]>
drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
Dan Carpenter <[email protected]>
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
Joseph Qi <[email protected]>
ocfs2: make ocfs2_calc_xattr_init() return void
Julian Anastasov <[email protected]>
ipvs: revalidate ihl before icmp_send
Karl Mehltretter <[email protected]>
netfilter: nft_synproxy: use the family-aware checksum helper
Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
Scott Mitchell <[email protected]>
netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
Jérémy Jean <[email protected]>
netfilter: flowtable: publish HW_DEAD after worker is done
Vlad Buslov <[email protected]>
netfilter: flowtable: allow unidirectional rules
Zhiling Zou <[email protected]>
xsk: Use a 32-bit compare in xsk_map_gen_lookup
Julian Sun <[email protected]>
fs: avoid repeated scans in evict_inodes()
Karl Mehltretter <[email protected]>
s390/pci/docs: Fix sriov_numvfs attribute name
Niklas Schnelle <[email protected]>
docs: s390/pci: Improve and update PCI documentation
Randy Dunlap <[email protected]>
Documentation: s390: correct spelling
Niklas Schnelle <[email protected]>
s390/pci: expose UID uniqueness guarantee
Christiano Amora <[email protected]>
Bluetooth: SMP: reject Security Request over BR/EDR
Ran Hongyun <[email protected]>
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
Jiayuan Chen <[email protected]>
bpf: Fix out-of-bounds read of rtt_min in sock_ops
Sven Schnelle <[email protected]>
selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
Weiming Shi <[email protected]>
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Daniel Borkmann <[email protected]>
bpf: Fix bpf_skb_change_tail wrt csum partial skbs
Claudio Imbrenda <[email protected]>
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
NeilBrown <[email protected]>
SUNRPC: lock against ->sock changing during sysfs read
Vitaly Kuznetsov <[email protected]>
HID: hyperv: streamline driver probe to avoid devres issues
Jinjie Ruan <[email protected]>
spi: zynqmp-gqspi: Use devm_spi_alloc_host()
Benoît Sevens <[email protected]>
HID: logitech-hidpp: fix race condition when accessing stale stack pointer
Guangshuo Li <[email protected]>
drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
Guangshuo Li <[email protected]>
drm/msm/adreno: fix autosuspend cleanup during teardown
Rik van Riel <[email protected]>
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
Zhao Li <[email protected]>
wifi: mwifiex: validate action frame fixed fields
Pengpeng Hou <[email protected]>
wifi: mwifiex: validate scan response extents
Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
Shengzhuo Wei <[email protected]>
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
Shengzhuo Wei <[email protected]>
wifi: p54: validate curve data length in the calibration curve converters
Tianchu Chen <[email protected]>
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
Ali Ahmet Memis <[email protected]>
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
Runyu Xiao <[email protected]>
wifi: wlcore: release runtime PM ref on regdomain config failure
Tianchu Chen <[email protected]>
wifi: rsi: fix heap OOB write on key removal
Jiangshan Yi <[email protected]>
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
Stanislaw Gruszka <[email protected]>
wifi: iwlegacy: fix broadcast stations deallocation
Jiangshan Yi <[email protected]>
wifi: brcmsmac: fix UAF in brcms_free_timer()
Wentao Liang <[email protected]>
watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
Tzung-Bi Shih <[email protected]>
watchdog: digicolor: Avoid division by zero
Guangshuo Li <[email protected]>
hwmon: (w83793) release probe data through kref
Guangshuo Li <[email protected]>
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
Iván Ezequiel Rodriguez <[email protected]>
Input: zero ff_effect before compat copy in input_ff_effect_from_user
Dmitry Torokhov <[email protected]>
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Raphaël Larocque <[email protected]>
Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
Hans de Goede <[email protected]>
Input: soc_button_array - check btns_desc->package.count
Hans de Goede <[email protected]>
Input: soc_button_array - fix MS Surface Pro 11 probe failure
Dmitry Torokhov <[email protected]>
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
Chris Sommers <[email protected]>
Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
Iván Ezequiel Rodriguez <[email protected]>
Input: evdev - zero absinfo before partial copy in EVIOCSABS
Alexei Turtanov <[email protected]>
Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
Diogo Ivo (Schneider Electric) <[email protected]>
mmc: sdhci_am654: Reset command and data lines on failed tuning
Xu Rao <[email protected]>
mmc: spi: reset bytes_xfered before retrying CRC failures
Runyu Xiao <[email protected]>
mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
Felix Gu <[email protected]>
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
Myeonghun Pak <[email protected]>
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
Fan Wu <[email protected]>
mmc: mxcmmc: cancel data work and watchdog on remove
Zhu Ling <[email protected]>
mmc: core: Fix OF node reference leak on card add failure
Christian Göttsche <[email protected]>
selinux: always fill AVC decision in avc_has_perm_noaudit()
Shuangpeng Bai <[email protected]>
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
Shengzhuo Wei <[email protected]>
i2c: imx: release DMA channels on probe error
Shengzhuo Wei <[email protected]>
i2c: at91: release DMA channels on remove and probe error
Maoyi Xie <[email protected]>
keys: translate request_key_auth pid for the reading procfs instance
Mark Amirkan <[email protected]>
net/packet: avoid truncating TPACKET_V3 private size
Mark Amirkan <[email protected]>
net/packet: clear RX owner on VNET header error
Jamal Hadi Salim <[email protected]>
net/sched: hhf: cap hh_flows_limit at change time
Zhiling Zou <[email protected]>
ipv6: xfrm: use full sockets in local error paths
Alexander Chesnokov <[email protected]>
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
Christian Lugnberg <[email protected]>
dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
Christian Lugnberg <[email protected]>
dmaengine: sun6i: fix non-atomic read of DMA position registers
Nicolas Thibert <[email protected]>
Bluetooth: btusb: fix NXP IW610 composite device handling
Mark Rutland <[email protected]>
arm64: percpu: Fix this_cpu_and() mask generation
Mark Rutland <[email protected]>
arm64: percpu: Fix this_cpu_write() casting
Wyatt Feng <[email protected]>
net: xfrm: reject unrepresentable espintcp transport headers
Zhiling Zou <[email protected]>
openvswitch: avoid reallocating confirmed conntrack labels
Jeffin Philip <[email protected]>
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
Quanye Yang <[email protected]>
RDMA/ucma: Serialize join and leave on copy_to_user failure
Inbal Schussheim <[email protected]>
tcp: exclude old ACKs from tcp fast path
Aohan Mei <[email protected]>
rds: ib: use rds_conn_drop() on protocol version mismatch
Niklas Cassel <[email protected]>
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
Jeremy Nyberg <[email protected]>
Input: xpad - fix PDP Marvel Xbox 360 controller
Erich Sartison <[email protected]>
Input: xpad - add support for Victrix Pro BFG Controller
hackyzh002 <[email protected]>
drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
hpp.iscas <[email protected]>
Input: eeti_ts - publish the OF module alias
Dmitriy Okunev <[email protected]>
net: mvpp2: prevent buffer overflow in page_pool allocation
Linus Walleij <[email protected]>
net: ethernet: cortina: Ack RX overrun interrupt correctly
Eric Dumazet <[email protected]>
net: lock the socket in sock_gettstamp()
Yige Jiang <[email protected]>
net: netsec: fix device_node reference leak on phy_np
Sasha Levin <[email protected]>
ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
Shivaprasad G Bhat <[email protected]>
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
Amit Machhiwal <[email protected]>
KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
Eric Dumazet <[email protected]>
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
Eric Dumazet <[email protected]>
drop_monitor: synchronize tracepoint unregistration on error path
Tzung-Bi Shih <[email protected]>
Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
Baineng Shou <[email protected]>
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
Eric Dumazet <[email protected]>
tcp: do not let tcp_rmem be set below 4096
Kuniyuki Iwashima <[email protected]>
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
Karl Mehltretter <[email protected]>
wifi: brcmfmac: fix lost 802.1x TX completion wakeup
Hohyun Sim <[email protected]>
net: fddi: skfp: fix NULL deref when setting the MAC address while down
Andrea Mayer <[email protected]>
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
Filipe Manana <[email protected]>
btrfs: tree-checker: print dev extent offset in error message
Slavin Liu <[email protected]>
ALSA: hda: trace PCM open only after assigning a stream
Zihan Xi <[email protected]>
wifi: virt_wifi: don't transfer operstate before register
Karl Mehltretter <[email protected]>
Input: trackpoint - fix the inertia attribute name in the ABI document
Nguyen Ngoc Thang <[email protected]>
ALSA: pcm: set timer->private_data before registering the PCM timer
Karl Mehltretter <[email protected]>
keys: fix lost wakeup when reaping a dead key type
Thadeu Lima de Souza Cascardo <[email protected]>
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: hold reference on ct until flow is released
Theodor Arsenij Larionov Trichkine <[email protected]>
netfilter: nft_nat: fully initialise new_addr in netmap setup
Jérémy Jean <[email protected]>
RDMA/siw: Bound fragmented header copies by the remaining length
Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
Alex Bereza <[email protected]>
dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
Johannes Berg <[email protected]>
wifi: mac80211: don't access the TSF of a down interface
Johannes Berg <[email protected]>
wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
Johannes Berg <[email protected]>
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
Johannes Berg <[email protected]>
wifi: cfg80211: don't filter by BSS type when removing stale entries
Johannes Berg <[email protected]>
wifi: cfg80211: only group hidden BSSes with beacon entries
Shivank Garg <[email protected]>
dmaengine: wait for RCU readers before releasing dma_device
Shivank Garg <[email protected]>
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
Shivank Garg <[email protected]>
dmaengine: Fix device kref underflow in dma_chan_put()
Donggeun Yoo <[email protected]>
dma-coherent: report a failed reserved memory assignment
Chen-Yu Tsai <[email protected]>
dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
Christoph Hellwig <[email protected]>
dma-mapping: simplify dma_init_coherent_memory
Orgad Shaneh <[email protected]>
MIPS: Octeon: apply USB FDT fixups also when USB is modular
Bard Liao <[email protected]>
soundwire: cadence_master: wait and cancel cdns->work before clock stop
Johannes Berg <[email protected]>
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
Carolina Jubran <[email protected]>
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
Shmulik Cohen <[email protected]>
wifi: libipw: reject too-short association responses
Shmulik Cohen <[email protected]>
wifi: libipw: reject too-short beacon and probe responses
Peng Hao <[email protected]>
wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
Mariano Baragiola <[email protected]>
wifi: virt_wifi: free skb when disconnected
Ruoyu Wang <[email protected]>
dmaengine: sprd: Fix runtime PM reference leak in probe
Li RongQing <[email protected]>
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Yehyeong Lee <[email protected]>
IB/isert: wait for deferred control PDU completions before releasing the connection
Max Gurtovoy <[email protected]>
scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd
Sebastian Andrzej Siewior <[email protected]>
scsi: target: iscsi: Redo iscsit_check_session_usage_count() return code
Sebastian Andrzej Siewior <[email protected]>
scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_check_session_usage_count()
Sebastian Andrzej Siewior <[email protected]>
scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_close_session()
Yehyeong Lee <[email protected]>
IB/iser: reject a remote invalidation of an unregistered direction
Max Gurtovoy <[email protected]>
IB/iser: Use iser_fr_desc as registration context
Max Gurtovoy <[email protected]>
IB/iser: Remove iser_reg_data_sg helper function
Max Gurtovoy <[email protected]>
IB/iser: Align coding style across driver
Xixin Liu <[email protected]>
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Xixin Liu <[email protected]>
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
Guoqing Jiang <[email protected]>
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Guoqing Jiang <[email protected]>
RDMA/siw: Cleanup siw_accept
Guoqing Jiang <[email protected]>
RDMA/siw: Introduce siw_cep_set_free_and_put
Pengpeng Hou <[email protected]>
ARM: socfpga: select the PL310 erratum 753970 workaround
Kyle Zeng <[email protected]>
xfrm: fix compat ALLOCSPI request use-after-free
Sabrina Dubroca <[email protected]>
xfrm: avoid RCU warnings around the per-netns netlink socket
Sabrina Dubroca <[email protected]>
xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead
Sabrina Dubroca <[email protected]>
xfrm: add extack support to verify_newsa_info
Sabrina Dubroca <[email protected]>
xfrm: add extack to verify_sec_ctx_len
Sabrina Dubroca <[email protected]>
xfrm: propagate extack to all netlink doit handlers
Ido Schimmel <[email protected]>
ipv6: Honor oif when choosing nexthop for locally generated traffic
Ido Schimmel <[email protected]>
ipv6: Select best matching nexthop object in fib6_table_lookup()
Arash Golgol <[email protected]>
media: video-i2c: fix buffer queue ordering
Sasha Levin <[email protected]>
Revert "perf cs-etm: Flush thread stacks after decoder reset"
Sasha Levin <[email protected]>
Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int"
Guangguan Wang <[email protected]>
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
Guangguan Wang <[email protected]>
net/smc: check smcd_v2_ext_offset when receiving proposal msg
Jens Axboe <[email protected]>
sunvdc: fix -EIO issue due to lack of retries
Russell King (Oracle) <[email protected]>
ARM: ensure interrupts are enabled in __do_user_fault()
Russell King (Oracle) <[email protected]>
ARM: fix branch predictor hardening
Russell King (Oracle) <[email protected]>
ARM: fix hash_name() fault
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix deadlock
Sasha Levin <[email protected]>
Reapply "bluetooth/l2cap: sync sock recv cb and release"
Darrick J. Wong <[email protected]>
iomap: iomap: fix memory corruption when recording errors during writeback
Paolo Abeni <[email protected]>
mptcp: close race between scheduler and state change
Paolo Abeni <[email protected]>
mptcp: avoid unneeded actions on subflow reset
Florian Westphal <[email protected]>
mptcp: hold mptcp socket before calling tcp_done
Eric Biggers <[email protected]>
netfilter: nft_set_pipapo_avx2: add missing vzeroupper
Eric Biggers <[email protected]>
crypto: sun8i-ce - Remove crypto_rng interface
Eric Biggers <[email protected]>
crypto: sun8i-ss - Remove crypto_rng interface
Xuanqiang Luo <[email protected]>
fou: Fix use-after-free in fou_create()
Weiming Shi <[email protected]>
net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
Weiming Shi <[email protected]>
i2c: smbus: reject oversized block transfers in the common path
Kazuki Hanai <[email protected]>
ALSA: us122l: Prevent write upgrades for read mappings
Eric Dumazet <[email protected]>
ipv6: mcast: extend RCU protection in igmp6_send()
Matthieu Baerts (NGI0) <[email protected]>
mptcp: syncookies: remember the request backup flag
Joe Damato <[email protected]>
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
Joe Damato <[email protected]>
bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
Haotian Zhang <[email protected]>
media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
Michael Bommarito <[email protected]>
media: hevc: add bounded tile-count helpers
Vishnu Razdan <[email protected]>
hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
Cong Nguyen <[email protected]>
hwmon: (applesmc) fix key backlight workqueue leak on register failure
Harald Freudenberger <[email protected]>
s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
Nagamani PV <[email protected]>
s390/qeth: allow bridgeport queries despite OS_MISMATCH
leixiang <[email protected]>
KVM: PPC: Book3S HV: Set irqfd->producer only on success
Kyle Zeng <[email protected]>
ipvs: reject invalid states in connection template sync records
Zihan Xi <[email protected]>
ipv4: fib: bound automatic table ID allocation
Zhiling Zou <[email protected]>
ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
Weiming Shi <[email protected]>
fbdev: vfb: defer cleanup until the last reference
Ilya Maximets <[email protected]>
netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
Norbert Szetei <[email protected]>
net: openvswitch: fix use-after-free of the flow table mask array
Fourie Zhang <[email protected]>
net: mpls: clear inner_protocol when the last label is popped
Johan Hovold <[email protected]>
net: hso: fix TIOCMIWAIT race
Thorsten Blum <[email protected]>
drm/i915: Fix memory leak in query_perf_config_list()
Jann Horn <[email protected]>
exec: do_close_on_exec() before taking exec_update_lock
Runyu Xiao <[email protected]>
cpufreq: initialize policy rwsem before sysfs publication
Zhongqiu Han <[email protected]>
cpufreq: zero-initialize policy cpumask before sysfs publication
Runyu Xiao <[email protected]>
ASoC: sti: initialize IRQ lock before requesting IRQ
Tianchu Chen <[email protected]>
ASoC: sprd: validate compress buffer sizes against fixed allocations
Donggeun Yoo <[email protected]>
tracing: Free histogram the var ref when its initialization fails
Ido Schimmel <[email protected]>
tunnels: Drop stale dst when building an ICMP error for PMTUD
Ali Ahmet Memis <[email protected]>
ufs: validate cylinder group metadata before caching it
Ali Ahmet Memis <[email protected]>
ufs: create the root dentry after loading cylinder metadata
James Hilliard <[email protected]>
watchdog: sunxi_wdt: preserve boot-enabled watchdog
Harry Wentland <[email protected]>
dm/amdgpu: fix malformed link_settings debugfs output
Roman Prucha <[email protected]>
ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
Zihan Xi <[email protected]>
ipv6: fix fib6 walker UAF on seq stop
Shivaprasad G Bhat <[email protected]>
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
Eric Dumazet <[email protected]>
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
Dmitry Bogdanov <[email protected]>
scsi: target: iscsi: Handle abort for WRITE_PENDING cmds
Sasha Levin <[email protected]>
Revert "bluetooth/l2cap: sync sock recv cb and release"
WenTao Liang <[email protected]>
drm/amd/display: set new_stream to NULL after release
Stian Halseth <[email protected]>
sunvdc: unmap LDC cookies when the descriptor send fails
Greg Marsden <[email protected]>
net/rds: fix tcp stream corruption with large pages
Linus Walleij <[email protected]>
net/rds: Pass a pointer to virt_to_page()
Aamir Ahmed <[email protected]>
net: hinic: fix mailbox segment buffer overflow
Li Youhong <[email protected]>
net: sun4i-emac: fix missing of_node_put() for phy_node
Kuniyuki Iwashima <[email protected]>
net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
Victor Nogueira <[email protected]>
net/sched: cls_route: free emptied bucket on filter move
Thibault Ferrante <[email protected]>
selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
Pengpeng Hou <[email protected]>
hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
Cong Nguyen <[email protected]>
hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX descriptors for freeq refill
Linus Walleij <[email protected]>
net: ethernet: cortina: Count RX drops once per frame
Linus Walleij <[email protected]>
net: ethernet: cortina: No mapping is a dropped rx
Linus Walleij <[email protected]>
net: ethernet: cortina: Count dropped frames as NAPI work
Linus Walleij <[email protected]>
net: ethernet: cortina: Finish RX updates before NAPI completion
Linus Walleij <[email protected]>
net: ethernet: cortina: Fix budget accounting
Andrew Stellman <[email protected]>
virtio-pci: return IRQ_HANDLED after non-zero ISR
Yu Zhang <[email protected]>
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
Jia Jia <[email protected]>
virtio_console: do not free control-out buffers on remove
Xianting Tian <[email protected]>
virtio-console: call scheduler when we free unused buffs
hpp.iscas <[email protected]>
ASoC: mt6351: Publish the OF module alias
Florian Westphal <[email protected]>
netfilter: ip6_tables: set F_PROTO when proto value is nonzero
Florian Westphal <[email protected]>
netfilter: nfnetlink_log: cope with concurrent instance destruction
hpp.iscas <[email protected]>
ASoC: Intel: SST: Publish the PCI module aliases
hpp.iscas <[email protected]>
ASoC: bcm: bcm63xx: Publish the OF module aliases
Edward Adam Davis <[email protected]>
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
Jamal Hadi Salim <[email protected]>
net/sched: ets: clamp quantum in parse and fallback paths
Jamal Hadi Salim <[email protected]>
net/sched: drr: clamp quantum in change class
Jamal Hadi Salim <[email protected]>
net/sched: pie: clamp psched_mtu in pie_drop_early
Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum in change and init paths
Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum in change path
Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp quantum in change path
Eric Dumazet <[email protected]>
net_sched: sch_fq_pie: implement lockless fq_pie_dump()
Yael Chemla <[email protected]>
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
Carolina Jubran <[email protected]>
net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
Shahar Shitrit <[email protected]>
net/mlx5e: Fix setting RS FEC after remapping
Thorsten Blum <[email protected]>
powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
Jamal Hadi Salim <[email protected]>
net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
Seungwon Bae <[email protected]>
vxlan: reject dynamic fdb entries that reference a nexthop id
Jason Winter <[email protected]>
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
Jakub Kicinski <[email protected]>
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
Jakub Kicinski <[email protected]>
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
Eric Dumazet <[email protected]>
bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref in btf_var_show()
Jiayuan Chen <[email protected]>
bpf: Fix NULL-ptr-deref when showing a void BTF type
Takashi Iwai <[email protected]>
ALSA: caiaq: Fix potential double-free at error path
Lorenzo Bianconi <[email protected]>
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
Allison Henderson <[email protected]>
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
Håkon Bugge <[email protected]>
net/rds: acquire the fastpath locks in rds_conn_shutdown()
Allison Henderson <[email protected]>
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
Gerd Rausch <[email protected]>
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
Allison Henderson <[email protected]>
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
Allison Henderson <[email protected]>
net/rds: use clear_bit_unlock() in release_refill()
Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in release_in_xmit()
Eric Dumazet <[email protected]>
bonding: do not clear curr_active_slave prematurely when releasing all slaves
Henry Martin <[email protected]>
tracing/probes: Fix use-after-free on field name/type of events with multiple probes
Joas Antonio dos Santos <[email protected]>
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
Kyle Zeng <[email protected]>
ipvs: fix reversed sequence option serialization
Qu Wenruo <[email protected]>
btrfs: do not force reloc root creation during qgroup_account_snapshot()
Josef Bacik <[email protected]>
btrfs: return an error from btrfs_record_root_in_trans
Linus Walleij <[email protected]>
ASoC: ux500: Program the MSP FIFO watermarks
Linus Walleij <[email protected]>
ASoC: ux500: Request the MSP MMIO resource
Arnd Bergmann <[email protected]>
ASoC: ux500: remove stedma40 references
Linus Walleij <[email protected]>
ASoC: ux500: Validate MSP DAI configuration
Linus Walleij <[email protected]>
ASoC: ux500: Correct MSP frame and bit clock setup
Linus Walleij <[email protected]>
ASoC: ux500: Propagate MSP setup errors
Arnd Bergmann <[email protected]>
ASoC: ux500: remove platform_data support
Linus Walleij <[email protected]>
ASoC: ux500: Fix MSP stream lifecycle handling
Guanghui Yang <[email protected]>
btrfs: detach failed sprout device from transaction update list
wangdicheng <[email protected]>
ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
Hui Su <[email protected]>
staging: fbtft: make dirty_lock IRQ-safe
Kuniyuki Iwashima <[email protected]>
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
Eric Dumazet <[email protected]>
ipv6: sr: restore network header before routing and forwarding
Qingfang Deng <[email protected]>
ppp: ppp_async: simplify tty disc_data access
Jiri Slaby <[email protected]>
tty: make tty_ldisc_ops::hangup return void
Linus Walleij <[email protected]>
ASoC: ab8500: Validate and program TDM slots correctly
Linus Walleij <[email protected]>
ASoC: ab8500: Correct digital interface format setup
Mark Brown <[email protected]>
ASoC: ab8500: Update to modern clocking terminology
Linus Walleij <[email protected]>
ASoC: ab8500: Repair the DAPM capture graph
Linus Walleij <[email protected]>
ASoC: ab8500: Reset the audio block before configuring it
Gongwei Li <[email protected]>
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Colin Ian King <[email protected]>
OPP: of: Fix potential multiplication overflow when calculating freq
James Nugraha <[email protected]>
net: amd-xgbe: discard rx packets with bad FCS
Henry Martin <[email protected]>
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
Xin Long <[email protected]>
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
Victor Nogueira <[email protected]>
net/sched: act_api: size the RTM_GETACTION reply from the actions
Victor Nogueira <[email protected]>
net/sched: act_api: budget all shared attributes in notify skbs
Hongfu Li <[email protected]>
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
Dan Carpenter <[email protected]>
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Jad Keskes <[email protected]>
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
Xie Yuanbin <[email protected]>
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
Sasha Levin <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
Sasha Levin <[email protected]>
Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors
Vlatko Kosturjak <[email protected]>
ppp_async: drop the errored frame instead of resetting its headroom
Geert Uytterhoeven <[email protected]>
clk: at91: pmc: #undef field_{get,prep}() before definition
Rudi Heitbaum <[email protected]>
ASoC: rt5645: Perform the initial jack detect at probe
Jia Jia <[email protected]>
vhost-scsi: flush backend after device ioctls
Robert Abrahamse <[email protected]>
ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
Jiale Yao <[email protected]>
Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
Deepanshu Kartikey <[email protected]>
wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
Li Qiang <[email protected]>
cifs: validate idmap key payload length
Vaibhav Jain <[email protected]>
powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
Michal Swiatkowski <[email protected]>
ice: pass the return value of skb_checksum_help()
Madhavender Singh <[email protected]>
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
Minhong He <[email protected]>
phonet: check register_netdevice_notifier() error in phonet_device_init()
Pengpeng Hou <[email protected]>
drm/gma500: return errors from Oaktrail HDMI I2C reads
Ibrahim Hashimov <[email protected]>
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
Georgi Valkov <[email protected]>
wifi: mwifiex: replace one-element arrays with flexible array members
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: bound aligned TLV advance in FW parser
Timur Kristóf <[email protected]>
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
Pu Hu <[email protected]>
arm64: kprobes: Allow reentering kprobes while single-stepping
Yu Peng <[email protected]>
arm64: fixmap: Allow 256K early_ioremap() at any offset
Tao Cui <[email protected]>
blk-cgroup: fix leaks and online flag on radix_tree_insert failure
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: fix an off-by-1 boundary check
Filipe Manana <[email protected]>
btrfs: fix reloc root cleanup in merge_reloc_roots()
Filipe Manana <[email protected]>
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
Pengpeng Hou <[email protected]>
wifi: rsi: validate beacon length before fixed buffer copy
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: mark the rcu locked areas properly
Pengpeng Hou <[email protected]>
wifi: libipw: fix key index receive bound checks
Liang Hao <[email protected]>
gpio: dwapb: Mask interrupts at hardware initialization
Pengpeng Hou <[email protected]>
wifi: libertas: reject short monitor TX frames
Pengpeng Hou <[email protected]>
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
Zhao Li <[email protected]>
wifi: mac80211: validate deauth frame length before reason access
Corentin Labbe <[email protected]>
wifi: ralink: RT2X00: init EEPROM properly
Pengpeng Hou <[email protected]>
ALSA: usb-audio: caiaq: validate EP1 reply lengths
Yousef Alhouseen <[email protected]>
xen/gntalloc: validate grant count before allocation
Farhad Alemi <[email protected]>
freevxfs: don't BUG() on unknown typed-extent type
Yousef Alhouseen <[email protected]>
xen/front-pgdir-shbuf: free grant reference head on errors
Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
Florian Westphal <[email protected]>
netfilter: nf_conntrack_expect: zero at allocation time
Gustavo Kenji Mendonça Kaneko <[email protected]>
drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
Haoxiang Li <[email protected]>
fbdev: pm2fb: unwind WC setup on probe failure
Adriana Stancu <[email protected]>
rtc: bq32000: add delay between RTC reads
Runyu Xiao <[email protected]>
net: au1000: move free_irq out of the close-time spinlocked section
Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
Tommy Huang <[email protected]>
rtc: aspeed: add AST2700 compatible
Samuel Moelius <[email protected]>
f2fs: validate inline dentry name lengths before conversion
Chen Cheng <[email protected]>
md/raid5: let stripe batch bm_seq comparison wrap-safe
Hans Zhang <[email protected]>
PCI: mediatek: Protect root bus removal with rescan lock
Hans Zhang <[email protected]>
PCI: rockchip: Protect root bus removal with rescan lock
Hans Zhang <[email protected]>
PCI: altera: Protect root bus removal with rescan lock
Hans Zhang <[email protected]>
PCI: iproc: Protect root bus removal with rescan lock
Jean-Louis Colaco <[email protected]>
ALSA: usb-audio: Add quirk for YAMAHA CDS3000
Tobias Deiminger <[email protected]>
leds: pca9532: Don't stop blinking for non-zero brightness
Yousef Alhouseen <[email protected]>
leds: uleds: Return -EFAULT on copy_to_user() failure
Galen Hassen <[email protected]>
ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
Rob Herring (Arm) <[email protected]>
gpio: pisosr: Read "ngpios" as u32
Arnd Bergmann <[email protected]>
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
Zhang Tianci <[email protected]>
fuse: set ff->flock only on success
Rosen Penev <[email protected]>
sparc: Disable compat support with LLD
Alice Mikityanska <[email protected]>
net/sched: act_csum: don't mangle UDP tunnel GSO packets
Agalakov Daniil <[email protected]>
e1000e: limit endianness conversion to boundary words
Raf Dickson <[email protected]>
vsock: use sk_acceptq_is_full() helper in all transports
Nazim Amirul <[email protected]>
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
Rosen Penev <[email protected]>
sparc64: uprobes: add missing break
bui duc phuc <[email protected]>
ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
bui duc phuc <[email protected]>
ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
Samuel Moelius <[email protected]>
Bluetooth: L2CAP: validate connectionless PSM length
Potin Lai <[email protected]>
hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
Jose Ignacio Tornos Martinez <[email protected]>
PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
Yuho Choi <[email protected]>
sctp: Unwind address notifier registration on failure
Nikolay Metchev <[email protected]>
platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
Xu Rao <[email protected]>
ata: libata-pmp: add JMicron JMS562 quirk
Kory Maincent <[email protected]>
hwmon: (adt7462) Add of_match_table to support devicetree
Jiajia Liu <[email protected]>
wifi: mt76: transform aspm_conf for pci_disable_link_state
Gleb Sonichev <[email protected]>
platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix potential system hang in mal_remove()
Al Viro <[email protected]>
configfs_depend_prep(): pass configfs_dirent instead of dentry
Chuck Lever <[email protected]>
xprtrdma: Add request-pool slack for delayed recycling
ZhengYuan Huang <[email protected]>
btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
Rosen Penev <[email protected]>
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
Ruoyu Wang <[email protected]>
ALSA: es18xx: check control allocation before private data setup
Maoyi Xie <[email protected]>
hsr: broadcast netlink notifications in the device's net namespace
Guangshuo Li <[email protected]>
net: cpsw_new: unregister devlink on port registration failure
Dawei Feng <[email protected]>
bpf: NUL-terminate replaced sysctl value
Li RongQing <[email protected]>
RDMA/mlx5: Fix state and counter desync on loopback enable failure
Thiyagarajan Pandiyan <[email protected]>
wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
Rosen Penev <[email protected]>
ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
Andrei Faleichyk <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
Michael Walle <[email protected]>
clk: keystone: don't cache clock rate
Mathias Nyman <[email protected]>
xhci: Prevent queuing new commands if xhci is inaccessible
David Yang <[email protected]>
net: dsa: sja1105: flower: reject cross-chip redirect
Cássio Gabriel <[email protected]>
ALSA: seq: oss: Reject reads that cannot fit the next event
Cássio Gabriel <[email protected]>
ASoC: codecs: rk3328: Use managed GPIO and clock helpers
Simon Xue <[email protected]>
iommu/rockchip: disable fetch dte time limit
Wentao Liang <[email protected]>
net: qrtr: fix node refcount leak on ctrl packet alloc failure
liyouhong <[email protected]>
ata: ahci: fail probe if BAR too small for claimed ports
Cezary Rojewski <[email protected]>
ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
Rosen Penev <[email protected]>
net: ibm: emac: Reserve VLAN header in MJS limit
Sanjay Chitroda <[email protected]>
iio: accel: mma8452: switch to non-devm request_threaded_irq()
Rik van Riel <[email protected]>
perf/ftrace: Fix WARNING in __unregister_ftrace_function
Osama Abdelkader <[email protected]>
mmc: davinci: fix mmc_add_host order in probe
Bard Liao <[email protected]>
soundwire: only handle alert events when the peripheral is attached
Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Complete coredump handling
Alexandre Courbot <[email protected]>
scripts: modpost: detect and report truncated buf_printf() output
Viacheslav Dubeyko <[email protected]>
hfs: rework hfsplus_readdir() logic
ikaros <[email protected]>
ACPICA: add boundary checks in two places
ikaros <[email protected]>
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
Weiming Shi <[email protected]>
ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
ikaros <[email protected]>
ACPICA: Add validation for node in acpi_ns_build_normalized_path()
ikaros <[email protected]>
ACPICA: Add package limit checks in parser functions
ikaros <[email protected]>
ACPICA: validate handler object type in two places
ikaros <[email protected]>
ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
ikaros <[email protected]>
ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
ikaros <[email protected]>
ACPICA: Prevent adding invalid references
ikaros <[email protected]>
ACPICA: validate byte_count in acpi_ps_get_next_package_length()
ikaros <[email protected]>
ACPICA: add boundary checks in acpi_ps_get_next_field()
ikaros <[email protected]>
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
ikaros <[email protected]>
ACPICA: Fix condition check in acpi_ps_parse_loop()
Jeremy Klarenbeek <[email protected]>
drm/amd/pm/si: Fix updating clock limits from power states
Fernando Fernandez Mancera <[email protected]>
ipv6: addrconf: fix temp address generation after prefix deprecation
Uwe Küchler <[email protected]>
ALSA: usb-audio: Add quirk for Novation Mininova
Mostafa Saleh <[email protected]>
irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
Stepan Ionichev <[email protected]>
iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
Rosen Penev <[email protected]>
mips: cps: Assemble jr.hb with an R2 ISA level
Dario Binacchi <[email protected]>
drm/panel: simple: Add AM-1280800W8TZQW-T00H
Daniel Lezcano <[email protected]>
thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
Adrian Ng Ho Yin <[email protected]>
clk: socfpga: agilex: implement l3_main_free_clk
Heiko Carstens <[email protected]>
s390/zcore: Removed unused variables
Jiayuan Chen <[email protected]>
rds: annotate data-race around rs_seen_congestion
Maoyi Xie <[email protected]>
rds: filter RDS_INFO_* getsockopt by caller's netns
Chenguang Zhao <[email protected]>
netlabel: fix IPv6 unlabeled address add error handling
Venkat Rao Bagalkote <[email protected]>
char/nvram: Remove redundant nvram_mutex
Christian Marangi <[email protected]>
usb: host: add ARCH_AIROHA in XHCI MTK dependency
Marco Felsch <[email protected]>
serial: 8250: fix possible ISR soft lockup
Stepan Ionichev <[email protected]>
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
Oliver Neukum <[email protected]>
usb: core: hcd: fix possible deadlock in rh control transfers
Adrian Wowk <[email protected]>
usbip: vhci_hcd: fix NULL deref in status_show_vhci
Christoph Hellwig <[email protected]>
isofs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
omfs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
hpfs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
jfs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
qnx4: handle set_blocksize failures
Christoph Hellwig <[email protected]>
minix: handle set_blocksize failures
Christoph Hellwig <[email protected]>
bfs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
affs: handle set_blocksize failures
Christoph Hellwig <[email protected]>
befs: handle set_blocksize failures
Allison Henderson <[email protected]>
net/rds: Don't sleep inside rds_ib_conn_path_shutdown
Eric Dumazet <[email protected]>
net/sched: sch_drr: make cl->quantum lockless
Eric Dumazet <[email protected]>
net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
Jan Volckaert <[email protected]>
net: usb: qmi_wwan: add MeiG SRM813Q
Yury Norov <[email protected]>
bitfield: wire __bf_shf to __builtin_ctzll
Miri Korenblit <[email protected]>
wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
Sudeep Holla <[email protected]>
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
Leonardo Bras <[email protected]>
arm64/daifflags: Make local_daif_*() helpers __always_inline
Pierre Barre <[email protected]>
9p: invalidate readdir buffer on seek
Cássio Gabriel <[email protected]>
ALSA: usx2y: Drain pending US-428 pipe-4 output commands
Joonwon Kang <[email protected]>
mailbox: Make mbox_send_message() return error code when tx fails
Chenguang Zhao <[email protected]>
RDMA/mlx5: Use QP port when decoding responder CQEs
Alessandro Baldi <[email protected]>
media: imon: Add iMON VFD HID OEM v1.2 key mappings
Thorsten Blum <[email protected]>
crypto: atmel-ecc - add support for atecc608b
Lukas Wunner <[email protected]>
crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject non-fatal dump when controller is crashed
Kumar Meiyappan <[email protected]>
scsi: pm8001: Reject firmware update in fatal error state
Viacheslav Dubeyko <[email protected]>
hfsplus: rework hfsplus_readdir() logic
Tom Chung <[email protected]>
drm/amd/display: Fix CRC open failure during active rendering
Stepan Ionichev <[email protected]>
mmc: davinci: avoid NULL deref of host->data in IRQ handler
Ethan Nelson-Moore <[email protected]>
ASoC: ti: omap3pandora: update board check to use DT compatible
Geert Uytterhoeven <[email protected]>
clk: renesas: cpg-mssr: Add number of clock cells check
Haoxiang Li <[email protected]>
media: em28xx-video: fix missing res_free() on init_usb_xfer failure
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
Zhaoyang Yu <[email protected]>
media: dm1105: fix missing error check for dma_alloc_coherent
Mika Westerberg <[email protected]>
thunderbolt: Set tb->root_switch to NULL when domain is stopped
Mika Westerberg <[email protected]>
thunderbolt: Keep the domain reference while processing hotplug
Mika Westerberg <[email protected]>
thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
Riccardo Boninsegna <[email protected]>
media: rc: mceusb: Add support for 04eb:e033
Pengpeng Hou <[email protected]>
soundwire: validate DT compatible before parsing it
Danielle Ratson <[email protected]>
bridge: Do not suppress ARP probes and DAD NS unconditionally
Marco Elver <[email protected]>
kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
Johannes Berg <[email protected]>
wifi: mac80211: always allow transmitting null-data on TXQs
Viacheslav Dubeyko <[email protected]>
hfsplus: fix issue of direct writes beyond end-of-file
Lukas Wunner <[email protected]>
PCI: Stop setting cached power state to 'unknown' on unbind
Hirokazu Honda <[email protected]>
tee: optee: Allow MT_NORMAL_TAGGED shared memory
Goldwyn Rodrigues <[email protected]>
ima: return error early if file xattr cannot be changed
Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
Sven Eckelmann <[email protected]>
batman-adv: dat: atomically update mac addresses
-------------
Diffstat:
.../ABI/testing/sysfs-devices-platform-trackpoint | 2 +- Documentation/driver-api/serial/tty.rst | 2 +- Documentation/networking/ip-sysctl.rst | 2 + Documentation/s390/pci.rst | 138 +++-- Documentation/s390/vfio-ccw.rst | 2 +- Makefile | 4 +- arch/arm/mach-socfpga/Kconfig | 2 +- arch/arm/mm/alignment.c | 4 + arch/arm/mm/fault.c | 82 ++- arch/arm64/include/asm/daifflags.h | 10 +- arch/arm64/include/asm/fixmap.h | 6 +- arch/arm64/include/asm/kprobes.h | 6 + arch/arm64/include/asm/percpu.h | 16 +- arch/arm64/kernel/probes/kprobes.c | 23 +- arch/mips/cavium-octeon/octeon-platform.c | 4 +- arch/mips/kernel/cps-vec.S | 6 + arch/powerpc/kernel/eeh_driver.c | 2 - arch/powerpc/kernel/iommu.c | 2 +- arch/powerpc/kexec/file_load_64.c | 2 +- arch/powerpc/kvm/book3s_hv.c | 4 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 5 +- arch/powerpc/platforms/pseries/kexec.c | 13 +- arch/s390/crypto/aes_s390.c | 16 +- arch/s390/kvm/interrupt.c | 72 +-- arch/s390/pci/pci_sysfs.c | 9 + arch/sparc/Kconfig | 1 + arch/sparc/kernel/uprobes.c | 1 + arch/x86/pci/fixup.c | 99 ++++ block/blk-cgroup.c | 4 +- crypto/Makefile | 5 + drivers/acpi/acpica/dsmethod.c | 43 ++ drivers/acpi/acpica/evhandler.c | 11 + drivers/acpi/acpica/exoparg3.c | 2 +- drivers/acpi/acpica/nsnames.c | 6 + drivers/acpi/acpica/nsprepkg.c | 7 + drivers/acpi/acpica/nsxfname.c | 4 + drivers/acpi/acpica/psargs.c | 134 ++++- drivers/acpi/acpica/psloop.c | 30 +- drivers/acpi/acpica/psparse.c | 14 + drivers/acpi/acpica/utcopy.c | 10 +- drivers/acpi/acpica/utresrc.c | 30 ++ drivers/ata/ahci.c | 22 + drivers/ata/libahci.c | 15 +- drivers/ata/libata-pmp.c | 7 +- drivers/block/sunvdc.c | 26 +- drivers/bluetooth/btmtksdio.c | 4 +- drivers/bluetooth/btusb.c | 23 +- drivers/bluetooth/hci_mrvl.c | 3 +- drivers/char/ipmi/ipmi_si_platform.c | 5 +- drivers/char/nvram.c | 16 +- drivers/char/virtio_console.c | 22 +- drivers/clk/at91/pmc.h | 2 + drivers/clk/clk-scpi.c | 2 +- drivers/clk/keystone/sci-clk.c | 8 + drivers/clk/renesas/renesas-cpg-mssr.c | 3 + drivers/clk/socfpga/clk-agilex.c | 2 + drivers/cpufreq/cpufreq.c | 6 +- drivers/crypto/allwinner/Kconfig | 16 - drivers/crypto/allwinner/sun8i-ce/Makefile | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 54 -- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 164 ------ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 -- drivers/crypto/allwinner/sun8i-ss/Makefile | 1 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 -- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 175 ------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 - drivers/crypto/atmel-ecc.c | 3 + drivers/dma/dmaengine.c | 10 +- drivers/dma/mmp_pdma.c | 2 +- drivers/dma/sprd-dma.c | 3 +- drivers/dma/sun6i-dma.c | 9 +- drivers/dma/ti/k3-udma-glue.c | 5 +- drivers/dma/xilinx/xilinx_dma.c | 26 +- drivers/edac/edac_device_sysfs.c | 11 +- drivers/firmware/arm_scmi/base.c | 15 +- drivers/firmware/arm_scpi.c | 4 +- drivers/gpio/gpio-arizona.c | 8 +- drivers/gpio/gpio-dwapb.c | 17 + drivers/gpio/gpio-pisosr.c | 4 +- drivers/gpio/gpio-zynq.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 +- drivers/gpu/drm/amd/amdgpu/atom.c | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 7 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 20 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 31 +- drivers/gpu/drm/arm/display/komeda/komeda_dev.c | 6 +- drivers/gpu/drm/arm/display/komeda/komeda_drv.c | 14 +- drivers/gpu/drm/arm/malidp_drv.c | 22 +- drivers/gpu/drm/drm_atomic_uapi.c | 13 +- drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 21 +- drivers/gpu/drm/i915/i915_query.c | 4 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 + drivers/gpu/drm/msm/hdmi/hdmi_phy.c | 8 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 2 + drivers/gpu/drm/nouveau/nvif/vmm.c | 1 + drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c | 23 +- drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramnv1a.c | 2 + drivers/gpu/drm/panel/panel-simple.c | 28 + drivers/gpu/drm/virtio/virtgpu_display.c | 2 +- drivers/gpu/drm/virtio/virtgpu_gem.c | 2 +- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +- drivers/hid/hid-alps.c | 6 +- drivers/hid/hid-hyperv.c | 58 ++- drivers/hid/hid-ids.h | 3 + drivers/hid/hid-logitech-hidpp.c | 10 +- drivers/hid/hid-quirks.c | 1 + drivers/hid/wacom_sys.c | 5 +- drivers/hwmon/adt7462.c | 8 + drivers/hwmon/applesmc.c | 7 +- drivers/hwmon/aspeed-pwm-tacho.c | 4 +- drivers/hwmon/gpio-fan.c | 5 +- drivers/hwmon/pmbus/lm25066.c | 60 +-- drivers/hwmon/pmbus/pmbus_core.c | 4 +- drivers/hwmon/w83791d.c | 1 + drivers/hwmon/w83793.c | 4 +- drivers/i2c/busses/i2c-at91-core.c | 3 + drivers/i2c/busses/i2c-at91-master.c | 12 +- drivers/i2c/busses/i2c-at91.h | 1 + drivers/i2c/busses/i2c-imx.c | 2 + drivers/i2c/i2c-core-smbus.c | 12 + drivers/iio/accel/mma8452.c | 19 +- drivers/iio/adc/qcom-spmi-iadc.c | 18 +- drivers/infiniband/core/iwpm_util.c | 9 +- drivers/infiniband/core/mad.c | 3 +- drivers/infiniband/core/ucma.c | 7 +- drivers/infiniband/hw/mlx4/sysfs.c | 4 + drivers/infiniband/hw/mlx5/cq.c | 3 +- drivers/infiniband/hw/mlx5/main.c | 11 + drivers/infiniband/sw/siw/siw_cm.c | 75 ++- drivers/infiniband/sw/siw/siw_qp_rx.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib.h | 7 + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 12 +- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 16 +- drivers/infiniband/ulp/iser/iscsi_iser.c | 72 +-- drivers/infiniband/ulp/iser/iscsi_iser.h | 8 +- drivers/infiniband/ulp/iser/iser_initiator.c | 49 +- drivers/infiniband/ulp/iser/iser_memory.c | 87 ++-- drivers/infiniband/ulp/iser/iser_verbs.c | 56 +- drivers/infiniband/ulp/isert/ib_isert.c | 86 ++-- drivers/infiniband/ulp/isert/ib_isert.h | 4 +- drivers/input/evdev.c | 2 + drivers/input/input-compat.c | 2 + drivers/input/joystick/xpad.c | 3 +- drivers/input/keyboard/atkbd.c | 8 + drivers/input/misc/soc_button_array.c | 16 +- drivers/input/mouse/synaptics.c | 8 + drivers/input/rmi4/rmi_driver.c | 13 + drivers/input/rmi4/rmi_smbus.c | 10 +- drivers/input/serio/i8042-acpipnpio.h | 7 + drivers/input/serio/serport.c | 3 +- drivers/input/touchscreen/eeti_ts.c | 1 + drivers/iommu/rockchip-iommu.c | 8 + drivers/irqchip/irq-gic-v3-its.c | 1 + drivers/leds/leds-pca9532.c | 8 +- drivers/leds/uleds.c | 11 +- drivers/mailbox/mailbox.c | 6 +- drivers/md/raid5.c | 2 +- drivers/media/i2c/video-i2c.c | 5 +- drivers/media/pci/dm1105/dm1105.c | 7 +- drivers/media/rc/imon.c | 4 + drivers/media/rc/mceusb.c | 2 + drivers/media/usb/em28xx/em28xx-video.c | 4 +- drivers/media/v4l2-core/v4l2-h264.c | 3 +- drivers/mmc/core/bus.c | 2 +- drivers/mmc/core/sdio_uart.c | 3 + drivers/mmc/host/davinci_mmc.c | 16 +- drivers/mmc/host/mmc_spi.c | 1 + drivers/mmc/host/mxcmmc.c | 4 + drivers/mmc/host/sdhci-of-aspeed.c | 5 +- drivers/mmc/host/sdhci_am654.c | 4 +- drivers/mmc/host/sh_mmcif.c | 3 +- drivers/net/bonding/bond_alb.c | 19 +- drivers/net/bonding/bond_main.c | 4 +- drivers/net/can/slcan.c | 3 +- drivers/net/can/usb/ems_usb.c | 43 ++ drivers/net/dsa/bcm_sf2_cfp.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 22 +- drivers/net/dsa/sja1105/sja1105_flower.c | 4 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 2 + drivers/net/ethernet/amd/au1000_eth.c | 3 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 3 +- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 3 + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 3 + drivers/net/ethernet/atheros/atlx/atl1.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 16 +- drivers/net/ethernet/broadcom/tg3.c | 4 + drivers/net/ethernet/cortina/gemini.c | 79 +-- drivers/net/ethernet/freescale/fman/fman.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 3 + drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c | 4 +- drivers/net/ethernet/ibm/emac/core.c | 3 +- drivers/net/ethernet/ibm/emac/mal.c | 6 +- drivers/net/ethernet/intel/e1000e/ethtool.c | 19 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 20 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en/port.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +- .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 7 +- drivers/net/ethernet/socionext/netsec.c | 2 + drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 10 +- drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c | 4 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 12 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 4 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_descs.c | 6 +- drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 11 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 32 +- drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 8 +- drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 14 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 + .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 106 +++- drivers/net/ethernet/ti/cpsw_new.c | 4 +- drivers/net/ethernet/ti/netcp_core.c | 2 +- drivers/net/fddi/skfp/skfddi.c | 3 +- drivers/net/macvlan.c | 4 + drivers/net/ppp/ppp_async.c | 90 +--- drivers/net/ppp/ppp_synctty.c | 3 +- drivers/net/slip/slip.c | 3 +- drivers/net/usb/catc.c | 15 +- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/usb/cx82310_eth.c | 1 + drivers/net/usb/hso.c | 2 +- drivers/net/usb/lan78xx.c | 7 +- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/usb/sr9700.c | 3 +- drivers/net/vxlan/vxlan_core.c | 17 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 2 + .../broadcom/brcm80211/brcmsmac/mac80211_if.c | 4 + drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 10 +- drivers/net/wireless/intel/iwlegacy/common.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- drivers/net/wireless/intersil/p54/eeprom.c | 22 +- drivers/net/wireless/mac80211_hwsim.c | 6 +- drivers/net/wireless/marvell/libertas/tx.c | 7 + drivers/net/wireless/marvell/libertas_tf/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/fw.h | 18 +- drivers/net/wireless/marvell/mwifiex/join.c | 8 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 54 +- drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 2 +- drivers/net/wireless/marvell/mwifiex/util.c | 10 +- drivers/net/wireless/mediatek/mt76/pci.c | 8 +- drivers/net/wireless/microchip/wilc1000/cfg80211.c | 14 + drivers/net/wireless/microchip/wilc1000/wlan.c | 9 + drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +- drivers/net/wireless/rsi/rsi_91x_hal.c | 8 + drivers/net/wireless/rsi/rsi_91x_mgmt.c | 8 +- drivers/net/wireless/ti/wlcore/main.c | 4 +- drivers/net/wireless/virt_wifi.c | 4 +- drivers/nfc/microread/microread.c | 6 +- drivers/nfc/nfcmrvl/fw_dnld.c | 11 +- drivers/nfc/pn533/pn533.c | 14 +- drivers/nfc/pn533/pn533.h | 4 +- drivers/nfc/pn533/usb.c | 4 +- drivers/nfc/pn544/pn544.c | 7 +- drivers/nfc/port100.c | 7 + drivers/nfc/st21nfca/core.c | 12 +- drivers/nfc/st21nfca/i2c.c | 33 +- drivers/opp/of.c | 2 +- drivers/pci/controller/pcie-altera.c | 2 + drivers/pci/controller/pcie-iproc.c | 2 + drivers/pci/controller/pcie-mediatek.c | 2 + drivers/pci/controller/pcie-rockchip-host.c | 2 + drivers/pci/pci-driver.c | 10 +- drivers/pci/pci-sysfs.c | 11 +- drivers/pci/quirks.c | 3 + drivers/pinctrl/pinctrl-single.c | 3 +- drivers/platform/x86/dell-laptop.c | 9 + drivers/platform/x86/intel-hid.c | 7 + drivers/rtc/rtc-aspeed.c | 1 + drivers/rtc/rtc-bq32k.c | 9 + drivers/s390/char/zcore.c | 8 +- drivers/s390/cio/device_ops.c | 2 + drivers/s390/net/qeth_l2.h | 3 +- drivers/s390/net/qeth_l2_main.c | 26 +- drivers/s390/net/qeth_l2_sys.c | 7 +- drivers/scsi/bfa/bfa_fcs_lport.c | 2 +- drivers/scsi/libiscsi_tcp.c | 3 + drivers/scsi/pm8001/pm8001_ctl.c | 8 + drivers/scsi/pm8001/pm80xx_hwi.c | 7 + drivers/soundwire/bus.c | 4 + drivers/soundwire/cadence_master.c | 7 + drivers/soundwire/slave.c | 4 +- drivers/spi/spi-zynqmp-gqspi.c | 18 +- drivers/staging/fbtft/fbtft-core.c | 9 +- drivers/target/iscsi/cxgbit/cxgbit.h | 8 +- drivers/target/iscsi/cxgbit/cxgbit_ddp.c | 4 +- drivers/target/iscsi/cxgbit/cxgbit_target.c | 34 +- drivers/target/iscsi/iscsi_target.c | 185 +++---- drivers/target/iscsi/iscsi_target.h | 16 +- drivers/target/iscsi/iscsi_target_configfs.c | 14 +- drivers/target/iscsi/iscsi_target_datain_values.c | 18 +- drivers/target/iscsi/iscsi_target_datain_values.h | 12 +- drivers/target/iscsi/iscsi_target_device.c | 2 +- drivers/target/iscsi/iscsi_target_device.h | 4 +- drivers/target/iscsi/iscsi_target_erl0.c | 32 +- drivers/target/iscsi/iscsi_target_erl0.h | 8 +- drivers/target/iscsi/iscsi_target_erl1.c | 42 +- drivers/target/iscsi/iscsi_target_erl1.h | 20 +- drivers/target/iscsi/iscsi_target_erl2.c | 20 +- drivers/target/iscsi/iscsi_target_erl2.h | 8 +- drivers/target/iscsi/iscsi_target_nego.c | 2 +- drivers/target/iscsi/iscsi_target_seq_pdu_list.c | 34 +- drivers/target/iscsi/iscsi_target_seq_pdu_list.h | 10 +- drivers/target/iscsi/iscsi_target_tmr.c | 38 +- drivers/target/iscsi/iscsi_target_tmr.h | 8 +- drivers/target/iscsi/iscsi_target_util.c | 77 +-- drivers/target/iscsi/iscsi_target_util.h | 50 +- drivers/tee/optee/call.c | 3 +- drivers/thermal/tegra/soctherm.c | 6 +- drivers/thunderbolt/tb.c | 6 +- drivers/thunderbolt/xdomain.c | 13 +- drivers/tty/serial/8250/8250_port.c | 7 + drivers/usb/core/hcd.c | 14 +- drivers/usb/gadget/udc/goku_udc.c | 3 +- drivers/usb/host/Kconfig | 2 +- drivers/usb/host/xhci-ring.c | 6 + drivers/usb/host/xhci.c | 4 + drivers/usb/usbip/vhci_sysfs.c | 52 +- drivers/vhost/scsi.c | 3 +- drivers/vhost/vdpa.c | 12 +- drivers/video/fbdev/pm2fb.c | 1 + drivers/video/fbdev/vfb.c | 11 +- drivers/virtio/virtio_pci_common.c | 4 +- drivers/watchdog/digicolor_wdt.c | 13 +- drivers/watchdog/sp5100_tco.c | 6 +- drivers/watchdog/sunxi_wdt.c | 45 +- drivers/xen/gntalloc.c | 13 +- drivers/xen/xen-front-pgdir-shbuf.c | 12 +- fs/9p/vfs_dir.c | 12 + fs/affs/affs.h | 5 - fs/affs/super.c | 6 +- fs/autofs/inode.c | 4 + fs/befs/linuxvfs.c | 3 +- fs/bfs/inode.c | 3 +- fs/btrfs/relocation.c | 47 +- fs/btrfs/transaction.c | 16 +- fs/btrfs/tree-checker.c | 2 +- fs/btrfs/volumes.c | 8 +- fs/cifs/cifsacl.c | 3 + fs/configfs/dir.c | 12 +- fs/exec.c | 22 +- fs/f2fs/inline.c | 7 + fs/freevxfs/vxfs_bmap.c | 3 +- fs/fuse/file.c | 3 +- fs/hfs/catalog.c | 9 - fs/hfs/dir.c | 28 +- fs/hfs/hfs.h | 3 +- fs/hfs/hfs_fs.h | 2 - fs/hfs/inode.c | 4 - fs/hfsplus/catalog.c | 11 - fs/hfsplus/dir.c | 28 +- fs/hfsplus/hfsplus_fs.h | 5 +- fs/hfsplus/inode.c | 40 +- fs/hfsplus/super.c | 2 - fs/hpfs/super.c | 3 +- fs/inode.c | 11 +- fs/iomap/buffered-io.c | 2 +- fs/isofs/inode.c | 3 +- fs/jfs/super.c | 3 +- fs/minix/inode.c | 3 +- fs/ocfs2/namei.c | 9 +- fs/ocfs2/xattr.c | 13 +- fs/ocfs2/xattr.h | 8 +- fs/omfs/inode.c | 6 +- fs/qnx4/inode.c | 3 +- fs/squashfs/xz_wrapper.c | 6 +- fs/ufs/cylinder.c | 10 + fs/ufs/super.c | 17 +- include/keys/request_key_auth-type.h | 2 +- include/linux/bitfield.h | 2 +- include/linux/hrtimer.h | 21 +- include/linux/kcsan-checks.h | 6 +- include/linux/mailbox_controller.h | 2 + include/linux/platform_data/asoc-ux500-msp.h | 20 - include/linux/rculist.h | 29 ++ include/linux/skbuff.h | 26 + include/linux/tty_ldisc.h | 2 +- include/media/v4l2-hevc.h | 41 ++ include/net/cfg80211.h | 2 +- include/net/gue.h | 19 +- include/net/netfilter/nf_conntrack.h | 5 + include/net/netfilter/nf_flow_table.h | 1 + include/net/netns/xfrm.h | 2 +- include/net/nfc/hci.h | 2 +- include/net/nfc/nfc.h | 3 +- include/net/pkt_cls.h | 6 +- include/target/iscsi/iscsi_target_core.h | 34 +- include/target/iscsi/iscsi_transport.h | 92 ++-- kernel/bpf/btf.c | 19 +- kernel/bpf/cgroup.c | 1 + kernel/dma/coherent.c | 79 ++- kernel/time/hrtimer.c | 103 ++-- kernel/trace/trace_event_perf.c | 12 +- kernel/trace/trace_events_hist.c | 2 +- kernel/trace/trace_probe.c | 48 +- kernel/trace/trace_probe.h | 2 + kernel/workqueue.c | 2 +- net/8021q/vlan_dev.c | 5 + net/appletalk/aarp.c | 5 + net/batman-adv/distributed-arp-table.c | 65 ++- net/batman-adv/types.h | 2 +- net/bluetooth/bnep/core.c | 17 +- net/bluetooth/bnep/netdev.c | 8 +- net/bluetooth/hci_sock.c | 20 +- net/bluetooth/l2cap_core.c | 31 +- net/bluetooth/l2cap_sock.c | 13 +- net/bluetooth/rfcomm/core.c | 6 + net/bluetooth/rfcomm/sock.c | 6 +- net/bluetooth/smp.c | 17 + net/bridge/br_arp_nd_proxy.c | 16 +- net/bridge/br_multicast.c | 2 - net/bridge/br_stp_bpdu.c | 5 +- net/ceph/mon_client.c | 2 +- net/core/dev.c | 4 +- net/core/drop_monitor.c | 4 +- net/core/filter.c | 33 +- net/core/skbuff.c | 81 +-- net/core/sock.c | 9 +- net/hsr/hsr_netlink.c | 9 +- net/ieee802154/6lowpan/core.c | 2 +- net/ipv4/arp.c | 1 + net/ipv4/fib_rules.c | 4 +- net/ipv4/fou_core.c | 6 +- net/ipv4/ip_gre.c | 12 + net/ipv4/ip_tunnel_core.c | 6 + net/ipv4/sysctl_net_ipv4.c | 4 +- net/ipv4/tcp_input.c | 3 +- net/ipv4/tcp_output.c | 6 +- net/ipv6/addrconf.c | 10 +- net/ipv6/exthdrs.c | 4 +- net/ipv6/exthdrs_core.c | 3 + net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 2 +- net/ipv6/mcast.c | 32 +- net/ipv6/netfilter/ip6_tables.c | 5 + net/ipv6/netfilter/ip6t_rpfilter.c | 2 +- net/ipv6/netfilter/ip6t_rt.c | 11 +- net/ipv6/route.c | 22 +- net/ipv6/seg6.c | 4 +- net/ipv6/seg6_local.c | 3 + net/ipv6/tcp_ipv6.c | 3 +- net/ipv6/xfrm6_output.c | 10 +- net/llc/llc_c_ac.c | 2 +- net/llc/llc_s_ac.c | 4 + net/llc/llc_sap.c | 8 +- net/mac80211/cfg.c | 3 + net/mac80211/debugfs_netdev.c | 6 + net/mac80211/iface.c | 2 + net/mac80211/mesh.c | 1 - net/mac80211/mlme.c | 6 +- net/mac80211/tx.c | 2 +- net/mac80211/util.c | 6 +- net/mptcp/protocol.c | 10 +- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 18 +- net/mptcp/syncookies.c | 5 +- net/netfilter/ipset/ip_set_hash_gen.h | 13 +- net/netfilter/ipvs/ip_vs_core.c | 6 + net/netfilter/ipvs/ip_vs_sync.c | 20 +- net/netfilter/nf_conntrack_expect.c | 3 +- net/netfilter/nf_conntrack_netlink.c | 13 +- net/netfilter/nf_conntrack_proto_tcp.c | 10 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_flow_table_core.c | 12 +- net/netfilter/nf_flow_table_offload.c | 19 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 13 +- net/netfilter/nfnetlink_queue.c | 77 ++- net/netfilter/nft_nat.c | 2 +- net/netfilter/nft_set_pipapo_avx2.c | 1 + net/netfilter/nft_synproxy.c | 3 +- net/netlabel/netlabel_unlabeled.c | 2 +- net/nfc/core.c | 15 +- net/nfc/digital_dep.c | 8 +- net/nfc/llcp.h | 1 + net/nfc/llcp_commands.c | 2 +- net/nfc/llcp_core.c | 173 +++++-- net/nfc/llcp_sock.c | 67 ++- net/nfc/nci/core.c | 10 +- net/nfc/netlink.c | 7 +- net/nfc/nfc.h | 3 +- net/openvswitch/conntrack.c | 14 +- net/openvswitch/flow_table.c | 4 +- net/packet/af_packet.c | 11 +- net/packet/internal.h | 2 +- net/phonet/pn_dev.c | 30 +- net/qrtr/af_qrtr.c | 4 +- net/rds/af_rds.c | 63 ++- net/rds/connection.c | 102 +++- net/rds/ib_cm.c | 27 +- net/rds/ib_frmr.c | 11 +- net/rds/ib_recv.c | 9 +- net/rds/message.c | 6 +- net/rds/send.c | 16 +- net/rds/tcp.c | 164 ++++-- net/rds/tcp_listen.c | 6 +- net/sched/act_api.c | 22 +- net/sched/act_csum.c | 8 +- net/sched/act_ct.c | 5 +- net/sched/act_gate.c | 30 +- net/sched/cls_api.c | 14 +- net/sched/cls_flower.c | 8 +- net/sched/cls_matchall.c | 8 +- net/sched/cls_route.c | 45 +- net/sched/sch_drr.c | 13 +- net/sched/sch_ets.c | 12 +- net/sched/sch_fq_pie.c | 62 ++- net/sched/sch_hfsc.c | 22 + net/sched/sch_hhf.c | 15 +- net/sched/sch_pie.c | 2 +- net/sched/sch_sfq.c | 7 +- net/sched/sch_teql.c | 7 +- net/sctp/associola.c | 15 +- net/sctp/ipv6.c | 12 +- net/sctp/protocol.c | 10 +- net/sctp/sm_make_chunk.c | 14 +- net/sctp/sm_sideeffect.c | 11 +- net/sctp/sm_statefuns.c | 2 + net/smc/smc_clc.c | 8 +- net/smc/smc_clc.h | 17 +- net/sunrpc/xprtrdma/verbs.c | 21 +- net/sunrpc/xprtsock.c | 7 +- net/tipc/group.c | 4 +- net/tipc/monitor.c | 3 +- net/vmw_vsock/hyperv_transport.c | 2 +- net/vmw_vsock/vmci_transport.c | 2 +- net/wireless/nl80211.c | 2 +- net/wireless/scan.c | 12 +- net/wireless/util.c | 26 +- net/wireless/wext-sme.c | 9 + net/xdp/xskmap.c | 2 +- net/xfrm/espintcp.c | 6 +- net/xfrm/xfrm_user.c | 228 ++++++--- scripts/mod/modpost.c | 11 +- security/integrity/ima/ima_appraise.c | 5 + security/keys/gc.c | 4 +- security/keys/request_key_auth.c | 12 +- security/selinux/avc.c | 5 +- sound/core/pcm_timer.c | 7 +- sound/core/seq/oss/seq_oss_rw.c | 3 +- sound/isa/es18xx.c | 4 + sound/pci/ctxfi/cthw20k2.c | 1 + sound/pci/hda/hda_controller.c | 2 +- sound/pci/hda/patch_conexant.c | 12 + sound/pci/hda/patch_realtek.c | 2 + sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 +- sound/soc/bcm/bcm63xx-i2s-whistler.c | 1 + sound/soc/codecs/ab8500-codec.c | 565 ++++++++++----------- sound/soc/codecs/cx20442.c | 3 +- sound/soc/codecs/mt6351.c | 1 + sound/soc/codecs/pcm3168a.c | 20 +- sound/soc/codecs/rk3328_codec.c | 54 +- sound/soc/codecs/rt5645.c | 4 + sound/soc/intel/atom/sst/sst_pci.c | 1 + sound/soc/intel/catpt/ipc.c | 8 + sound/soc/intel/catpt/loader.c | 3 + sound/soc/intel/catpt/registers.h | 12 + sound/soc/rockchip/rockchip_pdm.c | 16 +- sound/soc/rockchip/rockchip_spdif.c | 1 + sound/soc/sprd/sprd-pcm-compress.c | 15 +- sound/soc/sti/uniperif_reader.c | 4 +- sound/soc/ti/ams-delta.c | 3 +- sound/soc/ti/omap3pandora.c | 5 +- sound/soc/ux500/mop500.c | 8 +- sound/soc/ux500/ux500_msp_dai.c | 167 ++---- sound/soc/ux500/ux500_msp_dai.h | 11 - sound/soc/ux500/ux500_msp_i2s.c | 326 ++++++------ sound/soc/ux500/ux500_msp_i2s.h | 30 +- sound/soc/ux500/ux500_pcm.c | 83 +-- sound/usb/caiaq/audio.c | 10 +- sound/usb/caiaq/device.c | 53 +- sound/usb/caiaq/device.h | 4 +- sound/usb/caiaq/input.c | 6 + sound/usb/caiaq/midi.c | 6 +- sound/usb/mixer.c | 17 +- sound/usb/mixer_maps.c | 10 + sound/usb/quirks-table.h | 22 + sound/usb/usx2y/us122l.c | 9 +- sound/usb/usx2y/usbusx2y.c | 39 +- tools/perf/util/cs-etm.c | 81 +-- tools/testing/selftests/cgroup/test_kmem.c | 2 +- .../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc | 2 +- tools/testing/selftests/net/fib_nexthops.sh | 28 + tools/testing/selftests/net/pmtu.sh | 2 +- tools/testing/selftests/powerpc/tm/tm.h | 8 +- 592 files changed, 5904 insertions(+), 3858 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/595 batman-adv: dat: atomically update mac addresses
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit e6de568d3eda3e3c01c868fabd7a9535d5ee4a73 upstream.
When a MAC address is updated in batadv_dat_entry_add(), it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is transporting the half updated MAC address over the network or is creating an ARP response using it - poisoning the ARP cache.
atomic64_t can be used to store the 48 bit of a mac address. A reader will then either see the old mac address or the new one - never a mixture of both.
--- net/batman-adv/distributed-arp-table.c | 65 ++++++++++++++++++-------- net/batman-adv/types.h | 2 +- 2 files changed, 46 insertions(+), 21 deletions(-)
net/batman-adv/distributed-arp-table.c +45 -20
@@ -377,18 +377,19 @@ batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip,static void batadv_dat_entry_add (struct batadv_priv *bat_priv,__be32 ip,u8 *mac_addr,unsigned short vid) { +u64 u64_mac =ether_addr_to_u64 (mac_addr);struct batadv_dat_entry *dat_entry;int hash_added; dat_entry =batadv_dat_entry_hash_find (bat_priv, ip, vid);/* if this entry is already known, just update it */ if (dat_entry) { -if (!batadv_compare_eth (dat_entry->mac_addr, mac_addr)) -ether_addr_copy (dat_entry->mac_addr, mac_addr); +atomic64_set (&dat_entry->mac_addr, u64_mac); + dat_entry->last_update = jiffies;batadv_dbg (BATADV_DBG_DAT , bat_priv,"Entry updated: %pI4 %pM (vid: %d)\n" , - &dat_entry->ip, dat_entry->mac_addr, + &dat_entry->ip, mac_addr,batadv_print_vid (vid)); goto out; }
@@ -399,7 +400,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip, dat_entry->ip = ip; dat_entry->vid = vid; -ether_addr_copy (dat_entry->mac_addr, mac_addr); +atomic64_set (&dat_entry->mac_addr, u64_mac); dat_entry->last_update = jiffies;kref_init (&dat_entry->refcount);
@@ -415,7 +416,7 @@ static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip, }batadv_dbg (BATADV_DBG_DAT , bat_priv,"New entry added: %pI4 %pM (vid: %d)\n" , - &dat_entry->ip, dat_entry->mac_addr,batadv_print_vid (vid)); + &dat_entry->ip, mac_addr,batadv_print_vid (vid)); out:if (dat_entry)
@@ -876,6 +877,8 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset)struct hlist_head *head;unsigned long last_seen_jiffies;int last_seen_msecs, last_seen_secs, last_seen_mins; +u8 mac[ETH_ALEN ]__aligned(2) ; +u64 u64_mac;u32 i; primary_if =batadv_seq_print_text_primary_if_get (seq);
@@ -897,8 +900,11 @@ int batadv_dat_cache_seq_print_text(struct seq_file *seq, void *offset) last_seen_msecs = last_seen_msecs %60000 ; last_seen_secs = last_seen_msecs /1000 ; + u64_mac =atomic64_read (&dat_entry->mac_addr); +u64_to_ether_addr (u64_mac, mac); +seq_printf (seq," * %15pI4 %pM %4i %6i:%02i\n" , - &dat_entry->ip, dat_entry->mac_addr, + &dat_entry->ip, mac,batadv_print_vid (dat_entry->vid), last_seen_mins, last_seen_secs); }
@@ -927,6 +933,8 @@ batadv_dat_cache_dump_entry(struct sk_buff *msg, u32 portid,struct netlink_callback *cb, struct batadv_dat_entry *dat_entry) { + u8 mac[ETH_ALEN]; +u64 u64_mac;int msecs;void *hdr;
@@ -939,11 +947,12 @@ batadv_dat_cache_dump_entry(struct sk_buff *msg, u32 portid,genl_dump_check_consistent (cb, hdr); msecs =jiffies_to_msecs (jiffies - dat_entry->last_update); + u64_mac =atomic64_read (&dat_entry->mac_addr); +u64_to_ether_addr (u64_mac, mac);if (nla_put_in_addr (msg,BATADV_ATTR_DAT_CACHE_IP4ADDRESS , dat_entry->ip) || -nla_put (msg,BATADV_ATTR_DAT_CACHE_HWADDRESS ,ETH_ALEN , - dat_entry->mac_addr) || +nla_put (msg,BATADV_ATTR_DAT_CACHE_HWADDRESS ,ETH_ALEN , mac) ||nla_put_u16 (msg,BATADV_ATTR_DAT_CACHE_VID , dat_entry->vid) ||nla_put_u32 (msg,BATADV_ATTR_LAST_SEEN_MSECS , msecs)) {genlmsg_cancel (msg, hdr);
@@ -1220,6 +1229,8 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,struct net_device *soft_iface = bat_priv->soft_iface;int hdr_size =0 ;unsigned short vid; +u8 mac[ETH_ALEN ]; +u64 u64_mac;if (!atomic_read (&bat_priv->distributed_arp_table)) goto out;
@@ -1247,6 +1258,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv, dat_entry =batadv_dat_entry_hash_find (bat_priv, ip_dst, vid);if (dat_entry) { + u64_mac =atomic64_read (&dat_entry->mac_addr); +u64_to_ether_addr (u64_mac, mac); +/* If the ARP request is destined for a local client the local * client will answer itself. DAT would only generate a * duplicate packet.
@@ -1255,7 +1269,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,* additional DAT answer may trigger kernel warnings about * a packet coming from the wrong port. */ -if (batadv_is_my_client (bat_priv, dat_entry->mac_addr, vid)) { +if (batadv_is_my_client (bat_priv, mac, vid)) { ret = true; goto out; }
@@ -1265,18 +1279,16 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,* the backbone gws belonging to our backbone has claimed the * destination. */ -if (!batadv_bla_check_claim (bat_priv, - dat_entry->mac_addr, vid)) { +if (!batadv_bla_check_claim (bat_priv, mac, vid)) {batadv_dbg (BATADV_DBG_DAT , bat_priv,"Device %pM claimed by another backbone gw. Don't send ARP reply!" , - dat_entry->mac_addr); + mac); ret = true; goto out; } skb_new =batadv_dat_arp_create_reply (bat_priv, ip_dst, ip_src, - dat_entry->mac_addr, - hw_src, vid); + mac, hw_src, vid);if (!skb_new) goto out;
@@ -1319,6 +1331,8 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,struct batadv_dat_entry *dat_entry =NULL ;bool ret = false;unsigned short vid; +u8 mac[ETH_ALEN ]; +u64 u64_mac;int err;if (!atomic_read (&bat_priv->distributed_arp_table))
@@ -1346,8 +1360,11 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,if (!dat_entry) goto out; + u64_mac =atomic64_read (&dat_entry->mac_addr); +u64_to_ether_addr (u64_mac, mac); + skb_new =batadv_dat_arp_create_reply (bat_priv, ip_dst, ip_src, - dat_entry->mac_addr, hw_src, vid); + mac, hw_src, vid);if (!skb_new) goto out;
@@ -1439,6 +1456,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,u8 *hw_src, *hw_dst;bool dropped = false;unsigned short vid; +u8 mac[ETH_ALEN ]; +u64 u64_mac;if (!atomic_read (&bat_priv->distributed_arp_table)) goto out;
@@ -1467,11 +1486,17 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,* this frame would lead to doubled receive of an ARP reply. */ dat_entry =batadv_dat_entry_hash_find (bat_priv, ip_src, vid); -if (dat_entry &&batadv_compare_eth (hw_src, dat_entry->mac_addr)) { -batadv_dbg (BATADV_DBG_DAT , bat_priv,"Doubled ARP reply removed: ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]; dat_entry: %pM-%pI4\n" , - hw_src, &ip_src, hw_dst, &ip_dst, - dat_entry->mac_addr, &dat_entry->ip); - dropped = true; +if (dat_entry) { + u64_mac =atomic64_read (&dat_entry->mac_addr); +u64_to_ether_addr (u64_mac, mac); + +if (batadv_compare_eth (hw_src, mac)) { +batadv_dbg (BATADV_DBG_DAT , bat_priv, +"Doubled ARP reply removed: ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]; dat_entry: %pM-%pI4\n" , + hw_src, &ip_src, hw_dst, &ip_dst, + mac, &dat_entry->ip); + dropped = true; + } }/* Update our internal cache with both the IP addresses the node got
net/batman-adv/types.h +1 -1
@@ -2387,7 +2387,7 @@ struct batadv_dat_entry {__be32 ip;/** @mac_addr: the MAC address associated to the stored IPv4 */ -u8 mac_addr[ETH_ALEN ]; +atomic64_t mac_addr;/** @vid: the vlan ID associated to this entry */ unsigned short vid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 2/595 ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 87a6f2fa6e6c69bb649fa327635a0bd977724603 ]
mixer_ctl_feature_put(), mixer_ctl_procunit_put(), and mixer_ctl_selector_put() ignore failures from their SET_CUR helper routines and report the control as changed whenever the requested value differs from the current one.
If the device rejects the write, userspace still sees success although the hardware state did not change. Propagate write failures instead, using filter_error() so ignore_ctl_error keeps the same semantics as the existing get paths.
--- sound/usb/mixer.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
sound/usb/mixer.c +13 -4
@@ -1419,7 +1419,10 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[cnt]; val =get_abs_value (cval, val);if (oval != val) { -snd_usb_set_cur_mix_value (cval, c +1 , cnt, val); + err =snd_usb_set_cur_mix_value (cval, c +1 , + cnt, val); +if (err <0 ) +return filter_error (cval, err); changed =1 ; } cnt++;
@@ -1432,7 +1435,9 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0 ]; val =get_abs_value (cval, val);if (val != oval) { -snd_usb_set_cur_mix_value (cval,0 ,0 , val); + err =snd_usb_set_cur_mix_value (cval,0 ,0 , val); +if (err <0 ) +return filter_error (cval, err); changed =1 ; } }
@@ -2264,7 +2269,9 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0 ]; val =get_abs_value (cval, val);if (val != oval) { -set_cur_ctl_value (cval, cval->control <<8 , val); + err =set_cur_ctl_value (cval, cval->control <<8 , val); +if (err <0 ) +return filter_error (cval, err);return 1 ; }return 0 ;
@@ -2626,7 +2633,9 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol, val = ucontrol->value.enumerated.item[0 ]; val =get_abs_value (cval, val);if (val != oval) { -set_cur_ctl_value (cval, cval->control <<8 , val); + err =set_cur_ctl_value (cval, cval->control <<8 , val); +if (err <0 ) +return filter_error (cval, err);return 1 ; }return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 3/595 ima: return error early if file xattr cannot be changed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goldwyn Rodrigues <[email protected]>
[ Upstream commit 69fc6474236d9edda6983623e4282f2bdfd8e3d8 ]
During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.
WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170
Detect the state of the file early and return the error.
--- security/integrity/ima/ima_appraise.c | 5 +++++ 1 file changed, 5 insertions(+)
security/integrity/ima/ima_appraise.c +5 -0
@@ -81,6 +81,11 @@ static int ima_fix_xattr(struct dentry *dentry,int rc, offset;u8 algo = iint->ima_hash->algo; +if (IS_RDONLY (d_inode (dentry))) +return -EROFS ; +if (IS_IMMUTABLE (d_inode (dentry))) +return -EPERM ; +if (algo <=HASH_ALGO_SHA1 ) { offset =1 ; iint->ima_hash->xattr.sha1.type =IMA_XATTR_DIGEST ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 4/595 tee: optee: Allow MT_NORMAL_TAGGED shared memory
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hirokazu Honda <[email protected]>
[ Upstream commit 1a6e94a8ff32e7879effd1e4a45bf112e506edc1 ]
On ARM64, shared memory can have MT_NORMAL_TAGGED attribute when using the Memory Tagging Extension (MTE). The OP-TEE driver needs to recognize this as normal memory to allow sharing such buffers with the Secure World.
--- drivers/tee/optee/call.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tee/optee/call.c +2 -1
@@ -571,7 +571,8 @@ static bool is_normal_memory(pgprot_t p)return (((pgprot_val (p) &L_PTE_MT_MASK ) ==L_PTE_MT_WRITEALLOC ) || ((pgprot_val (p) &L_PTE_MT_MASK ) ==L_PTE_MT_WRITEBACK ));#elif defined(CONFIG_ARM64 ) -return (pgprot_val (p) &PTE_ATTRINDX_MASK ) ==PTE_ATTRINDX (MT_NORMAL ); +return ((pgprot_val (p) &PTE_ATTRINDX_MASK ) ==PTE_ATTRINDX (MT_NORMAL )) || + ((pgprot_val (p) &PTE_ATTRINDX_MASK ) ==PTE_ATTRINDX (MT_NORMAL_TAGGED ));#else #error "Unuspported architecture"#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 5/595 PCI: Stop setting cached power state to unknown on unbind
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
[ Upstream commit d462c8e89e84bfb6417e6b4c88e0cb7cc747ba41 ]
When a PCI device is unbound from its driver, pci_device_remove() sets the cached power state in pci_dev->current_state to PCI_UNKNOWN. This was introduced by commit 2449e06a5696 ("PCI: reset pci device state to unknown state for resume") to invalidate the cached power state in case the system is subsequently put to sleep.
For bound devices, the cached power state is set to PCI_UNKNOWN in pci_pm_suspend_noirq(), immediately before entering system sleep.
Extend to unbound devices for consistency.
This obviates the need to change the cached power state on unbind, so stop doing so.
--- drivers/pci/pci-driver.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/pci/pci-driver.c +2 -8
@@ -463,13 +463,6 @@ static int pci_device_remove(struct device *dev)/* Undo the runtime PM settings in local_pci_probe() */ pm_runtime_put_sync (dev); -/* -* If the device is still on, set the power state as "unknown", -* since it might change by the next time we load the driver. -*/ -if (pci_dev->current_state ==PCI_D0 ) - pci_dev->current_state =PCI_UNKNOWN ; -/* * We would love to complain here if pci_dev->is_enabled is set, that * the driver should have called pci_disable_device(), but the
@@ -808,7 +801,7 @@ static int pci_pm_suspend_noirq(struct device *dev)if (!pm) {pci_save_state (pci_dev); - goto Fixup; + goto set_unknown; }if (pm->suspend_noirq) {
@@ -865,6 +858,7 @@ static int pci_pm_suspend_noirq(struct device *dev) goto Fixup; } +set_unknown:pci_pm_set_unknown_state (pci_dev);/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 6/595 hfsplus: fix issue of direct writes beyond end-of-file
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 5f63ac80aef2ee6bb58eab62e98c264774872da6 ]
The xfstests' test-case generic/729 fails with error:
sudo ./check generic/729
FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #36 SMP PREEMPT_DYNAMIC Fri Apr 17 12:40:51 PDT 2026 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/729 23s ... [failed, exit status 1]- output mismatch
mmap-rw-fault: /mnt/test/mmap-rw-fault.tmp: Input/output error
The hfsplus_get_block() only allows creating the next sequential block. It returns -EIO for direct writes beyond EOF. This patch waits for any in-flight DIO on the inode to finish. Then, it extends the file by calling generic_cont_expand_simple() with the goal to guarantee that blockdev_direct_IO() finds all needed blocks already reachable sequentially. And, finally, it flushes and invalidates the DIO range again so the page cache is clean before the direct write begins.
sudo ./check generic/729
FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #40 SMP PREEMPT_DYNAMIC Thu Apr 16 15:41:03 PDT 2026 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/729 23s ... 32s
Ran: generic/729
Passed all 1 tests
--- fs/hfsplus/inode.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-)
fs/hfsplus/inode.c +36 -2
@@ -128,9 +128,44 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)struct file *file = iocb->ki_filp;struct address_space *mapping = file->f_mapping;struct inode *inode = mapping->host; +loff_t isize;size_t count =iov_iter_count (iter); +loff_t end = iocb->ki_pos + count;ssize_t ret; +/* +* The hfsplus_get_block() only allows creating the next sequential block. +* For direct writes beyond EOF, expand the file first. +*/ +if (iov_iter_rw (iter) ==WRITE && iocb->ki_pos >i_size_read (inode)) { +loff_t start_off, end_off; +loff_t start_page, end_page; + + isize =i_size_read (inode); + +/* +* Wait for any in-flight DIO on this inode to finish before +* calling generic_cont_expand_simple(). +*/ +inode_dio_wait (inode); + + ret =generic_cont_expand_simple (inode, iocb->ki_pos); +if (ret) +return ret; + + start_off = isize; + end_off = (end >0 ) ? end -1 : end; + + ret =filemap_write_and_wait_range (mapping, start_off, end_off); +if (ret) +return ret; + + start_page = start_off >>PAGE_SHIFT ; + end_page = end_off >>PAGE_SHIFT ; + +invalidate_inode_pages2_range (mapping, start_page, end_page); + } + ret =blockdev_direct_IO (iocb, inode, iter, hfsplus_get_block);/*
@@ -138,8 +173,7 @@ static ssize_t hfsplus_direct_IO(struct kiocb *iocb, struct iov_iter *iter)* blocks outside i_size. Trim these off again. */ if (unlikely (iov_iter_rw (iter) ==WRITE && ret <0 )) { -loff_t isize =i_size_read (inode); -loff_t end = iocb->ki_pos + count; + isize =i_size_read (inode);if (end > isize)hfsplus_write_failed (mapping, end);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 7/595 wifi: mac80211: always allow transmitting null-data on TXQs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 51129a2ca0482b006d0e12a0aa025ff1e1cad2cb ]
Jouni reported that certain sequences of tests caused some WDS tests to fail after applying the upcoming hwsim changes for NAN. I bisected that down to converting hwsim to TXQs, and after a long debug session found that the 4-addr NDP was getting dropped, because it goes out via a (management) TXQ and is a data frame.
It's unclear to me now why this only happens in some test sequences (e.g. "sigma_dut_sae_h2e_ap_loop ap_wds_sta" and "sigma_dut_eap_ttls_all_akm_suites ap_wds_sta_open"), maybe that affects timing and the frame is otherwise delayed in some way.
Correct the check to only drop frames that actually carry data, not NDPs.
--- net/mac80211/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/tx.c +1 -1
@@ -3695,7 +3695,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,* injected frames or EAPOL frames from the local station. */ if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && - ieee80211_is_data(hdr->frame_control) && + ieee80211_is_data_present(hdr->frame_control) && !ieee80211_vif_is_mesh(&tx.sdata->vif) && tx.sdata->vif.type != NL80211_IFTYPE_OCB && !is_multicast_ether_addr(hdr->addr1) &&
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 8/595 kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 07a1a6562ce29e2e0c134a57882d6e52e8758492 ]
Some subsystems enable -Wmaybe-uninitialized [1], which can trigger false positives when KCSAN is enabled. Specifically, passing an uninitialized variable to functions that instrument accesses (e.g., copy_from_user()) results in calls to __kcsan_check_access().
Because __kcsan_check_access() takes a const volatile void *ptr, GCC infers that the function may only read the memory location, and thus warns if the passed variable is uninitialized.
However, KCSAN is a dynamic analysis tool for data race detection; while it does read the memory location to detect concurrent modifications, the "initialized'ness" of the memory location is irrelevant for its analysis.
Use absolute_pointer() in __kcsan_check_write(), kcsan_check_write(), and kcsan_check_atomic_write() to hide the pointer from the compiler, preventing it from concluding that the pointer passed points to uninitialized memory.
This fixes warnings like:
| CC fs/ntfs3/file.o | In file included from include/asm-generic/rwonce.h:27, | from arch/arm64/include/asm/rwonce.h:81, | from include/linux/compiler.h:369, | from include/linux/array_size.h:5, | from include/linux/kernel.h:16, | from include/linux/backing-dev.h:12, | from fs/ntfs3/file.c:10: | In function 'instrument_copy_from_user_before', | inlined from '_inline_copy_from_user' at include/linux/uaccess.h:184:2, | inlined from 'copy_from_user' at include/linux/uaccess.h:221:9, | inlined from 'ntfs_ioctl_fitrim' at fs/ntfs3/file.c:77:6, | inlined from 'ntfs_ioctl' at fs/ntfs3/file.c:164:10: | include/linux/kcsan-checks.h:220:28: error: 'range' may be used uninitialized [-Werror=maybe-uninitialized] | 220 | #define kcsan_check_access __kcsan_check_access | | ^ | include/linux/kcsan-checks.h:311:9: note: in expansion of macro 'kcsan_check_access' | 311 | kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) | | ^~~~~~~~~~~~~~~~~~ | include/linux/instrumented.h:147:9: note: in expansion of macro 'kcsan_check_write' | 147 | kcsan_check_write(to, n); | | ^~~~~~~~~~~~~~~~~ | include/linux/kcsan-checks.h: In function 'ntfs_ioctl': | include/linux/kcsan-checks.h:37:6: note: by argument 1 of type 'const volatile void *' to '__kcsan_check_access' declared here | 37 | void __kcsan_check_access(const volatile void *ptr, size_t size, int type); | | ^~~~~~~~~~~~~~~~~~~~ | fs/ntfs3/file.c:65:29: note: 'range' declared here | 65 | struct fstrim_range range; | | ^~~~~
--- include/linux/kcsan-checks.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/kcsan-checks.h +3 -3
@@ -196,7 +196,7 @@ static inline void __kcsan_disable_current(void) { }* @size: size of access */ #define __kcsan_check_write (ptr, size) \ - __kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) + __kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)/** * __kcsan_check_read_write - check regular read-write access for races
@@ -222,7 +222,7 @@ static inline void __kcsan_disable_current(void) { }* @size: size of access */ #define kcsan_check_write (ptr, size) \ - kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) + kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE)/** * kcsan_check_read_write - check regular read-write access for races
@@ -245,7 +245,7 @@ static inline void __kcsan_disable_current(void) { }#define kcsan_check_atomic_read (ptr, size) \ kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC)#define kcsan_check_atomic_write (ptr, size) \ - kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE) + kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE)#define kcsan_check_atomic_read_write (ptr, size) \ kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_COMPOUND)#endif
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 9/595 bridge: Do not suppress ARP probes and DAD NS unconditionally
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danielle Ratson <[email protected]>
[ Upstream commit fee1fc1d5a5475f5516d406a03e443348cd0f06c ]
When neighbor suppression is enabled on a VXLAN port, the bridge is expected to reply to ARP/NS messages on behalf of remote hosts when both FDB and neighbor entries exist. This allows the bridge to suppress flooding of these messages to the VXLAN overlay.
According to RFC 9161 ("Operational Aspects of Proxy ARP/ND in Ethernet Virtual Private Networks"):
"A PE SHOULD reply to broadcast/multicast address resolution messages, i.e., ARP Requests, ARP probes, NS messages, as well as DAD NS messages. An ARP probe is an ARP Request constructed with an all-zero sender IP address that may be used by hosts for IPv4 Address Conflict Detection as specified in [RFC5227]".
However, the current implementation unconditionally suppresses ARP probes and DAD Neighbor Solicitations, which breaks Duplicate Address Detection (DAD) over EVPN.
For DAD to work correctly over the VXLAN fabric:
- When the bridge does not know the answer:
flood the probe/DAD packet to allow remote VTEPs to respond.
- When the bridge knows the answer:
reply to indicate the address is in use.
Fix by adjusting the early suppression checks to exclude ARP probes and DAD NS from unconditional suppression.
When replying to a DAD NS, br_nd_send() is adjusted to set the NA destination to the all-nodes multicast address (ff02::1) and clear the Solicited flag, in accordance with RFC 4861 section 7.2.4.
--- net/bridge/br_arp_nd_proxy.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/bridge/br_arp_nd_proxy.c +11 -5
@@ -162,7 +162,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,return ;if (parp->ar_op !=htons (ARPOP_RREQUEST ) && parp->ar_op !=htons (ARPOP_RREPLY ) && - (ipv4_is_zeronet (sip) || sip == tip)) { + sip == tip) {/* prevent flooding to neigh suppress ports */ BR_INPUT_SKB_CB (skb)->proxyarp_replied =1 ;return ;
@@ -260,6 +260,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,int ns_olen;int i, len;u8 *daddr; +bool dad;u16 pvid;if (!dev ||skb_linearize (request))
@@ -298,8 +299,13 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, } } + dad =ipv6_addr_any (&ipv6_hdr (request)->saddr); +/* Ethernet header */ -ether_addr_copy (eth_hdr (reply)->h_dest, daddr); +if (dad) +ipv6_eth_mc_map (&in6addr_linklocal_allnodes,eth_hdr (reply)->h_dest); +else +ether_addr_copy (eth_hdr (reply)->h_dest, daddr);ether_addr_copy (eth_hdr (reply)->h_source, n->ha);eth_hdr (reply)->h_proto =htons (ETH_P_IPV6 ); reply->protocol =htons (ETH_P_IPV6 );
@@ -315,7 +321,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, pip6->priority =ipv6_hdr (request)->priority; pip6->nexthdr =IPPROTO_ICMPV6 ; pip6->hop_limit =255 ; - pip6->daddr =ipv6_hdr (request)->saddr; + pip6->daddr = dad ? in6addr_linklocal_allnodes :ipv6_hdr (request)->saddr; pip6->saddr = *(struct in6_addr *)n->primary_key;skb_pull (reply,sizeof (struct ipv6hdr ));
@@ -328,7 +334,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, na->icmph.icmp6_type =NDISC_NEIGHBOUR_ADVERTISEMENT ; na->icmph.icmp6_router = (n->flags &NTF_ROUTER ) ?1 :0 ; na->icmph.icmp6_override =1 ; - na->icmph.icmp6_solicited =1 ; + na->icmph.icmp6_solicited = dad ?0 :1 ; na->target = ns->target;ether_addr_copy (&na->opt[2 ], n->ha); na->opt[0 ] =ND_OPT_TARGET_LL_ADDR ;
@@ -429,7 +435,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, saddr = &iphdr->saddr; daddr = &iphdr->daddr; -if (ipv6_addr_any (saddr) || !ipv6_addr_cmp (saddr, daddr)) { +if (!ipv6_addr_cmp (saddr, daddr)) {/* prevent flooding to neigh suppress ports */ BR_INPUT_SKB_CB (skb)->proxyarp_replied =1 ;return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 10/595 soundwire: validate DT compatible before parsing it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <[email protected]>
[ Upstream commit 45c7bda7b7440183850012153988e40b300f40d0 ]
sdw_of_find_slaves() fetches raw "compatible" bytes with of_get_property() and then immediately parses them with sscanf("sdw%01x%04hx%04hx%02hhx", ...).
Live-tree OF properties are stored as raw bytes plus a separate length; they are not globally guaranteed to be NUL-terminated. Validate the first compatible string before parsing it.
--- drivers/soundwire/slave.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soundwire/slave.c +2 -2
@@ -209,8 +209,8 @@ int sdw_of_find_slaves(struct sdw_bus *bus)struct sdw_slave_id id;const __be32 *addr; - compat =of_get_property (node,"compatible" ,NULL ); -if (!compat) + ret =of_property_read_string (node,"compatible" , &compat); +if (ret)continue ; ret = sscanf(compat, "sdw%01x%04hx%04hx%02hhx", &sdw_version,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 11/595 media: rc: mceusb: Add support for 04eb:e033
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Riccardo Boninsegna <[email protected]>
[ Upstream commit 0692c2602e4cd410aa045f8991bd1c142b2e56f9 ]
This is a Sonix SN8P2202XG microcontroller with firmware compatible with the already supported Northstar 04eb:e004, implementing an MCE IR receiver (PCB seems to be tracked for a transmitter too but missing related parts).
Found in a Skintek SK-CR-IN+IR ( http://www.skintek.it/SK-CR-IN+IR.php ) internal 3.5 inch USB card reader and MCE receiver combo (implemented by, and wired as, separate USB devices)
PCB marking: AU6475 966816 STIR REV:A02 MCE
--- drivers/media/rc/mceusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/rc/mceusb.c +2 -0
@@ -398,6 +398,8 @@ static const struct usb_device_id mceusb_dev_table[] = { { USB_DEVICE(VENDOR_COMPRO, 0x3082) },/* Northstar Systems, Inc. eHome Infrared Transceiver */ { USB_DEVICE(VENDOR_NORTHSTAR, 0xe004) }, +/* Northstar Systems, Inc. eHome Infrared Transceiver - variant */ + { USB_DEVICE(VENDOR_NORTHSTAR, 0xe033) },/* TiVo PC IR Receiver */ { USB_DEVICE(VENDOR_TIVO, 0x2000), .driver_info = TIVO_KIT },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 12/595 thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 4c63f29872cb444b33665348bbd2f45cab06afcd ]
If tb_cfg_request() fails setting up the request (for example the control channel is shut down already) it returns an error without calling the callback. To avoid leaking that memory, call tb_cfg_request_put() if tb_cfg_request() fails.
--- drivers/thunderbolt/xdomain.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/thunderbolt/xdomain.c +6 -1
@@ -97,6 +97,7 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response, size_t size, enum tb_cfg_pkg_type type) {struct tb_cfg_request *req; +int ret; req =tb_cfg_request_alloc ();if (!req)
@@ -108,7 +109,11 @@ static int __tb_xdomain_response(struct tb_ctl *ctl, const void *response, req->request_size = size; req->request_type = type; -return tb_cfg_request (ctl, req, response_ready, req); + ret =tb_cfg_request (ctl, req, response_ready, req); +if (ret) +tb_cfg_request_put (req); + +return ret; }/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 13/595 thunderbolt: Keep the domain reference while processing hotplug
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 138ec65b2c761f065b19d115aed2b8246fc272f5 ]
We process hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). For example if user unloads the driver while at the same time plugging a device router we may have scheduled tb_handle_hotplug() to run. Avoid possible UAF in this case by taking the domain reference before scheduling the hotplug handler in tb_queue_hotplug().
--- drivers/thunderbolt/tb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/thunderbolt/tb.c +4 -1
@@ -56,7 +56,7 @@ static void tb_queue_hotplug(struct tb *tb, u64 route, u8 port, bool unplug)if (!ev)return ; - ev->tb = tb; + ev->tb =tb_domain_get (tb); ev->route = route; ev->port = port; ev->unplug = unplug;
@@ -1213,6 +1213,9 @@ static void tb_handle_hotplug(struct work_struct *work)pm_runtime_mark_last_busy (&tb->dev);pm_runtime_put_autosuspend (&tb->dev); +/* Undo the refcount increased in tb_queue_hotplug() */ +tb_domain_put (tb); +kfree (ev); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 14/595 thunderbolt: Set tb->root_switch to NULL when domain is stopped
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit e56249d8a68e712f3b60e1f3fdbb5b4fea146468 ]
Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.
--- drivers/thunderbolt/tb.c | 1 + drivers/thunderbolt/xdomain.c | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/thunderbolt/tb.c +1 -0
@@ -1264,6 +1264,7 @@ static void tb_stop(struct tb *tb)tb_tunnel_free (tunnel); }tb_switch_remove (tb->root_switch); + tb->root_switch =NULL ; tcm->hotplug_active = false;/* signal tb_handle_hotplug to quit */ }
drivers/thunderbolt/xdomain.c +5 -1
@@ -577,7 +577,7 @@ static void tb_xdp_handle_request(struct work_struct *work)mutex_lock (&tb->lock);if (tb->root_switch) - uuid = tb->root_switch->uuid; + uuid =kmemdup (tb->root_switch->uuid,sizeof (*uuid),GFP_KERNEL );else uuid =NULL ;mutex_unlock (&tb->lock);
@@ -638,6 +638,7 @@ static void tb_xdp_handle_request(struct work_struct *work) } out: +kfree (uuid);kfree (xw->pkg);kfree (xw);
@@ -1496,6 +1497,9 @@ static struct tb_xdomain *switch_find_xdomain(struct tb_switch *sw, {struct tb_port *port; +if (!sw) +return NULL ; +tb_switch_for_each_port (sw, port) {struct tb_xdomain *xd;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 15/595 media: dm1105: fix missing error check for dma_alloc_coherent
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Yu <[email protected]>
[ Upstream commit 3eaac9e02d8591d3c790db572ef1c8fa5a841fdb ]
The return value of dm1105_dma_map(), which handles DMA memory allocation, is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver will proceed using a NULL pointer for DMA transfers, leading to a kernel oops or invalid hardware access.
Fix this by checking the return value and propagating -ENOMEM on failure.
--- drivers/media/pci/dm1105/dm1105.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/media/pci/dm1105/dm1105.c +6 -1
@@ -769,6 +769,8 @@ static void dm1105_ir_exit(struct dm1105_dev *dm1105)static int dm1105_hw_init (struct dm1105_dev *dev) { +int ret; +dm1105_disable_irqs (dev);dm_writeb (DM1105_HOST_CTR ,0 );
@@ -779,7 +781,10 @@ static int dm1105_hw_init(struct dm1105_dev *dev)dm_writew (DM1105_TSCTR ,0xc10a );/* map DMA and set address */ -dm1105_dma_map (dev); + ret =dm1105_dma_map (dev); +if (ret) +return -ENOMEM ; +dm1105_set_dma_addr (dev);/* big buffer */ dm_writel (DM1105_RLEN ,5 *DM1105_DMA_BYTES );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 16/595 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit d201c2612e5aada0c931cd55115175e0a5141023 ]
The 6320 family has 9 global1 interrupt, not 8. Fix it.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -5036,7 +5036,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .global1_addr = 0x1b, .global2_addr = 0x1c, .age_time_coeff = 15000, - .g1_irqs = 8, + .g1_irqs = 9, .g2_irqs = 10, .atu_move_port_mask = 0xf, .pvt = true,
@@ -5061,7 +5061,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .global1_addr = 0x1b, .global2_addr = 0x1c, .age_time_coeff = 15000, - .g1_irqs = 8, + .g1_irqs = 9, .g2_irqs = 10, .atu_move_port_mask = 0xf, .multi_chip = true,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 17/595 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit e0fdb4157a85056bd256a7aebac4a3a2f580b201 ]
Commit 9e5baf9b3636 ("net: dsa: mv88e6xxx: add RMU disable op") did not add the .rmu_disable() method for the 6320 family. Add it now.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +2 -0
@@ -4170,6 +4170,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, .pot_clear = mv88e6xxx_g2_pot_clear, .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, .vtu_getnext = mv88e6352_g1_vtu_getnext, .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, .gpio_ops = &mv88e6352_gpio_ops,
@@ -4212,6 +4213,7 @@ static const struct mv88e6xxx_ops mv88e6321_ops = { .watchdog_ops = &mv88e6390_watchdog_ops, .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu, .reset = mv88e6352_g1_reset, + .rmu_disable = mv88e6352_g1_rmu_disable, .vtu_getnext = mv88e6352_g1_vtu_getnext, .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge, .gpio_ops = &mv88e6352_gpio_ops,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 18/595 media: em28xx-video: fix missing res_free() on init_usb_xfer failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit cc20e81da6d99926f94fad7af21f75c07e865769 ]
res_get() is called before em28xx_init_usb_xfer(), but the error path of em28xx_init_usb_xfer() does not release the resource, leading to a persistent busy state.
--- drivers/media/usb/em28xx/em28xx-video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/usb/em28xx/em28xx-video.c +3 -1
@@ -1115,8 +1115,10 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count) dev->max_pkt_size, dev->packet_multiplier, em28xx_urb_data_copy); -if (rc <0 ) +if (rc <0 ) { +res_free (dev, vq->type);return rc; + }/* * djh: it's not clear whether this code is still needed. I'm
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 19/595 clk: renesas: cpg-mssr: Add number of clock cells check
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 7f0c422c7fbfd9294ff9321ada0c63561e5c6ea0 ]
The number of clock cells is not validated in the clock provider's clk_src_get() callback. Add the missing check.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/clk/renesas/renesas-cpg-mssr.c +3 -0
@@ -280,6 +280,9 @@ struct clk *cpg_mssr_clk_src_twocell_get(struct of_phandle_args *clkspec,struct clk *clk;int range_check; +if (clkspec->args_count !=2 ) +return ERR_PTR (-EINVAL ); +switch (clkspec->args[0 ]) {case CPG_CORE : type ="core" ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 20/595 ASoC: ti: omap3pandora: update board check to use DT compatible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit 45efb8fbdae303539e7fb5562e147583d4ed63ad ]
The omap3pandora driver contains a check for the ARM machine ID via the machine_is_omap3_pandora() macro. The board concerned now supports only FDT booting, which does not use machine IDs, and therefore the code should be updated to check the DT compatible property instead. The legacy board file for this machine was removed in commit 7fcf7e061edd ("ARM: OMAP2+: Remove legacy booting support for Pandora"). The presence of this machine ID check prevents the removal of machine IDs no longer used by the kernel from arch/arm/tools/mach-types, because the machine_is_*() macros are generated from mach-types. To resolve this issue, use of_machine_is_compatible() instead.
--- sound/soc/ti/omap3pandora.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/ti/omap3pandora.c +3 -2
@@ -11,12 +11,12 @@#include <linux/delay.h> #include <linux/regulator/consumer.h> #include <linux/module.h> +#include <linux/of.h> #include <sound/core.h> #include <sound/pcm.h> #include <sound/soc.h> -#include <asm/mach-types.h> #include <linux/platform_data/asoc-ti-mcbsp.h> #include "omap-mcbsp.h"
@@ -224,7 +224,8 @@ static int __init omap3pandora_soc_init(void) {int ret; -if (!machine_is_omap3_pandora ()) +if (!of_machine_is_compatible ("openpandora,omap3-pandora-600mhz" ) && + !of_machine_is_compatible ("openpandora,omap3-pandora-1ghz" ))return -ENODEV ;pr_info ("OMAP3 Pandora SoC init\n" );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 21/595 mmc: davinci: avoid NULL deref of host->data in IRQ handler
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
[ Upstream commit 4f28846aaf8db9668e338b8987973f8935edff34 ]
mmc_davinci_irq() returns early only when both host->cmd and host->data are NULL:
if (host->cmd == NULL && host->data == NULL) {
...
return IRQ_NONE;
}So we may legitimately reach the rest of the handler with host->data == NULL (and therefore data == NULL). The DATDNE branch already guards against this with an explicit "if (data != NULL)" check, but the subsequent TOUTRD ("read data timeout") and CRCWR/CRCRD ("data CRC error") branches dereference data unconditionally:
if (qstatus & MMCST0_TOUTRD) {
data->error = -ETIMEDOUT; <-- NULL deref
...
davinci_abort_data(host, data);
}
if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {
data->error = -EILSEQ; <-- NULL deref
...
}If either bit is set in qstatus while host->data is NULL, the kernel will crash inside the IRQ handler. smatch flags this:
drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we
previously assumed 'data' could be null (see line 914)
Gate both branches on a non-NULL data, matching the existing pattern used by the DATDNE branch.
No functional change for callers where data is non-NULL, which is the only case in which these branches did meaningful work before this change.
--- drivers/mmc/host/davinci_mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/davinci_mmc.c +2 -2
@@ -934,7 +934,7 @@ static irqreturn_t mmc_davinci_irq(int irq, void *dev_id) } } -if (qstatus &MMCST0_TOUTRD ) { +if (data && (qstatus &MMCST0_TOUTRD )) {/* Read data timeout */ data->error = -ETIMEDOUT ; end_transfer =1 ;
@@ -946,7 +946,7 @@ static irqreturn_t mmc_davinci_irq(int irq, void *dev_id)davinci_abort_data (host, data); } -if (qstatus & (MMCST0_CRCWR |MMCST0_CRCRD )) { +if (data && (qstatus & (MMCST0_CRCWR |MMCST0_CRCRD ))) {/* Data CRC error */ data->error = -EILSEQ ; end_transfer =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 22/595 drm/amd/display: Fix CRC open failure during active rendering
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <[email protected]>
[ Upstream commit 5eb2fdafeb6f4a442643b77a21a4c9e70586a146 ]
[Why]
Opening the CRC data file during active rendering can fail with -EINVAL. The wait for commit->hw_done returns remaining jiffies on success, but the CRC path was treating that as an error.
[How]
Handle wait_for_completion_interruptible_timeout() correctly:
positive return as success, 0 as timeout, and negative as error.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +6 -1
@@ -176,8 +176,13 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name)*/ ret =wait_for_completion_interruptible_timeout ( &commit->hw_done,10 *HZ ); -if (ret) +if (ret <0 ) + goto cleanup; + +if (ret ==0 ) { + ret = -ETIMEDOUT ; goto cleanup; + } } enable =amdgpu_dm_is_valid_crc_source (source);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 23/595 hfsplus: rework hfsplus_readdir() logic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 4b0496432844628ad05a5b1efce329a3340174d2 ]
The xfstests' test-case generic/637 fails with error:
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc4+ #8 SMP PREEMPT_DYNAMIC Thu May 1 16:43:22 PDT 2025 MKFS_OPTIONS -- /dev/loop51MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
QA output created by 637
entries 7 and 8 have duplicate d_off 8
Found unlinked files in open dir (see xfstests-dev/results//generic/637.full for details)
Debugging of the hfsplus_readdir() logic showed this:
hfsplus: hfsplus_readdir(): 163 ctx->pos 0
hfsplus: hfsplus_readdir(): 189 ctx->pos 1
hfsplus: hfsplus_readdir(): 264 ctx->pos 2, ino 18
hfsplus: hfsplus_readdir(): 264 ctx->pos 3, ino 19
hfsplus: hfsplus_readdir(): 264 ctx->pos 4, ino 28
hfsplus: hfsplus_readdir(): 264 ctx->pos 5, ino 118
hfsplus: hfsplus_readdir(): 264 ctx->pos 6, ino 29
hfsplus: hfsplus_readdir(): 264 ctx->pos 7, ino 30
hfsplus: hfsplus_readdir(): 264 ctx->pos 8, ino 31
hfsplus: hfsplus_readdir(): 304 ctx->pos 8
hfsplus: hfsplus_unlink():420 dir->i_ino 17, inode->i_ino 28
hfsplus: hfsplus_readdir(): 141 ctx->pos 7
hfsplus: hfsplus_readdir(): 264 ctx->pos 7, ino 31
hfsplus: hfsplus_readdir(): 264 ctx->pos 8, ino 32
hfsplus: hfsplus_readdir(): 264 ctx->pos 9, ino 33
It means that hfsplus_readdir() stopped the processing of folder's items on ctx->pos 8, then, item with ino 28 has been deleted and hfsplus_readdir() re-started the logic from ctx->pos 7. As a result, previous and new sets of folder's items have overlapping values for the case of d_off 8.
Currently, HFS+ has very complicated and fragile logic of rd->file->f_pos correction in hfsplus_delete_cat(). This patch removes this logic and it stores the current pos into hfsplus_readdir_data. Finally, if rd->pos == ctx->pos then hfsplus_readdir() tries to find the position in b-tree's node by means of hfsplus_cat_key. This position is used to re-start the folder's content traversal.
sudo ./check generic/637
FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.1.0-rc1+ #44 SMP PREEMPT_DYNAMIC Mon May 4 15:58:45 PDT 2026 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/637 22s ... 22s
Ran: generic/637
Passed all 1 tests
--- fs/hfsplus/catalog.c | 11 ----------- fs/hfsplus/dir.c | 28 +++++++++++----------------- fs/hfsplus/hfsplus_fs.h | 5 +---- fs/hfsplus/inode.c | 2 -- fs/hfsplus/super.c | 2 -- 5 files changed, 12 insertions(+), 36 deletions(-)
fs/hfsplus/catalog.c +0 -11
@@ -332,7 +332,6 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)struct super_block *sb = dir->i_sb;struct hfs_find_data fd;struct hfsplus_fork_raw fork; -struct list_head *pos;int err, off;u16 type;
@@ -390,16 +389,6 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)hfsplus_free_fork (sb, cnid, &fork,HFSPLUS_TYPE_RSRC ); } -/* we only need to take spinlock for exclusion with ->release() */ -spin_lock (&HFSPLUS_I (dir)->open_dir_lock); -list_for_each (pos, &HFSPLUS_I (dir)->open_dir_list) { -struct hfsplus_readdir_data *rd = - list_entry(pos, struct hfsplus_readdir_data, list); -if (fd.tree->keycmp (fd.search_key, (void *)&rd->key) <0 ) - rd->file->f_pos--; - } -spin_unlock (&HFSPLUS_I (dir)->open_dir_lock); - err =hfs_brec_remove (&fd);if (err) goto out;
fs/hfsplus/dir.c +11 -17
@@ -185,7 +185,15 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx) }if (ctx->pos >= inode->i_size) goto out; - err =hfs_brec_goto (&fd, ctx->pos -1 ); + rd = file->private_data; +if (rd && rd->pos == ctx->pos) { +memcpy (fd.search_key, &rd->key,sizeof (struct hfsplus_cat_key )); + err =hfs_brec_find (&fd, hfs_find_rec_by_key); +if (err == -ENOENT ) + err =hfs_brec_goto (&fd,1 ); + }else { + err =hfs_brec_goto (&fd, ctx->pos -1 ); + }if (err) goto out;for (;;) {
@@ -261,7 +269,6 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)if (err) goto out; } - rd = file->private_data;if (!rd) { rd =kmalloc (sizeof (struct hfsplus_readdir_data ),GFP_KERNEL );if (!rd) {
@@ -269,15 +276,8 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx) goto out; } file->private_data = rd; - rd->file = file; -spin_lock (&HFSPLUS_I (inode)->open_dir_lock); -list_add (&rd->list, &HFSPLUS_I (inode)->open_dir_list); -spin_unlock (&HFSPLUS_I (inode)->open_dir_lock); } -/* -* Can be done after the list insertion; exclusion with -* hfsplus_delete_cat() is provided by directory lock. -*/ + rd->pos = ctx->pos;memcpy (&rd->key, fd.key,sizeof (struct hfsplus_cat_key )); out:kfree (strbuf);
@@ -287,13 +287,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)static int hfsplus_dir_release (struct inode *inode,struct file *file) { -struct hfsplus_readdir_data *rd = file->private_data; -if (rd) { -spin_lock (&HFSPLUS_I (inode)->open_dir_lock); -list_del (&rd->list); -spin_unlock (&HFSPLUS_I (inode)->open_dir_lock); -kfree (rd); - } +kfree (file->private_data);return 0 ; }
fs/hfsplus/hfsplus_fs.h +1 -4
@@ -246,8 +246,6 @@ struct hfsplus_inode_info {sector_t fs_blocks;u8 userflags;/* BSD user file flags */ u32 subfolders;/* Subfolder count (HFSX only) */ -struct list_head open_dir_list; -spinlock_t open_dir_lock;loff_t phys_size;struct inode vfs_inode;
@@ -297,8 +295,7 @@ struct hfs_find_data { };struct hfsplus_readdir_data { -struct list_head list; -struct file *file; +loff_t pos;struct hfsplus_cat_key key; };
fs/hfsplus/inode.c +0 -2
@@ -435,8 +435,6 @@ struct inode *hfsplus_new_inode(struct super_block *sb, struct inode *dir, inode->i_mtime = inode->i_atime = inode->i_ctime =current_time (inode); hip =HFSPLUS_I (inode); -INIT_LIST_HEAD (&hip->open_dir_list); -spin_lock_init (&hip->open_dir_lock);mutex_init (&hip->extents_lock);atomic_set (&hip->opencnt,0 ); hip->extent_state =0 ;
fs/hfsplus/super.c +0 -2
@@ -90,8 +90,6 @@ struct inode *hfsplus_iget(struct super_block *sb, unsigned long ino)HFSPLUS_I (inode)->fs_blocks =0 ;HFSPLUS_I (inode)->userflags =0 ;HFSPLUS_I (inode)->subfolders =0 ; -INIT_LIST_HEAD (&HFSPLUS_I (inode)->open_dir_list); -spin_lock_init (&HFSPLUS_I (inode)->open_dir_lock);HFSPLUS_I (inode)->phys_size =0 ; if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID ||
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 24/595 scsi: pm8001: Reject firmware update in fatal error state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Meiyappan <[email protected]>
[ Upstream commit 2a8fbcfb04aa9db189bfa3842d4f586aecd0e631 ]
pm8001_store_update_fw() allows a firmware update request even when the controller has already entered a fatal error state.
Firmware update is not valid once the controller is in that state, and attempting it can lead to a call trace. Reject the request early by checking controller_fatal_error, set the firmware status to FAIL_PARAMETERS, and return -EINVAL.
--- drivers/scsi/pm8001/pm8001_ctl.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/scsi/pm8001/pm8001_ctl.c +8 -0
@@ -822,6 +822,14 @@ static ssize_t pm8001_store_update_fw(struct device *cdev, goto out; } +if (pm8001_ha->controller_fatal_error) { +pm8001_dbg (pm8001_ha,FAIL , +"controller in fatal error state, firmware update rejected\n" ); + pm8001_ha->fw_status =FAIL_PARAMETERS ; + ret = -EINVAL ; + goto out; + } +for (i =0 ; flash_command_table[i].code !=FLASH_CMD_NONE ; i++) {if (!memcmp (flash_command_table[i].command, cmd_ptr,strlen (cmd_ptr))) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 25/595 scsi: pm8001: Reject non-fatal dump when controller is crashed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Meiyappan <[email protected]>
[ Upstream commit aa3b8f56ef27ed72394a752820abdec4608b731c ]
pm80xx_get_non_fatal_dump() can be called even after the controller has entered a fatal error state. In that case the forensic memory contents are not safe to access for a non-fatal dump request, and attempting to do so can trigger a call trace.
Check controller_fatal_error before reading the non-fatal dump buffer and return -EINVAL when the controller is already in a crashed state.
This prevents non-fatal dump collection from running in an invalid controller state.
--- drivers/scsi/pm8001/pm80xx_hwi.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/pm8001/pm80xx_hwi.c +7 -0
@@ -400,6 +400,13 @@ ssize_t pm80xx_get_non_fatal_dump(struct device *cdev,char *buf_copy = buf; temp = (u32 *)pm8001_ha->memoryMap.region[FORENSIC_MEM ].virt_ptr; + +if (pm8001_ha->controller_fatal_error) { +pm8001_dbg (pm8001_ha,FAIL , +"non-fatal dump not available in fatal error state\n" ); +return -EINVAL ; + } +if (++pm8001_ha->non_fatal_count ==1 ) {if (pm8001_ha->chip_id == chip_8001) { snprintf(pm8001_ha->forensic_info.data_buf.direct_data,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 26/595 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
[ Upstream commit c64ba13e2033c3c6dc1a097bf35f9f1fe457c3f7 ]
Andrew reports build breakage of arm allmodconfig, reproducible with gcc 14.2.0 and 15.2.0:
crypto/ecc.c: In function 'ecc_point_mult':
crypto/ecc.c:1380:1: error: the frame size of 1360 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
gcc aggressively inlines functions called by ecc_point_mult() (without there being any explicit inline declarations), which pushes stack usage close to the limit imposed by CONFIG_FRAME_WARN. allmodconfig implies CONFIG_KASAN_STACK=y, which increases the stack above that limit.
In the bugzilla entry linked below, gcc maintainers explain that gcc estimates extra stack usage caused by inlining, but ASAN instrumentation is added in post-IPA passes and thus the inlining heuristics cannot account for it.
It could be argued that -Werror=frame-larger-than=1280 instructs the compiler to avoid inlining beyond that limit lest the build breaks, which would imply gcc behaves incorrectly. But gcc maintainers reject this notion and believe that a warning switch should never affect code generation, even if it is promoted to an error.
One way to unbreak the build is to limit inlining via -finline-limit=100 or by explicitly declaring some functions noinline. However while it does keep stack usage of individual functions below the limit, *total* stack usage increases.
A longterm solution is to refactor ecc.c for reduced stack usage. It currently performs ECC point multiplication with a Montgomery ladder which uses co-Z (conjugate) addition to trade off memory for speed. The algorithm is susceptible to timing attacks and needs to be replaced with a constant time Montgomery ladder, which should consume less memory and thus resolve the stack usage issue as a side effect.
In the interim, raise the limit for ecc.c, as is already done for several other files in the source tree.
Constrain to gcc because clang 19.1.7 does not exhibit the issue. It makes do with a 724 bytes stack frame even though it inlines almost the same functions as gcc.
--- crypto/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
crypto/Makefile +5 -0
@@ -176,6 +176,11 @@ obj-$(CONFIG_CRYPTO_ECC) += ecc.o obj-$(CONFIG_CRYPTO_ESSIV) += essiv.o obj-$(CONFIG_CRYPTO_CURVE25519) += curve25519-generic.o +# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949 +ifeq ($(CONFIG_ARM)$(CONFIG_KASAN_STACK)$(CONFIG_CC_IS_GCC),yyy) +CFLAGS_ecc.o += $(call cc-option,-Wframe-larger-than=1536) +endif + ecdh_generic-y += ecdh.o ecdh_generic-y += ecdh_helper.o obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 27/595 crypto: atmel-ecc - add support for atecc608b
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit b668edaf8dcc8d09f6f1e71797422b44d4bd22a3 ]
Tested on hardware with an ATECC608B at 0x60. The device binds successfully, passes the driver's sanity check, and registers the ecdh-nist-p256 KPP algorithm.
The hardware ECDH path was also exercised using a minimal KPP test module, covering private key generation, public key derivation, and shared secret computation.
--- drivers/crypto/atmel-ecc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/atmel-ecc.c +3 -0
@@ -360,6 +360,8 @@ static int atmel_ecc_remove(struct i2c_client *client)static const struct of_device_id atmel_ecc_dt_ids[] = { { .compatible ="atmel,atecc508a" , + }, { + .compatible ="atmel,atecc608b" , }, {/* sentinel */ }
@@ -369,6 +371,7 @@ MODULE_DEVICE_TABLE(of, atmel_ecc_dt_ids);static const struct i2c_device_id atmel_ecc_id[] = { {"atecc508a" }, + {"atecc608b" }, { } };MODULE_DEVICE_TABLE (i2c, atmel_ecc_id);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 28/595 media: imon: Add iMON VFD HID OEM v1.2 key mappings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Baldi <[email protected]>
[ Upstream commit d97d13c24d7893abcfb80d38630ce74daaa1434c ]
Add Vol+/Vol-/Mute panel button mappings for iMON VFD HID OEM v1.2. This version differs in the codes that generate the KEY_VOLUMEUP, KEY_VOLUMEDOWN and KEY_MUTE events.
--- drivers/media/rc/imon.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/rc/imon.c +4 -0
@@ -295,6 +295,10 @@ static const struct imon_usb_dev_descr imon_OEM_VFD = { { 0x000100000000ffeell, KEY_VOLUMEUP }, { 0x010000000000ffeell, KEY_VOLUMEDOWN }, { 0x000000000100ffeell, KEY_MUTE }, +/* iMON VFD HID OEM v1.2 */ + { 0x000000000a00ffeell, KEY_VOLUMEUP }, + { 0x000000000b00ffeell, KEY_VOLUMEDOWN }, + { 0x000000000c00ffeell, KEY_MUTE },/* 0xffdc iMON MCE VFD */ { 0x00010000ffffffeell, KEY_VOLUMEUP }, { 0x01000000ffffffeell, KEY_VOLUMEDOWN },
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 29/595 RDMA/mlx5: Use QP port when decoding responder CQEs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 194762e6e436acde0f8f6aef44200b0058c36791 ]
The responder CQE path determines the link layer via rdma_port_get_link_layer(). Use qp->port instead of hardcoding port 1, which can mis-decode completions on multi-port devices.
--- drivers/infiniband/hw/mlx5/cq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/cq.c +2 -1
@@ -166,7 +166,8 @@ enum {static void handle_responder (struct ib_wc *wc,struct mlx5_cqe64 *cqe,struct mlx5_ib_qp *qp) { -enum rdma_link_layer ll =rdma_port_get_link_layer (qp->ibqp.device,1 ); +enum rdma_link_layer ll = +rdma_port_get_link_layer (qp->ibqp.device, qp->port);struct mlx5_ib_dev *dev =to_mdev (qp->ibqp.device);struct mlx5_ib_srq *srq =NULL ;struct mlx5_ib_wq *wq;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 30/595 mailbox: Make mbox_send_message() return error code when tx fails
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonwon Kang <[email protected]>
[ Upstream commit 96a3d2f3167f5644b30e60171898e67123c3c2c6 ]
When the mailbox controller failed transmitting message, the error code was only passed to the client's tx done handler and not to mbox_send_message() in blocking mode. For this reason, the function could return a false success. This commit resolves the issue by introducing the tx status and checking it before mbox_send_message() returns.
This commit works with the premise that the multi-threads' access to a channel in blocking mode is serialized by clients, not by the mailbox APIs, since the current mbox_send_message() in blocking mode does not support multi-threads.
--- drivers/mailbox/mailbox.c | 6 +++++- include/linux/mailbox_controller.h | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/mailbox/mailbox.c +5 -1
@@ -110,8 +110,10 @@ static void tx_tick(struct mbox_chan *chan, int r)if (chan->cl->tx_done) chan->cl->tx_done (chan->cl, mssg, r); -if (r != -ETIME && chan->cl->tx_block) +if (r != -ETIME && chan->cl->tx_block) { + chan->tx_status = r;complete (&chan->tx_complete); + } }static enum hrtimer_restart txdone_hrtimer (struct hrtimer *hrtimer)
@@ -281,6 +283,8 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)if (ret ==0 ) { t = -ETIME ;tx_tick (chan, t); + }else if (chan->tx_status <0 ) { + t = chan->tx_status; } }
include/linux/mailbox_controller.h +2 -0
@@ -108,6 +108,7 @@ struct mbox_controller {* @txdone_method: Way to detect TXDone chosen by the API * @cl: Pointer to the current owner of this channel * @tx_complete: Transmission completion +* @tx_status: Transmission status * @active_req: Currently active request hook * @msg_count: No. of mssg currently queued * @msg_free: Index of next available mssg slot
@@ -120,6 +121,7 @@ struct mbox_chan {unsigned txdone_method;struct mbox_client *cl;struct completion tx_complete; +int tx_status;void *active_req;unsigned msg_count, msg_free;void *msg_data[MBOX_TX_QUEUE_LEN ];
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 31/595 ALSA: usx2y: Drain pending US-428 pipe-4 output commands
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 18977c0dd722f52217027ff75de2811c53cce2cc ]
The US-428 pipe-4 output path submits at most one pending p4out entry from the shared-memory ring per input interrupt. If userspace queues more than one command before the interrupt handler runs, later commands remain pending until later input interrupts, even when async pipe-4 URBs are available.
Drain pending entries while idle async URBs are available. Copy each command into the existing per-URB async buffer before submission, so the submitted transfer does not depend on a userspace-mapped ring slot remaining unchanged after p4out_sent is advanced.
Also update p4out_sent only after usb_submit_urb() succeeds, so a failed submission is not reported as sent.
This keeps the shared-memory ABI unchanged and fixes only the local queue-draining behavior.
--- sound/usb/usx2y/usbusx2y.c | 39 ++++++++++++++++++++++---------------- 1 file changed, 23 insertions(+), 16 deletions(-)
sound/usb/usx2y/usbusx2y.c +23 -16
@@ -180,7 +180,7 @@ static void i_usx2y_in04_int(struct urb *urb)struct usx2ydev *usx2y = urb->context;struct us428ctls_sharedmem *us428ctls = usx2y->us428ctls_sharedmem;struct us428_p4out *p4out; -int i, j, n, diff, send; +int i, j, n, diff, send, len; usx2y->in04_int_calls++;
@@ -223,24 +223,31 @@ static void i_usx2y_in04_int(struct urb *urb) }while (!err && usx2y->us04->submitted < usx2y->us04->len); } }else { -if (us428ctls && us428ctls->p4out_last >=0 && us428ctls->p4out_last <N_US428_P4OUT_BUFS ) { -if (us428ctls->p4out_last != us428ctls->p4out_sent) { - send = us428ctls->p4out_sent +1 ; -if (send >=N_US428_P4OUT_BUFS ) - send =0 ; -for (j =0 ; j <URBS_ASYNC_SEQ && !err; ++j) { -if (!usx2y->as04.urb[j]->status) { - p4out = us428ctls->p4out + send;// FIXME if more than 1 p4out is new, 1 gets lost. -usb_fill_bulk_urb (usx2y->as04.urb[j], usx2y->dev, -usb_sndbulkpipe (usx2y->dev,0x04 ), &p4out->val.vol, - p4out->type ==ELT_LIGHT ?sizeof (struct us428_lights ) :5 , - i_usx2y_out04_int, usx2y); - err =usb_submit_urb (usx2y->as04.urb[j],GFP_ATOMIC ); +while (us428ctls && + us428ctls->p4out_last >=0 && + us428ctls->p4out_last <N_US428_P4OUT_BUFS && + us428ctls->p4out_last != us428ctls->p4out_sent) { +for (j =0 ; j <URBS_ASYNC_SEQ && !err; ++j) { +if (!usx2y->as04.urb[j]->status) { + send = us428ctls->p4out_sent +1 ; +if (send >=N_US428_P4OUT_BUFS ) + send =0 ; + + p4out = us428ctls->p4out + send; + len = p4out->type ==ELT_LIGHT ? +sizeof (struct us428_lights ) :5 ; +memcpy (usx2y->as04.urb[j]->transfer_buffer, + &p4out->val.vol, len); + usx2y->as04.urb[j]->transfer_buffer_length = len; + err =usb_submit_urb (usx2y->as04.urb[j],GFP_ATOMIC ); +if (!err) us428ctls->p4out_sent = send; -break ; - } + +break ; } } +if (j >=URBS_ASYNC_SEQ || err) +break ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 32/595 9p: invalidate readdir buffer on seek
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre Barre <[email protected]>
[ Upstream commit e661e17ddbed524b5fbda789a091b48b6b677067 ]
The per-fid readdir buffer (fid->rdir) is populated lazily and only refilled when fully drained (rdir->head == rdir->tail). userspace lseek() on a directory fd updates file->f_pos via generic_file_llseek() but does not touch the cached buffer, so the next getdents() iterates the stale cache and emits entries from the previous position instead of the one the caller asked for.
Track the file position the cached data corresponds to in struct p9_rdir, and drop the cache on entry to iterate_shared when it no longer matches ctx->pos. The 9p protocol's Tread/Treaddir already take an arbitrary offset on every request, so a refill at the new position is always legal; no .llseek override or seek restriction is needed.
Message-ID: <[email protected]>
--- fs/9p/vfs_dir.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/9p/vfs_dir.c +12 -0
@@ -30,6 +30,7 @@* struct p9_rdir - readdir accounting * @head: start offset of current dirread buffer * @tail: end offset of current dirread buffer +* @offset: file position the data at @head corresponds to * @buf: dirread buffer * * private structure for keeping track of readdir
@@ -39,6 +40,7 @@struct p9_rdir {int head;int tail; +loff_t offset;uint8_t buf[]; };
@@ -104,6 +106,9 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) kvec.iov_base = rdir->buf; kvec.iov_len = buflen; +if (rdir->head < rdir->tail && rdir->offset != ctx->pos) + rdir->head = rdir->tail =0 ; +while (1 ) {if (rdir->tail == rdir->head) {struct iov_iter to;
@@ -118,6 +123,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) rdir->head =0 ; rdir->tail = n; + rdir->offset = ctx->pos; }while (rdir->head < rdir->tail) { err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
@@ -135,6 +141,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) rdir->head += err; ctx->pos += err; + rdir->offset = ctx->pos; } } }
@@ -162,6 +169,9 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)if (!rdir)return -ENOMEM ; +if (rdir->head < rdir->tail && rdir->offset != ctx->pos) + rdir->head = rdir->tail =0 ; +while (1 ) {if (rdir->tail == rdir->head) { err = p9_client_readdir(fid, rdir->buf, buflen,
@@ -171,6 +181,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx) rdir->head =0 ; rdir->tail = err; + rdir->offset = ctx->pos; }while (rdir->head < rdir->tail) {
@@ -191,6 +202,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx) ctx->pos = curdirent.d_off; rdir->head += err; + rdir->offset = ctx->pos; } } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 33/595 arm64/daifflags: Make local_daif_*() helpers __always_inline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonardo Bras <[email protected]>
[ Upstream commit 827ce94e0897a70241abf810b1d3d7d083053a39 ]
Make sure those helpers are always inlined and instrumentation safe.
--- arch/arm64/include/asm/daifflags.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/arm64/include/asm/daifflags.h +5 -5
@@ -19,7 +19,7 @@/* mask/save/unmask/restore all exceptions, including interrupts. */ -static inline void local_daif_mask (void ) +static __always_inline void local_daif_mask(void) { WARN_ON(system_has_prio_mask_debugging() && (read_sysreg_s(SYS_ICC_PMR_EL1) == (GIC_PRIO_IRQOFF |
@@ -38,7 +38,7 @@ static inline void local_daif_mask(void)trace_hardirqs_off (); } -static inline unsigned long local_daif_save_flags (void ) +static __always_inline unsigned long local_daif_save_flags (void ) {unsigned long flags;
@@ -53,7 +53,7 @@ static inline unsigned long local_daif_save_flags(void)return flags; } -static inline unsigned long local_daif_save (void ) +static __always_inline unsigned long local_daif_save (void ) {unsigned long flags;
@@ -64,7 +64,7 @@ static inline unsigned long local_daif_save(void)return flags; } -static inline void local_daif_restore (unsigned long flags) +static __always_inline void local_daif_restore(unsigned long flags) {bool irq_disabled = flags &PSR_I_BIT ;
@@ -124,7 +124,7 @@ static inline void local_daif_restore(unsigned long flags)* Called by synchronous exception handlers to restore the DAIF bits that were * modified by taking an exception. */ -static inline void local_daif_inherit (struct pt_regs *regs) +static __always_inline void local_daif_inherit(struct pt_regs *regs) {unsigned long flags = regs->pstate &DAIF_MASK ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 34/595 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit 56e7e64cdd0e7209a58c8ec66028d63387402919 ]
BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries.
Reject truncated payloads before copying the report array.
--- drivers/firmware/arm_scmi/base.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/firmware/arm_scmi/base.c +13 -2
@@ -280,6 +280,8 @@ static void *scmi_base_fill_custom_report(const struct scmi_handle *handle, void *report, u32 *src_id) { int i; +u32 error_status; +size_t expected_sz;const struct scmi_base_error_notify_payld *p = payld;struct scmi_base_error_report *r = report;
@@ -293,10 +295,19 @@ static void *scmi_base_fill_custom_report(const struct scmi_handle *handle,if (evt_id !=SCMI_EVENT_BASE_ERROR_EVENT ||sizeof (*p) < payld_sz)return NULL ; + expected_sz = offsetof(typeof(*p), msg_reports); +if (payld_sz < expected_sz) +return NULL ; + r->timestamp = timestamp; r->agent_id =le32_to_cpu (p->agent_id); - r->fatal =IS_FATAL_ERROR (le32_to_cpu (p->error_status)); - r->cmd_count =ERROR_CMD_COUNT (le32_to_cpu (p->error_status)); + error_status =le32_to_cpu (p->error_status); + r->fatal =IS_FATAL_ERROR (error_status); + r->cmd_count =ERROR_CMD_COUNT (error_status); + expected_sz += r->cmd_count *sizeof (p->msg_reports[0 ]); +if (payld_sz < expected_sz) +return NULL ; +for (i =0 ; i < r->cmd_count; i++) r->reports[i] =le64_to_cpu (p->msg_reports[i]); *src_id =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 35/595 wifi: mac80211: dont call ieee80211_handle_reconfig_failure when not needed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 7a8a3ff2815501f78f494808355ddf37e08647d0 ]
In case reconfiguration of NAN fails, we call ieee80211_handle_reconfig_failure, that marks all interfaces as not in the driver.
Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces is called to destroy all the interfaces.
If we have any other interface but the NAN one, for example a BSS station, then when its state (links, stations) will be removed, we won't tell the driver about this, because we will think that the interfaces are not in the driver, and then drivers might remain with dangling pointers to objects like stations and links (at least for iwlwifi this is the case).
ieee80211_handle_reconfig_failure is meant to be called after we cleaned up the state in the driver, there is no reason to call it for NAN reconfiguration failure.
Fix the code to just warn in such a case, as we do in other error paths in reconfig where it is too complicated to rewind.
--- net/mac80211/util.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/mac80211/util.c +1 -5
@@ -2519,11 +2519,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) }break ;case NL80211_IFTYPE_NAN : - res =ieee80211_reconfig_nan (sdata); -if (res <0 ) { -ieee80211_handle_reconfig_failure (local); -return res; - } +WARN_ON (ieee80211_reconfig_nan (sdata));break ;case NL80211_IFTYPE_WDS :case NL80211_IFTYPE_AP_VLAN :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 36/595 bitfield: wire __bf_shf to __builtin_ctzll
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yury Norov <[email protected]>
[ Upstream commit 09472f591aa0b72c2dd6c693f48b2d6fea66c7ba ]
__bf_shf() is currently based on built-in ffsll. It's more straightforward to wire it to __builtin_ctzll, which makes it a pure rename.
Worth to notice that __builtin_ffsll() is buggy on GCC before 14.1:
int main() {
sizeof(struct {
int t : !(__builtin_ffsll(~0ULL) + 1 < 0);
});
} test.c: In function 'main':
test.c:3:21: error: bit-field 't' width not an integer constant
3 | int t : !(__builtin_ffsll(~0ULL) + 1 < 0);
| ^--- include/linux/bitfield.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/bitfield.h +1 -1
@@ -40,7 +40,7 @@* reg |= FIELD_PREP(REG_FIELD_C, c); */ -#define __bf_shf (x) (__builtin_ffsll(x) - 1) +#define __bf_shf __builtin_ctzll#define __scalar_type_to_unsigned_cases (type) \ unsigned type: (unsigned type)0, \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 37/595 net: usb: qmi_wwan: add MeiG SRM813Q
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Volckaert <[email protected]>
[ Upstream commit 9758c11fc6c138a79a28a5659feeaa3abde7aa6a ]
Add support for the Qualcomm Technology Snapdragon X35-based MeiG SRM813Q module.
The module can be put in different modes via AT commands to enable/disable GPS functionality:
MODEM - PPP mode(2dee:4d63): AT+SER=1,1
If#= 0: RMNET
If#= 1: DIAG/ADB
If#= 2: MODEM
If#= 3: AT
P: Vendor=2dee ProdID=4d63 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
NMEA mode(2dee:4d64): AT+SER=51,1
If#= 0: RMNET
If#= 1: DIAG/ADB
If#= 2: NMEA
If#= 3: AT
P: Vendor=2dee ProdID=4d64 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
--- drivers/net/usb/qmi_wwan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/qmi_wwan.c +2 -0
@@ -1384,6 +1384,8 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */ {QMI_FIXED_INTF(0x2dee, 0x4d22, 5)}, /* MeiG Smart SRM825L */ + {QMI_QUIRK_SET_DTR(0x2dee, 0x4d63, 0)}, /* MeiG SRM813Q w/ Modem(PPP) */ + {QMI_QUIRK_SET_DTR(0x2dee, 0x4d64, 0)}, /* MeiG SRM813Q w/ NMEA *//* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 38/595 net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 25ae123db10ba9ab890b56bcdb0a4363aee8529a ]
This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c.
Now kfree_rcu() is there, we can remove this problematic rcu_barrier() which causes extreme RTNL pressure in many syzbot reports.
INFO: task syz-executor:77945 is blocked on a mutex likely owned by task kworker/u1024:5:36537. task:kworker/u1024:5 state:D stack:24616 pid:36537 tgid:36537 ppid:2 task_flags:0x4208060 flags:0x00080000 last_sleep:612797637337 Workqueue: netns cleanup_net Call Trace: <TASK> [<ffffffff81914eaa>] context_switch+0xf2a/0x1730 kernel/sched/core.c:6483 [<ffffffff81201143>] __schedule+0x1133/0x43a0 kernel/sched/core.c:8411 [<ffffffff8120446b>] __schedule_loop kernel/sched/core.c:8514 [inline] [<ffffffff8120446b>] schedule+0xab/0x260 kernel/sched/core.c:8529 [<ffffffff8121a093>] schedule_timeout+0xc3/0x2b0 kernel/time/sleep_timeout.c:75 [<ffffffff81205347>] do_wait_for_common kernel/sched/completion.c:100 [inline] [<ffffffff81205347>] __wait_for_common kernel/sched/completion.c:121 [inline] [<ffffffff81205347>] wait_for_common kernel/sched/completion.c:132 [inline] [<ffffffff81205347>] wait_for_completion+0x2c7/0x5d0 kernel/sched/completion.c:153 [<ffffffff81b8f27f>] rcu_barrier+0x49f/0x620 kernel/rcu/tree.c:3888 [<ffffffff860091b3>] br_multicast_dev_del+0x303/0x350 net/bridge/br_multicast.c:4459 [<ffffffff85fb5dbc>] br_dev_uninit+0x1c/0x40 net/bridge/br_device.c:157 [<ffffffff8568058c>] unregister_netdevice_many_notify+0x1c1c/0x2300 net/core/dev.c:12599 [<ffffffff8562be43>] ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] [<ffffffff8562be43>] ops_undo_list+0x3d3/0x940 net/core/net_namespace.c:248
--- net/bridge/br_multicast.c | 2 -- 1 file changed, 2 deletions(-)
net/bridge/br_multicast.c +0 -2
@@ -3357,8 +3357,6 @@ void br_multicast_dev_del(struct net_bridge *br)br_multicast_gc (&deleted_head);cancel_work_sync (&br->mcast_gc_work); - -rcu_barrier (); }int br_multicast_set_router (struct net_bridge *br,unsigned long val)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 39/595 net/sched: sch_drr: make cl->quantum lockless
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit a4d880b85089e12a5f2e8e2fee386310cec5b99a ]
cl->quantum does not need to be protected by RTNL or qdisc spinlock.
--- net/sched/sch_drr.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/sched/sch_drr.c +4 -6
@@ -99,10 +99,8 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid, } } -sch_tree_lock (sch);if (tb[TCA_DRR_QUANTUM ]) - cl->quantum = quantum; -sch_tree_unlock (sch); +WRITE_ONCE (cl->quantum, quantum);return 0 ; }
@@ -251,7 +249,7 @@ static int drr_dump_class(struct Qdisc *sch, unsigned long arg, nest =nla_nest_start_noflag (skb,TCA_OPTIONS );if (nest ==NULL ) goto nla_put_failure; -if (nla_put_u32 (skb,TCA_DRR_QUANTUM , cl->quantum)) +if (nla_put_u32 (skb,TCA_DRR_QUANTUM ,READ_ONCE (cl->quantum))) goto nla_put_failure;return nla_nest_end (skb, nest);
@@ -370,7 +368,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,if (!cl_is_active (cl)) {list_add_tail (&cl->alist, &q->active); -WRITE_ONCE (cl->deficit, cl->quantum); +WRITE_ONCE (cl->deficit,READ_ONCE (cl->quantum)); } sch->qstats.backlog += len;
@@ -411,7 +409,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)return skb; } -WRITE_ONCE (cl->deficit, cl->deficit + cl->quantum); +WRITE_ONCE (cl->deficit, cl->deficit +READ_ONCE (cl->quantum));list_move_tail (&cl->alist, &q->active); } out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 40/595 net/rds: Dont sleep inside rds_ib_conn_path_shutdown
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Allison Henderson <[email protected]>
[ Upstream commit 16f48efaeb6991193fb7775c577f06f5b20b0c90 ]
New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the wait_event call, which blocks other work items in the queue. Fix this by changing wait_event to wait_event timeout, and looping until the wait check succeeds.
--- net/rds/ib_cm.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-)
net/rds/ib_cm.c +20 -5
@@ -1076,6 +1076,19 @@ int rds_ib_conn_path_connect(struct rds_conn_path *cp)return ret; } +static unsigned long rds_ib_conn_path_shutdown_check_wait (struct rds_conn_path *cp) +{ +struct rds_connection *conn = cp->cp_conn; +struct rds_ib_connection *ic = conn->c_transport_data; + +return (!ic->i_cm_id || + (rds_ib_ring_empty (&ic->i_recv_ring) && + (atomic_read (&ic->i_signaled_sends) ==0 ) && + (atomic_read (&ic->i_fastreg_inuse_count)) ==0 && + (atomic_read (&ic->i_fastreg_wrs) ==RDS_IB_DEFAULT_FR_WR ))) ?0 + :msecs_to_jiffies (1000 ); +} +/* * This is so careful about only cleaning up resources that were built up * so that it can be called at any point during startup. In fact it
@@ -1116,11 +1129,13 @@ void rds_ib_conn_path_shutdown(struct rds_conn_path *cp)* sends to complete we're ensured that there will be no * more tx processing. */ -wait_event (rds_ib_ring_empty_wait, -rds_ib_ring_empty (&ic->i_recv_ring) && - (atomic_read (&ic->i_signaled_sends) ==0 ) && - (atomic_read (&ic->i_fastreg_inuse_count) ==0 ) && - (atomic_read (&ic->i_fastreg_wrs) ==RDS_IB_DEFAULT_FR_WR )); +while (!wait_event_timeout (rds_ib_ring_empty_wait, +rds_ib_conn_path_shutdown_check_wait (cp) ==0 , +msecs_to_jiffies (1000 ))) { +tasklet_schedule (&ic->i_send_tasklet); +tasklet_schedule (&ic->i_recv_tasklet); + } +tasklet_kill (&ic->i_send_tasklet);tasklet_kill (&ic->i_recv_tasklet);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 41/595 befs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7597d42a25332617a3dfe596758d780ec6c028d7 ]
befs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/befs/linuxvfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/befs/linuxvfs.c +2 -1
@@ -891,7 +891,8 @@ befs_fill_super(struct super_block *sb, void *data, int silent)*/ sb->s_magic =BEFS_SUPER_MAGIC ;/* Set real blocksize of fs */ -sb_set_blocksize (sb, (ulong ) befs_sb->block_size); +if (!sb_set_blocksize (sb, (ulong ) befs_sb->block_size)) + goto unacquire_priv_sbp; sb->s_op = &befs_sops; sb->s_export_op = &befs_export_operations; sb->s_time_min =0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 42/595 affs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 0861182af5983a39bd2a891966436c5679b74a45 ]
affs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/affs/affs.h | 5 ----- fs/affs/super.c | 6 ++++-- 2 files changed, 4 insertions(+), 7 deletions(-)
fs/affs/affs.h +0 -5
@@ -220,11 +220,6 @@ static inline bool affs_validblock(struct super_block *sb, int block) block < AFFS_SB(sb)->s_partition_size); } -static inline void -affs_set_blocksize (struct super_block *sb,int size) -{ -sb_set_blocksize (sb, size); -}static inline struct buffer_head *affs_bread (struct super_block *sb,int block) {
fs/affs/super.c +4 -2
@@ -392,7 +392,8 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent) size =i_size_read (sb->s_bdev->bd_inode) >>9 ;pr_debug ("initial blocksize=%d, #blocks=%d\n" ,512 , size); -affs_set_blocksize (sb,PAGE_SIZE ); +if (!sb_set_blocksize (sb,PAGE_SIZE )) +return -EINVAL ;/* Try to find root block. Its location depends on the block size. */ i =bdev_logical_block_size (sb->s_bdev);
@@ -407,7 +408,8 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)if (root_block <0 ) sbi->s_root_block = (reserved + size -1 ) /2 ;pr_debug ("setting blocksize to %d\n" , blocksize); -affs_set_blocksize (sb, blocksize); +if (!sb_set_blocksize (sb, blocksize)) +return -EINVAL ; sbi->s_partition_size = size;/* The root block location that was calculated above is not
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 43/595 bfs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 2430e3380936df0b648af720cae624eef035a2d1 ]
bfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/bfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/bfs/inode.c +2 -1
@@ -343,7 +343,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) s->s_time_min =0 ; s->s_time_max =U32_MAX ; -sb_set_blocksize (s,BFS_BSIZE ); +if (!sb_set_blocksize (s,BFS_BSIZE )) + goto out; sbh =sb_bread (s,0 );if (!sbh)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 44/595 minix: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 38a03dc2bc71e7e0746cdb9ef5e9947f72470c67 ]
minix uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/minix/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/minix/inode.c +2 -1
@@ -270,7 +270,8 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) sbi->s_namelen =60 ; sbi->s_version =MINIX_V3 ; sbi->s_mount_state =MINIX_VALID_FS ; -sb_set_blocksize (s, m3s->s_blocksize); +if (!sb_set_blocksize (s, m3s->s_blocksize)) + goto out; s->s_max_links =MINIX2_LINK_MAX ; }else goto out_no_fs;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 45/595 qnx4: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit c7d911ea1cc9a63b07e52f5e75b263be0615b289 ]
qnx4 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/qnx4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/qnx4/inode.c +2 -1
@@ -195,7 +195,8 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)return -ENOMEM ; s->s_fs_info = qs; -sb_set_blocksize (s,QNX4_BLOCK_SIZE ); +if (!sb_set_blocksize (s,QNX4_BLOCK_SIZE )) +return -EINVAL ; s->s_op = &qnx4_sops; s->s_magic =QNX4_SUPER_MAGIC ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 46/595 jfs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 05107f5602751fcfd3d108c1f579eb45aabead52 ]
jfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/jfs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/super.c +2 -1
@@ -529,7 +529,8 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)/* * Initialize blocksize to 4K. */ -sb_set_blocksize (sb,PSIZE ); +if (!sb_set_blocksize (sb,PSIZE )) + goto out_unload;/* * Set method vectors.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 47/595 hpfs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit a405996f23e04942aad064ab8d50c55827482872 ]
hpfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/hpfs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/hpfs/super.c +2 -1
@@ -584,7 +584,8 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent) }/*sbi->sb_mounting = 1;*/ -sb_set_blocksize (s,512 ); +if (!sb_set_blocksize (s,512 )) + goto bail0; sbi->sb_fs_size =-1 ;if (!(bootblock =hpfs_map_sector (s,0 , &bh0,0 ))) goto bail1;if (!(superblock =hpfs_map_sector (s,16 , &bh1,1 ))) goto bail2;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 48/595 omfs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 18c3d6fcb557f920c9143711497625e70153874c ]
omfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/omfs/inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/omfs/inode.c +4 -2
@@ -480,7 +480,8 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent) sb->s_time_min =0 ; sb->s_time_max =U64_MAX /MSEC_PER_SEC ; -sb_set_blocksize (sb,0x200 ); +if (!sb_set_blocksize (sb,0x200 )) + goto end; bh =sb_bread (sb,0 );if (!bh)
@@ -532,7 +533,8 @@ static int omfs_fill_super(struct super_block *sb, void *data, int silent)* Use sys_blocksize as the fs block since it is smaller than a * page while the fs blocksize can be larger. */ -sb_set_blocksize (sb, sbi->s_sys_blocksize); +if (!sb_set_blocksize (sb, sbi->s_sys_blocksize)) + goto out_brelse_bh;/* * ...and the difference goes into a shift. sys_blocksize is always
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 49/595 isofs: handle set_blocksize failures
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 25ef4c4d9f0e96fb89c0ae0d7127c3f12a31bc32 ]
isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
--- fs/isofs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/isofs/inode.c +2 -1
@@ -858,7 +858,8 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)* entries. By forcing the blocksize in this way, we ensure * that we will never be required to do this. */ -sb_set_blocksize (s, orig_zonesize); +if (!sb_set_blocksize (s, orig_zonesize)) + goto out_freesbi; sbi->s_nls_iocharset =NULL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 50/595 usbip: vhci_hcd: fix NULL deref in status_show_vhci
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Wowk <[email protected]>
[ Upstream commit bc150783542ba2e7c1257d1299c6f3269bdba270 ]
platform_get_drvdata() can return NULL if a VHCI host controller's probe failed (e.g. due to USB bus number exhaustion). status_show_vhci() checked for a NULL pdev but not for a NULL hcd returned by platform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not return NULL - it returns a pointer offset of 0x260, causing a NULL pointer dereference when that value is subsequently dereferenced.
Add a NULL check on hcd before calling hcd_to_vhci_hcd(). Move status_show_not_ready() above status_show_vhci() to make it callable from the new error path without a forward declaration.
--- drivers/usb/usbip/vhci_sysfs.c | 52 +++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 23 deletions(-)
drivers/usb/usbip/vhci_sysfs.c +29 -23
@@ -59,6 +59,29 @@ static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vd *out +=sprintf (*out,"\n" ); } +static ssize_t status_show_not_ready (int pdev_nr,char *out) +{ +char *s = out; +int i =0 ; + +for (i =0 ; i <VHCI_HC_PORTS ; i++) { + out +=sprintf (out,"hs %04u %03u " , + (pdev_nr *VHCI_PORTS ) + i, +VDEV_ST_NOTASSIGNED ); + out +=sprintf (out,"000 00000000 0000000000000000 0-0" ); + out +=sprintf (out,"\n" ); + } + +for (i =0 ; i <VHCI_HC_PORTS ; i++) { + out +=sprintf (out,"ss %04u %03u " , + (pdev_nr *VHCI_PORTS ) +VHCI_HC_PORTS + i, +VDEV_ST_NOTASSIGNED ); + out +=sprintf (out,"000 00000000 0000000000000000 0-0" ); + out +=sprintf (out,"\n" ); + } +return out - s; +} +/* Sysfs entry to show port status */ static ssize_t status_show_vhci (int pdev_nr,char *out) {
@@ -76,6 +99,12 @@ static ssize_t status_show_vhci(int pdev_nr, char *out) } hcd =platform_get_drvdata (pdev); + +if (!hcd) { +usbip_dbg_vhci_sysfs ("show status error (hcd is NULL)\n" ); +return status_show_not_ready (pdev_nr, out); + } + vhci_hcd =hcd_to_vhci_hcd (hcd); vhci = vhci_hcd->vhci;
@@ -104,29 +133,6 @@ static ssize_t status_show_vhci(int pdev_nr, char *out)return out - s; } -static ssize_t status_show_not_ready (int pdev_nr,char *out) -{ -char *s = out; -int i =0 ; - -for (i =0 ; i <VHCI_HC_PORTS ; i++) { - out +=sprintf (out,"hs %04u %03u " , - (pdev_nr *VHCI_PORTS ) + i, -VDEV_ST_NOTASSIGNED ); - out +=sprintf (out,"000 00000000 0000000000000000 0-0" ); - out +=sprintf (out,"\n" ); - } - -for (i =0 ; i <VHCI_HC_PORTS ; i++) { - out +=sprintf (out,"ss %04u %03u " , - (pdev_nr *VHCI_PORTS ) +VHCI_HC_PORTS + i, -VDEV_ST_NOTASSIGNED ); - out +=sprintf (out,"000 00000000 0000000000000000 0-0" ); - out +=sprintf (out,"\n" ); - } -return out - s; -} -static int status_name_to_id (const char *name) {char *c;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 51/595 usb: core: hcd: fix possible deadlock in rh control transfers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit d5559f43d76b398392b26a15cbc16d731969cd1c ]
Quoted 1 line
From within the SCSI error handler memory allocations must not
trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doing the reset itself relies on VM magic. However, that is insufficient, as resetting a device involves resuming it. Resumption as well as resetting involves conrol transfers to the parent of the device to be reset. That may be a root hub. Hence usbcore must heed the flags passed to usb_submit_urb() processing control transfers to root hubs.
The problem exist since the storage driver has been merged.
--- drivers/usb/core/hcd.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/core/hcd.c +8 -6
@@ -473,7 +473,8 @@ rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)/* Root hub control transfers execute synchronously */ -static int rh_call_control (struct usb_hcd *hcd,struct urb *urb) +static int rh_call_control (struct usb_hcd *hcd, +struct urb *urb,gfp_t mem_flags) {struct usb_ctrlrequest *cmd;u16 typeReq, wValue, wIndex, wLength;
@@ -508,8 +509,8 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)* tbuf should be at least as big as the * USB hub descriptor. */ - tbuf_size =max_t (u16,sizeof (struct usb_hub_descriptor ), wLength); - tbuf =kzalloc (tbuf_size,GFP_KERNEL ); + tbuf_size =max_t (u16,sizeof (struct usb_hub_descriptor ), wLength); + tbuf =kzalloc (tbuf_size, mem_flags);if (!tbuf) { status = -ENOMEM ; goto err_alloc;
@@ -839,12 +840,13 @@ static int rh_queue_status (struct usb_hcd *hcd, struct urb *urb)return retval; } -static int rh_urb_enqueue (struct usb_hcd *hcd,struct urb *urb) +static int rh_urb_enqueue (struct usb_hcd *hcd, +struct urb *urb,gfp_t mem_flags) {if (usb_endpoint_xfer_int (&urb->ep->desc))return rh_queue_status (hcd, urb);if (usb_endpoint_xfer_control (&urb->ep->desc)) -return rh_call_control (hcd, urb); +return rh_call_control (hcd, urb, mem_flags);return -EINVAL ; }
@@ -1549,7 +1551,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)*/ if (is_root_hub (urb->dev)) { - status =rh_urb_enqueue (hcd, urb); + status =rh_urb_enqueue (hcd, urb, mem_flags); }else { status =map_urb_for_dma (hcd, urb, mem_flags);if (likely (status ==0 )) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 52/595 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
[ Upstream commit 5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02 ]
goku_irq() handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL ->driver:
if (dev->gadget.speed != USB_SPEED_UNKNOWN
&& dev->driver
&& dev->driver->resume) {
spin_unlock(&dev->lock);
dev->driver->resume(&dev->gadget);
...
}but the very next branch unconditionally dereferences dev->driver when an INT_USBRESET arrives:
if (stat & INT_USBRESET) {
ACK(INT_USBRESET);
INFO(dev, "USB reset done, gadget %s\n",
dev->driver->driver.name);
}If the controller raises INT_USBRESET before any gadget driver has been bound (or after one has been unbound), dev->driver is NULL and the printk dereferences NULL.
smatch flags the inconsistency:
drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:
we previously assumed 'dev->driver' could be null (see line 1607)
Fall back to a placeholder when the gadget driver is not bound.
No functional change while a gadget driver is bound.
--- drivers/usb/gadget/udc/goku_udc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/goku_udc.c +2 -1
@@ -1615,7 +1615,8 @@ static irqreturn_t goku_irq(int irq, void *_dev)if (stat &INT_USBRESET ) {/* hub reset done */ ACK (INT_USBRESET );INFO (dev,"USB reset done, gadget %s\n" , - dev->driver->driver.name); + dev->driver ? dev->driver->driver.name : +"<not bound>" ); }// and INT_ERR on some endpoint's crc/bitstuff/... problem }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 53/595 serial: 8250: fix possible ISR soft lockup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb ]
There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase.
The reason for the soft lockup in the ISR is the missing FIFO error IRQ (FIFOE) handling. Not handling it and reporting IRQ_HANDLED triggers the IRQ immediately again.
Fix this by adding a check for the FIFOE status and clearing the FIFO if no data is ready (DR).
This behavior was observed on an AM62L device which uses the OMAP 8250 driver. Fix it for all 8250 drivers, since the OMAP driver's special IRQ setup handling may trigger this behavior more frequently, but it is not ensured that other 8250 drivers aren't affected.
--- drivers/tty/serial/8250/8250_port.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/tty/serial/8250/8250_port.c +7 -0
@@ -1894,6 +1894,13 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) status =serial_port_in (port,UART_LSR ); +/* +* Recover from no-data-ready and FIFO error condition to avoid getting +* stuck in the ISR. +*/ +if (!(status &UART_LSR_DR ) && (status &UART_LSR_FIFOE )) +serial8250_clear_and_reinit_fifos (up); +/* * If port is stopped and there are no error conditions in the * FIFO, then don't drain the FIFO, as this may lead to TTY buffer
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 54/595 usb: host: add ARCH_AIROHA in XHCI MTK dependency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit ffeaf31f05d664581aa436d9cb92b4d1d8d301ce ]
Airoha SoC use the same register map and logic of the Mediatek xHCI driver, hence add it to the dependency list to permit compilation also on this ARCH.
--- drivers/usb/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/Kconfig +1 -1
@@ -72,7 +72,7 @@ config USB_XHCI_HISTB config USB_XHCI_MTK tristate "xHCI support for MediaTek SoCs" select MFD_SYSCON - depends on (MIPS && SOC_MT7621) || ARCH_MEDIATEK || COMPILE_TEST + depends on (MIPS && SOC_MT7621) || ARCH_MEDIATEK || ARCH_AIROHA || COMPILE_TEST help Say 'Y' to enable the support for the xHCI host controller found in MediaTek SoCs.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 55/595 char/nvram: Remove redundant nvram_mutex
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Venkat Rao Bagalkote <[email protected]>
[ Upstream commit e8c715f3a7dae43fabae261493a26474fec11863 ]
The global nvram_mutex in drivers/char/nvram.c is redundant and unused, and this triggers compiler warnings on some configurations.
All platform-specific nvram operations already provide their own internal synchronization, meaning the wrapper-level mutex does not provide any additional safety.
Remove the nvram_mutex definition along with all remaining lock/unlock users across PPC32, x86, and m68k code paths, and rely entirely on the per-architecture nvram implementations for locking.
--- drivers/char/nvram.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/char/nvram.c +3 -13
@@ -53,7 +53,6 @@#include <asm/nvram.h> #endif -static DEFINE_MUTEX (nvram_mutex);static DEFINE_SPINLOCK (nvram_state_lock);static int nvram_open_cnt;/* #times opened */ static int nvram_open_mode;/* special open modes */
@@ -310,11 +309,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,break ;#ifdef CONFIG_PPC32 case IOC_NVRAM_SYNC : -if (ppc_md.nvram_sync !=NULL ) { -mutex_lock (&nvram_mutex); +if (ppc_md.nvram_sync) ppc_md.nvram_sync (); -mutex_unlock (&nvram_mutex); - } ret =0 ;break ;#endif
@@ -324,11 +320,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,if (!capable (CAP_SYS_ADMIN ))return -EACCES ; -if (arch_nvram_ops.initialize !=NULL ) { -mutex_lock (&nvram_mutex); +if (arch_nvram_ops.initialize) ret = arch_nvram_ops.initialize (); -mutex_unlock (&nvram_mutex); - }break ;case NVRAM_SETCKS :/* just set checksum, contents unchanged (maybe useful after
@@ -336,11 +329,8 @@ static long nvram_misc_ioctl(struct file *file, unsigned int cmd,if (!capable (CAP_SYS_ADMIN ))return -EACCES ; -if (arch_nvram_ops.set_checksum !=NULL ) { -mutex_lock (&nvram_mutex); +if (arch_nvram_ops.set_checksum) ret = arch_nvram_ops.set_checksum (); -mutex_unlock (&nvram_mutex); - }break ;#endif /* CONFIG_X86 || CONFIG_M68K */ }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 56/595 netlabel: fix IPv6 unlabeled address add error handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenguang Zhao <[email protected]>
[ Upstream commit 56872b930feee7ae07b9720ca950dd9fa65596ee ]
netlbl_unlhsh_add_addr6() always returned zero after netlbl_af6list_add(), masking failures such as duplicate IPv6 static label entries.
--- net/netlabel/netlabel_unlabeled.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netlabel/netlabel_unlabeled.c +1 -1
@@ -295,7 +295,7 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,if (ret_val !=0 )kfree (entry); - return 0; + return ret_val; }#endif /* IPv6 */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 57/595 rds: filter RDS_INFO_* getsockopt by callers netns
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit c96a5209dda666004b8ee1ed7f0d493d09a4f200 ]
The RDS_INFO_* family of getsockopt(2) options reads several file-scope global lists that are not per-netns:
rds_sock_info / rds6_sock_info,
rds_sock_inc_info / rds6_sock_inc_info -> rds_sock_list
rds_tcp_tc_info / rds6_tcp_tc_info -> rds_tcp_tc_list
rds_conn_info / rds6_conn_info, rds_conn_message_info_cmn (for the *_SEND_MESSAGES and *_RETRANS_MESSAGES variants), rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)
-> rds_conn_hash[]
The handlers do not filter by the caller's network namespace. rds_info_getsockopt() has no netns or capable() check, and rds_create() has no capable() check, so AF_RDS is reachable from an unprivileged user namespace. As a result, an unprivileged caller in a fresh user_ns plus netns can read the bound address and sock inode of every RDS socket on the host, the peer address of incoming messages on every RDS socket on the host, the peer address and TCP sequence numbers of every rds-tcp connection on the host, and the peer address and RDS sequence numbers of every RDS connection on the host.
The rds-tcp transport is reachable from a non-initial netns (see rds_set_transport()), so a one-shot init_net gate at rds_info_getsockopt() would deny legitimate per-netns visibility to rds-tcp callers. Instead, filter at each handler by comparing the netns of the caller's socket to the netns of the list entry, or to rds_conn_net(conn) for connection paths. Only copy entries whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are aggregate statistics and remain global.
Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket binds 127.0.0.1:4242 in init_net as root. A child process enters a fresh user_ns plus netns and opens AF_RDS there, then calls getsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the child sees the init_net socket. After this change, the child sees zero entries.
Drop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count globals. v2 used them for the size precheck and lens->nr; v3 replaced the precheck with a per-ns count from a first pass over the list, so the globals have no remaining readers. The matching increments and decrements in rds_create()/rds_destroy_sock() and rds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with them. Reported by the kernel test robot under clang W=1.
--- net/rds/af_rds.c | 59 ++++++++++++++++++++++++++++++++++------- net/rds/connection.c | 13 +++++++++ net/rds/tcp.c | 63 ++++++++++++++++++++++++++++---------------- 3 files changed, 104 insertions(+), 31 deletions(-)
net/rds/af_rds.c +50 -9
@@ -43,7 +43,6 @@/* this is just used for stats gathering :/ */ static DEFINE_SPINLOCK (rds_sock_lock); -static unsigned long rds_sock_count;static LIST_HEAD (rds_sock_list);DECLARE_WAIT_QUEUE_HEAD (rds_poll_waitq);
@@ -82,7 +81,6 @@ static int rds_release(struct socket *sock)spin_lock_bh (&rds_sock_lock);list_del_init (&rs->rs_item); - rds_sock_count--;spin_unlock_bh (&rds_sock_lock);rds_trans_put (rs->rs_transport);
@@ -695,7 +693,6 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)spin_lock_bh (&rds_sock_lock);list_add_tail (&rs->rs_item, &rds_sock_list); - rds_sock_count++;spin_unlock_bh (&rds_sock_lock);return 0 ;
@@ -736,6 +733,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,struct rds_info_iterator *iter, struct rds_info_lengths *lens) { + struct net *net = sock_net(sock->sk);struct rds_sock *rs;struct rds_incoming *inc;unsigned int total =0 ;
@@ -745,6 +743,9 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,spin_lock_bh (&rds_sock_lock);list_for_each_entry (rs, &rds_sock_list, rs_item) { +/* Only show sockets in the caller's netns. */ +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ;/* This option only supports IPv4 sockets. */ if (!ipv6_addr_v4mapped (&rs->rs_bound_addr))continue ;
@@ -775,6 +776,7 @@ static void rds6_sock_inc_info(struct socket *sock, unsigned int len,struct rds_info_iterator *iter, struct rds_info_lengths *lens) { + struct net *net = sock_net(sock->sk);struct rds_incoming *inc;unsigned int total =0 ;struct rds_sock *rs;
@@ -784,6 +786,9 @@ static void rds6_sock_inc_info(struct socket *sock, unsigned int len,spin_lock_bh (&rds_sock_lock);list_for_each_entry (rs, &rds_sock_list, rs_item) { +/* Only show sockets in the caller's netns. */ +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ;read_lock (&rs->rs_recv_lock);list_for_each_entry (inc, &rs->rs_recv_queue, i_item) {
@@ -807,7 +812,9 @@ static void rds_sock_info(struct socket *sock, unsigned int len,struct rds_info_iterator *iter, struct rds_info_lengths *lens) { + struct net *net = sock_net(sock->sk);struct rds_info_socket sinfo; +unsigned int copied =0 ;unsigned int cnt =0 ;struct rds_sock *rs;
@@ -815,12 +822,24 @@ static void rds_sock_info(struct socket *sock, unsigned int len,spin_lock_bh (&rds_sock_lock); -if (len < rds_sock_count) { - cnt = rds_sock_count; - goto out; +/* First pass: count entries visible in the caller's netns. */ +list_for_each_entry (rs, &rds_sock_list, rs_item) { +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ; +if (!ipv6_addr_v4mapped (&rs->rs_bound_addr)) +continue ; + cnt++; } +if (len < cnt) + goto out; +list_for_each_entry (rs, &rds_sock_list, rs_item) { +if (copied >= cnt) +break ; +/* Only show sockets in the caller's netns. */ +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ;/* This option only supports IPv4 sockets. */ if (!ipv6_addr_v4mapped (&rs->rs_bound_addr))continue ;
@@ -833,8 +852,13 @@ static void rds_sock_info(struct socket *sock, unsigned int len, sinfo.inum =sock_i_ino (rds_rs_to_sk (rs));rds_info_copy (iter, &sinfo,sizeof (sinfo)); - cnt++; + copied++; } +/* A concurrent rds_bind() can change rs_bound_addr between the +* two passes without holding rds_sock_lock, so copied may be +* less than cnt. Report what was actually copied. +*/ + cnt = copied; out: lens->nr = cnt;
@@ -848,17 +872,32 @@ static void rds6_sock_info(struct socket *sock, unsigned int len,struct rds_info_iterator *iter, struct rds_info_lengths *lens) { + struct net *net = sock_net(sock->sk);struct rds6_info_socket sinfo6; +unsigned int copied =0 ; +unsigned int cnt =0 ;struct rds_sock *rs; len /=sizeof (struct rds6_info_socket );spin_lock_bh (&rds_sock_lock); -if (len < rds_sock_count) +/* First pass: count entries visible in the caller's netns. */ +list_for_each_entry (rs, &rds_sock_list, rs_item) { +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ; + cnt++; + } + +if (len < cnt) goto out;list_for_each_entry (rs, &rds_sock_list, rs_item) { +if (copied >= cnt) +break ; +/* Only show sockets in the caller's netns. */ +if (!net_eq (sock_net (rds_rs_to_sk (rs)), net)) +continue ; sinfo6.sndbuf =rds_sk_sndbuf (rs); sinfo6.rcvbuf =rds_sk_rcvbuf (rs); sinfo6.bound_addr = rs->rs_bound_addr;
@@ -868,10 +907,12 @@ static void rds6_sock_info(struct socket *sock, unsigned int len, sinfo6.inum =sock_i_ino (rds_rs_to_sk (rs));rds_info_copy (iter, &sinfo6,sizeof (sinfo6)); + copied++; } + cnt = copied; out: - lens->nr = rds_sock_count; + lens->nr = cnt; lens->each =sizeof (struct rds6_info_socket );spin_unlock_bh (&rds_sock_lock);
net/rds/connection.c +13 -0
@@ -540,6 +540,7 @@ static void rds_conn_message_info_cmn(struct socket *sock, unsigned int len,struct rds_info_lengths *lens, int want_send, bool isv6) { + struct net *net = sock_net(sock->sk);struct hlist_head *head;struct list_head *list;struct rds_connection *conn;
@@ -562,6 +563,9 @@ static void rds_conn_message_info_cmn(struct socket *sock, unsigned int len,struct rds_conn_path *cp;int npaths; +/* Only show connections in the caller's netns. */ +if (!net_eq (rds_conn_net (conn), net)) +continue ;if (!isv6 && conn->c_isv6)continue ;
@@ -660,6 +664,7 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len, u64 *buffer, size_t item_len) { +struct net *net =sock_net (sock->sk);struct hlist_head *head;struct rds_connection *conn;size_t i;
@@ -672,6 +677,9 @@ void rds_for_each_conn_info(struct socket *sock, unsigned int len,for (i =0 , head = rds_conn_hash; i <ARRAY_SIZE (rds_conn_hash); i++, head++) {hlist_for_each_entry_rcu (conn, head, c_hash_node) { +/* Only show connections in the caller's netns. */ +if (!net_eq (rds_conn_net (conn), net)) +continue ;/* Zero the per-item buffer before handing it to the * visitor so any field the visitor does not write -
@@ -705,6 +713,7 @@ static void rds_walk_conn_path_info(struct socket *sock, unsigned int len, u64 *buffer, size_t item_len) { +struct net *net =sock_net (sock->sk);struct hlist_head *head;struct rds_connection *conn;size_t i;
@@ -719,6 +728,10 @@ static void rds_walk_conn_path_info(struct socket *sock, unsigned int len,hlist_for_each_entry_rcu (conn, head, c_hash_node) {struct rds_conn_path *cp; +/* Only show connections in the caller's netns. */ +if (!net_eq (rds_conn_net (conn), net)) +continue ; +/* XXX We only copy the information from the first * path for now. The problem is that if there are * more than one underlying paths, we cannot report
net/rds/tcp.c +41 -22
136 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 58/595 rds: annotate data-race around rs_seen_congestion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 67636cab273ed0c0b0f2adab6c9369a471cb7966 ]
rs_seen_congestion is read in rds_poll() and written in rds_sendmsg() and rds_poll() without any lock. Use READ_ONCE()/WRITE_ONCE() to annotate these lockless accesses and silence KCSAN.
--- net/rds/af_rds.c | 4 ++-- net/rds/send.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
net/rds/af_rds.c +2 -2
@@ -217,7 +217,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,poll_wait (file,sk_sleep (sk), wait); -if (rs->rs_seen_congestion) +if (READ_ONCE (rs->rs_seen_congestion))poll_wait (file, &rds_poll_waitq, wait);read_lock_irqsave (&rs->rs_recv_lock, flags);
@@ -245,7 +245,7 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,/* clear state any time we wake a seen-congested socket */ if (mask) - rs->rs_seen_congestion =0 ; +WRITE_ONCE (rs->rs_seen_congestion,0 );return mask; }
net/rds/send.c +1 -1
@@ -1340,7 +1340,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) ret =rds_cong_wait (conn->c_fcong, dport, nonblock, rs);if (ret) { - rs->rs_seen_congestion =1 ; +WRITE_ONCE (rs->rs_seen_congestion,1 ); goto out; } while (!rds_send_queue_rm(rs, conn, cpath, rm, rs->rs_bound_port,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 59/595 s390/zcore: Removed unused variables
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit 0a2aa995c0a1d363b5f0803862e84834e3876ae2 ]
allmodconfig with clang W=1 points out unused global variables:
drivers/s390/char/zcore.c:49:23: error: variable
'zcore_reipl_file' set but not used [-Werror,-Wunused-but-set-global]drivers/s390/char/zcore.c:50:23: error: variable
'zcore_hsa_file' set but not used [-Werror,-Wunused-but-set-global]
Remove both of them, since there is no point in keeping them.
--- drivers/s390/char/zcore.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/s390/char/zcore.c +2 -6
@@ -45,8 +45,6 @@ struct ipib_info {static struct debug_info *zcore_dbf;static int hsa_available;static struct dentry *zcore_dir; -static struct dentry *zcore_reipl_file; -static struct dentry *zcore_hsa_file;static struct ipl_parameter_block *zcore_ipl_block;static DEFINE_MUTEX (hsa_buf_mutex);
@@ -325,10 +323,8 @@ static int __init zcore_init(void) goto fail; zcore_dir =debugfs_create_dir ("zcore" ,NULL ); - zcore_reipl_file =debugfs_create_file ("reipl" ,S_IRUSR , zcore_dir, -NULL , &zcore_reipl_fops); - zcore_hsa_file =debugfs_create_file ("hsa" ,S_IRUSR |S_IWUSR , zcore_dir, -NULL , &zcore_hsa_fops); +debugfs_create_file ("reipl" ,S_IRUSR , zcore_dir,NULL , &zcore_reipl_fops); +debugfs_create_file ("hsa" ,S_IRUSR |S_IWUSR , zcore_dir,NULL , &zcore_hsa_fops);register_reboot_notifier (&zcore_reboot_notifier);atomic_notifier_chain_register (&panic_notifier_list, &zcore_on_panic_notifier);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 60/595 clk: socfpga: agilex: implement l3_main_free_clk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ng Ho Yin <[email protected]>
[ Upstream commit 1e7f56205813a2c48cdb3e9a4b0a24f49fd9a548 ]
The AGILEX_L3_MAIN_FREE_CLK is defined in the dt-bindings header but was never implemented in the clock driver. Per the Agilex TRM, l3_main_free_clk has no divider or mux and is a fixed 1:1 derivative of noc_free_clk that clocks most of the interconnect datapath.
--- drivers/clk/socfpga/clk-agilex.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/socfpga/clk-agilex.c +2 -0
@@ -247,6 +247,8 @@ static const struct stratix10_perip_cnt_clock agilex_main_perip_cnt_clks[] = { 0, 0x3C, 0, 0, 0}, {AGILEX_NOC_FREE_CLK ,"noc_free_clk" ,NULL , noc_free_mux,ARRAY_SIZE (noc_free_mux), 0, 0x40, 0, 0, 0}, + { AGILEX_L3_MAIN_FREE_CLK, "l3_main_free_clk", "noc_free_clk", NULL, + 1, 0, 0, 1, 0, 0}, { AGILEX_L4_SYS_FREE_CLK, "l4_sys_free_clk", NULL, noc_mux, ARRAY_SIZE(noc_mux), 0, 0, 4, 0x30, 1}, { AGILEX_EMAC_A_FREE_CLK, "emaca_free_clk", NULL, emaca_free_mux, ARRAY_SIZE(emaca_free_mux),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 61/595 thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit ee126267bc04bfb03816ae9d71ca24c5bf99e739 ]
Use devm_thermal_of_cooling_device_register() to simplify resource management and avoid manual cleanup in error paths.
As a side effect this change has the benefit of solving an existing issue. Before, the function tegra_soctherm_remove() only called debugfs_remove_recursive() and never called thermal_cooling_device_unregister() for any of the cooling devices registered here.
After the driver removal, the thermal framework's cdev list would still hold references to thermal_cooling_device objects whose devdata pointer (ts) pointed to memory already freed by the platform device's devm cleanup.
With this change, the cooling device is unregistered when the driver is removed, thus fixing the issue above.
--- drivers/thermal/tegra/soctherm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/thermal/tegra/soctherm.c +3 -3
@@ -1737,9 +1737,9 @@ static void soctherm_init_hw_throt_cdev(struct platform_device *pdev) stc->init = true; }else { - tcd =thermal_of_cooling_device_register (np_stcc, - (char *)name, ts, - &throt_cooling_ops); + tcd =devm_thermal_of_cooling_device_register (dev, np_stcc, + (char *)name, ts, + &throt_cooling_ops);if (IS_ERR_OR_NULL (tcd)) { dev_err(dev, "throttle-cfg: %s: failed to register cooling device\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 62/595 drm/panel: simple: Add AM-1280800W8TZQW-T00H
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dario Binacchi <[email protected]>
[ Upstream commit 6acb810ebc5d8dea5c250326c14dc44e32dc8e92 ]
Add Ampire, AM-1280800W8TZQW-T00H 10.1" TFT LCD panel timings.
--- drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/gpu/drm/panel/panel-simple.c +28 -0
@@ -686,6 +686,31 @@ static const struct panel_desc ampire_am_1280800n3tzqw_t00h = { .connector_type = DRM_MODE_CONNECTOR_LVDS, }; +static const struct drm_display_mode ampire_am_1280800w8tzqw_t00h_mode = { + .clock =72400 , + .hdisplay =1280 , + .hsync_start =1280 +40 , + .hsync_end =1280 +40 +80 , + .htotal =1280 +40 +80 +40 , + .vdisplay =800 , + .vsync_start =800 +10 , + .vsync_end =800 +10 +18 , + .vtotal =800 +10 +18 +10 , +}; + +static const struct panel_desc ampire_am_1280800w8tzqw_t00h = { + .modes = &ire_am_1280800w8tzqw_t00h_mode, + .num_modes =1 , + .bpc =8 , + .size = { + .width =217 , + .height =136 , + }, + .bus_flags =DRM_BUS_FLAG_DE_HIGH , + .bus_format =MEDIA_BUS_FMT_RGB888_1X7X4_SPWG , + .connector_type =DRM_MODE_CONNECTOR_LVDS , +}; +static const struct drm_display_mode ampire_am_480272h3tmqw_t01h_mode = { .clock =9000 , .hdisplay =480 ,
@@ -3921,6 +3946,9 @@ static const struct of_device_id platform_of_match[] = { { .compatible = "ampire,am-1280800n3tzqw-t00h", .data = &ire_am_1280800n3tzqw_t00h, + }, { + .compatible = "ampire,am-1280800w8tzqw-t00h", + .data = &ire_am_1280800w8tzqw_t00h, }, { .compatible = "ampire,am-480272h3tmqw-t01h", .data = &ire_am_480272h3tmqw_t01h,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 63/595 mips: cps: Assemble jr.hb with an R2 ISA level
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit e5d64f868e484da06f5c141c18c32c01c269625e ]
A MIPS allmodconfig built with LLVM can select CPU_MIPS32_R1 together with MIPS_MT_SMP. In that configuration clang invokes the integrated assembler with -march=mips32, and the MIPS MT path in cps-vec.S fails to assemble two jr.hb instructions:
arch/mips/kernel/cps-vec.S:376:2: error: instruction requires a CPU feature not currently enabled
arch/mips/kernel/cps-vec.S:490:4: error: instruction requires a CPU feature not currently enabled
The earlier jr.hb in the same file is already assembled inside a .set MIPS_ISA_LEVEL_RAW scope. The two failing sites are reached after popping back to the file's base ISA level, so LLVM correctly rejects them for an R1 target.
Wrap those jr.hb instructions in the same ISA-level push/pop used by the working site. This keeps the MT code unchanged while making the required R2 hazard-branch encoding explicit to the assembler.
--- arch/mips/kernel/cps-vec.S | 6 ++++++ 1 file changed, 6 insertions(+)
arch/mips/kernel/cps-vec.S +6 -0
@@ -395,8 +395,11 @@ LEAF(mips_cps_boot_vpes) .set pop PTR_LA t1, 1f + .set push + .set MIPS_ISA_LEVEL_RAW jr.hb t1 nop + .set pop 1: mfc0 t1, CP0_MVPCONTROL ori t1, t1, MVPCONTROL_VPC mtc0 t1, CP0_MVPCONTROL
@@ -509,8 +512,11 @@ LEAF(mips_cps_boot_vpes) li t0, TCHALT_H mtc0 t0, CP0_TCHALT PTR_LA t0, 1f + .set push + .set MIPS_ISA_LEVEL_RAW 1: jr.hb t0 nop + .set pop 2:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 64/595 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <[email protected]>
[ Upstream commit 929fec2964f71d4b1ac664ee963d8226c5cf01c6 ]
iadc_probe() calls enable_irq_wake() after a successful devm_request_irq(), but the driver has no remove callback or matching disable_irq_wake(), so the wake reference count on the IRQ is leaked on module unload or driver unbind.
Check the IRQ request error first, then register a devm action that calls disable_irq_wake() so the wake reference is released in the same scope as the enable. While here, drop the inverted "if (!ret) ... else return ret" in favour of the standard "if (ret) return ret;" pattern.
--- drivers/iio/adc/qcom-spmi-iadc.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/iio/adc/qcom-spmi-iadc.c +15 -3
@@ -482,6 +482,11 @@ static const struct iio_chan_spec iadc_channels[] = { }, }; +static void iadc_disable_irq_wake (void *data) +{ +disable_irq_wake ((unsigned long )data); +} +static int iadc_probe (struct platform_device *pdev) {struct device_node *node = pdev->dev.of_node;
@@ -539,9 +544,16 @@ static int iadc_probe(struct platform_device *pdev)if (!iadc->poll_eoc) { ret =devm_request_irq (dev, irq_eoc, iadc_isr,0 ,"spmi-iadc" , iadc); -if (!ret) -enable_irq_wake (irq_eoc); -else +if (ret) +return ret; + + ret =enable_irq_wake (irq_eoc); +if (ret) +return ret; + + ret =devm_add_action_or_reset (dev, iadc_disable_irq_wake, + (void *)(unsigned long )irq_eoc); +if (ret)return ret; }else {device_init_wakeup (iadc->dev,1 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 65/595 irqchip/gic-v4: Dont advertise VLPIs if no ITS is probed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
[ Upstream commit e61654fbc3bc5d07ec9fafe29f33e19b2b5d0fd5 ]
When accidentally setting “kvm-arm.vgic_v4_enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gic_domain” is NULL and the kernel attempts to access it.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
Mem abort info:
ESR = 0x0000000096000006
CPU: 1 UID: 0 PID: 295 Comm: lkvm-static Not tainted 7.1.0-rc4-ge3f15ad3970e #5 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 81402005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __irq_domain_instantiate+0x1d4/0x578
lr : __irq_domain_instantiate+0x1cc/0x578Set vLPI support to false at init time if the host has no ITS, so it propagates properly to kvm_vgic_global_state.has_gicv4.
--- drivers/irqchip/irq-gic-v3-its.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-gic-v3-its.c +1 -0
@@ -5426,6 +5426,7 @@ int __init its_init(struct fwnode_handle *handle, struct rdists *rdists,its_acpi_probe ();if (list_empty (&its_nodes)) { + rdists->has_vlpis = false;pr_warn ("ITS: No ITS available, not enabling LPIs\n" );return -ENXIO ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 66/595 ALSA: usb-audio: Add quirk for Novation Mininova
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Küchler <[email protected]>
[ Upstream commit b2e9d2cbbb71b00faf3e27fb741a27b9ad455edd ]
Add a device-specific quirk for the Novation Mininova synthesizer (USB ID 1235:001e) to enable proper recognition and functionality as a MIDI device.
--- sound/usb/quirks-table.h | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/usb/quirks-table.h +8 -0
@@ -2814,6 +2814,14 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, +{ +USB_DEVICE (0x1235 ,0x001e ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Novation", */ +/* .product_name = "Mininova", */ + QUIRK_DATA_RAW_BYTES(0) + } +}, { USB_DEVICE_VENDOR_SPEC(0x1235, 0x4661), .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 67/595 ipv6: addrconf: fix temp address generation after prefix deprecation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit e20d8922aa8fe441d291364c96c2179a005b79ea ]
When a router temporarily deprecates an IPv6 prefix (either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire) and later restores it, the kernel permanently loses its ability to generate temporary privacy addresses (RFC 8981) for that prefix.
This happens because the address worker attempts to generate a replacement temporary address when the current one nears expiration. As the base prefix is deprecated already, the generation fails after marking the temporary address as already having spawned a replacement (ifp->regen_count++).
When the router eventually restores the prefix, the temporary address becomes active again. However, once it naturally expires, the address worker sees this temporary address already tried to generate one and skips the regeneration.
Fix the issue by resetting the regen_count check of the latest temp address generated for the prefix updated by the incoming RA.
--- net/ipv6/addrconf.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +9 -1
@@ -1160,6 +1160,7 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,ipv6_link_dev_addr (idev, ifa);if (ifa->flags&IFA_F_TEMPORARY ) { +/* manage_tempaddrs() relies on addresses being added to the head */ list_add (&ifa->tmp_list, &idev->tempaddr_list);in6_ifa_hold (ifa); }
@@ -2532,8 +2533,10 @@ static void manage_tempaddrs(struct inet6_dev *idev, __u32 valid_lft, __u32 prefered_lft, bool create, unsigned long now) { - u32 flags; + u32 orig_prefered_lft = prefered_lft;struct inet6_ifaddr *ift; +bool reset_done = false; +u32 flags;read_lock_bh (&idev->lock);/* update all temporary addresses in the list */
@@ -2568,6 +2571,11 @@ static void manage_tempaddrs(struct inet6_dev *idev, prefered_lft = max_prefered;spin_lock (&ift->lock); +/* the first match is the most recent temp address */ +if (!reset_done && orig_prefered_lft >0 ) { + ift->regen_count =0 ; + reset_done = true; + } flags = ift->flags; ift->valid_lft = valid_lft; ift->prefered_lft = prefered_lft;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 68/595 drm/amd/pm/si: Fix updating clock limits from power states
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Klarenbeek <[email protected]>
[ Upstream commit e6c5d36756e7d4d260e2365fc4d01226f1973152 ]
VBIOS can contain conflicting values between:
- the maximum allowed clocks and voltages on AC or DC
- the clocks and voltages in power states on AC or DC
Update maximum clock (and voltage) limits for both AC/DC and take the highest value from the VBIOS limits and the performance/battery power states. Previously this was only done for AC, but is also needed for DC.
This commit fixes the behaviour on some laptop GPUs, where the VBIOS limit was set to the lowest possible clock frequency, so the GPU was stuck on the lowest possible power level on battery.
Some affected GPUs are:
FirePro W4170M (Dell Precision M2800)
Radeon HD 8790M (Dell Latitude E6540)
and possibly other laptop GPUs.
--- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 29 +++++++++++++++++++---- 1 file changed, 24 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +24 -5
@@ -7143,6 +7143,7 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev,struct evergreen_power_info *eg_pi =evergreen_get_pi (adev);struct si_power_info *si_pi =si_get_pi (adev);struct si_ps *ps =si_get_ps (rps); +struct amdgpu_clock_and_voltage_limits *limits;u16 leakage_voltage;struct rv7xx_pl *pl = &ps->performance_levels[index];int ret;
@@ -7202,12 +7203,30 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev, si_pi->mvdd_bootup_value = mvdd; } +/* +* Update maximum allowed clock limits. +* VBIOS can contain conflicting values between: +* - the maximum allowed clocks and voltages on AC or DC +* - the clocks and voltages in power states on AC or DC +*/ if ((rps->class &ATOM_PPLIB_CLASSIFICATION_UI_MASK ) == -ATOM_PPLIB_CLASSIFICATION_UI_PERFORMANCE ) { - adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk = pl->sclk; - adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.mclk = pl->mclk; - adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.vddc = pl->vddc; - adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.vddci = pl->vddci; +ATOM_PPLIB_CLASSIFICATION_UI_PERFORMANCE ) + limits = &adev->pm.dpm.dyn_state.max_clock_voltage_on_ac; +else if ((rps->class &ATOM_PPLIB_CLASSIFICATION_UI_MASK ) == +ATOM_PPLIB_CLASSIFICATION_UI_BATTERY ) + limits = &adev->pm.dpm.dyn_state.max_clock_voltage_on_dc; +else + limits =NULL ; + +if (limits) { +if (pl->sclk > limits->sclk) + limits->sclk = pl->sclk; +if (pl->mclk > limits->mclk) + limits->mclk = pl->mclk; +if (pl->vddc > limits->vddc) + limits->vddc = pl->vddc; +if (pl->vddci > limits->vddci) + limits->vddci = pl->vddci; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 69/595 ACPICA: Fix condition check in acpi_ps_parse_loop()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 8de27e2d83c0d07ae9443c6304575b0609394bfd ]
Fix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent out-of-bounds access.
--- drivers/acpi/acpica/psloop.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/acpi/acpica/psloop.c +4 -1
@@ -426,7 +426,10 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)ACPI_ERROR ((AE_INFO ,"Skipping While/If block" )); -if (*walk_state->aml ==AML_ELSE_OP ) { +if ((walk_state->aml < + parser_state->aml_end) + && (*walk_state->aml == +AML_ELSE_OP )) {ACPI_ERROR ((AE_INFO ,"Skipping Else block" )); walk_state->parser_state.aml =
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 70/595 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 945e87267cfd90937b3c637f87324cbb56998b72 ]
Fix use-after-free issue in acpi_ds_terminate_control_method() by clearing references to method locals and arguments.
--- drivers/acpi/acpica/dsmethod.c | 43 ++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)
drivers/acpi/acpica/dsmethod.c +43 -0
@@ -698,6 +698,8 @@ void acpi_ds_terminate_control_method(union acpi_operand_object *method_desc, struct acpi_walk_state *walk_state) { + u32 i; +struct acpi_namespace_node *ref_node;ACPI_FUNCTION_TRACE_PTR (ds_terminate_control_method, walk_state);
@@ -708,6 +710,47 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc, }if (walk_state) { +/* +* Check if the return value is a ref_of reference to a method local +* or argument. If so, clear the reference to avoid use-after-free +* when the walk state is deleted. +*/ +if (walk_state->return_desc && + (walk_state->return_desc->common.type == +ACPI_TYPE_LOCAL_REFERENCE ) + && (walk_state->return_desc->reference.class == +ACPI_REFCLASS_REFOF )) { + ref_node = walk_state->return_desc->reference.object; +if (ref_node) { + +/* Check against method locals */ +for (i =0 ; i <ACPI_METHOD_NUM_LOCALS ; i++) { +if (ref_node == + &walk_state->local_variables[i]) { +acpi_ut_remove_reference + (walk_state->return_desc); + walk_state->return_desc =NULL ; +break ; + } + } + +/* Check against method arguments if not already cleared */ +if (walk_state->return_desc) { +for (i =0 ; i <ACPI_METHOD_NUM_ARGS ; + i++) { +if (ref_node == + &walk_state->arguments[i]) { +acpi_ut_remove_reference + (walk_state-> + return_desc); + walk_state-> + return_desc =NULL ; +break ; + } + } + } + } + }/* Delete all arguments and locals */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 71/595 ACPICA: add boundary checks in acpi_ps_get_next_field()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit e15aa60de0256d63df2331bf5a4bc4dd287504cd ]
Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access.
--- drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/acpi/acpica/psargs.c +17 -0
@@ -474,6 +474,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_stateASL_CV_CAPTURE_COMMENTS_ONLY (parser_state); aml = parser_state->aml; +if (aml >= parser_state->aml_end) { +return_PTR (NULL ); + } +/* Determine field type */ switch (ACPI_GET8 (parser_state->aml)) {
@@ -522,6 +526,11 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state/* Get the 4-character name */ +if ((parser_state->aml +ACPI_NAMESEG_SIZE ) > + parser_state->aml_end) { +acpi_ps_free_op (field); +return_PTR (NULL ); + }ACPI_MOVE_32_TO_32 (&name, parser_state->aml);acpi_ps_set_name (field, name); parser_state->aml +=ACPI_NAMESEG_SIZE ;
@@ -567,6 +576,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state/* Get the two bytes (Type/Attribute) */ +if ((parser_state->aml +2 ) > parser_state->aml_end) { +acpi_ps_free_op (field); +return_PTR (NULL ); + } access_type =ACPI_GET8 (parser_state->aml); parser_state->aml++; access_attribute =ACPI_GET8 (parser_state->aml);
@@ -578,6 +591,10 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state/* This opcode has a third byte, access_length */ if (opcode ==AML_INT_EXTACCESSFIELD_OP ) { +if (parser_state->aml >= parser_state->aml_end) { +acpi_ps_free_op (field); +return_PTR (NULL ); + } access_length =ACPI_GET8 (parser_state->aml); parser_state->aml++;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 72/595 ACPICA: validate byte_count in acpi_ps_get_next_package_length()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit d49c6ee08365a8596f639da46eb7e71752b0cd42 ]
Validate package length reading in acpi_ps_get_next_package_length().
--- drivers/acpi/acpica/psargs.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/acpi/acpica/psargs.c +17 -0
@@ -48,6 +48,7 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)u32 package_length =0 ;u32 byte_count;u8 byte_zero_mask =0x3F ;/* Default [0:5] */ +u32 remaining;ACPI_FUNCTION_TRACE (ps_get_next_package_length);
@@ -55,7 +56,23 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state)* Byte 0 bits [6:7] contain the number of additional bytes * used to encode the package length, either 0,1,2, or 3 */ + +/* Check if we have at least one byte to read */ + remaining = (u32 )ACPI_PTR_DIFF (parser_state->aml_end, aml); +if (remaining ==0 ) { +return_UINT32 (0 ); + } + byte_count = (aml[0 ] >>6 ); + +/* Validate byte_count and ensure we have enough bytes to read */ +if (byte_count >= remaining) { + +/* Clamp to available bytes and advance to end */ + parser_state->aml = parser_state->aml_end; +return_UINT32 (0 ); + } + parser_state->aml += ((acpi_size )byte_count +1 );/* Get bytes 3, 2, 1 as needed */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 73/595 ACPICA: Prevent adding invalid references
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 6e8c55e13a5e3a9f38921d62924f18ceba3330eb ]
Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object().
--- drivers/acpi/acpica/utcopy.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/acpica/utcopy.c +9 -1
@@ -731,7 +731,15 @@ acpi_ut_copy_simple_object(union acpi_operand_object *source_desc,break ; } -acpi_ut_add_reference (source_desc->reference.object); +/* +* Local/Arg/Debug references do not have a valid Object pointer +* that can be referenced +*/ +if ((source_desc->reference.class !=ACPI_REFCLASS_LOCAL ) && + (source_desc->reference.class !=ACPI_REFCLASS_ARG ) && + (source_desc->reference.class !=ACPI_REFCLASS_DEBUG )) { +acpi_ut_add_reference (source_desc->reference.object); + }break ;case ACPI_TYPE_REGION :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 74/595 ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 0e2021f49e64b3c8a9aa880d0c62a218bfe147ce ]
Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().
--- drivers/acpi/acpica/exoparg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpica/exoparg3.c +1 -1
@@ -152,7 +152,7 @@ acpi_status acpi_ex_opcode_3A_1T_1R(struct acpi_walk_state *walk_state)/* Truncate request if larger than the actual String/Buffer */ - else if ((index + length) > operand[0]->string.length) { + else if ((index + length) > operand[0]->string.length || (index + length) < index) { /* Check for overflow */ length = (acpi_size )operand[0 ]->string.length - (acpi_size )index;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 75/595 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 27d27e75ecb752a0b4da848c440bb3a88396ecba ]
Improve argument parsing in acpi_ps_get_next_simple_arg() to handle remaining AML data safely.
--- drivers/acpi/acpica/psargs.c | 78 +++++++++++++++++++++++++++++++----- 1 file changed, 68 insertions(+), 10 deletions(-)
drivers/acpi/acpica/psargs.c +68 -10
@@ -384,6 +384,8 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,u32 length;u16 opcode;u8 *aml = parser_state->aml; +u32 remaining = (u32 )ACPI_PTR_DIFF (parser_state->aml_end, aml); +u64 partial_value;ACPI_FUNCTION_TRACE_U32 (ps_get_next_simple_arg, arg_type);
@@ -393,8 +395,13 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,/* Get 1 byte from the AML stream */ opcode =AML_BYTE_OP ; - arg->common.value.integer = (u64) *aml; - length =1 ; +if (remaining >=1 ) { + arg->common.value.integer = (u64)*aml; + length =1 ; + }else { + arg->common.value.integer =0 ; + length =0 ; + }break ;case ARGP_WORDDATA :
@@ -402,8 +409,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,/* Get 2 bytes from the AML stream */ opcode =AML_WORD_OP ; -ACPI_MOVE_16_TO_64 (&arg->common.value.integer, aml); - length =2 ; +if (remaining >=2 ) { +ACPI_MOVE_16_TO_64 (&arg->common.value.integer, aml); + length =2 ; + }else { + arg->common.value.integer =0 ; + length =0 ; +if (remaining >0 ) { + partial_value =0 ; +memcpy (&partial_value, aml, remaining); + arg->common.value.integer = partial_value; + length = remaining; + } + }break ;case ARGP_DWORDDATA :
@@ -411,8 +429,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,/* Get 4 bytes from the AML stream */ opcode =AML_DWORD_OP ; -ACPI_MOVE_32_TO_64 (&arg->common.value.integer, aml); - length =4 ; +if (remaining >=4 ) { +ACPI_MOVE_32_TO_64 (&arg->common.value.integer, aml); + length =4 ; + }else { + arg->common.value.integer =0 ; + length =0 ; +if (remaining >0 ) { + partial_value =0 ; +memcpy (&partial_value, aml, remaining); + arg->common.value.integer = partial_value; + length = remaining; + } + }break ;case ARGP_QWORDDATA :
@@ -420,8 +449,19 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,/* Get 8 bytes from the AML stream */ opcode =AML_QWORD_OP ; -ACPI_MOVE_64_TO_64 (&arg->common.value.integer, aml); - length =8 ; +if (remaining >=8 ) { +ACPI_MOVE_64_TO_64 (&arg->common.value.integer, aml); + length =8 ; + }else { + arg->common.value.integer =0 ; + length =0 ; +if (remaining >0 ) { + partial_value =0 ; +memcpy (&partial_value, aml, remaining); + arg->common.value.integer = partial_value; + length = remaining; + } + }break ;case ARGP_CHARLIST :
@@ -434,10 +474,28 @@ acpi_ps_get_next_simple_arg(struct acpi_parse_state *parser_state,/* Find the null terminator */ length =0 ; -while (aml[length]) { +while ((length < remaining) && aml[length]) { + length++; + } +if (length < remaining) { + +/* Account for the terminating null */ length++; + }else { +/* +* No terminator found - add null at buffer boundary +* and report a warning +*/ +ACPI_WARNING ((AE_INFO , +"Invalid AML string: no null terminator, truncating at offset %u" , + (u32)(aml - parser_state->aml))); + +/* Add null terminator at the boundary */ +if (remaining >0 ) { + aml[remaining -1 ] =0 ; + length = remaining; + } } - length++;break ;case ARGP_NAME :
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 76/595 ACPICA: validate handler object type in two places
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit c5296da2d516707862f8a2dbb4b515f777e5294f ]
ACPICA: validate handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler().
--- drivers/acpi/acpica/evhandler.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/acpi/acpica/evhandler.c +11 -0
@@ -130,6 +130,14 @@ acpi_ev_has_default_handler(struct acpi_namespace_node *node,/* Walk the linked list of handlers for this object */ while (handler_obj) { + +/* Validate handler object type before accessing fields */ + +if (handler_obj->common.type != +ACPI_TYPE_LOCAL_ADDRESS_HANDLER ) { +break ; + } +if (handler_obj->address_space.space_id == space_id) {if (handler_obj->address_space.handler_flags &ACPI_ADDR_HANDLER_DEFAULT_INSTALLED ) {
@@ -292,6 +300,9 @@ union acpi_operand_object *acpi_ev_find_region_handler(acpi_adr_space_type/* Walk the handler list for this device */ while (handler_obj) { +if (handler_obj->common.type !=ACPI_TYPE_LOCAL_ADDRESS_HANDLER ) { +break ; + }/* Same space_id indicates a handler is installed */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 77/595 ACPICA: Add package limit checks in parser functions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit d27d48a528e437aed690f977e69a6fe73fe82ab5 ]
Add package limit checks in parser functions to prevent out-of-bounds access.
--- drivers/acpi/acpica/nsxfname.c | 4 ++++ drivers/acpi/acpica/psargs.c | 4 ++++ drivers/acpi/acpica/psloop.c | 25 +++++++++++++++++++++++++ drivers/acpi/acpica/psparse.c | 8 ++++++++ 4 files changed, 41 insertions(+)
drivers/acpi/acpica/nsxfname.c +4 -0
@@ -512,6 +512,10 @@ acpi_status acpi_install_method(u8 *buffer) parser_state.aml +=acpi_ps_get_opcode_size (opcode); parser_state.pkg_end =acpi_ps_get_next_package_end (&parser_state); +if ((parser_state.pkg_end > parser_state.aml_end) || + (parser_state.pkg_end < parser_state.aml)) { +return (AE_AML_PACKAGE_LIMIT ); + } path =acpi_ps_get_next_namestring (&parser_state); method_flags = *parser_state.aml++;
drivers/acpi/acpica/psargs.c +4 -0
@@ -867,6 +867,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, parser_state->pkg_end =acpi_ps_get_next_package_end (parser_state); +if ((parser_state->pkg_end > parser_state->aml_end) + || (parser_state->pkg_end < parser_state->aml)) { +return_ACPI_STATUS (AE_AML_PACKAGE_LIMIT ); + }break ;case ARGP_FIELDLIST :
drivers/acpi/acpica/psloop.c +25 -0
@@ -362,6 +362,13 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) walk_state->parser_state.aml =acpi_ps_get_next_package_end (&walk_state->parser_state); +if ((walk_state->parser_state.aml > + walk_state->parser_state.aml_end) + || (walk_state->parser_state.aml < + walk_state->aml)) { +return_ACPI_STATUS + (AE_AML_PACKAGE_LIMIT ); + } walk_state->aml = walk_state->parser_state.aml; }
@@ -422,6 +429,14 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) parser_state->aml =acpi_ps_get_next_package_end (parser_state); +if ((parser_state->aml > + parser_state->aml_end) + || (parser_state->aml < + walk_state->control_state-> + control.aml_predicate_start)) { +return_ACPI_STATUS + (AE_AML_PACKAGE_LIMIT ); + } walk_state->aml = parser_state->aml; ACPI_ERROR((AE_INFO,
@@ -437,6 +452,16 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) walk_state->parser_state.aml =acpi_ps_get_next_package_end (parser_state); +if ((walk_state->parser_state. + aml > + walk_state->parser_state. + aml_end) + || (walk_state-> + parser_state.aml < + walk_state->aml)) { +return_ACPI_STATUS + (AE_AML_PACKAGE_LIMIT ); + } walk_state->aml = parser_state->aml; }
drivers/acpi/acpica/psparse.c +8 -0
@@ -300,6 +300,7 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state, {struct acpi_parse_state *parser_state = &walk_state->parser_state;acpi_status status =AE_CTRL_PENDING ; +u8 *aml;ACPI_FUNCTION_TRACE_PTR (ps_next_parse_state, op);
@@ -344,7 +345,14 @@ acpi_ps_next_parse_state(struct acpi_walk_state *walk_state,* Predicate of an IF was true, and we are at the matching ELSE. * Just close out this package */ + aml = parser_state->aml; + parser_state->aml =acpi_ps_get_next_package_end (parser_state); +if ((parser_state->aml > parser_state->aml_end) || + (parser_state->aml < aml)) { + status =AE_AML_PACKAGE_LIMIT ; +break ; + } status =AE_CTRL_PENDING ;break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 78/595 ACPICA: Add validation for node in acpi_ns_build_normalized_path()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit 96b2b616870e46e2bc04efec03879683a0036e66 ]
Add validation for node in acpi_ns_build_normalized_path() to prevent use-after-free vulnerabilities.
--- drivers/acpi/acpica/nsnames.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/acpica/nsnames.c +6 -0
@@ -222,6 +222,12 @@ acpi_ns_build_normalized_path(struct acpi_namespace_node *node, goto build_trailing_null; } +/* Validate the Node to avoid use-after-free vulnerabilities */ + +if (ACPI_GET_DESCRIPTOR_TYPE (node) !=ACPI_DESC_TYPE_NAMED ) { + goto build_trailing_null; + } + next_node = node;while (next_node && next_node != acpi_gbl_root_node) {if (next_node != node) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 79/595 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc ]
acpi_ns_custom_package() unconditionally dereferences the first element of the package to read the _BIX version number, without checking for NULL:
if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)
When firmware returns a _BIX package whose first element is an unresolvable reference, ACPICA evaluates that entry to NULL. acpi_ns_remove_null_elements() does not strip NULL entries for ACPI_PTYPE_CUSTOM packages (fixed-position format would break if elements were shifted), so acpi_ns_custom_package() sees the NULL and causes a crash.
Add a NULL check for the first element (version field) before dereferencing it. The caller then receives AE_AML_OPERAND_TYPE instead of crashing.
--- drivers/acpi/acpica/nsprepkg.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/acpica/nsprepkg.c +7 -0
@@ -631,6 +631,13 @@ acpi_ns_custom_package(struct acpi_evaluate_info *info,/* Get version number, must be Integer */ +if (!(*elements)) { +ACPI_WARN_PREDEFINED ((AE_INFO , info->full_pathname, + info->node_flags, +"Return Package has a NULL version element" )); +return_ACPI_STATUS (AE_AML_OPERAND_TYPE ); + } +if ((*elements)->common.type !=ACPI_TYPE_INTEGER ) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, info->node_flags,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 80/595 ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d ]
Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows.
--- drivers/acpi/acpica/utresrc.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/acpi/acpica/utresrc.c +30 -0
@@ -161,6 +161,28 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,/* Walk the byte list, abort on any invalid descriptor type or length */ while (aml < end_aml) { +/* +* Validate that the remaining buffer space can hold enough +* bytes to safely access fields during validation. +* For large resource descriptors (bit 7 set), we need enough +* bytes to access the Type field in serial_bus resources. +* Small resource descriptors only need sizeof(struct aml_resource_end_tag). +*/ +if ((acpi_size)(end_aml - aml) < +sizeof (struct aml_resource_end_tag )) { +return_ACPI_STATUS (AE_AML_BUFFER_LENGTH ); + } + +/* +* For large resource descriptors, ensure enough space for +* the header plus serial_bus Type field access. +*/ +if ((ACPI_GET8 (aml) &ACPI_RESOURCE_NAME_LARGE ) && + ((acpi_size)(end_aml - aml) < + ACPI_OFFSET(struct aml_resource_common_serialbus, + type) +1 )) { +return_ACPI_STATUS (AE_AML_BUFFER_LENGTH ); + }/* Validate the Resource Type and Resource Length */
@@ -178,6 +200,14 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state, length =acpi_ut_get_descriptor_length (aml); +/* +* Validate that the descriptor length doesn't exceed the +* remaining buffer size to prevent reading beyond the end. +*/ +if (length > (acpi_size)(end_aml - aml)) { +return_ACPI_STATUS (AE_AML_BUFFER_LENGTH ); + } +/* Invoke the user function */ if (user_function) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 81/595 ACPICA: add boundary checks in two places
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ikaros <[email protected]>
[ Upstream commit bdc35754012906dbf094be104b103ca3adfef6f7 ]
Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access.
--- drivers/acpi/acpica/psargs.c | 18 +++++++++++++++++- drivers/acpi/acpica/psparse.c | 6 ++++++ 2 files changed, 23 insertions(+), 1 deletion(-)
drivers/acpi/acpica/psargs.c +17 -1
@@ -148,10 +148,16 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)/* Point past any namestring prefix characters (backslash or carat) */ -while (ACPI_IS_ROOT_PREFIX (*end) ||ACPI_IS_PARENT_PREFIX (*end)) { +while (end < parser_state->aml_end && + (ACPI_IS_ROOT_PREFIX (*end) ||ACPI_IS_PARENT_PREFIX (*end))) { end++; } +if (end >= parser_state->aml_end) { + parser_state->aml = parser_state->aml_end; +return_PTR (NULL ); + } +/* Decode the path prefix character */ switch (*end) {
@@ -176,6 +182,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)/* Multiple name segments, 4 chars each, count in next byte */ +if ((end +1 ) >= parser_state->aml_end) { + parser_state->aml = parser_state->aml_end; +return_PTR (NULL ); + } + end +=2 + (*(end +1 ) *ACPI_NAMESEG_SIZE );break ;
@@ -187,6 +198,11 @@ char *acpi_ps_get_next_namestring(struct acpi_parse_state *parser_state)break ; } +if (end > parser_state->aml_end) { + parser_state->aml = parser_state->aml_end; +return_PTR (NULL ); + } + parser_state->aml = end;return_PTR ((char *)start); }
drivers/acpi/acpica/psparse.c +6 -0
@@ -70,6 +70,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)u16 opcode; aml = parser_state->aml; +if (aml >= parser_state->aml_end) { +return (0xFFFF ); + } opcode = (u16 )ACPI_GET8 (aml);if (opcode ==AML_EXTENDED_PREFIX ) {
@@ -77,6 +80,9 @@ u16 acpi_ps_peek_opcode(struct acpi_parse_state * parser_state)/* Extended opcode, get the second opcode byte */ aml++; +if (aml >= parser_state->aml_end) { +return (0xFFFF ); + } opcode = (u16) ((opcode <<8 ) |ACPI_GET8 (aml)); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 82/595 hfs: rework hfsplus_readdir() logic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit 7fde7e806657fbe0d33f489521b488eed94f9b39 ]
The xfstests' test-case generic/637 fails with error:
FSTYP -- hfs
PLATFORM -- Linux/x86_64 kvm-xfstests 6.15.0-rc4-xfstests-g00b827f0cffa #1 SMP PREEMPT_DYNAMIC Fri May 25 MKFS_OPTIONS -- /dev/vdcMOUNT_OPTIONS -- /dev/vdc /vdc
QA output created by 637
entries 7 and 8 have duplicate d_off 8
Found unlinked files in open dir (see xfstests-dev/results//generic/637.full for details)
Likewise HFS+, currently, HFS has very complicated and fragile logic of rd->file->f_pos correction in hfs_delete_cat(). This patch removes this logic and it stores the current pos into hfs_readdir_data. Finally, if rd->pos == ctx->pos then hfs_readdir() tries to find the position in b-tree's node by means of hfs_cat_key. This position is used to re-start the folder's content traversal.
sudo ./check generic/637
FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.1.0-rc1+ #55 SMP PREEMPT_DYNAMIC Tue May 19 15:18:02 PDT 2026 MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/637 32s ... 31s
Ran: generic/637
Passed all 1 tests
--- fs/hfs/catalog.c | 9 --------- fs/hfs/dir.c | 28 +++++++++++----------------- fs/hfs/hfs.h | 3 +-- fs/hfs/hfs_fs.h | 2 -- fs/hfs/inode.c | 4 ---- 5 files changed, 12 insertions(+), 34 deletions(-)
fs/hfs/catalog.c +0 -9
@@ -222,7 +222,6 @@ int hfs_cat_delete(u32 cnid, struct inode *dir, const struct qstr *str) {struct super_block *sb;struct hfs_find_data fd; -struct hfs_readdir_data *rd;int res, type;hfs_dbg (CAT_MOD ,"delete_cat: %s,%u\n" , str ? str->name :NULL , cnid);
@@ -248,14 +247,6 @@ int hfs_cat_delete(u32 cnid, struct inode *dir, const struct qstr *str) } } -/* we only need to take spinlock for exclusion with ->release() */ -spin_lock (&HFS_I (dir)->open_dir_lock); -list_for_each_entry (rd, &HFS_I (dir)->open_dir_list, list) { -if (fd.tree->keycmp (fd.search_key, (void *)&rd->key) <0 ) - rd->file->f_pos--; - } -spin_unlock (&HFS_I (dir)->open_dir_lock); - res =hfs_brec_remove (&fd);if (res) goto out;
fs/hfs/dir.c +11 -17
@@ -97,7 +97,15 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx) }if (ctx->pos >= inode->i_size) goto out; - err =hfs_brec_goto (&fd, ctx->pos -1 ); + rd = file->private_data; +if (rd && rd->pos == ctx->pos) { +memcpy (fd.search_key, &rd->key,sizeof (struct hfs_cat_key )); + err =hfs_brec_find (&fd); +if (err == -ENOENT ) + err =hfs_brec_goto (&fd,1 ); + }else { + err =hfs_brec_goto (&fd, ctx->pos -1 ); + }if (err) goto out;
@@ -146,7 +154,6 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)if (err) goto out; } - rd = file->private_data;if (!rd) { rd =kmalloc (sizeof (struct hfs_readdir_data ),GFP_KERNEL );if (!rd) {
@@ -154,15 +161,8 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx) goto out; } file->private_data = rd; - rd->file = file; -spin_lock (&HFS_I (inode)->open_dir_lock); -list_add (&rd->list, &HFS_I (inode)->open_dir_list); -spin_unlock (&HFS_I (inode)->open_dir_lock); } -/* -* Can be done after the list insertion; exclusion with -* hfs_delete_cat() is provided by directory lock. -*/ + rd->pos = ctx->pos;memcpy (&rd->key, &fd.key->cat,sizeof (struct hfs_cat_key )); out:hfs_find_exit (&fd);
@@ -171,13 +171,7 @@ static int hfs_readdir(struct file *file, struct dir_context *ctx)static int hfs_dir_release (struct inode *inode,struct file *file) { -struct hfs_readdir_data *rd = file->private_data; -if (rd) { -spin_lock (&HFS_I (inode)->open_dir_lock); -list_del (&rd->list); -spin_unlock (&HFS_I (inode)->open_dir_lock); -kfree (rd); - } +kfree (file->private_data);return 0 ; }
fs/hfs/hfs.h +1 -2
@@ -281,8 +281,7 @@ struct hfs_mdb {/*======== Data structures kept in memory ========*/ struct hfs_readdir_data { -struct list_head list; -struct file *file; +loff_t pos;struct hfs_cat_key key; };
fs/hfs/hfs_fs.h +0 -2
@@ -68,8 +68,6 @@ struct hfs_inode_info {struct hfs_cat_key cat_key; -struct list_head open_dir_list; -spinlock_t open_dir_lock;struct inode *rsrc_inode;struct mutex extents_lock;
fs/hfs/inode.c +0 -4
@@ -188,8 +188,6 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_treturn NULL ;mutex_init (&HFS_I (inode)->extents_lock); -INIT_LIST_HEAD (&HFS_I (inode)->open_dir_list); -spin_lock_init (&HFS_I (inode)->open_dir_lock);hfs_cat_build_key (sb, (btree_key *)&HFS_I (inode)->cat_key, dir->i_ino, name); inode->i_ino =HFS_SB (sb)->next_id++; inode->i_mode = mode;
@@ -323,8 +321,6 @@ static int hfs_read_inode(struct inode *inode, void *data)HFS_I (inode)->flags =0 ;HFS_I (inode)->rsrc_inode =NULL ;mutex_init (&HFS_I (inode)->extents_lock); -INIT_LIST_HEAD (&HFS_I (inode)->open_dir_list); -spin_lock_init (&HFS_I (inode)->open_dir_lock);/* Initialize the inode */ inode->i_uid = hsb->s_uid;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 83/595 scripts: modpost: detect and report truncated buf_printf() output
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <[email protected]>
[ Upstream commit d7231d8cb262b1e350c00271bf53d54414b4f3b1 ]
buf_printf() uses a fixed-size stack buffer. vsnprintf() returns the number of bytes that *would* have been written to that buffer, which can be larger than the size of said buffer if the formatted string is too long.
The problem is that whenever this happens buf_printf() currently passes this length, unchecked, to buf_write(), which silently reads past the stack buffer and copies invalid data into the output buffer.
Fix this by detecting vsnprintf() failures and truncations before appending to the output buffer, and report a fatal error instead of producing corrupt symbol names.
--- scripts/mod/modpost.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
scripts/mod/modpost.c +10 -1
@@ -2146,8 +2146,17 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,va_start (ap, fmt); len =vsnprintf (tmp,SZ , fmt, ap); -buf_write (buf, tmp, len);va_end (ap); + +if (len <0 ) { +perror ("vsnprintf failed" ); +exit (1 ); + } +if (len >=SZ ) +fatal ("buf_printf output truncated for string %s: %d bytes needed, %d available\n" , + tmp, len +1 ,SZ ); + +buf_write (buf, tmp, len); }void buf_write (struct buffer *buf,const char *s,int len)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 84/595 ASoC: Intel: catpt: Complete coredump handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit 7e5d59f407bc39d43b350cc45f7880647429eb5d ]
An exception may occur during the firmware booting procedure. In such case the firmware sends COREDUMP_REQUESTS and expects the driver to dump relevant information and finish with the COREDUMP_RELEASE write.
To distinguish such situation from generic timeout, always signal fw_ready completion when a coredump request is received and translate it to -EREMOTEIO in catpt_boot_firmware().
The "FW READY" print makes the success clearly visible even when the event-traces are not enabled.
--- sound/soc/intel/catpt/ipc.c | 8 ++++++++ sound/soc/intel/catpt/loader.c | 3 +++ sound/soc/intel/catpt/registers.h | 12 ++++++++++++ 3 files changed, 23 insertions(+)
sound/soc/intel/catpt/ipc.c +8 -0
@@ -205,6 +205,7 @@ static void catpt_dsp_process_response(struct catpt_dev *cdev, u32 header)memcpy_fromio (&config, cdev->lpe_ba + off,sizeof (config));trace_catpt_ipc_payload ((u8 *)&config,sizeof (config)); +dev_dbg (cdev->dev,"FW READY 0x%08x\n" , header);catpt_ipc_arm (ipc, &config);complete (&cdev->fw_ready);return ;
@@ -215,6 +216,13 @@ static void catpt_dsp_process_response(struct catpt_dev *cdev, u32 header)dev_err (cdev->dev,"ADSP device coredump received\n" ); ipc->ready = false;catpt_coredump (cdev); + +if (catpt_readl_dram (cdev,COREDUMP ) ==CATPT_COREDUMP_REQUEST ) { +dev_dbg (cdev->dev,"releasing firmware from the coredump state\n" ); +catpt_writel_dram (cdev,COREDUMP ,CATPT_COREDUMP_RELEASE ); + } + +complete (&cdev->fw_ready);/* TODO: attempt recovery */ break ;
sound/soc/intel/catpt/loader.c +3 -0
@@ -626,6 +626,9 @@ int catpt_boot_firmware(struct catpt_dev *cdev, bool restore)if (!ret) {dev_err (cdev->dev,"firmware ready timeout\n" );return -ETIMEDOUT ; +/* Wake up does not mean FW is ready, an exception could occur. */ + }else if (!cdev->ipc.ready) { +return -EREMOTEIO ; }/* update sram pg & clock once done booting */
sound/soc/intel/catpt/registers.h +12 -0
@@ -124,6 +124,11 @@#define CATPT_SSCR2_DEFAULT 0x0#define CATPT_SSPSP2_DEFAULT 0x0 +/* Coredump register and its states */ +#define CATPT_DRAM_COREDUMP 0x1F4 +#define CATPT_COREDUMP_REQUEST UINT_MAX +#define CATPT_COREDUMP_RELEASE 0 +/* Physically the same block, access address differs between host and dsp */ #define CATPT_DSP_DRAM_OFFSET 0x400000#define catpt_to_host_offset (offset) ((offset) & ~(CATPT_DSP_DRAM_OFFSET))
@@ -137,6 +142,8 @@/* registry I/O helpers */ +#define catpt_dram_addr (cdev) \ + ((cdev)->lpe_ba + (cdev)->spec->host_dram_offset)#define catpt_shim_addr (cdev) \ ((cdev)->lpe_ba + (cdev)->spec->host_shim_offset)#define catpt_dma_addr (cdev, dma) \
@@ -151,6 +158,11 @@#define catpt_writel_ssp (cdev, ssp, reg, val) \ writel(val, catpt_ssp_addr(cdev, ssp) + (reg)) +#define catpt_readl_dram (cdev, reg) \ + readl(catpt_dram_addr(cdev) + CATPT_DRAM_##reg) +#define catpt_writel_dram (cdev, reg, val) \ + writel(val, catpt_dram_addr(cdev) + CATPT_DRAM_##reg) +#define catpt_readl_shim (cdev, reg) \ readl(catpt_shim_addr(cdev) + CATPT_SHIM_##reg)#define catpt_writel_shim (cdev, reg, val) \
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 85/595 soundwire: only handle alert events when the peripheral is attached
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
[ Upstream commit 38cd651ebce7065a81c7e950d9e2ea1572304605 ]
It doesn't make sense to handle an alert event when the peripheral is not attached. The slave->status could be SDW_SLAVE_ATTACHED or SDW_SLAVE_ALERT when it is attached on the bus.
--- drivers/soundwire/bus.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/soundwire/bus.c +4 -0
@@ -1697,6 +1697,10 @@ int sdw_handle_slave_status(struct sdw_bus *bus,break ;case SDW_SLAVE_ALERT : +if (slave->status !=SDW_SLAVE_ATTACHED && + slave->status !=SDW_SLAVE_ALERT ) +continue ; + ret =sdw_handle_slave_alerts (slave);if (ret) dev_err(bus->dev,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 86/595 mmc: davinci: fix mmc_add_host order in probe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <[email protected]>
[ Upstream commit d04e0151d316edbdb4f0397a9b92a1936e4a1421 ]
mmc_add_host() makes the host visible to the MMC core. Register the interrupt handlers and advertise MMC_CAP_SDIO_IRQ before that, so the core cannot start using the host before IRQ handling is set up.
--- drivers/mmc/host/davinci_mmc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/mmc/host/davinci_mmc.c +5 -7
@@ -1305,14 +1305,10 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) goto cpu_freq_fail; } - ret =mmc_add_host (mmc); -if (ret <0 ) - goto mmc_add_host_fail; - ret =devm_request_irq (&pdev->dev, irq, mmc_davinci_irq,0 ,mmc_hostname (mmc), host);if (ret) - goto request_irq_fail; + goto mmc_add_host_fail;if (host->sdio_irq >=0 ) { ret = devm_request_irq(&pdev->dev, host->sdio_irq,
@@ -1322,6 +1318,10 @@ static int davinci_mmcsd_probe(struct platform_device *pdev) mmc->caps |=MMC_CAP_SDIO_IRQ ; } + ret =mmc_add_host (mmc); +if (ret <0 ) + goto mmc_add_host_fail; +rename_region (mem,mmc_hostname (mmc)); dev_info(mmc_dev(host->mmc), "Using %s, %d-bit mode\n",
@@ -1330,8 +1330,6 @@ static int davinci_mmcsd_probe(struct platform_device *pdev)return 0 ; -request_irq_fail: -mmc_remove_host (mmc); mmc_add_host_fail:mmc_davinci_cpufreq_deregister (host); cpu_freq_fail:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 87/595 perf/ftrace: Fix WARNING in __unregister_ftrace_function
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 9581123304b23049437324038698af9fb56ee663 ]
perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without checking whether the ftrace_ops was ever successfully registered. This triggers a WARN_ON in __unregister_ftrace_function() when the ops doesn't have FTRACE_OPS_FL_ENABLED set.
This can happen during perf_event_alloc() error cleanup when perf_trace_destroy() is called via __free_event() on an event whose ftrace_ops registration failed or was already torn down by perf_try_init_event()'s err_destroy path.
The call path is:
perf_event_alloc() error cleanup
-> __free_event()
-> event->destroy() [tp_perf_event_destroy]
-> perf_trace_destroy()
-> perf_trace_event_close()
-> TRACE_REG_PERF_CLOSE
-> perf_ftrace_function_unregister()
-> unregister_ftrace_function()
-> __unregister_ftrace_function()
-> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to unregister. If the ops is not enabled, just free the filter and return success.
--- kernel/trace/trace_event_perf.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
kernel/trace/trace_event_perf.c +11 -1
@@ -494,7 +494,17 @@ static int perf_ftrace_function_register(struct perf_event *event)static int perf_ftrace_function_unregister (struct perf_event *event) {struct ftrace_ops *ops = &event->ftrace_ops; -int ret =unregister_ftrace_function (ops); +int ret =0 ; + +/* +* Perf will call this unconditionally even if the ops is not +* enabled. The unregister_ftrace_function() will warn if called +* when not enabled. Just bypass the unregistering if ops isn't +* enabled here. +*/ +if (ops->flags &FTRACE_OPS_FL_ENABLED ) + ret =unregister_ftrace_function (ops); +ftrace_free_filter (ops);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 88/595 iio: accel: mma8452: switch to non-devm request_threaded_irq()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <[email protected]>
[ Upstream commit 0a6726ec20cd4c0101f2de0ca485a11676224dea ]
Avoid using devm_request_threaded_irq() as the driver requires explicit error-handling path(s). Using devm_* API together with goto-based unwinding breaks the expected LIFO resource release model.
Add explicit IRQ cleanup in the driver teardown paths to follow kernel resource management conventions.
--- drivers/iio/accel/mma8452.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/iio/accel/mma8452.c +12 -7
@@ -1676,18 +1676,16 @@ static int mma8452_probe(struct i2c_client *client, goto trigger_cleanup;if (client->irq) { - ret =devm_request_threaded_irq (&client->dev, - client->irq, -NULL , mma8452_interrupt, -IRQF_TRIGGER_LOW |IRQF_ONESHOT , - client->name, indio_dev); + ret =request_threaded_irq (client->irq,NULL , mma8452_interrupt, +IRQF_TRIGGER_LOW |IRQF_ONESHOT , + client->name, indio_dev);if (ret) goto buffer_cleanup; } ret =pm_runtime_set_active (&client->dev);if (ret <0 ) - goto buffer_cleanup; + goto free_irq;pm_runtime_enable (&client->dev); pm_runtime_set_autosuspend_delay(&client->dev,
@@ -1696,7 +1694,7 @@ static int mma8452_probe(struct i2c_client *client, ret =iio_device_register (indio_dev);if (ret <0 ) - goto buffer_cleanup; + goto free_irq; ret =mma8452_set_freefall_mode (data, false);if (ret <0 )
@@ -1707,6 +1705,10 @@ static int mma8452_probe(struct i2c_client *client, unregister_device:iio_device_unregister (indio_dev); +free_irq: +if (client->irq) +free_irq (client->irq, indio_dev); + buffer_cleanup:iio_triggered_buffer_cleanup (indio_dev);
@@ -1733,6 +1735,9 @@ static int mma8452_remove(struct i2c_client *client)pm_runtime_set_suspended (&client->dev);pm_runtime_put_noidle (&client->dev); +if (client->irq) +free_irq (client->irq, indio_dev); +iio_triggered_buffer_cleanup (indio_dev);mma8452_trigger_cleanup (indio_dev);mma8452_standby (iio_priv (indio_dev));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 89/595 net: ibm: emac: Reserve VLAN header in MJS limit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 0906c117f81c2ae6e6dbfa82719f79c75e1c9325 ]
The IBM EMAC programs its Maximum Jumbo Size (MJS) drop threshold from ndev->mtu directly. The hardware sizes the threshold against the L2 frame minus the ethernet header, but does not discount the 802.1Q tag, so a frame carrying a VLAN tag and a full 1500-byte payload exceeds MJS by exactly 4 bytes and is dropped.
This is normally hidden because JPSM (and therefore the MJS check) only engages when the MTU is raised above ETH_DATA_LEN. With the qca8k DSA tagger the conduit MTU is bumped by QCA_HDR_LEN to 1502 during dsa_conduit_setup(), which is enough to enable JPSM and expose the off-by-VLAN-tag in the limit.
Pad MJS by VLAN_HLEN so a VLAN-tagged full-MTU frame passes.
Reported on Meraki MX60 (qca8k switch): tagged VLAN traffic drops at 1500-byte payload, while 1496 bytes works and untagged 1500 bytes works.
--- drivers/net/ethernet/ibm/emac/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ibm/emac/core.c +2 -1
@@ -30,6 +30,7 @@#include <linux/skbuff.h> #include <linux/crc32.h> #include <linux/ethtool.h> +#include <linux/if_vlan.h> #include <linux/mii.h> #include <linux/bitops.h> #include <linux/workqueue.h>
@@ -464,7 +465,7 @@ static inline u32 emac_iff2rmr(struct net_device *ndev)if (emac_has_feature (dev,EMAC_APM821XX_REQ_JUMBO_FRAME_SIZE )) { r &= ~EMAC4_RMR_MJS_MASK ; - r |=EMAC4_RMR_MJS (ndev->mtu); + r |=EMAC4_RMR_MJS (ndev->mtu +VLAN_HLEN ); }return r;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 90/595 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit eb7107264da8545ba7381a76818bae553e1fd1e4 ]
Revert changes done in commit 489db5d94150 ("ASoC: pcm3168a:
Don't disable pcm3168a when CONFIG_PM defined") and add pm_runtime_status_suspended() check.
The suspended-check addresses regulator's "unbalanced disables" warning during driver removal even when CONFIG_PM is enabled.
--- sound/soc/codecs/pcm3168a.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
sound/soc/codecs/pcm3168a.c +7 -13
@@ -813,15 +813,6 @@ int pcm3168a_probe(struct device *dev, struct regmap *regmap) }EXPORT_SYMBOL_GPL (pcm3168a_probe); -static void pcm3168a_disable (struct device *dev) -{ -struct pcm3168a_priv *pcm3168a =dev_get_drvdata (dev); - -regulator_bulk_disable (ARRAY_SIZE (pcm3168a->supplies), - pcm3168a->supplies); -clk_disable_unprepare (pcm3168a->scki); -} -void pcm3168a_remove (struct device *dev) {struct pcm3168a_priv *pcm3168a =dev_get_drvdata (dev);
@@ -833,10 +824,12 @@ void pcm3168a_remove(struct device *dev)* The asserted level of GPIO_ACTIVE_LOW is LOW. */ gpiod_set_value_cansleep (pcm3168a->gpio_rst,1 ); +pm_runtime_disable (dev); -#ifndef CONFIG_PM -pcm3168a_disable (dev); -#endif +if (!pm_runtime_status_suspended (dev)) { +regulator_bulk_disable (ARRAY_SIZE (pcm3168a->supplies), pcm3168a->supplies); +clk_disable_unprepare (pcm3168a->scki); + } }EXPORT_SYMBOL_GPL (pcm3168a_remove);
@@ -892,7 +885,8 @@ static int pcm3168a_rt_suspend(struct device *dev)regcache_cache_only (pcm3168a->regmap, true); -pcm3168a_disable (dev); +regulator_bulk_disable (ARRAY_SIZE (pcm3168a->supplies), pcm3168a->supplies); +clk_disable_unprepare (pcm3168a->scki);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 91/595 ata: ahci: fail probe if BAR too small for claimed ports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: liyouhong <[email protected]>
[ Upstream commit c4086c6e1af757e1ff26fa2d2926b3ec0195de79 ]
When an AHCI controller is disabled in BIOS, its HOST_CAP register may contain a bogus value, e.g. 0xFFFFFFFF.
Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field, a value of 0x1f means 32 ports. If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.
Add validation in ahci_init_one() to check that the BAR size is sufficient for the number of ports claimed in CAP.NP. The check calculates the required MMIO size as:
required_size = 0x100 (global registers) + max_ports * 0x80
If required_size exceeds the actual BAR size, the probe fails with -ENODEV, preventing the panic and providing a clear error message.
--- drivers/ata/ahci.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/ata/ahci.c +22 -0
@@ -1768,6 +1768,24 @@ static ssize_t remapped_nvme_show(struct device *dev,static DEVICE_ATTR_RO (remapped_nvme); +static int ahci_validate_bar_size (struct pci_dev *pdev,int bar, +struct ahci_host_priv *hpriv) +{ +u32 cap =readl (hpriv->mmio +HOST_CAP ); +unsigned int max_ports =ahci_nr_ports (cap); +u32 last_port_end =0x100 + (max_ports *0x80 ); +resource_size_t bar_size =pci_resource_len (pdev, bar); + +if (last_port_end > bar_size) { +dev_warn (&pdev->dev, +"BAR%d too small for %u ports (last port ends at %#x, BAR %pa)\n" , + bar, max_ports, last_port_end, &bar_size); +return -ENODEV ; + } + +return 0 ; +} +static int ahci_init_one (struct pci_dev *pdev,const struct pci_device_id *ent) {unsigned int board_id = ent->driver_data;
@@ -1872,6 +1890,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) hpriv->mmio =pcim_iomap_table (pdev)[ahci_pci_bar]; + rc =ahci_validate_bar_size (pdev, ahci_pci_bar, hpriv); +if (rc) +return rc; +/* detect remapped nvme devices */ ahci_remap_check (pdev, ahci_pci_bar, hpriv);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 92/595 net: qrtr: fix node refcount leak on ctrl packet alloc failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <[email protected]>
[ Upstream commit 3b09ff54114566864eea59020f6b69c5bb325b9d ]
qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a reference on the returned node. If the subsequent call to qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the function returns -ENOMEM without calling qrtr_node_release() to release the node reference.
Add qrtr_node_release(node) before returning on the allocation failure path to properly release the reference.
--- net/qrtr/af_qrtr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/qrtr/af_qrtr.c +3 -1
@@ -1003,8 +1003,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)return -EINVAL ; skb =qrtr_alloc_ctrl_packet (&pkt,GFP_KERNEL ); -if (!skb) +if (!skb) { +qrtr_node_release (node);return -ENOMEM ; + } pkt->cmd =cpu_to_le32 (QRTR_TYPE_RESUME_TX ); pkt->client.node =cpu_to_le32 (cb->dst_node);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 93/595 iommu/rockchip: disable fetch dte time limit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Xue <[email protected]>
[ Upstream commit 8d4346ecd4950ae08cc76a6de327c264e846758c ]
Disable the Bit 31 of the AUTO_GATING iommu register, as it causes hangups with the RGA3 (Raster Graphics Acceleration 3) peripheral. The RGA3 register description of the TRM already states that the bit must be set to 1. The vendor kernel sets the bit unconditionally to 1 to fix VOP (Video Output Processor) screen black issues. This patch squashes the 2 vendor kernel commits with the following commit messages:
Master fetch data and cpu update page table may work in parallel, may have the following procedure:
master cpu
fetch dte update page tabl
| |
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make dte invalid) <- zap iotlb entry
| |
fetch dte again
(make iommu block) <- zap iotlb entry
New iommu version has the above bug, if fetch dte consecutively four times, then it will be blocked. Fortunately, we can set bit 31 of register MMU_AUTO_GATING to 1 to make it work as old version which does not have this issue.
This issue only appears on RV1126 so far, so make a workaround dedicated to "rockchip,rv1126" machine type.
iommu/rockchip: fix vop blocked and screen black on RK356X and RK3588
RK3568 and RK3588 has the same issue as RV1126/RV1109 that caused by dte fetch time limit, So we can set BIT(31) of register 0x24 default to 1 as a workaround.
--- drivers/iommu/rockchip-iommu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iommu/rockchip-iommu.c +8 -0
@@ -75,6 +75,8 @@#define SPAGE_ORDER 12#define SPAGE_SIZE (1 << SPAGE_ORDER) +#define DISABLE_FETCH_DTE_TIME_LIMIT BIT(31) +/* * Support mapping any size that fits in one page table: * 4 KiB to 4 MiB
@@ -864,6 +866,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu)struct iommu_domain *domain = iommu->domain;struct rk_iommu_domain *rk_domain =to_rk_domain (domain);int ret, i; +u32 auto_gate; ret =clk_bulk_enable (iommu->num_clocks, iommu->clocks);if (ret)
@@ -882,6 +885,11 @@ static int rk_iommu_enable(struct rk_iommu *iommu) rk_domain->dt_dma);rk_iommu_base_command (iommu->bases[i],RK_MMU_CMD_ZAP_CACHE );rk_iommu_write (iommu->bases[i],RK_MMU_INT_MASK ,RK_MMU_IRQ_MASK ); + +/* Workaround for iommu blocked, BIT(31) default to 1 */ + auto_gate =rk_iommu_read (iommu->bases[i],RK_MMU_AUTO_GATING ); + auto_gate |=DISABLE_FETCH_DTE_TIME_LIMIT ; +rk_iommu_write (iommu->bases[i],RK_MMU_AUTO_GATING , auto_gate); } ret =rk_iommu_enable_paging (iommu);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 94/595 ASoC: codecs: rk3328: Use managed GPIO and clock helpers
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 0cf3489bba9ad13aae052232e223e19a620fe7a7 ]
rk3328_platform_probe() acquires the mute GPIO with gpiod_get_optional() but never releases it. It also enables mclk and pclk manually while relying on probe error labels for unwind, and the driver has no platform remove callback to disable those clocks after a successful unbind.
This path has already needed fixes for missing clock unwinds on probe errors. Use devm_gpiod_get_optional() and devm_clk_get_enabled() so the GPIO and enabled clock lifetimes are tied to the device. This removes the manual error labels and makes both probe failure and driver unbind follow the normal devres cleanup path.
--- sound/soc/codecs/rk3328_codec.c | 54 ++++++++------------------------- 1 file changed, 13 insertions(+), 41 deletions(-)
sound/soc/codecs/rk3328_codec.c +13 -41
@@ -426,7 +426,6 @@ static int rk3328_platform_probe(struct platform_device *pdev)struct rk3328_codec_priv *rk3328;struct regmap *grf;void __iomem *base; -int ret =0 ; rk3328 =devm_kzalloc (&pdev->dev,sizeof (*rk3328),GFP_KERNEL );if (!rk3328)
@@ -442,14 +441,13 @@ static int rk3328_platform_probe(struct platform_device *pdev)regmap_write (grf,RK3328_GRF_SOC_CON2 , (BIT (14 ) <<16 |BIT (14 ))); - ret =of_property_read_u32 (rk3328_np,"spk-depop-time-ms" , - &rk3328->spk_depop_time); -if (ret <0 ) { +if (of_property_read_u32 (rk3328_np,"spk-depop-time-ms" , + &rk3328->spk_depop_time)) {dev_info (&pdev->dev,"spk_depop_time use default value.\n" ); rk3328->spk_depop_time =200 ; } - rk3328->mute =gpiod_get_optional (&pdev->dev,"mute" ,GPIOD_OUT_HIGH ); + rk3328->mute =devm_gpiod_get_optional (&pdev->dev,"mute" ,GPIOD_OUT_HIGH );if (IS_ERR (rk3328->mute))return PTR_ERR (rk3328->mute);/*
@@ -462,57 +460,31 @@ static int rk3328_platform_probe(struct platform_device *pdev)regmap_write (grf,RK3328_GRF_SOC_CON10 ,BIT (17 ) |BIT (1 )); } - rk3328->mclk =devm_clk_get (&pdev->dev,"mclk" ); + rk3328->mclk =devm_clk_get_enabled (&pdev->dev,"mclk" );if (IS_ERR (rk3328->mclk))return PTR_ERR (rk3328->mclk); - ret =clk_prepare_enable (rk3328->mclk); -if (ret) -return ret;clk_set_rate (rk3328->mclk,INITIAL_FREQ ); - rk3328->pclk =devm_clk_get (&pdev->dev,"pclk" ); -if (IS_ERR (rk3328->pclk)) { -dev_err (&pdev->dev,"can't get acodec pclk\n" ); - ret =PTR_ERR (rk3328->pclk); - goto err_unprepare_mclk; - } - - ret =clk_prepare_enable (rk3328->pclk); -if (ret <0 ) { -dev_err (&pdev->dev,"failed to enable acodec pclk\n" ); - goto err_unprepare_mclk; - } + rk3328->pclk =devm_clk_get_enabled (&pdev->dev,"pclk" ); +if (IS_ERR (rk3328->pclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (rk3328->pclk), +"failed to get or enable acodec pclk\n" ); base =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (base)) { - ret =PTR_ERR (base); - goto err_unprepare_pclk; - } +if (IS_ERR (base)) +return PTR_ERR (base); rk3328->regmap =devm_regmap_init_mmio (&pdev->dev, base, &rk3328_codec_regmap_config); -if (IS_ERR (rk3328->regmap)) { - ret =PTR_ERR (rk3328->regmap); - goto err_unprepare_pclk; - } +if (IS_ERR (rk3328->regmap)) +return PTR_ERR (rk3328->regmap);platform_set_drvdata (pdev, rk3328); - ret =devm_snd_soc_register_component (&pdev->dev, &soc_codec_rk3328, +return devm_snd_soc_register_component (&pdev->dev, &soc_codec_rk3328, rk3328_dai,ARRAY_SIZE (rk3328_dai)); -if (ret) - goto err_unprepare_pclk; - -return 0 ; - -err_unprepare_pclk: -clk_disable_unprepare (rk3328->pclk); - -err_unprepare_mclk: -clk_disable_unprepare (rk3328->mclk); -return ret; }static const struct of_device_id rk3328_codec_of_match[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 95/595 ALSA: seq: oss: Reject reads that cannot fit the next event
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <[email protected]>
[ Upstream commit 611f538253d970f4d152003841544e875828d015 ]
snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue.
The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count.
Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This prevents an undersized read from looking like end-of-file while leaving the event queued for a later read with a large enough buffer.
--- sound/core/seq/oss/seq_oss_rw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/core/seq/oss/seq_oss_rw.c +2 -1
@@ -57,7 +57,8 @@ snd_seq_oss_read(struct seq_oss_devinfo *dp, char __user *buf, int count)break ; } ev_len =ev_length (&rec); -if (ev_len < count) { +if (count < ev_len) { + err = -EINVAL ;snd_seq_oss_readq_unlock (readq, flags);break ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 96/595 net: dsa: sja1105: flower: reject cross-chip redirect
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0 ]
dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count.
Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.
--- drivers/net/dsa/sja1105/sja1105_flower.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/sja1105/sja1105_flower.c +2 -2
@@ -345,9 +345,9 @@ int sja1105_cls_flower_add(struct dsa_switch *ds, int port,struct dsa_port *to_dp; to_dp =dsa_port_from_netdev (act->dev); -if (IS_ERR (to_dp)) { +if (IS_ERR (to_dp) || to_dp->ds != ds) {NL_SET_ERR_MSG_MOD (extack, -"Destination not a switch port" ); +"Destination not a local switch port" );return -EOPNOTSUPP ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 97/595 xhci: Prevent queuing new commands if xhci is inaccessible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
[ Upstream commit 82b70c799281cc24506085be978b829149ba0ca4 ]
Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD_FLAG_HW_ACCESSIBLE.
HCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume.
Also print a warning if xhci is being suspended with commands still pending on the command ring.
--- drivers/usb/host/xhci-ring.c | 6 ++++++ drivers/usb/host/xhci.c | 4 ++++ 2 files changed, 10 insertions(+)
drivers/usb/host/xhci-ring.c +6 -0
@@ -4199,6 +4199,7 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd, u32 field3, u32 field4, bool command_must_succeed) { int reserved_trbs = xhci->cmd_ring_reserved_trbs; +struct usb_hcd *hcd =xhci_to_hcd (xhci);int ret; if ((xhci->xhc_state & XHCI_STATE_DYING) ||
@@ -4208,6 +4209,11 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,return -ESHUTDOWN ; } +if (!HCD_HW_ACCESSIBLE (hcd)) { +xhci_warn (xhci,"Can't queue command, xHC not accessible\n" ); +return -ESHUTDOWN ; + } +if (!command_must_succeed) reserved_trbs++;
drivers/usb/host/xhci.c +4 -0
@@ -1034,6 +1034,10 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)/* step 1: stop endpoint */ /* skipped assuming that port suspend has done */ +/* Check if command ring is empty */ +if (!list_empty (&xhci->cmd_list)) +xhci_warn (xhci,"Suspending and stopping xHC with pending command!\n" ); +/* step 2: clear Run/Stop bit */ command =readl (&xhci->op_regs->command); command &= ~CMD_RUN ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 98/595 clk: keystone: dont cache clock rate
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit a80b32a140c8612bbaed27009c383d43304db6d5 ]
The TISCI firmware will return 0 if the clock or consumer is not enabled although there is a stored value in the firmware. IOW a call to set rate will work but at get rate will always return 0 if the clock is disabled.
The clk framework will try to cache the clock rate when it's requested by a consumer. If the clock or consumer is not enabled at that point, the cached value is 0, which is wrong. Thus, disable the cache altogether.
--- drivers/clk/keystone/sci-clk.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/clk/keystone/sci-clk.c +8 -0
@@ -342,6 +342,14 @@ static int _sci_clk_build(struct sci_clk_provider *provider, init.ops = &sci_clk_ops; init.num_parents = sci_clk->num_parents; + +/* +* A clock rate query to the SCI firmware will return 0 if either the +* clock itself is disabled or the attached device/consumer is disabled. +* This makes it inherently unsuitable for the caching of the clk +* framework. +*/ + init.flags =CLK_GET_RATE_NOCACHE ; sci_clk->hw.init = &init; ret =devm_clk_hw_register (provider->dev, &sci_clk->hw);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 99/595 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Faleichyk <[email protected]>
[ Upstream commit 3580bc53520ce4efc94ece5886ad3670b93667ba ]
The internal microphone on ASUS VivoBook X509DAP (subsystem ID 0x1043:0x197e) is not detected without a quirk entry. Add ALC256_FIXUP_ASUS_MIC_NO_PRESENCE to fix the issue.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9355,6 +9355,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x18f1 ,"Asus FX505DT" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x194e ,"ASUS UX563FD" ,ALC294_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x1970 ,"ASUS UX550VE" ,ALC289_FIXUP_ASUS_GA401 ), +SND_PCI_QUIRK (0x1043 ,0x197e ,"ASUS VivoBook X509DAP" ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1982 ,"ASUS B1400CEPE" ,ALC256_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x19ce ,"ASUS B9450FA" ,ALC294_FIXUP_ASUS_HPE ), SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 100/595 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 39851b7e580a65bee732e5364f0efb974b242370 ]
Use platform_get_irq_optional() to retrieve the interrupt resource instead of directly parsing and mapping the OF node via irq_of_parse_and_map(). This is the standard pattern for platform devices. irq_of_parse_and_map() requires ire_dispose_mapping(), which is missing.
Message-ID: <[email protected]> [Handle a negative return from platform_get_irq_optional() to mean
no interrupt is assigned.]
--- drivers/char/ipmi/ipmi_si_platform.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_si_platform.c +4 -1
@@ -286,7 +286,10 @@ static int of_ipmi_probe(struct platform_device *pdev) io.regspacing = regspacing ?be32_to_cpup (regspacing) :DEFAULT_REGSPACING ; io.regshift = regshift ?be32_to_cpup (regshift) :0 ; - io.irq =irq_of_parse_and_map (pdev->dev.of_node,0 ); + io.irq =platform_get_irq_optional (pdev,0 ); +if (io.irq <0 ) + io.irq =0 ; + io.dev = &pdev->dev; dev_dbg(&pdev->dev, "addr 0x%lx regsize %d spacing %d irq %d\n",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 101/595 wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thiyagarajan Pandiyan <[email protected]>
[ Upstream commit dfb67ae569bf0726187725b1ef8d89377778861e ]
Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as 1-byte field, capping the maximum IE list size at 255 bytes. When a large beacon is received, the IE list is truncated, passing incomplete data to wpa_supplicant. This causes supplicant to fail parsing the IEs.
Increasing the size of ie_len to allow the full length of the IE list to be forwarded properly.
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/net/cfg80211.h +1 -1
@@ -6482,7 +6482,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,* cfg80211 then sends a notification to userspace. */ void cfg80211_notify_new_peer_candidate (struct net_device *dev, -const u8 *macaddr,const u8 *ie,u8 ie_len, +const u8 *macaddr,const u8 *ie,size_t ie_len,int sig_dbm,gfp_t gfp);/**
net/wireless/nl80211.c +1 -1
@@ -16259,7 +16259,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, }void cfg80211_notify_new_peer_candidate (struct net_device *dev,const u8 *addr, -const u8 *ie,u8 ie_len, +const u8 *ie,size_t ie_len,int sig_dbm,gfp_t gfp) {struct wireless_dev *wdev = dev->ieee80211_ptr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 102/595 RDMA/mlx5: Fix state and counter desync on loopback enable failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 0d32eabccbe4b2f8d45be3192c5f3c76c8af703d ]
In mlx5_ib_enable_lb(), dev->lb.enabled was unconditionally set to true even if mlx5_nic_vport_update_local_lb() failed.
Fix this by only setting dev->lb.enabled on success. On failure, roll back the reference counters and return the error.
--- drivers/infiniband/hw/mlx5/main.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/infiniband/hw/mlx5/main.c +11 -0
@@ -1708,6 +1708,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) dev->lb.qps == 1) {if (!dev->lb.enabled) { err =mlx5_nic_vport_update_local_lb (dev->mdev, true); +if (err) + goto err_rollback; + dev->lb.enabled = true; } }
@@ -1715,6 +1718,14 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)mutex_unlock (&dev->lb.mutex);return err; + +err_rollback: +if (td) + dev->lb.user_td--; +if (qp) + dev->lb.qps--; +mutex_unlock (&dev->lb.mutex); +return err; }void mlx5_ib_disable_lb (struct mlx5_ib_dev *dev,bool td,bool qp)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 103/595 bpf: NUL-terminate replaced sysctl value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <[email protected]>
[ Upstream commit a66e3b5bacf38d6ab29fa05a9754f7a114485605 ]
When writing to sysctls, proc_sys_call_handler() guarantees that the buffer passed to proc handlers is NUL-terminated. If bpf_sysctl_set_new_value() replaces the pending sysctl value, it can hand a replacement buffer directly to proc handlers. However, the helper currently copies only buf_len bytes into that buffer without appending a NUL terminator, leaving downstream parsers vulnerable to out-of-bounds access.
Fix this by appending a '\0' after the replaced value to restore the expected sysctl semantics. Since the helper already rejects buf_len greater than PAGE_SIZE - 1, there is always room for the extra byte.
Reproduced in a QEMU x86_64 guest booted with KASAN while exercising the sysctl replacement path with a cgroup/sysctl BPF program. The reproducer targets /proc/sys/net/core/flow_limit_cpu_bitmap, fills the original user write buffer with non-zero bytes, and overrides the sysctl value so the replacement buffer lacks a terminating NUL. Under that setup, the pre-fix kernel reported:
BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90 Read of size 1 at addr ffff88800de57000 by task repro_patch3/66 CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcb/0x5e0 ? __virt_addr_valid+0x21d/0x3f0 ? strnchrnul+0x72/0x90 ? strnchrnul+0x72/0x90 kasan_report+0xca/0x100 ? strnchrnul+0x72/0x90 strnchrnul+0x72/0x90 bitmap_parse+0x37/0x2e0 flow_limit_cpu_sysctl+0xc6/0x840 ? __pfx_flow_limit_cpu_sysctl+0x10/0x10 ? __kvmalloc_node_noprof+0x5ba/0x870 proc_sys_call_handler+0x31d/0x480 ? __pfx_proc_sys_call_handler+0x10/0x10 ? selinux_file_permission+0x39f/0x500 ? lock_is_held_type+0x9e/0x120 vfs_write+0x98e/0x1000 ... </TASK> The buggy address is located 0 bytes to the right of allocated 4096-byte region [ffff88800de56000, ffff88800de57000)
With this fix applied, rerunning the same sysctl-targeted path yields no corresponding KASAN reports.
--- kernel/bpf/cgroup.c | 1 + 1 file changed, 1 insertion(+)
kernel/bpf/cgroup.c +1 -0
@@ -1727,6 +1727,7 @@ BPF_CALL_3(bpf_sysctl_set_new_value, struct bpf_sysctl_kern *, ctx,return -E2BIG ;memcpy (ctx->new_val, buf, buf_len); + ((char *)ctx->new_val)[buf_len] ='\0' ; ctx->new_len = buf_len; ctx->new_updated =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 104/595 net: cpsw_new: unregister devlink on port registration failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
[ Upstream commit b64f763b607426ac97e44b114f0b8844ac3b86dd ]
cpsw_probe() registers devlink before registering the CPSW ports.
If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed.
Add a devlink cleanup label for the path where devlink registration has already succeeded, and use it when port registration fails.
--- drivers/net/ethernet/ti/cpsw_new.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/cpsw_new.c +3 -1
@@ -2029,7 +2029,7 @@ static int cpsw_probe(struct platform_device *pdev) ret =cpsw_register_ports (cpsw);if (ret) - goto clean_unregister_notifiers; + goto clean_unregister_devlink; dev_notice(dev, "initialized (regs %pa, pool size %d) hw_ver:%08X %d.%d (%d)\n", &ss_res->start, descs_pool_size,
@@ -2041,6 +2041,8 @@ static int cpsw_probe(struct platform_device *pdev)return 0 ; +clean_unregister_devlink: +cpsw_unregister_devlink (cpsw); clean_unregister_notifiers:cpsw_unregister_notifiers (cpsw); clean_cpts:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 105/595 hsr: broadcast netlink notifications in the devices net namespace
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <[email protected]>
[ Upstream commit a762fabd7ef9a6cc07258684138f9c3f078d0326 ]
The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net.
Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter.
This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX).
Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake.
hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().
--- net/hsr/hsr_netlink.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/hsr/hsr_netlink.c +7 -2
@@ -209,7 +209,8 @@ void hsr_nl_ringerror(struct hsr_priv *hsr, unsigned char addr[ETH_ALEN], goto nla_put_failure;genlmsg_end (skb, msg_head); -genlmsg_multicast (&hsr_genl_family, skb,0 ,0 ,GFP_ATOMIC ); +genlmsg_multicast_netns (&hsr_genl_family,dev_net (port->dev), + skb,0 ,0 ,GFP_ATOMIC );return ;
@@ -245,8 +246,12 @@ void hsr_nl_nodedown(struct hsr_priv *hsr, unsigned char addr[ETH_ALEN])if (res <0 ) goto nla_put_failure; +rcu_read_lock (); + master =hsr_port_get_hsr (hsr,HSR_PT_MASTER );genlmsg_end (skb, msg_head); -genlmsg_multicast (&hsr_genl_family, skb,0 ,0 ,GFP_ATOMIC ); +genlmsg_multicast_netns (&hsr_genl_family,dev_net (master->dev), + skb,0 ,0 ,GFP_ATOMIC ); +rcu_read_unlock ();return ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 106/595 ALSA: es18xx: check control allocation before private data setup
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <[email protected]>
[ Upstream commit 422e42b7c2b882ba1d16d4afc8891bcea7c4de93 ]
snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer.
Check the returned control pointers before using them and return -ENOMEM on allocation failure.
--- sound/isa/es18xx.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/isa/es18xx.c +4 -0
@@ -1820,6 +1820,8 @@ static int snd_es18xx_mixer(struct snd_card *card)for (idx =0 ; idx <ARRAY_SIZE (snd_es18xx_base_controls); idx++) {struct snd_kcontrol *kctl; kctl =snd_ctl_new1 (&snd_es18xx_base_controls[idx], chip); +if (!kctl) +return -ENOMEM ;if (chip->caps &ES18XX_HWV ) {switch (idx) {case 0 :
@@ -1874,6 +1876,8 @@ static int snd_es18xx_mixer(struct snd_card *card)for (idx =0 ; idx <ARRAY_SIZE (snd_es18xx_hw_volume_controls); idx++) {struct snd_kcontrol *kctl; kctl =snd_ctl_new1 (&snd_es18xx_hw_volume_controls[idx], chip); +if (!kctl) +return -ENOMEM ;if (idx ==0 ) chip->hw_volume = kctl;else
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 107/595 netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit d3bf9eae486490832bd08fd62ab0ac601f346bd4 ]
The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped.
This matches the existing get_unaligned_be32() use later in the same function.
--- net/netfilter/nf_conntrack_proto_tcp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_proto_tcp.c +5 -5
@@ -411,11 +411,11 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,BUG_ON (ptr ==NULL );/* Fast path for timestamp-only option */ -if (length ==TCPOLEN_TSTAMP_ALIGNED - && *(__be32 *)ptr ==htonl ((TCPOPT_NOP <<24 ) - | (TCPOPT_NOP <<16 ) - | (TCPOPT_TIMESTAMP <<8 ) - |TCPOLEN_TIMESTAMP )) +if (length ==TCPOLEN_TSTAMP_ALIGNED && +get_unaligned_be32 (ptr) == ((TCPOPT_NOP <<24 ) | + (TCPOPT_NOP <<16 ) | + (TCPOPT_TIMESTAMP <<8 ) | +TCPOLEN_TIMESTAMP ))return ;while (length >0 ) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 108/595 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <[email protected]>
[ Upstream commit 18d32b0013efba19f7ad3e5b08d7aee813d604a6 ]
[BUG]
Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a corresponding block group in the in-memory cache:
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601
Call Trace:
__btrfs_balance fs/btrfs/volumes.c:4217 [inline]
btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604
btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]
btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313
...[CAUSE]__btrfs_balance() iterates the on-disk chunk tree and passes the chunk logical bytenr to btrfs_may_alloc_data_chunk() before relocating a data chunk. That helper then queries the in-memory block group cache:
cache = btrfs_lookup_block_group(fs_info, chunk_offset); chunk_type = cache->flags; /* cache may be NULL */
A corrupt image can contain a chunk item whose matching block group item is missing, so no block group is ever inserted into the cache. In that case btrfs_lookup_block_group() returns NULL.
The code only guards this with ASSERT(cache), which becomes a no-op when CONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of cache->flags therefore crashes the kernel.
[FIX]
Add a NULL check after btrfs_lookup_block_group() in btrfs_may_alloc_data_chunk() and print and error message for clarity.
--- fs/btrfs/volumes.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +5 -1
@@ -3296,7 +3296,11 @@ static int btrfs_may_alloc_data_chunk(struct btrfs_fs_info *fs_info,u64 chunk_type; cache =btrfs_lookup_block_group (fs_info, chunk_offset); -ASSERT (cache); +if (unlikely (!cache)) { +btrfs_err (fs_info,"balance: chunk at bytenr %llu has no corresponding block group" , + chunk_offset); +return -EUCLEAN ; + } chunk_type = cache->flags;btrfs_put_block_group (cache);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 109/595 xprtrdma: Add request-pool slack for delayed recycling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 64bf6892057b746c55bcc045b9492741b72d8d27 ]
After the previous patch gates req recycling on Send completion, a completed RPC's rpcrdma_req can remain pinned by the sendctx ring until the next signaled Send completion releases it. The transmitted-RPC ceiling is unchanged: xprt_request_get_cong() gates Sends against xprt->cwnd, the RPC/RDMA credit window fed by server-granted credits and capped at re_max_requests. The req pool, however, must exceed max_reqs by enough that this recycle delay does not stall a slot allocation that the credit window would admit.
The headroom is bounded. frwr_open() sets re_send_batch to re_max_requests >> 3 -- one in every eight Sends is signaled -- so at most re_send_batch unsignaled Sends can be outstanding before the next signaled completion releases them. That equals max_reqs / 8 reqs in the worst case, with a one-slot floor for small max_reqs values where the right-shift rounds to zero.
The sendctx ring and the hardware Send Queue are not enlarged to match. Both are sized in rpcrdma_sendctxs_create() and frwr_query_device() for re_max_requests in-flight Sends, which is the ceiling the credit window enforces. The pool slack does not raise that ceiling -- it only lets allocation keep pace with the credit window during the brief interval in which earlier reqs are pinned waiting for the next signaled completion. At any moment, at most re_send_batch sendctxes are held by unswept unsignaled Sends, leaving the rest of the ring available for newly admitted Sends.
Allocate max_reqs + DIV_ROUND_UP(max_reqs, 8) request objects and name the slack calculation at the allocation site so the 1/8 bound stays tied to the Send-signaling batch size.
--- net/sunrpc/xprtrdma/verbs.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
net/sunrpc/xprtrdma/verbs.c +20 -1
@@ -1054,6 +1054,22 @@ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf)rpcrdma_rep_destroy (rep); } +static unsigned int rpcrdma_req_pool_slack (unsigned int max_reqs) +{ +/* The sendctx ring can hold up to one Send-signaling batch +* (re_send_batch, set by frwr_open() to re_max_requests >> 3) +* of unfinished Sends. Each pins its req until a signaled Send +* completion releases the sendctx. Size the pool above max_reqs +* by that batch so the recycle delay does not stall a slot +* allocation that the RPC/RDMA credit window would admit. +* +* Round up: re_max_requests >> 3 is zero when max_reqs < 8, but +* a single unsignaled Send is still enough to pin one req. One +* slack slot covers that case. +*/ +return DIV_ROUND_UP (max_reqs,8 ); +} +/** * rpcrdma_buffer_create - Create initial set of req/rep objects * @r_xprt: transport instance to (re)initialize
@@ -1063,6 +1079,7 @@ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf)int rpcrdma_buffer_create (struct rpcrdma_xprt *r_xprt) {struct rpcrdma_buffer *buf = &r_xprt->rx_buf; +unsigned int max_reqs;int i, rc; buf->rb_bc_srv_max_requests =0 ;
@@ -1076,7 +1093,9 @@ int rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)INIT_LIST_HEAD (&buf->rb_all_reps); rc = -ENOMEM ; -for (i =0 ; i < r_xprt->rx_xprt.max_reqs; i++) { + max_reqs = r_xprt->rx_xprt.max_reqs; + max_reqs +=rpcrdma_req_pool_slack (max_reqs); +for (i =0 ; i < max_reqs; i++) {struct rpcrdma_req *req; req = rpcrdma_req_create(r_xprt, RPCRDMA_V1_DEF_INLINE_SIZE * 2,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 110/595 configfs_depend_prep(): pass configfs_dirent instead of dentry
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 764682e0118432260191d194edbdaff208260483 ]
Again, the only thing it uses dentry for is dentry->d_fsdata; for the recursive call the situation is the same as with configfs_detach_prep() and the same observation about ->s_dentry->d_fsdata applies.
--- fs/configfs/dir.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
fs/configfs/dir.c +4 -8
@@ -1083,15 +1083,12 @@ static int configfs_dump(struct configfs_dirent *sd, int level)* much on the stack, though, so folks that need this function - be careful * about your stack! Patches will be accepted to make it iterative. */ -static int configfs_depend_prep (struct dentry *origin, +static int configfs_depend_prep (struct configfs_dirent *sd,struct config_item *target) { -struct configfs_dirent *child_sd, *sd; +struct configfs_dirent *child_sd;int ret =0 ; -BUG_ON (!origin || !origin->d_fsdata); - sd = origin->d_fsdata; -if (sd->s_element == target)/* Boo-yah */ goto out;
@@ -1099,8 +1096,7 @@ static int configfs_depend_prep(struct dentry *origin,if ((child_sd->s_type &CONFIGFS_DIR ) && !(child_sd->s_type &CONFIGFS_USET_DROPPING ) && !(child_sd->s_type &CONFIGFS_USET_CREATING )) { - ret =configfs_depend_prep (child_sd->s_dentry, - target); + ret =configfs_depend_prep (child_sd, target);if (!ret) goto out;/* Child path boo-yah */ }
@@ -1121,7 +1117,7 @@ static int configfs_do_depend_item(struct dentry *subsys_dentry,spin_lock (&configfs_dirent_lock);/* Scan the tree, return 0 if found */ - ret =configfs_depend_prep (subsys_dentry, target); + ret =configfs_depend_prep (subsys_dentry->d_fsdata, target);if (ret) goto out_unlock_dirent_lock;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 111/595 net: ibm: emac: mal: fix potential system hang in mal_remove()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 7c5d41f87f079990bf241359e3c1332d8d10fe87 ]
napi_disable() is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPI_STATE_SCHED bit to clear.
In mal_remove(), napi_disable() is called unconditionally. If no MACs were registered, NAPI was never enabled. Also, if they were registered but subsequently unregistered, NAPI was already disabled in mal_unregister_commac(). In either case, calling napi_disable() causes the kernel to hang upon module removal.
Fix this by only calling napi_disable() in mal_remove() if the commac list is not empty (which implies NAPI is enabled).
--- drivers/net/ethernet/ibm/emac/mal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/ibm/emac/mal.c +3 -3
@@ -716,13 +716,13 @@ static int mal_remove(struct platform_device *ofdev)MAL_DBG (mal,"remove" NL );/* Synchronize with scheduled polling */ -napi_disable (&mal->napi); - -if (!list_empty (&mal->list)) +if (!list_empty (&mal->list)) { +napi_disable (&mal->napi);/* This is *very* bad */ WARN (1 ,KERN_EMERG "mal%d: commac list is not empty on remove!\n" , mal->index); + }free_irq (mal->serr_irq, mal);free_irq (mal->txde_irq, mal);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 112/595 platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Sonichev <[email protected]>
[ Upstream commit bfe91a80b13f8068f6fa07aa8c468d284150d4ad ]
The Inspiron N5110 needs the touchpad LED quirk (Vostro V130 quirk) to properly control the touchpad LED. Add its DMI identifier to the existing quirk table, next to the similar Inspiron M5110 entry.
Tested on Dell Inspiron N5110.
The touchpad LED works correctly with this quirk enabled.
--- drivers/platform/x86/dell-laptop.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/platform/x86/dell-laptop.c +9 -0
@@ -198,6 +198,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = { }, .driver_data = &quirk_dell_vostro_v130, }, + { + .callback = dmi_matched, + .ident = "Dell Inspiron N5110", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N5110"), + }, + .driver_data = &quirk_dell_vostro_v130, + }, { .callback = dmi_matched, .ident = "Dell Vostro 3360",
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 113/595 wifi: mt76: transform aspm_conf for pci_disable_link_state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiajia Liu <[email protected]>
[ Upstream commit 2dd78856223484895306351df1f903a4b75d213f ]
commit b478e162f227 ("PCI/ASPM: Consolidate link state defines") changed PCIE_LINK_STATE_L0S (1) to (BIT(0) | BIT(1)). PCI_EXP_LNKCTL_ASPM_L0S (1) and PCI_EXP_LNKCTL_ASPM_L1 (2) are no longer matched with PCIE_LINK_STATE_L0S (3) and PCIE_LINK_STATE_L1 (4).
On the platform enabling ASPM L0s and L1, mt76_pci_disable_aspm is not able to disable L1. Fix this by transforming aspm_conf to pcie link state.
--- drivers/net/wireless/mediatek/mt76/pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/pci.c +7 -1
@@ -30,8 +30,14 @@ void mt76_pci_disable_aspm(struct pci_dev *pdev)if (IS_ENABLED (CONFIG_PCIEASPM )) {int err; +int state =0 ; - err =pci_disable_link_state (pdev, aspm_conf); +if (aspm_conf &PCI_EXP_LNKCTL_ASPM_L0S ) + state |=PCIE_LINK_STATE_L0S ; +if (aspm_conf &PCI_EXP_LNKCTL_ASPM_L1 ) + state |=PCIE_LINK_STATE_L1 ; + + err =pci_disable_link_state (pdev, state);if (!err)return ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 114/595 hwmon: (adt7462) Add of_match_table to support devicetree
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent <[email protected]>
[ Upstream commit cd1b42617aafe01810ab7d3b9948d2f5fa9fb8af ]
Add of_match_table to add support of devicetree probing.
--- drivers/hwmon/adt7462.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hwmon/adt7462.c +8 -0
@@ -12,6 +12,7 @@#include <linux/hwmon.h> #include <linux/hwmon-sysfs.h> #include <linux/err.h> +#include <linux/mod_devicetable.h> #include <linux/mutex.h> #include <linux/log2.h> #include <linux/slab.h>
@@ -1814,10 +1815,17 @@ static const struct i2c_device_id adt7462_id[] = { };MODULE_DEVICE_TABLE (i2c, adt7462_id); +static const struct of_device_id adt7462_of_match[] = { + { .compatible ="onnn,adt7462" }, + { }, +}; +MODULE_DEVICE_TABLE (of, adt7462_of_match); +static struct i2c_driver adt7462_driver = { .class =I2C_CLASS_HWMON , .driver = { .name ="adt7462" , + .of_match_table = adt7462_of_match, }, .probe_new = adt7462_probe, .id_table = adt7462_id,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 115/595 ata: libata-pmp: add JMicron JMS562 quirk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <[email protected]>
[ Upstream commit c62aff1174cf88e10716c7513702443c47551fc6 ]
JMicron JMS562, as used in QNAP QDA-A2AR RAID1 adapters, may keep the exported ATA device not ready while the array is rebuilding.
In this state, libata may repeatedly try to softreset and classify the fan-out link. On the affected adapter, this can time out, make PMP/SCR access fail, and eventually disable the fan-out link before the RAID volume is exported.
A failing boot shows the fan-out link failing SRST, PMP access timing out, SCR read failing, and the link being disabled:
ata4.00: softreset failed (device not ready) ata4.15: qc timeout after 3000 msecs (cmd 0xe4) ata4.00: failed to read SCR 0 (Emask=0x4) ata4.00: failed to recover link after 3 tries, disabling
After that, the root filesystem on the exported RAID volume cannot be found.
Add JMS562 to the existing JMicron PMP quirk that disables LPM, avoids softreset on fan-out links, and assumes an ATA device. This prevents libata from dropping the exported RAID volume during rebuild recovery.
--- drivers/ata/libata-pmp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/ata/libata-pmp.c +6 -1
@@ -446,8 +446,13 @@ static void sata_pmp_quirks(struct ata_port *ap)* otherwise. Don't try hard to recover it. */ ap->pmp_link[ap->nr_pmp_links -1 ].flags |=ATA_LFLAG_NO_RETRY ; - }else if (vendor ==0x197b && (devid ==0x2352 || devid ==0x0325 )) { + }else if (vendor ==0x197b && + (devid ==0x0562 || devid ==0x2352 || devid ==0x0325 )) {/* +* 0x0562: JMicron JMS562, as used in QNAP QDA-A2AR RAID1 +* adapters. The exported device may stay not ready +* while the array is rebuilding, and SRST/classify can +* time out before the RAID volume is exported. * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350? * 0x0325: jmicron JMB394. */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 116/595 platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Metchev <[email protected]>
[ Upstream commit c39023ca9a447f09c072080efc84d6874c2275c9 ]
The volume rocker buttons on the HP ProBook x360 440 G1 convertible emit events 0xc4-0xc7 via the intel-hid ACPI device (INT33D5). These codes are only present in intel_array_keymap, which is used when the "5 button array" input device exists. On this machine button_array_present() returns false because the firmware does not advertise the array through the HEBC method, so notify_handler() routes the events to a NULL priv->array and they are dropped as "unknown event 0xc4". As a result the side volume keys do nothing.
Add the machine to button_array_table so the array device is created and the volume rocker emits KEY_VOLUMEUP / KEY_VOLUMEDOWN. This is equivalent to booting with the enable_5_button_array=1 module parameter, which was used to confirm the fix on the affected hardware.
--- drivers/platform/x86/intel-hid.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/platform/x86/intel-hid.c +7 -0
@@ -114,6 +114,13 @@ static const struct dmi_system_id button_array_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 4"), }, }, + { + .ident = "HP ProBook x360 440 G1", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook x360 440 G1"), + }, + }, { } };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 117/595 sctp: Unwind address notifier registration on failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <[email protected]>
[ Upstream commit c8459ee2fef502d6ef6c063751c33d9ac7943eab ]
sctp_v4_add_protocol() and sctp_v6_add_protocol() register their address notifiers before registering the SCTP protocol handlers. If protocol registration fails, the functions return without unregistering the notifiers.
Unregister the notifiers on the protocol registration failure paths. Also propagate notifier registration failures instead of ignoring them.
--- net/sctp/ipv6.c | 10 ++++++++-- net/sctp/protocol.c | 10 ++++++++-- 2 files changed, 16 insertions(+), 4 deletions(-)
net/sctp/ipv6.c +8 -2
@@ -1149,11 +1149,17 @@ void sctp_v6_protosw_exit(void)/* Register with inet6 layer. */ int sctp_v6_add_protocol (void ) { +int ret; +/* Register notifier for inet6 address additions/deletions. */ -register_inet6addr_notifier (&sctp_inet6addr_notifier); + ret =register_inet6addr_notifier (&sctp_inet6addr_notifier); +if (ret) +return ret; -if (inet6_add_protocol (&sctpv6_protocol,IPPROTO_SCTP ) <0 ) +if (inet6_add_protocol (&sctpv6_protocol,IPPROTO_SCTP ) <0 ) { +unregister_inet6addr_notifier (&sctp_inet6addr_notifier);return -EAGAIN ; + }return 0 ; }
net/sctp/protocol.c +8 -2
@@ -1178,12 +1178,18 @@ static void sctp_v4_protosw_exit(void)static int sctp_v4_add_protocol (void ) { +int ret; +/* Register notifier for inet address additions/deletions. */ -register_inetaddr_notifier (&sctp_inetaddr_notifier); + ret =register_inetaddr_notifier (&sctp_inetaddr_notifier); +if (ret) +return ret;/* Register SCTP with inet layer. */ -if (inet_add_protocol (&sctp_protocol,IPPROTO_SCTP ) <0 ) +if (inet_add_protocol (&sctp_protocol,IPPROTO_SCTP ) <0 ) { +unregister_inetaddr_notifier (&sctp_inetaddr_notifier);return -EAGAIN ; + }return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 118/595 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
[ Upstream commit 6a4f64c3a3ada43e71ef1e06da89beb36bdaeefa ]
Some Qualcomm PCIe devices (WCN6855/WCN7850 WiFi cards, SDX62/SDX65 modems) do not properly support Secondary Bus Reset (SBR).
Testing confirms this is device-specific, not deployment-specific:
MediaTek MT7925e successfully uses bus reset through the same passive M.2-to-PCIe adapters where Qualcomm devices fail, proving PERST# is properly wired through the adapters.
Prevent use of Secondary Bus Reset for these devices.
--- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/quirks.c +3 -0
@@ -3614,6 +3614,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x0033 , quirk_no_bus_reset);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x0034 , quirk_no_bus_reset);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_ATHEROS ,0x003e , quirk_no_bus_reset); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_QCOM ,0x1103 , quirk_no_bus_reset);/* WCN6855 */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_QCOM ,0x1107 , quirk_no_bus_reset);/* WCN7850 */ +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_QCOM ,0x0308 , quirk_no_bus_reset);/* SDX62/SDX65 */ /* * Root port on some Cavium CN8xxx chips do not successfully complete a bus
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 119/595 hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Potin Lai <[email protected]>
[ Upstream commit 83dda7ed185501ba1f8165aeca83ff4a8ef7c263 ]
Swap the high setting and low setting coefficients in the lm25066_coeff table for LM5064, LM5066, and LM5066i. The coefficients were previously mapped incorrectly, resulting in inverted current and power scaling.
Additionally, dynamically assign the exponent (R) registers inside the probe's LM25066_DEV_SETUP_CL check. This ensures that the proper exponent is applied (e.g., for LM25056, high setting power exponent is -4, but low setting power exponent is -3).
--- drivers/hwmon/pmbus/lm25066.c | 54 ++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 26 deletions(-)
drivers/hwmon/pmbus/lm25066.c +28 -26
@@ -131,23 +131,23 @@ static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = { .R = -2, }, [PSC_CURRENT_IN] = { - .m = 10742, - .b = 1552, + .m = 5456, + .b = 2118, .R = -2, }, [PSC_CURRENT_IN_L] = { - .m = 5456, - .b = 2118, + .m = 10742, + .b = 1552, .R = -2, }, [PSC_POWER] = { - .m = 1204, - .b = 8524, + .m = 612, + .b = 11202, .R = -3, }, [PSC_POWER_L] = { - .m = 612, - .b = 11202, + .m = 1204, + .b = 8524, .R = -3, }, [PSC_TEMPERATURE] = {
@@ -166,23 +166,23 @@ static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = { .R = -2, }, [PSC_CURRENT_IN] = { - .m = 10753, - .b = -1200, + .m = 5405, + .b = -600, .R = -2, }, [PSC_CURRENT_IN_L] = { - .m = 5405, - .b = -600, + .m = 10753, + .b = -1200, .R = -2, }, [PSC_POWER] = { - .m = 1204, - .b = -6000, + .m = 605, + .b = -8000, .R = -3, }, [PSC_POWER_L] = { - .m = 605, - .b = -8000, + .m = 1204, + .b = -6000, .R = -3, }, [PSC_TEMPERATURE] = {
@@ -201,23 +201,23 @@ static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = { .R = -2, }, [PSC_CURRENT_IN] = { - .m = 15076, - .b = -504, + .m = 7645, + .b = 100, .R = -2, }, [PSC_CURRENT_IN_L] = { - .m = 7645, - .b = 100, + .m = 15076, + .b = -504, .R = -2, }, [PSC_POWER] = { - .m = 1701, - .b = -4000, + .m = 861, + .b = -965, .R = -3, }, [PSC_POWER_L] = { - .m = 861, - .b = -965, + .m = 1701, + .b = -4000, .R = -3, }, [PSC_TEMPERATURE] = {
@@ -497,18 +497,20 @@ static int lm25066_probe(struct i2c_client *client) info->m[PSC_VOLTAGE_OUT ] = coeff[PSC_VOLTAGE_OUT ].m; info->b[PSC_VOLTAGE_OUT ] = coeff[PSC_VOLTAGE_OUT ].b; info->R[PSC_VOLTAGE_OUT ] = coeff[PSC_VOLTAGE_OUT ].R; - info->R[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN ].R; - info->R[PSC_POWER ] = coeff[PSC_POWER ].R;if (config &LM25066_DEV_SETUP_CL ) { info->m[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN_L ].m; info->b[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN_L ].b; + info->R[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN_L ].R; info->m[PSC_POWER ] = coeff[PSC_POWER_L ].m; info->b[PSC_POWER ] = coeff[PSC_POWER_L ].b; + info->R[PSC_POWER ] = coeff[PSC_POWER_L ].R; }else { info->m[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN ].m; info->b[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN ].b; + info->R[PSC_CURRENT_IN ] = coeff[PSC_CURRENT_IN ].R; info->m[PSC_POWER ] = coeff[PSC_POWER ].m; info->b[PSC_POWER ] = coeff[PSC_POWER ].b; + info->R[PSC_POWER ] = coeff[PSC_POWER ].R; }return pmbus_do_probe (client, info);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 120/595 Bluetooth: L2CAP: validate connectionless PSM length
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <[email protected]>
[ Upstream commit a40a5f922546b3bd7c094d882b29177db4f2abe0 ]
Connectionless L2CAP frames carry a two-byte PSM at the start of the payload. l2cap_recv_frame() currently reads that PSM unconditionally after validating only the outer L2CAP length.
A malformed connectionless frame with a zero- or one-byte payload can therefore make the parser read beyond the advertised skb payload and use tailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer injected a one-byte connectionless payload and reached the unchecked read.
Reject connectionless frames that cannot contain the PSM before reading or pulling it. This preserves all valid connectionless frames while dropping only structurally incomplete packets.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -8106,6 +8106,11 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)break ;case L2CAP_CID_CONN_LESS : +if (skb->len <L2CAP_PSMLEN_SIZE ) { +kfree_skb (skb); +break ; + } + psm =get_unaligned ((__le16 *) skb->data);skb_pull (skb,L2CAP_PSMLEN_SIZE );l2cap_conless_channel (conn, psm, skb);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 121/595 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <[email protected]>
[ Upstream commit ee7b5f7b39332febf917f9ebf212842cc9379815 ]
rockchip_pdm_set_fmt() calls pm_runtime_get_sync() before accessing hardware registers, but ignores its return value.
If the runtime resume fails, the function continues to perform register accesses while the device state is undefined.
Replace pm_runtime_get_sync() with pm_runtime_resume_and_get() and return early on failure to avoid unpowered register accesses.
--- sound/soc/rockchip/rockchip_pdm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/soc/rockchip/rockchip_pdm.c +5 -1
@@ -260,6 +260,7 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai, {struct rk_pdm_dev *pdm =to_info (cpu_dai);unsigned int mask =0 , val =0 ; +int ret; mask =PDM_CKP_MSK ;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {
@@ -273,7 +274,10 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,return -EINVAL ; } -pm_runtime_get_sync (cpu_dai->dev); + ret =pm_runtime_resume_and_get (cpu_dai->dev); +if (ret) +return ret; +regmap_update_bits (pdm->regmap,PDM_CLK_CTRL , mask, val);pm_runtime_put (cpu_dai->dev);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 122/595 ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <[email protected]>
[ Upstream commit 3168721d6ec3b610edf6a3c22ad190722a27d276 ]
Enable the 'hclk' bus clock before the 'clk' controller clock during runtime resume.
The bus clock provides the register access interface, so enable it before the controller clock. This also makes the resume sequence the reverse of the suspend sequence, which keeps the clock ordering consistent.
--- sound/soc/rockchip/rockchip_pdm.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/rockchip/rockchip_pdm.c +5 -5
@@ -364,16 +364,16 @@ static int rockchip_pdm_runtime_resume(struct device *dev)struct rk_pdm_dev *pdm =dev_get_drvdata (dev);int ret; - ret =clk_prepare_enable (pdm->clk); + ret =clk_prepare_enable (pdm->hclk);if (ret) { -dev_err (pdm->dev,"clock enable failed %d\n" , ret); +dev_err (pdm->dev,"hclock enable failed %d\n" , ret);return ret; } - ret =clk_prepare_enable (pdm->hclk); + ret =clk_prepare_enable (pdm->clk);if (ret) { -clk_disable_unprepare (pdm->clk); -dev_err (pdm->dev,"hclock enable failed %d\n" , ret); +clk_disable_unprepare (pdm->hclk); +dev_err (pdm->dev,"clock enable failed %d\n" , ret);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 123/595 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: bui duc phuc <[email protected]>
[ Upstream commit 3546e9aa691ac981e4734fedd1646d0180784893 ]
If regcache_sync() fails during runtime resume, the driver disables the clocks and returns an error. However, the regmap cache-only mode is left disabled.
Restore cache-only mode in the error path so subsequent register accesses continue to use the cache while the device is inactive.
--- sound/soc/rockchip/rockchip_spdif.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/rockchip/rockchip_spdif.c +1 -0
@@ -96,6 +96,7 @@ static int __maybe_unused rk_spdif_runtime_resume(struct device *dev) ret =regcache_sync (spdif->regmap);if (ret) { +regcache_cache_only (spdif->regmap, true);clk_disable_unprepare (spdif->mclk);clk_disable_unprepare (spdif->hclk); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 124/595 sparc64: uprobes: add missing break
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 5b0eee4cd812bd6547eea393cb9b5c0322f26c88 ]
Missing fallthrough causes failure with newer compilers:
arch/sparc/kernel/uprobes.c:284:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]
284 | default:
| ^
arch/sparc/kernel/uprobes.c:284:2: note: insert 'break;' to avoid fall-through
284 | default:
| ^
| break;--- arch/sparc/kernel/uprobes.c | 1 + 1 file changed, 1 insertion(+)
arch/sparc/kernel/uprobes.c +1 -0
@@ -278,6 +278,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self,case DIE_SSTEP :if (uprobe_post_sstep_notifier (args->regs)) ret =NOTIFY_STOP ; +break ;default :break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 125/595 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazim Amirul <[email protected]>
[ Upstream commit d3265c19b35d036bba327b36b5366bee76b0157c ]
Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring.
However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE.
On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm.
RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix.
Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions.
Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h +2 -2
@@ -398,9 +398,9 @@#define XGMAC_RIE BIT(6)#define XGMAC_TBUE BIT(2)#define XGMAC_TIE BIT(0) -#define XGMAC_DMA_INT_DEFAULT_EN (XGMAC_NIE | XGMAC_AIE | XGMAC_RBUE | \ +#define XGMAC_DMA_INT_DEFAULT_EN (XGMAC_NIE | XGMAC_AIE | \ XGMAC_RIE | XGMAC_TIE) -#define XGMAC_DMA_INT_DEFAULT_RX (XGMAC_RBUE | XGMAC_RIE) +#define XGMAC_DMA_INT_DEFAULT_RX (XGMAC_RIE)#define XGMAC_DMA_INT_DEFAULT_TX (XGMAC_TIE)#define XGMAC_DMA_CH_Rx_WATCHDOG (x) (0x0000313c + (0x80 * (x)))#define XGMAC_RWT GENMASK(7, 0)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 126/595 vsock: use sk_acceptq_is_full() helper in all transports
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raf Dickson <[email protected]>
[ Upstream commit 4ff2e84ff1b33d79fa0e3ae355ce4a334908ef9a ]
Replace the open-coded backlog check with sk_acceptq_is_full(). The helper uses > instead of >=, which is the correct comparison per commit 64a146513f8f ("[NET]: Revert incorrect accept queue backlog changes."), and adds READ_ONCE() for proper memory ordering.
--- net/vmw_vsock/hyperv_transport.c | 2 +- net/vmw_vsock/vmci_transport.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/vmw_vsock/hyperv_transport.c +1 -1
@@ -314,7 +314,7 @@ static void hvs_open_connection(struct vmbus_channel *chan) goto out;if (conn_from_host) { -if (sk->sk_ack_backlog >= sk->sk_max_ack_backlog) +if (sk_acceptq_is_full (sk)) goto out; new =vsock_create_connected (sk);
net/vmw_vsock/vmci_transport.c +1 -1
@@ -1004,7 +1004,7 @@ static int vmci_transport_recv_listen(struct sock *sk,* reset. Otherwise we create and initialize a child socket and reply * with a connection negotiation. */ -if (sk->sk_ack_backlog >= sk->sk_max_ack_backlog) { +if (sk_acceptq_is_full (sk)) {vmci_transport_reply_reset (pkt);return -ECONNREFUSED ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 127/595 e1000e: limit endianness conversion to boundary words
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Agalakov Daniil <[email protected]>
[ Upstream commit a5ecafcfb27baf2dba766c4fd99dbb947f4e85d8 ]
[Why]
In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy().
The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words.
Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/e1000e/ethtool.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/e1000e/ethtool.c +12 -7
@@ -597,20 +597,25 @@ static int e1000_set_eeprom(struct net_device *netdev,/* need read/modify/write of first changed EEPROM word */ /* only the second byte of the word is being modified */ ret_val =e1000_read_nvm (hw, first_word,1 , &eeprom_buff[0 ]); +if (ret_val) + goto out; + +/* Device's eeprom is always little-endian, word addressable */ +le16_to_cpus (&eeprom_buff[0 ]); + ptr++; } -if (((eeprom->offset + eeprom->len) &1 ) && (!ret_val)) +if ((eeprom->offset + eeprom->len) &1 ) {/* need read/modify/write of last changed EEPROM word */ /* only the first byte of the word is being modified */ ret_val =e1000_read_nvm (hw, last_word,1 , &eeprom_buff[last_word - first_word]); +if (ret_val) + goto out; -if (ret_val) - goto out; - -/* Device's eeprom is always little-endian, word addressable */ -for (i =0 ; i < last_word - first_word +1 ; i++) -le16_to_cpus (&eeprom_buff[i]); +/* Device's eeprom is always little-endian, word addressable */ +le16_to_cpus (&eeprom_buff[last_word - first_word]); + }memcpy (ptr, bytes, eeprom->len);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 128/595 net/sched: act_csum: dont mangle UDP tunnel GSO packets
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Mikityanska <[email protected]>
[ Upstream commit 9bcb30b389ec5888590cb6ec58c7a3b80fe49a11 ]
Similar to commit add641e7dee3 ("sched: act_csum: don't mangle TCP and UDP GSO packets"), UDP tunnel GSO packets going through act_csum shouldn't have their checksum calculated at this point, because it will be done after segmentation. Setting the checksum in act_csum modifies skb->ip_summed and prevents inner IP csum offload from kicking in, resulting in a packet with a bad checksum.
Add UDP tunnel GSO packets to the exceptions, and also add UDP GSO (SKB_GSO_UDP_L4), as the same logic as in the commit mentioned above applies to UDP GSO too.
--- net/sched/act_csum.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/sched/act_csum.c +6 -2
@@ -257,7 +257,9 @@ static int tcf_csum_ipv4_udp(struct sk_buff *skb, unsigned int ihl,const struct iphdr *iph;u16 ul; -if (skb_is_gso (skb) &&skb_shinfo (skb)->gso_type &SKB_GSO_UDP ) +if (skb_is_gso (skb) &&skb_shinfo (skb)->gso_type & + (SKB_GSO_UDP |SKB_GSO_UDP_L4 | +SKB_GSO_UDP_TUNNEL |SKB_GSO_UDP_TUNNEL_CSUM ))return 1 ;/*
@@ -313,7 +315,9 @@ static int tcf_csum_ipv6_udp(struct sk_buff *skb, unsigned int ihl,const struct ipv6hdr *ip6h;u16 ul; -if (skb_is_gso (skb) &&skb_shinfo (skb)->gso_type &SKB_GSO_UDP ) +if (skb_is_gso (skb) &&skb_shinfo (skb)->gso_type & + (SKB_GSO_UDP |SKB_GSO_UDP_L4 | +SKB_GSO_UDP_TUNNEL |SKB_GSO_UDP_TUNNEL_CSUM ))return 1 ;/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 129/595 sparc: Disable compat support with LLD
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 852fed2e8bfe195351fb0078ba7245d41154e7a5 ]
An LLVM=1 sparc64 allmodconfig enables COMPAT and then tries to build the 32-bit vDSO. That path cannot be linked with ld.lld:
ld.lld: error: unknown emulation: elf32_sparc
ld.lld does not support the 32-bit SPARC ELF emulation used for the compat vDSO, so keep COMPAT disabled when LLD is the linker. This avoids selecting an unsupported build path while leaving the existing GNU ld configuration unchanged.
--- arch/sparc/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/sparc/Kconfig +1 -0
@@ -496,6 +496,7 @@ endmenu config COMPAT bool depends on SPARC64 + depends on !LD_IS_LLD default y select COMPAT_BINFMT_ELF if BINFMT_ELF select HAVE_UID16
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 130/595 fuse: set ff->flock only on success
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Tianci <[email protected]>
[ Upstream commit 71947173cef279be5eed209ec28f8c11f9d73159 ]
If FUSE_SETLK fails (e.g., due to EWOULDBLOCK), we shall not set FUSE_RELEASE_FLOCK_UNLOCK in fuse_file_release().
--- fs/fuse/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/fuse/file.c +2 -1
@@ -2570,8 +2570,9 @@ static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)struct fuse_file *ff = file->private_data;/* emulate flock with POSIX locks */ - ff->flock = true; err =fuse_setlk (file, fl,1 ); +if (!err) + ff->flock = true; }return err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 131/595 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 57a6ed0b41677ccc5e28cc0976e495c1dfa33747 ]
bfa_fcs_fdmi_get_portattr() gets inlined into multiple places and has two fairly large variables on the stack, to the point of causing a warning in some randconfig builds:
drivers/scsi/bfa/bfa_fcs_lport.c:2198:1: error: stack frame size (1560) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_portattr_block' [-Werror,-Wframe-larger-than]
2198 | bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
| ^
drivers/scsi/bfa/bfa_fcs_lport.c:1856:1: error: stack frame size (1600) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_rhba_pyld' [-Werror,-Wframe-larger-than]
1856 | bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
| ^Mark the inner function as noinline_for_stack to keep it separate from the other variables and prevent multiple copies of the same variable to get inlined here.
--- drivers/scsi/bfa/bfa_fcs_lport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/bfa/bfa_fcs_lport.c +1 -1
@@ -2665,7 +2665,7 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi, } -static void +static noinline_for_stack voidbfa_fcs_fdmi_get_portattr (struct bfa_fcs_lport_fdmi_s *fdmi,struct bfa_fcs_fdmi_port_attr_s *port_attr) {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 132/595 gpio: pisosr: Read "ngpios" as u32
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 4910aa198d25e5d1067236560ba34ab12bccc677 ]
The generic "ngpios" property is encoded as a normal uint32 cell. The pisosr driver stores it in the gpio_chip field, but reading it with a u16 helper does not match the DT property encoding.
Read "ngpios" as u32 and keep the existing assignment to the chip field.
--- drivers/gpio/gpio-pisosr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpio/gpio-pisosr.c +3 -1
@@ -128,6 +128,7 @@ static int pisosr_gpio_probe(struct spi_device *spi) {struct device *dev = &spi->dev;struct pisosr_gpio *gpio; +u32 ngpios;int ret; gpio =devm_kzalloc (dev,sizeof (*gpio),GFP_KERNEL );
@@ -138,7 +139,8 @@ static int pisosr_gpio_probe(struct spi_device *spi) gpio->chip = template_chip; gpio->chip.parent = dev; -of_property_read_u16 (dev->of_node,"ngpios" , &gpio->chip.ngpio); +if (!of_property_read_u32 (dev->of_node,"ngpios" , &ngpios)) + gpio->chip.ngpio = ngpios; gpio->spi = spi;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 133/595 ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Galen Hassen <[email protected]>
[ Upstream commit f7c4968ae3af3e819428da5416c2dfd361473f5c ]
The Lenovo IdeaPad Slim 5 16AKP10 (PCI SSID 17aa:38b6) uses the Conexant SN6140 codec. The internal microphone is on pin 0x1a but the BIOS configures it with pin default 0x95a60120, which includes a jack detection bit that causes the kernel to treat it as an unplugged external mic rather than a fixed internal mic.
Add a pin config quirk that overrides pin 0x1a to 0x95a60130, setting the connectivity bits to indicate a fixed/always-connected device. This allows the internal microphone to be correctly identified and used.
--- sound/pci/hda/patch_conexant.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/pci/hda/patch_conexant.c +12 -0
@@ -237,6 +237,7 @@ enum {CXT_FIXUP_HEADSET_MIC ,CXT_FIXUP_HP_MIC_NO_PRESENCE ,CXT_PINCFG_SWS_JS201D , +CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10 ,CXT_PINCFG_TOP_SPEAKER ,CXT_FIXUP_HP_A_U , CXT_FIXUP_ACER_SWIFT_HP,
@@ -771,6 +772,12 @@ static const struct hda_pintbl cxt_pincfg_lemote[] = { {} }; +/* Lenovo IdeaPad Slim 5 16AKP10 with SN6140 */ +static const struct hda_pintbl cxt_pincfg_lenovo_ideapad_slim5_16akp10[] = { + {0x1a ,0x95a60130 },/* Internal mic, fixed/always-connected */ + {} +}; +/* SuoWoSi/South-holding JS201D with sn6140 */ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {0x16 ,0x03211040 },/* hp out */
@@ -962,6 +969,10 @@ static const struct hda_fixup cxt_fixups[] = { .type = HDA_FIXUP_PINS, .v.pins = cxt_pincfg_sws_js201d, }, + [CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10] = { + .type = HDA_FIXUP_PINS, + .v.pins = cxt_pincfg_lenovo_ideapad_slim5_16akp10, + }, [CXT_PINCFG_TOP_SPEAKER] = { .type = HDA_FIXUP_FUNC, .v.func = cxt_fixup_sirius_top_speaker,
@@ -1067,6 +1078,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x17aa ,0x21da ,"Lenovo X220" ,CXT_PINCFG_LENOVO_TP410 ),SND_PCI_QUIRK (0x17aa ,0x21db ,"Lenovo X220-tablet" ,CXT_PINCFG_LENOVO_TP410 ),SND_PCI_QUIRK (0x17aa ,0x38af ,"Lenovo IdeaPad Z560" ,CXT_FIXUP_MUTE_LED_EAPD ), +SND_PCI_QUIRK (0x17aa ,0x38b6 ,"Lenovo IdeaPad Slim 5 16AKP10" ,CXT_PINCFG_LENOVO_IDEAPAD_SLIM5_16AKP10 ),SND_PCI_QUIRK (0x17aa ,0x3905 ,"Lenovo G50-30" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x390b ,"Lenovo G50-80" ,CXT_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 134/595 leds: uleds: Return -EFAULT on copy_to_user() failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <[email protected]>
[ Upstream commit 61ed78f55a46e12afd4b464c4ba736f55ff33c5e ]
uleds_read() copies the current brightness value to userspace but ignores copy_to_user() failures. It then clears the pending update and reports a successful full read even when no data was copied.
Return -EFAULT when the copy fails and leave the update pending so a later read can retry.
--- drivers/leds/uleds.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/leds/uleds.c +7 -4
@@ -148,10 +148,13 @@ static ssize_t uleds_read(struct file *file, char __user *buffer, size_t count, }else if (!udev->new_data && (file->f_flags &O_NONBLOCK )) { retval = -EAGAIN ; }else if (udev->new_data) { - retval =copy_to_user (buffer, &udev->brightness, -sizeof (udev->brightness)); - udev->new_data = false; - retval =sizeof (udev->brightness); +if (copy_to_user (buffer, &udev->brightness, +sizeof (udev->brightness))) { + retval = -EFAULT ; + }else { + udev->new_data = false; + retval =sizeof (udev->brightness); + } }mutex_unlock (&udev->mutex);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 135/595 leds: pca9532: Dont stop blinking for non-zero brightness
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Deiminger <[email protected]>
[ Upstream commit 0261683a4d31783d680e74b3ae5f22f6a62128cc ]
pca9532 unexpectedly stopped blinking when changing brightness to a non-zero value. To reproduce:
echo timer > /sys/class/leds/led-1/trigger # blinks echo 255 > /sys/class/leds/led-1/brightness # blinking stops, light on cat /sys/class/leds/led-1/trigger # still claims [timer]
According to Documentation/leds/leds-class.rst, only brightness = 0 shall be a stop condition:
Quoted 3 lines
You can change the brightness value of a LED independently of the timer trigger. However, if you set the brightness value to
LED_OFFit will also disable the timer trigger.
Therefore add a guard to continue blinking when brightness != LED_OFF, similar to how pca955x does it since 575f10dc64a2 ("leds: pca955x: Add HW blink support").
--- drivers/leds/leds-pca9532.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/leds/leds-pca9532.c +5 -3
@@ -177,11 +177,13 @@ static int pca9532_set_brightness(struct led_classdev *led_cdev,int err =0 ;struct pca9532_led *led =ldev_to_led (led_cdev); -if (value ==LED_OFF ) +if (value ==LED_OFF ) { led->state =PCA9532_OFF ; -else if (value ==LED_FULL ) + }else if (led->state ==PCA9532_PWM1 ) { +return 0 ;/* Non-zero brightness shall not stop HW blinking */ + }else if (value ==LED_FULL ) { led->state =PCA9532_ON ; -else { + }else { led->state =PCA9532_PWM0 ;/* Thecus: hardcode one pwm */ err =pca9532_calcpwm (led->client,0 ,0 , value);if (err)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 136/595 ALSA: usb-audio: Add quirk for YAMAHA CDS3000
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Louis Colaco <[email protected]>
[ Upstream commit 348f69320e4db6ebec6940c81154bec4b9eb275a ]
This quirk is identical to the one for the Yamaha Steinberg UR22, here applied to a CD player that also uses the Steinberg USB interface. This quirk is necessary to avoid sporadic "clic" noise when using the DAC of the player.
--- sound/usb/quirks-table.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
sound/usb/quirks-table.h +14 -0
@@ -484,6 +484,20 @@ YAMAHA_DEVICE(0x105d, NULL), } } }, +{ +USB_DEVICE (0x0499 ,0x150d ), + QUIRK_DRIVER_INFO { +/* .vendor_name = "Yamaha", */ +/* .product_name = "CDS3000", */ + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END + } + } +}, {USB_DEVICE (0x0499 ,0x1718 ), QUIRK_DRIVER_INFO {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 137/595 PCI: iproc: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a6a64e150f12ad5391e0a0d60f6a3d119b06ce50 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-iproc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-iproc.c +2 -0
@@ -1556,8 +1556,10 @@ int iproc_pcie_remove(struct iproc_pcie *pcie) {struct pci_host_bridge *host =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (host->bus);pci_remove_root_bus (host->bus); +pci_unlock_rescan_remove ();iproc_pcie_msi_disable (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 138/595 PCI: altera: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a8759c8ac48c0419f5899e95a6ffc611b07c965b ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-altera.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-altera.c +2 -0
@@ -837,8 +837,10 @@ static int altera_pcie_remove(struct platform_device *pdev)struct altera_pcie *pcie =platform_get_drvdata (pdev);struct pci_host_bridge *bridge =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (bridge->bus);pci_remove_root_bus (bridge->bus); +pci_unlock_rescan_remove ();altera_pcie_irq_teardown (pcie);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 139/595 PCI: rockchip: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit 0bd9611587bb494c33566d825fe34b2705e4b167 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-rockchip-host.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-rockchip-host.c +2 -0
@@ -1021,8 +1021,10 @@ static int rockchip_pcie_remove(struct platform_device *pdev)struct rockchip_pcie *rockchip =dev_get_drvdata (dev);struct pci_host_bridge *bridge =pci_host_bridge_from_priv (rockchip); +pci_lock_rescan_remove ();pci_stop_root_bus (bridge->bus);pci_remove_root_bus (bridge->bus); +pci_unlock_rescan_remove ();irq_domain_remove (rockchip->irq_domain);rockchip_pcie_deinit_phys (rockchip);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 140/595 PCI: mediatek: Protect root bus removal with rescan lock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Zhang <[email protected]>
[ Upstream commit a29812a55da8d0dbeb071b26ac428c338e3fc389 ]
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
--- drivers/pci/controller/pcie-mediatek.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/pcie-mediatek.c +2 -0
@@ -1155,8 +1155,10 @@ static int mtk_pcie_remove(struct platform_device *pdev)struct mtk_pcie *pcie =platform_get_drvdata (pdev);struct pci_host_bridge *host =pci_host_bridge_from_priv (pcie); +pci_lock_rescan_remove ();pci_stop_root_bus (host->bus);pci_remove_root_bus (host->bus); +pci_unlock_rescan_remove ();mtk_pcie_free_resources (pcie);mtk_pcie_irq_teardown (pcie);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 141/595 md/raid5: let stripe batch bm_seq comparison wrap-safe
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Cheng <[email protected]>
[ Upstream commit 00e93faf4cea9e8802ac5dfee0952d84fc95c40f ]
Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -911,7 +911,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *shif (test_and_clear_bit (STRIPE_BIT_DELAY , &sh->state)) {int seq = sh->bm_seq;if (test_bit (STRIPE_BIT_DELAY , &sh->batch_head->state) && - sh->batch_head->bm_seq > seq) + sh->batch_head->bm_seq - seq >0 ) seq = sh->batch_head->bm_seq;set_bit (STRIPE_BIT_DELAY , &sh->batch_head->state); sh->batch_head->bm_seq = seq;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 142/595 f2fs: validate inline dentry name lengths before conversion
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <[email protected]>
[ Upstream commit cfcd0e49a178b3dac2c0ece656079081dbf5da74 ]
Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots.
A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block.
Validate each inline dentry name length against the inline filename area before copying it.
--- fs/f2fs/inline.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/f2fs/inline.c +7 -0
@@ -478,6 +478,12 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry) bit_pos++;continue ; } +if (unlikely (le16_to_cpu (de->name_len) >F2FS_NAME_LEN || + bit_pos +GET_DENTRY_SLOTS (le16_to_cpu (de->name_len)) > + d.max)) { + err = -EFSCORRUPTED ; + goto punch_dentry_pages; + }/* * We only need the disk_name and hash to move the dentry.
@@ -498,6 +504,7 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry) bit_pos +=GET_DENTRY_SLOTS (le16_to_cpu (de->name_len)); }return 0 ; + punch_dentry_pages:truncate_inode_pages (&dir->i_data,0 );f2fs_truncate_blocks (dir,0 , false);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 143/595 rtc: aspeed: add AST2700 compatible
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommy Huang <[email protected]>
[ Upstream commit 3319cfeeb8c4047026f84df045c438f7bbd338a6 ]
Add support for matching the RTC controller on ASPEED AST2700 SoCs.
The AST2700 RTC controller is compatible with the existing ASPEED RTC driver implementation.
--- drivers/rtc/rtc-aspeed.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-aspeed.c +1 -0
@@ -111,6 +111,7 @@ static const struct of_device_id aspeed_rtc_match[] = { { .compatible = "aspeed,ast2400-rtc", }, { .compatible = "aspeed,ast2500-rtc", }, { .compatible = "aspeed,ast2600-rtc", }, + { .compatible = "aspeed,ast2700-rtc", }, {} }; MODULE_DEVICE_TABLE(of, aspeed_rtc_match);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 144/595 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <[email protected]>
[ Upstream commit 92742802ecbf215a2b60dcfd326d2213595010f1 ]
pci_write_rom() controls access to the ROM content through the corresponding sysfs attribute, and treats the input as a request to disable only when it matches the string "0\n" exactly:
if ((off == 0) && (*buf == '0') && (count == 2))
The count == 2 condition encodes the trailing newline that echo(1) appends. This was found when userspace wrote "0" without a trailing newline aiming to disable access, which failed to match the condition above and enabled access instead. For example:
$ echo 0 > rom # "0\n", count 2, access disabled $ echo -n 0 > rom # "0", count 1, access enabled $ echo > rom # "", count 1, access enabled (likely not desirable)
Parse the input with kstrtobool(), which handles common boolean inputs such as "0", "1", "n", "y" or "off", "on", with or without a trailing newline, so both of the above disable access, and update the now stale comment.
As a side effect, input that does not parse as a boolean is rejected with -EINVAL rather than enabling access. The documented "0" and "1" continue to work as before, and rejecting malformed input brings the attribute in line with how sysfs attributes typically handle it.
--- drivers/pci/pci-sysfs.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/pci/pci-sysfs.c +6 -5
@@ -1308,18 +1308,19 @@ void __weak pci_remove_resource_files(struct pci_dev *dev) { return; }* @off: file offset * @count: number of byte in input * -* writing anything except 0 enables it +* Writing a boolean value enables or disables the ROM display. */ static ssize_t pci_write_rom (struct file *filp,struct kobject *kobj,struct bin_attribute *bin_attr,char *buf,loff_t off,size_t count) {struct pci_dev *pdev =to_pci_dev (kobj_to_dev (kobj)); +bool enable; -if ((off ==0 ) && (*buf =='0' ) && (count ==2 )) - pdev->rom_attr_enabled =0 ; -else - pdev->rom_attr_enabled =1 ; +if (kstrtobool (buf, &enable)) +return -EINVAL ; + + pdev->rom_attr_enabled = enable;return count; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 145/595 net: au1000: move free_irq out of the close-time spinlocked section
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <[email protected]>
[ Upstream commit f48763beab4eea41fc480c9702ec6eebe8d75e4f ]
au1000_close() calls free_irq() while aup->lock is still held with spin_lock_irqsave(). free_irq() can sleep because it takes the IRQ descriptor request mutex, so it does not belong inside the close-time spinlocked section.
This was found by our static analysis tool and then confirmed by manual review of the in-tree au1000_close() .ndo_stop path. The reviewed path keeps aup->lock held across the MAC reset, queue stop and free_irq(dev->irq, dev).
A directed runtime validation kept that ndo_stop carrier and the same free_irq(dev->irq, dev) operation under the driver lock. Lockdep reported "BUG: sleeping function called from invalid context" and "Invalid wait context" while free_irq() was taking desc->request_mutex, with au1000_close() and free_irq() on the stack.
Drop aup->lock before freeing the IRQ. The protected close-time work still stops the device and queue before IRQ teardown, but the sleepable IRQ core path now runs outside the spinlocked section.
--- drivers/net/ethernet/amd/au1000_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/amd/au1000_eth.c +2 -1
@@ -943,9 +943,10 @@ static int au1000_close(struct net_device *dev)/* stop the device */ netif_stop_queue (dev); +spin_unlock_irqrestore (&aup->lock, flags); +/* disable the interrupt */ free_irq (dev->irq, dev); -spin_unlock_irqrestore (&aup->lock, flags);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/595 rtc: bq32000: add delay between RTC reads
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adriana Stancu <[email protected]>
[ Upstream commit d4992b7050a10079bc760bdc5b8688e05a09dfc2 ]
When the RTC is used on systems without a interrupt line, userspace tools like hwclock fall back to a frequent polling loop to synchronize with the edge of the next second.
On the BQ32000, this aggressive polling can temporarly lock the register refresh cycle, because the continuous transfers prevent the hardware from updating the buffer. This results in stale data reads or select() timeouts in userspace.
This patch introduces a delay before reading the RTC registers in order to provide a sufficient idle time for the hardware to sync with the register buffer.
--- drivers/rtc/rtc-bq32k.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/rtc/rtc-bq32k.c +9 -0
@@ -15,6 +15,7 @@#include <linux/init.h> #include <linux/errno.h> #include <linux/bcd.h> +#include <linux/delay.h> #define BQ32K_SECONDS 0x00/* Seconds register address */ #define BQ32K_SECONDS_MASK 0x7F/* Mask over seconds value */
@@ -88,9 +89,17 @@ static int bq32k_write(struct device *dev, void *data, uint8_t off, uint8_t len)static int bq32k_rtc_read_time (struct device *dev,struct rtc_time *tm) { +struct i2c_client *client =to_i2c_client (dev);struct bq32k_regs regs;int error; +/* +* When the device doesn't have the interrupt connected, prevent +* userpace from polling the RTC registers too frequently. +*/ +if (client->irq <=0 ) +usleep_range (2000 ,2500 ); + error =bq32k_read (dev, ®s,0 ,sizeof (regs));if (error)return error;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 147/595 fbdev: pm2fb: unwind WC setup on probe failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
[ Upstream commit 16eb19f0c90af03bda6ba66586d7bb0e9cf85b43 ]
Add arch_phys_wc_del() on error path to keep the write-combining setup balanced when later probe steps fail.
--- drivers/video/fbdev/pm2fb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/pm2fb.c +1 -0
@@ -1706,6 +1706,7 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id) err_exit_both:kfree (info->pixmap.addr); err_exit_pixmap: +arch_phys_wc_del (default_par->wc_cookie);iounmap (info->screen_base);release_mem_region (pm2fb_fix.smem_start, pm2fb_fix.smem_len); err_exit_mmio:
Signature · 1 line
2.53.0