5.10.37-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 420/530 ovl: invalidate readdir cache on changes to dir with origin
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit 65cd913ec9d9d71529665924c81015b7ab7d9381 ]
The test in ovl_dentry_version_inc() was out-dated and did not include the case where readdir cache is used on a non-merge dir that has origin xattr, indicating that it may contain leftover whiteouts.
To make the code more robust, use the same helper ovl_dir_is_real() to determine if readdir cache should be used and if readdir cache should be invalidated.
--- fs/overlayfs/overlayfs.h | 30 +++++++++++++++++++++++++++--- fs/overlayfs/readdir.c | 12 ------------ fs/overlayfs/util.c | 31 +++++++++---------------------- 3 files changed, 36 insertions(+), 37 deletions(-)
fs/overlayfs/overlayfs.h +27 -3
@@ -308,9 +308,6 @@ int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry, enum ovl_xattr ox, const void *value, size_t size, int xerr);int ovl_set_impure (struct dentry *dentry,struct dentry *upperdentry); -void ovl_set_flag (unsigned long flag,struct inode *inode); -void ovl_clear_flag (unsigned long flag,struct inode *inode); -bool ovl_test_flag (unsigned long flag,struct inode *inode);bool ovl_inuse_trylock (struct dentry *dentry);void ovl_inuse_unlock (struct dentry *dentry);bool ovl_is_inuse (struct dentry *dentry);
@@ -324,6 +321,21 @@ char *ovl_get_redirect_xattr(struct ovl_fs *ofs, struct dentry *dentry, int padding);int ovl_sync_status (struct ovl_fs *ofs); +static inline void ovl_set_flag (unsigned long flag,struct inode *inode) +{ +set_bit (flag, &OVL_I (inode)->flags); +} + +static inline void ovl_clear_flag (unsigned long flag,struct inode *inode) +{ +clear_bit (flag, &OVL_I (inode)->flags); +} + +static inline bool ovl_test_flag (unsigned long flag,struct inode *inode) +{ +return test_bit (flag, &OVL_I (inode)->flags); +} +static inline bool ovl_is_impuredir (struct super_block *sb,struct dentry *dentry) {
@@ -427,6 +439,18 @@ int ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, struct dentry *dentry, int level);int ovl_indexdir_cleanup (struct ovl_fs *ofs); +/* +* Can we iterate real dir directly? +* +* Non-merge dir may contain whiteouts from a time it was a merge upper, before +* lower dir was removed under it and possibly before it was rotated from upper +* to lower layer. +*/ +static inline bool ovl_dir_is_real (struct dentry *dir) +{ +return !ovl_test_flag (OVL_WHITEOUTS ,d_inode (dir)); +} +/* inode.c */ int ovl_set_nlink_upper (struct dentry *dentry);int ovl_set_nlink_lower (struct dentry *dentry);
fs/overlayfs/readdir.c +0 -12
@@ -319,18 +319,6 @@ static inline int ovl_dir_read(struct path *realpath,return err; } -/* -* Can we iterate real dir directly? -* -* Non-merge dir may contain whiteouts from a time it was a merge upper, before -* lower dir was removed under it and possibly before it was rotated from upper -* to lower layer. -*/ -static bool ovl_dir_is_real (struct dentry *dir) -{ -return !ovl_test_flag (OVL_WHITEOUTS ,d_inode (dir)); -} -static void ovl_dir_reset (struct file *file) {struct ovl_dir_file *od = file->private_data;
fs/overlayfs/util.c +9 -22
@@ -419,18 +419,20 @@ void ovl_inode_update(struct inode *inode, struct dentry *upperdentry) } } -static void ovl_dentry_version_inc (struct dentry *dentry,bool impurity) +static void ovl_dir_version_inc (struct dentry *dentry,bool impurity) {struct inode *inode =d_inode (dentry);WARN_ON (!inode_is_locked (inode)); +WARN_ON (!d_is_dir (dentry));/* -* Version is used by readdir code to keep cache consistent. For merge -* dirs all changes need to be noted. For non-merge dirs, cache only -* contains impure (ones which have been copied up and have origins) -* entries, so only need to note changes to impure entries. +* Version is used by readdir code to keep cache consistent. +* For merge dirs (or dirs with origin) all changes need to be noted. +* For non-merge dirs, cache contains only impure entries (i.e. ones +* which have been copied up and have origins), so only need to note +* changes to impure entries. */ -if (OVL_TYPE_MERGE (ovl_path_type (dentry)) || impurity) +if (!ovl_dir_is_real (dentry) || impurity)OVL_I (inode)->version++; }
@@ -439,7 +441,7 @@ void ovl_dir_modified(struct dentry *dentry, bool impurity)/* Copy mtime/ctime */ ovl_copyattr (d_inode (ovl_dentry_upper (dentry)),d_inode (dentry)); -ovl_dentry_version_inc (dentry, impurity); +ovl_dir_version_inc (dentry, impurity); }u64 ovl_dentry_version_get (struct dentry *dentry)
@@ -634,21 +636,6 @@ int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry)return err; } -void ovl_set_flag (unsigned long flag,struct inode *inode) -{ -set_bit (flag, &OVL_I (inode)->flags); -} - -void ovl_clear_flag (unsigned long flag,struct inode *inode) -{ -clear_bit (flag, &OVL_I (inode)->flags); -} - -bool ovl_test_flag (unsigned long flag,struct inode *inode) -{ -return test_bit (flag, &OVL_I (inode)->flags); -} -/** * Caller must hold a reference to inode to prevent it from being freed while * it is marked inuse.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 421/530 RDMA/qedr: Fix error return code in qedr_iw_connect()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 10dd83dbcd157baf7a78a09ddb2f84c627bc7f1d ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/hw/qedr/qedr_iw_cm.c +3 -1
@@ -636,8 +636,10 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)memcpy (in_params.local_mac_addr, dev->ndev->dev_addr,ETH_ALEN );if (test_and_set_bit (QEDR_IWARP_CM_WAIT_FOR_CONNECT , - &qp->iwarp_cm_flags)) + &qp->iwarp_cm_flags)) { + rc = -ENODEV ; goto err;/* QP already being destroyed */ + } rc = dev->ops->iwarp_connect (dev->rdma_ctx, &in_params, &out_params);if (rc) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 422/530 IB/hfi1: Fix error return code in parse_platform_config()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 4c7d9c69adadfc31892c7e8e134deb3546552106 ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/hfi1/firmware.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/hfi1/firmware.c +1 -0
@@ -1916,6 +1916,7 @@ int parse_platform_config(struct hfi1_devdata *dd)dd_dev_err (dd,"%s: Failed CRC check at offset %ld\n" , __func__, (ptr - (u32 *)dd->platform_config.data)); + ret = -EINVAL ; goto bail; }/* Jump the CRC DWORD */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 423/530 RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 22efb0a8d130c6379c1eb64cbace1542b27e37ff ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/bnxt_re/qplib_fp.c +1 -0
@@ -2784,6 +2784,7 @@ do_rq:dev_err (&cq->hwq.pdev->dev,"FP: CQ Processed terminal reported rq_cons_idx 0x%x exceeds max 0x%x\n" , cqe_cons, rq->max_wqe); + rc = -EINVAL ; goto done; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 424/530 cxgb4: Fix unintentional sign extension issues
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit dd2c79677375c37f8f9f8d663eb4708495d595ef ]
The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that the top bit of the u8 is set then all then all the upper 32 bits of the u64 end up as also being set because of the sign-extension. Fix this by casting the u8 values to a u64 before the 24 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- .../net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +11 -11
@@ -174,31 +174,31 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_lip[15 ] | f->fs.nat_lip[14 ] <<8 | f->fs.nat_lip[13 ] <<16 | - f->fs.nat_lip[12] << 24, 1); + (u64)f->fs.nat_lip[12] << 24, 1);set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +1 ,WORD_MASK , f->fs.nat_lip[11 ] | f->fs.nat_lip[10 ] <<8 | f->fs.nat_lip[9 ] <<16 | - f->fs.nat_lip[8 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[8 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +2 ,WORD_MASK , f->fs.nat_lip[7 ] | f->fs.nat_lip[6 ] <<8 | f->fs.nat_lip[5 ] <<16 | - f->fs.nat_lip[4 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[4 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_SND_UNA_RAW_W +3 ,WORD_MASK , f->fs.nat_lip[3 ] | f->fs.nat_lip[2 ] <<8 | f->fs.nat_lip[1 ] <<16 | - f->fs.nat_lip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[0 ] <<24 ,1 ); }else {set_tcb_field (adap, f, tid,TCB_RX_FRAG3_LEN_RAW_W ,WORD_MASK , f->fs.nat_lip[3 ] | f->fs.nat_lip[2 ] <<8 | f->fs.nat_lip[1 ] <<16 | - f->fs.nat_lip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[0 ] <<25 ,1 ); } }
@@ -208,25 +208,25 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_fip[15 ] | f->fs.nat_fip[14 ] <<8 | f->fs.nat_fip[13 ] <<16 | - f->fs.nat_fip[12] << 24, 1); + (u64)f->fs.nat_fip[12] << 24, 1);set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +1 ,WORD_MASK , f->fs.nat_fip[11 ] | f->fs.nat_fip[10 ] <<8 | f->fs.nat_fip[9 ] <<16 | - f->fs.nat_fip[8 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[8 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +2 ,WORD_MASK , f->fs.nat_fip[7 ] | f->fs.nat_fip[6 ] <<8 | f->fs.nat_fip[5 ] <<16 | - f->fs.nat_fip[4 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[4 ] <<24 ,1 );set_tcb_field (adap, f, tid,TCB_RX_FRAG2_PTR_RAW_W +3 ,WORD_MASK , f->fs.nat_fip[3 ] | f->fs.nat_fip[2 ] <<8 | f->fs.nat_fip[1 ] <<16 | - f->fs.nat_fip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_fip[0 ] <<24 ,1 ); }else { set_tcb_field(adap, f, tid,
@@ -234,13 +234,13 @@ static void set_nat_params(struct adapter *adap, struct filter_entry *f,WORD_MASK , f->fs.nat_fip[3 ] | f->fs.nat_fip[2 ] <<8 | f->fs.nat_fip[1 ] <<16 | - f->fs.nat_fip[0] << 24, 1); + (u64)f->fs.nat_fip[0] << 24, 1); } }set_tcb_field (adap, f, tid,TCB_PDU_HDR_LEN_W ,WORD_MASK , (dp ? (nat_lp[1 ] | nat_lp[0 ] <<8 ) :0 ) | - (sp ? (nat_fp[1 ] <<16 | nat_fp[0 ] <<24 ) :0 ), + (sp ? (nat_fp[1 ] <<16 | (u64 )nat_fp[0 ] <<24 ) :0 ),1 ); }
Signature · 1 line
2.30.2
Re: [PATCH 5.10 424/530] cxgb4: Fix unintentional sign extension issues
Hi!
Quoted 8 lines
From: Colin Ian King <[email protected]>
The shifting of the u8 integers f->fs.nat_lip[] by 24 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that the top bit of the u8 is set then all then all the upper 32 bits of the u64 end up as also being set because of the sign-extension. Fix this by casting the u8 values to a u64 before the 24 bit left shift.
Should we really use -stable series for beta-testing patches going to -rc1? Because that's what Sasha is effectively doing.
Quoted 6 lines
Addresses-Coverity: ("Unintended sign extension")
Fixes 12b276fbf6e0 ("cxgb4: add support to create hash filters")Signed-off-by Colin Ian King <[email protected]>Signed-off-by David S. Miller <[email protected]>Signed-off-by Sasha Levin <[email protected]>
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c static void set_nat_params(struct adapter *adap, struct filter_entry *f, · line 203
Quoted 8 lines
drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +1
-1set_tcb_field (adap, f, tid,TCB_RX_FRAG3_LEN_RAW_W ,WORD_MASK , f->fs.nat_lip[3 ] | f->fs.nat_lip[2 ] <<8 | f->fs.nat_lip[1 ] <<16 | - f->fs.nat_lip[0 ] <<24 ,1 ); + (u64 )f->fs.nat_lip[0 ] <<25 ,1 ); } }
This one is wrong.
Best regards,
Pavel
Signature · 1 line
http://www.livejournal.com/~pavelmachek
Greg Kroah-Hartman
maintainerPATCH 425/530 net: thunderx: Fix unintentional sign extension issue
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]
The shifting of the u8 integers rq->caching by 26 bits to the left will be promoted to a 32 bit signed int and then sign-extended to a u64. In the event that rq->caching is greater than 0x1f then all then all the upper 32 bits of the u64 end up as also being set because of the int sign-extension. Fix this by casting the u8 values to a u64 before the 26 bit left shift.
Addresses-Coverity: ("Unintended sign extension")
--- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cavium/thunder/nicvf_queues.c +1 -1
@@ -776,7 +776,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, mbx.rq.msg =NIC_MBOX_MSG_RQ_CFG ; mbx.rq.qs_num = qs->vnic_id; mbx.rq.rq_num = qidx; - mbx.rq.cfg = (rq->caching <<26 ) | (rq->cq_qs <<19 ) | + mbx.rq.cfg = ((u64 )rq->caching <<26 ) | (rq->cq_qs <<19 ) | (rq->cq_idx <<16 ) | (rq->cont_rbdr_qs <<9 ) | (rq->cont_qs_rbdr_idx <<8 ) | (rq->start_rbdr_qs <<1 ) | (rq->start_qs_rbdr_idx);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 426/530 RDMA/srpt: Fix error return code in srpt_cm_req_recv()
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 6bc950beff0c440ac567cdc4e7f4542a9920953d ]
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -0
@@ -2378,6 +2378,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,pr_info ("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n" ,dev_name (&sdev->device->dev), port_num);mutex_unlock (&sport->mutex); + ret = -EINVAL ; goto reject; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 427/530 RDMA/rtrs-clt: destroy sysfs after removing session from active list
In reply to Greg Kroah-HartmanFrom: Gioh Kim <[email protected]>
[ Upstream commit 7f4a8592ff29f19c5a2ca549d0973821319afaad ]
A session can be removed dynamically by sysfs interface "remove_path" that eventually calls rtrs_clt_remove_path_from_sysfs function. The current rtrs_clt_remove_path_from_sysfs first removes the sysfs interfaces and frees sess->stats object. Second it removes the session from the active list.
Therefore some functions could access non-connected session and access the freed sess->stats object even-if they check the session status before accessing the session.
For instance rtrs_clt_request and get_next_path_min_inflight check the session status and try to send IO to the session. The session status could be changed when they are trying to send IO but they could not catch the change and update the statistics information in sess->stats object, and generate use-after-free problem.
(see: "RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats")
This patch changes the rtrs_clt_remove_path_from_sysfs to remove the session from the active session list and then destroy the sysfs interfaces.
Each function still should check the session status because closing or error recovery paths can change the status.
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +1 -1
@@ -2803,8 +2803,8 @@ int rtrs_clt_remove_path_from_sysfs(struct rtrs_clt_sess *sess, }while (!changed && old_state !=RTRS_CLT_DEAD );if (likely (changed)) { -rtrs_clt_destroy_sess_files (sess, sysfs_self);rtrs_clt_remove_path_from_arr (sess); +rtrs_clt_destroy_sess_files (sess, sysfs_self);kobject_put (&sess->kobj); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 428/530 i2c: cadence: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 23ceb8462dc6f4b4decdb5536a7e5fc477cdf0b6 ]
The PM reference count is not expected to be incremented on return in functions cdns_i2c_master_xfer and cdns_reg_slave.
However, pm_runtime_get_sync will increment pm usage counter even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-cadence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cadence.c +2 -2
@@ -789,7 +789,7 @@ static int cdns_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,bool change_role = false;#endif - ret =pm_runtime_get_sync (id->dev); + ret =pm_runtime_resume_and_get (id->dev);if (ret <0 )return ret;
@@ -911,7 +911,7 @@ static int cdns_reg_slave(struct i2c_client *slave)if (slave->flags &I2C_CLIENT_TEN )return -EAFNOSUPPORT ; - ret =pm_runtime_get_sync (id->dev); + ret =pm_runtime_resume_and_get (id->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 429/530 i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ]
The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-img-scb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-img-scb.c +2 -2
@@ -1057,7 +1057,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, atomic = true; } - ret =pm_runtime_get_sync (adap->dev.parent); + ret =pm_runtime_resume_and_get (adap->dev.parent);if (ret <0 )return ret;
@@ -1158,7 +1158,7 @@ static int img_i2c_init(struct img_i2c *i2c)u32 rev;int ret; - ret =pm_runtime_get_sync (i2c->adap.dev.parent); + ret =pm_runtime_resume_and_get (i2c->adap.dev.parent);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 430/530 i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 278e5bbdb9a94fa063c0f9bcde2479d0b8042462 ]
The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-imx-lpi2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-imx-lpi2c.c +1 -1
@@ -259,7 +259,7 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct *lpi2c_imx)unsigned int temp;int ret; - ret =pm_runtime_get_sync (lpi2c_imx->adapter.dev.parent); + ret =pm_runtime_resume_and_get (lpi2c_imx->adapter.dev.parent);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 431/530 i2c: imx: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 47ff617217ca6a13194fcb35c6c3a0c57c080693 ]
In i2c_imx_xfer() and i2c_imx_remove(), the pm reference count is not expected to be incremented on return.
However, pm_runtime_get_sync will increment pm reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-imx.c +2 -2
@@ -1036,7 +1036,7 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter,struct imx_i2c_struct *i2c_imx =i2c_get_adapdata (adapter);int result; - result =pm_runtime_get_sync (i2c_imx->adapter.dev.parent); + result =pm_runtime_resume_and_get (i2c_imx->adapter.dev.parent);if (result <0 )return result;
@@ -1280,7 +1280,7 @@ static int i2c_imx_remove(struct platform_device *pdev)struct imx_i2c_struct *i2c_imx =platform_get_drvdata (pdev);int irq, ret; - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 432/530 i2c: omap: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 780f629741257ed6c54bd3eb53b57f648eabf200 ]
The PM reference count is not expected to be incremented on return in omap_i2c_probe() and omap_i2c_remove().
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. I Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
What's more, error path 'err_free_mem' seems not like a proper name any more. So I change the name to err_disable_pm and move pm_runtime_disable below, for pm_runtime of 'pdev->dev' should be disabled when pm_runtime_resume_and_get fails.
--- drivers/i2c/busses/i2c-omap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-omap.c +4 -4
@@ -1404,9 +1404,9 @@ omap_i2c_probe(struct platform_device *pdev)pm_runtime_set_autosuspend_delay (omap->dev,OMAP_I2C_PM_TIMEOUT );pm_runtime_use_autosuspend (omap->dev); - r =pm_runtime_get_sync (omap->dev); + r =pm_runtime_resume_and_get (omap->dev);if (r <0 ) - goto err_free_mem; + goto err_disable_pm;/* * Read the Rev hi bit-[15:14] ie scheme this is 1 indicates ver2.
@@ -1513,8 +1513,8 @@ err_unuse_clocks:omap_i2c_write_reg (omap,OMAP_I2C_CON_REG ,0 );pm_runtime_dont_use_autosuspend (omap->dev);pm_runtime_put_sync (omap->dev); +err_disable_pm:pm_runtime_disable (&pdev->dev); -err_free_mem:return r; }
@@ -1525,7 +1525,7 @@ static int omap_i2c_remove(struct platform_device *pdev)int ret;i2c_del_adapter (&omap->adapter); - ret =pm_runtime_get_sync (&pdev->dev); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 433/530 i2c: sprd: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 3a4f326463117cee3adcb72999ca34a9aaafda93 ]
The PM reference count is not expected to be incremented on return in sprd_i2c_master_xfer() and sprd_i2c_remove().
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-sprd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-sprd.c +2 -2
@@ -290,7 +290,7 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,struct sprd_i2c *i2c_dev = i2c_adap->algo_data;int im, ret; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -576,7 +576,7 @@ static int sprd_i2c_remove(struct platform_device *pdev)struct sprd_i2c *i2c_dev =platform_get_drvdata (pdev);int ret; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 434/530 i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit 2c662660ce2bd3b09dae21a9a9ac9395e1e6c00b ]
The PM reference count is not expected to be incremented on return in these stm32f7_i2c_xx serious functions.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-stm32f7.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +6 -6
@@ -1652,7 +1652,7 @@ static int stm32f7_i2c_xfer(struct i2c_adapter *i2c_adap, i2c_dev->msg_id =0 ; f7_msg->smbus = false; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -1698,7 +1698,7 @@ static int stm32f7_i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr, f7_msg->read_write = read_write; f7_msg->smbus = true; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
@@ -1799,7 +1799,7 @@ static int stm32f7_i2c_reg_slave(struct i2c_client *slave)if (ret)return ret; - ret =pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev);if (ret <0 )return ret;
@@ -1880,7 +1880,7 @@ static int stm32f7_i2c_unreg_slave(struct i2c_client *slave)WARN_ON (!i2c_dev->slave[id]); - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -2277,7 +2277,7 @@ static int stm32f7_i2c_regs_backup(struct stm32f7_i2c_dev *i2c_dev)int ret;struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
@@ -2299,7 +2299,7 @@ static int stm32f7_i2c_regs_restore(struct stm32f7_i2c_dev *i2c_dev)int ret;struct stm32f7_i2c_regs *backup_regs = &i2c_dev->backup_regs; - ret =pm_runtime_get_sync (i2c_dev->dev); + ret =pm_runtime_resume_and_get (i2c_dev->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 435/530 i2c: xiic: fix reference leak when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit a85c5c7a3aa8041777ff691400b4046e56149fd3 ]
The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.
However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.
Replace it with pm_runtime_resume_and_get to keep usage counter balanced.
--- drivers/i2c/busses/i2c-xiic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-xiic.c +2 -2
@@ -706,7 +706,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)dev_dbg (adap->dev.parent,"%s entry SR: 0x%x\n" , __func__,xiic_getreg8 (i2c,XIIC_SR_REG_OFFSET )); - err =pm_runtime_get_sync (i2c->dev); + err =pm_runtime_resume_and_get (i2c->dev);if (err <0 )return err;
@@ -873,7 +873,7 @@ static int xiic_i2c_remove(struct platform_device *pdev)/* remove adapter & data */ i2c_del_adapter (&i2c->adap); - ret =pm_runtime_get_sync (i2c->dev); + ret =pm_runtime_resume_and_get (i2c->dev);if (ret <0 )return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 436/530 i2c: cadence: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-cadence.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-cadence.c +4 -1
@@ -1200,7 +1200,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)if (IS_ERR (id->membase))return PTR_ERR (id->membase); - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.owner =THIS_MODULE ; id->adap.dev.of_node = pdev->dev.of_node;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 437/530 i2c: emev2: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit bb6129c32867baa7988f7fd2066cf18ed662d240 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-emev2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-emev2.c +4 -1
@@ -395,7 +395,10 @@ static int em_i2c_probe(struct platform_device *pdev)em_i2c_reset (&priv->adap); - priv->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err_clk; + priv->irq = ret; ret =devm_request_irq (&pdev->dev, priv->irq, em_i2c_irq_handler,0 ,"em_i2c" , priv);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 438/530 i2c: jz4780: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-jz4780.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-jz4780.c +4 -1
@@ -826,7 +826,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)jz4780_i2c_writew (i2c,JZ4780_I2C_INTM ,0x0 ); - i2c->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto err; + i2c->irq = ret; ret =devm_request_irq (&pdev->dev, i2c->irq, jz4780_i2c_irq,0 ,dev_name (&pdev->dev), i2c);if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 439/530 i2c: mlxbf: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0d3bf53e897dce943b98d975bbde77156af6cd81 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-mlxbf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/i2c/busses/i2c-mlxbf.c +2 -0
@@ -2376,6 +2376,8 @@ static int mlxbf_i2c_probe(struct platform_device *pdev)mlxbf_i2c_init_slave (pdev, priv); irq =platform_get_irq (pdev,0 ); +if (irq <0 ) +return irq; ret =devm_request_irq (dev, irq, mlxbf_smbus_irq,IRQF_ONESHOT |IRQF_SHARED |IRQF_PROBE_SHARED ,dev_name (dev), priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 440/530 i2c: rcar: make sure irq is not threaded on Gen2 and earlier
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 24c6d4bc563881539d2cd4433e502436ad87d512 ]
Ensure this irq runs as fast as possible.
--- drivers/i2c/busses/i2c-rcar.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-rcar.c +5 -1
@@ -928,6 +928,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)struct rcar_i2c_priv *priv;struct i2c_adapter *adap;struct device *dev = &pdev->dev; +unsigned long irqflags =0 ;int ret;/* Otherwise logic will break because some bytes must always use PIO */
@@ -976,6 +977,9 @@ static int rcar_i2c_probe(struct platform_device *pdev)rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ +if (priv->devtype <I2C_RCAR_GEN3 ) + irqflags |=IRQF_NO_THREAD ; +if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (!IS_ERR (priv->rstc)) {
@@ -995,7 +999,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) priv->flags |=ID_P_HOST_NOTIFY ; priv->irq =platform_get_irq (pdev,0 ); - ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq,0 ,dev_name (dev), priv); + ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq); goto out_pm_disable;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 441/530 i2c: rcar: protect against supurious interrupts on V3U
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 9c975c432bc0aa53a90438fc80b369cb35134a48 ]
V3U creates spurious interrupts which we need to handle. This costs time until BUS_PHASE_DATA can be activated which is problematic for Gen2 SoCs and earlier. Because of this we introduce two interrupt handlers here which will call a generic main irq function once the timing critical stuff is done.
--- drivers/i2c/busses/i2c-rcar.c | 57 ++++++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 14 deletions(-)
drivers/i2c/busses/i2c-rcar.c +43 -14
@@ -625,20 +625,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)* generated. It turned out that taking a spinlock at the beginning of the ISR * was already causing repeated messages. Thus, this driver was converted to * the now lockless behaviour. Please keep this in mind when hacking the driver. +* R-Car Gen3 seems to have this fixed but earlier versions than R-Car Gen2 are +* likely affected. Therefore, we have different interrupt handler entries. */ -static irqreturn_t rcar_i2c_irq (int irq,void *ptr) +static irqreturn_t rcar_i2c_irq (int irq,struct rcar_i2c_priv *priv,u32 msr) { -struct rcar_i2c_priv *priv = ptr; -u32 msr; - -/* Clear START or STOP immediately, except for REPSTART after read */ -if (likely (!(priv->flags &ID_P_REP_AFTER_RD ))) -rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); - - msr =rcar_i2c_read (priv,ICMSR ); - -/* Only handle interrupts that are currently enabled */ - msr &=rcar_i2c_read (priv,ICMIER );if (!msr) {if (rcar_i2c_slave_irq (priv))return IRQ_HANDLED ;
@@ -682,6 +673,41 @@ out:return IRQ_HANDLED ; } +static irqreturn_t rcar_i2c_gen2_irq (int irq,void *ptr) +{ +struct rcar_i2c_priv *priv = ptr; +u32 msr; + +/* Clear START or STOP immediately, except for REPSTART after read */ +if (likely (!(priv->flags &ID_P_REP_AFTER_RD ))) +rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); + +/* Only handle interrupts that are currently enabled */ + msr =rcar_i2c_read (priv,ICMSR ); + msr &=rcar_i2c_read (priv,ICMIER ); + +return rcar_i2c_irq (irq, priv, msr); +} + +static irqreturn_t rcar_i2c_gen3_irq (int irq,void *ptr) +{ +struct rcar_i2c_priv *priv = ptr; +u32 msr; + +/* Only handle interrupts that are currently enabled */ + msr =rcar_i2c_read (priv,ICMSR ); + msr &=rcar_i2c_read (priv,ICMIER ); + +/* +* Clear START or STOP immediately, except for REPSTART after read or +* if a spurious interrupt was detected. +*/ +if (likely (!(priv->flags &ID_P_REP_AFTER_RD ) && msr)) +rcar_i2c_write (priv,ICMCR ,RCAR_BUS_PHASE_DATA ); + +return rcar_i2c_irq (irq, priv, msr); +} +static struct dma_chan *rcar_i2c_request_dma_chan (struct device *dev,enum dma_transfer_direction dir,dma_addr_t port_addr)
@@ -929,6 +955,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)struct i2c_adapter *adap;struct device *dev = &pdev->dev;unsigned long irqflags =0 ; +irqreturn_t (*irqhandler)(int irq,void *ptr) = rcar_i2c_gen3_irq;int ret;/* Otherwise logic will break because some bytes must always use PIO */
@@ -977,8 +1004,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)rcar_i2c_write (priv,ICSAR ,0 );/* Gen2: must be 0 if not using slave */ -if (priv->devtype <I2C_RCAR_GEN3 ) +if (priv->devtype <I2C_RCAR_GEN3 ) { irqflags |=IRQF_NO_THREAD ; + irqhandler = rcar_i2c_gen2_irq; + }if (priv->devtype ==I2C_RCAR_GEN3 ) { priv->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL );
@@ -999,7 +1028,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) priv->flags |=ID_P_HOST_NOTIFY ; priv->irq =platform_get_irq (pdev,0 ); - ret =devm_request_irq (dev, priv->irq, rcar_i2c_irq, irqflags,dev_name (dev), priv); + ret =devm_request_irq (dev, priv->irq, irqhandler, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq); goto out_pm_disable;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 442/530 i2c: rcar: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 147178cf03a6dcb337e703d4dacd008683022a58 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with the invalid IRQ #s.
--- drivers/i2c/busses/i2c-rcar.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-rcar.c +4 -1
@@ -1027,7 +1027,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)if (of_property_read_bool (dev->of_node,"smbus" )) priv->flags |=ID_P_HOST_NOTIFY ; - priv->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto out_pm_disable; + priv->irq = ret; ret =devm_request_irq (dev, priv->irq, irqhandler, irqflags,dev_name (dev), priv);if (ret <0 ) {dev_err (dev,"cannot get irq %d\n" , priv->irq);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 443/530 i2c: sh7760: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s.
--- drivers/i2c/busses/i2c-sh7760.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +4 -1
@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) goto out2; } - id->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; + id->irq = ret; id->adap.nr = pdev->id; id->adap.algo = &sh7760_i2c_algo;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 444/530 powerpc/xive: Drop check on irq_data in xive_core_debug_show()
In reply to Greg Kroah-HartmanFrom: Cédric Le Goater <[email protected]>
[ Upstream commit a74ce5926b20cd0e6d624a9b2527073a96dfed7f ]
When looping on IRQ descriptor, irq_data is always valid.
--- arch/powerpc/sysdev/xive/common.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
arch/powerpc/sysdev/xive/common.c +10 -11
@@ -1606,6 +1606,8 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_datau32 target;u8 prio;u32 lirq; +struct xive_irq_data *xd; +u64 val;if (!is_xive_irq (chip))return ;
@@ -1619,17 +1621,14 @@ static void xive_debug_show_irq(struct seq_file *m, u32 hw_irq, struct irq_dataseq_printf (m,"IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x " , hw_irq, target, prio, lirq); -if (d) { -struct xive_irq_data *xd =irq_data_get_irq_handler_data (d); -u64 val =xive_esb_read (xd,XIVE_ESB_GET ); - -seq_printf (m,"flags=%c%c%c PQ=%c%c" , - xd->flags &XIVE_IRQ_FLAG_STORE_EOI ?'S' :' ' , - xd->flags &XIVE_IRQ_FLAG_LSI ?'L' :' ' , - xd->flags &XIVE_IRQ_FLAG_H_INT_ESB ?'H' :' ' , - val &XIVE_ESB_VAL_P ?'P' :'-' , - val &XIVE_ESB_VAL_Q ?'Q' :'-' ); - } + xd =irq_data_get_irq_handler_data (d); + val =xive_esb_read (xd,XIVE_ESB_GET ); +seq_printf (m,"flags=%c%c%c PQ=%c%c" , + xd->flags &XIVE_IRQ_FLAG_STORE_EOI ?'S' :' ' , + xd->flags &XIVE_IRQ_FLAG_LSI ?'L' :' ' , + xd->flags &XIVE_IRQ_FLAG_H_INT_ESB ?'H' :' ' , + val &XIVE_ESB_VAL_P ?'P' :'-' , + val &XIVE_ESB_VAL_Q ?'Q' :'-' );seq_puts (m,"\n" ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 445/530 powerpc/xive: Fix xmon command "dxi"
In reply to Greg Kroah-HartmanFrom: Cédric Le Goater <[email protected]>
[ Upstream commit 33e4bc5946432a4ac173fd08e8e30a13ab94d06d ]
When under xmon, the "dxi" command dumps the state of the XIVE interrupts. If an interrupt number is specified, only the state of the associated XIVE interrupt is dumped. This form of the command lacks an irq_data parameter which is nevertheless used by xmon_xive_get_irq_config(), leading to an xmon crash.
Fix that by doing a lookup in the system IRQ mapping to query the IRQ descriptor data. Invalid interrupt numbers, or not belonging to the XIVE IRQ domain, OPAL event interrupt number for instance, should be caught by the previous query done at the firmware level.
--- arch/powerpc/sysdev/xive/common.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
arch/powerpc/sysdev/xive/common.c +10 -4
@@ -261,17 +261,20 @@ notrace void xmon_xive_do_dump(int cpu)xmon_printf ("\n" ); } +static struct irq_data *xive_get_irq_data (u32 hw_irq) +{ +unsigned int irq =irq_find_mapping (xive_irq_domain, hw_irq); + +return irq ?irq_get_irq_data (irq) :NULL ; +} +int xmon_xive_get_irq_config (u32 hw_irq,struct irq_data *d) { -struct irq_chip *chip =irq_data_get_irq_chip (d);int rc;u32 target;u8 prio;u32 lirq; -if (!is_xive_irq (chip)) -return -EINVAL ; - rc = xive_ops->get_irq_config (hw_irq, &target, &prio, &lirq);if (rc) {xmon_printf ("IRQ 0x%08x : no config rc=%d\n" , hw_irq, rc);
@@ -281,6 +284,9 @@ int xmon_xive_get_irq_config(u32 hw_irq, struct irq_data *d)xmon_printf ("IRQ 0x%08x : target=0x%x prio=%02x lirq=0x%x " , hw_irq, target, prio, lirq); +if (!d) + d =xive_get_irq_data (hw_irq); +if (d) {struct xive_irq_data *xd =irq_data_get_irq_handler_data (d);u64 val =xive_esb_read (xd,XIVE_ESB_GET );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 446/530 ASoC: ak5558: correct reset polarity
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 0b93bbc977af55fd10687f2c96c807cba95cb927 ]
Reset (aka power off) happens when the reset gpio is made active. The reset gpio is GPIO_ACTIVE_LOW
--- sound/soc/codecs/ak5558.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/ak5558.c +2 -2
@@ -272,7 +272,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558)if (!ak5558->reset_gpiod)return ; -gpiod_set_value_cansleep (ak5558->reset_gpiod,0 ); +gpiod_set_value_cansleep (ak5558->reset_gpiod,1 );usleep_range (1000 ,2000 ); }
@@ -281,7 +281,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558)if (!ak5558->reset_gpiod)return ; -gpiod_set_value_cansleep (ak5558->reset_gpiod,1 ); +gpiod_set_value_cansleep (ak5558->reset_gpiod,0 );usleep_range (1000 ,2000 ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 447/530 net/mlx5: Fix bit-wise and with zero
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 82c3ba31c370b6001cbf90689e98da1fb6f26aef ]
The bit-wise and of the action field with MLX5_ACCEL_ESP_ACTION_DECRYPT is incorrect as MLX5_ACCEL_ESP_ACTION_DECRYPT is zero and not intended to be a bit-flag. Fix this by using the == operator as was originally intended.
Addresses-Coverity: ("Logically dead code")
--- drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +1 -1
@@ -850,7 +850,7 @@ mlx5_fpga_ipsec_release_sa_ctx(struct mlx5_fpga_ipsec_sa_ctx *sa_ctx)return ; } -if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action & +if (sa_ctx->fpga_xfrm->accel_xfrm.attrs.action ==MLX5_ACCEL_ESP_ACTION_DECRYPT )ida_simple_remove (&fipsec->halloc, sa_ctx->sa_handle);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 448/530 net/packet: make packet_fanout.arr size configurable up to 64K
In reply to Greg Kroah-HartmanFrom: Tanner Love <[email protected]>
[ Upstream commit 9c661b0b85444e426d3f23250305eeb16f6ffe88 ]
One use case of PACKET_FANOUT is lockless reception with one socket per CPU. 256 is a practical limit on increasingly many machines.
Increase PACKET_FANOUT_MAX to 64K. Expand setsockopt PACKET_FANOUT to take an extra argument max_num_members. Also explicitly define a fanout_args struct, instead of implicitly casting to an integer. This documents the API and simplifies the control flow.
If max_num_members is not specified or is set to 0, then 256 is used, same as before.
--- include/uapi/linux/if_packet.h | 12 +++++++++++ net/packet/af_packet.c | 37 +++++++++++++++++++++++----------- net/packet/internal.h | 5 +++-- 3 files changed, 40 insertions(+), 14 deletions(-)
include/uapi/linux/if_packet.h +12 -0
@@ -2,6 +2,7 @@#ifndef __LINUX_IF_PACKET_H#define __LINUX_IF_PACKET_H +#include <asm/byteorder.h> #include <linux/types.h> struct sockaddr_pkt {
@@ -296,6 +297,17 @@ struct packet_mreq {unsigned char mr_address[8 ]; }; +struct fanout_args { +#if defined(__LITTLE_ENDIAN_BITFIELD) +__u16 id; +__u16 type_flags; +#else +__u16 type_flags; +__u16 id; +#endif +__u32 max_num_members; +}; +#define PACKET_MR_MULTICAST 0#define PACKET_MR_PROMISC 1#define PACKET_MR_ALLMULTI 2
net/packet/af_packet.c +25 -12
@@ -1636,13 +1636,15 @@ static bool fanout_find_new_id(struct sock *sk, u16 *new_id)return false; } -static int fanout_add (struct sock *sk,u16 id,u16 type_flags) +static int fanout_add (struct sock *sk,struct fanout_args *args) {struct packet_rollover *rollover =NULL ;struct packet_sock *po =pkt_sk (sk); +u16 type_flags = args->type_flags;struct packet_fanout *f, *match;u8 type = type_flags &0xff ;u8 flags = type_flags >>8 ; +u16 id = args->id;int err;switch (type) {
@@ -1700,11 +1702,21 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) } } err = -EINVAL ; -if (match && match->flags != flags) - goto out; -if (!match) { +if (match) { +if (match->flags != flags) + goto out; +if (args->max_num_members && + args->max_num_members != match->max_num_members) + goto out; + }else { +if (args->max_num_members >PACKET_FANOUT_MAX ) + goto out; +if (!args->max_num_members) +/* legacy PACKET_FANOUT_MAX */ + args->max_num_members =256 ; err = -ENOMEM ; - match =kzalloc (sizeof (*match),GFP_KERNEL ); + match =kvzalloc (struct_size (match, arr, args->max_num_members), +GFP_KERNEL );if (!match) goto out;write_pnet (&match->net,sock_net (sk));
@@ -1720,6 +1732,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) match->prot_hook.func = packet_rcv_fanout; match->prot_hook.af_packet_priv = match; match->prot_hook.id_match = match_fanout_group; + match->max_num_members = args->max_num_members;list_add (&match->list, &fanout_list); } err = -EINVAL ;
@@ -1730,7 +1743,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) match->prot_hook.type == po->prot_hook.type && match->prot_hook.dev == po->prot_hook.dev) { err = -ENOSPC ; -if (refcount_read (&match->sk_ref) <PACKET_FANOUT_MAX ) { +if (refcount_read (&match->sk_ref) < match->max_num_members) {__dev_remove_pack (&po->prot_hook); po->fanout = match; po->rollover = rollover;
@@ -1744,7 +1757,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)if (err && !refcount_read (&match->sk_ref)) {list_del (&match->list); -kfree (match); +kvfree (match); } out:
@@ -3075,7 +3088,7 @@ static int packet_release(struct socket *sock)kfree (po->rollover);if (f) {fanout_release_data (f); -kfree (f); +kvfree (f); }/* * Now the socket is dead. No more input will appear.
@@ -3866,14 +3879,14 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, }case PACKET_FANOUT : { -int val; +struct fanout_args args = {0 }; -if (optlen !=sizeof (val)) +if (optlen !=sizeof (int ) && optlen !=sizeof (args))return -EINVAL ; -if (copy_from_sockptr (&val, optval,sizeof (val))) +if (copy_from_sockptr (&args, optval, optlen))return -EFAULT ; -return fanout_add (sk, val &0xffff , val >>16 ); +return fanout_add (sk, &args); }case PACKET_FANOUT_DATA : {
net/packet/internal.h +3 -2
@@ -77,11 +77,12 @@ struct packet_ring_buffer { };extern struct mutex fanout_mutex; -#define PACKET_FANOUT_MAX 256 +#define PACKET_FANOUT_MAX (1 << 16)struct packet_fanout {possible_net_t net;unsigned int num_members; +u32 max_num_members;u16 id;u8 type;u8 flags;
@@ -90,10 +91,10 @@ struct packet_fanout {struct bpf_prog __rcu *bpf_prog; };struct list_head list; -struct sock *arr[PACKET_FANOUT_MAX ];spinlock_t lock;refcount_t sk_ref;struct packet_type prot_hook____cacheline_aligned_in_smp ; +struct sock *arr[]; };struct packet_rollover {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 449/530 net/packet: remove data races in fanout operations
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 94f633ea8ade8418634d152ad0931133338226f6 ]
af_packet fanout uses RCU rules to ensure f->arr elements are not dismantled before RCU grace period.
However, it lacks rcu accessors to make sure KCSAN and other tools wont detect data races. Stupid compilers could also play games.
--- net/packet/af_packet.c | 15 +++++++++------ net/packet/internal.h | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-)
net/packet/af_packet.c +9 -6
@@ -1358,7 +1358,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f,struct packet_sock *po, *po_next, *po_skip =NULL ;unsigned int i, j, room =ROOM_NONE ; - po =pkt_sk (f->arr[idx]); + po =pkt_sk (rcu_dereference (f->arr[idx]));if (try_self) { room =packet_rcv_has_room (po, skb);
@@ -1370,7 +1370,7 @@ static unsigned int fanout_demux_rollover(struct packet_fanout *f, i = j =min_t (int, po->rollover->sock, num -1 ); do { - po_next = pkt_sk(f->arr[i]); + po_next = pkt_sk(rcu_dereference(f->arr[i])); if (po_next != po_skip && !READ_ONCE(po_next->pressure) && packet_rcv_has_room(po_next, skb) == ROOM_NORMAL) { if (i != j)
@@ -1465,7 +1465,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,if (fanout_has_flag (f,PACKET_FANOUT_FLAG_ROLLOVER )) idx =fanout_demux_rollover (f, skb, idx, true, num); - po =pkt_sk (f->arr[idx]); + po =pkt_sk (rcu_dereference (f->arr[idx]));return po->prot_hook.func (skb, dev, &po->prot_hook, orig_dev); }
@@ -1479,7 +1479,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po)struct packet_fanout *f = po->fanout;spin_lock (&f->lock); - f->arr[f->num_members] = sk; +rcu_assign_pointer (f->arr[f->num_members], sk);smp_wmb (); f->num_members++;if (f->num_members ==1 )
@@ -1494,11 +1494,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)spin_lock (&f->lock);for (i =0 ; i < f->num_members; i++) { -if (f->arr[i] == sk) +if (rcu_dereference_protected (f->arr[i], +lockdep_is_held (&f->lock)) == sk)break ; }BUG_ON (i >= f->num_members); - f->arr[i] = f->arr[f->num_members -1 ]; +rcu_assign_pointer (f->arr[i], +rcu_dereference_protected (f->arr[f->num_members -1 ], +lockdep_is_held (&f->lock))); f->num_members--;if (f->num_members ==0 )__dev_remove_pack (&f->prot_hook);
net/packet/internal.h +1 -1
@@ -94,7 +94,7 @@ struct packet_fanout {spinlock_t lock;refcount_t sk_ref;struct packet_type prot_hook____cacheline_aligned_in_smp ; -struct sock *arr[]; +struct sock __rcu *arr[]; };struct packet_rollover {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 450/530 drm/i915/gvt: Fix error code in intel_gvt_init_device()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 329328ec6a87f2c1275f50d979d55513de458409 ]
The intel_gvt_init_vgpu_type_groups() function is only called from intel_gvt_init_device(). If it fails then the intel_gvt_init_device() prints the error code and propagates it back again. That's a bug because false is zero/success. The fix is to modify it to return zero or negative error codes and make everything consistent.
--- drivers/gpu/drm/i915/gvt/gvt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gvt/gvt.c +4 -4
@@ -126,7 +126,7 @@ static bool intel_get_gvt_attrs(struct attribute_group ***intel_vgpu_type_groupsreturn true; } -static bool intel_gvt_init_vgpu_type_groups (struct intel_gvt *gvt) +static int intel_gvt_init_vgpu_type_groups (struct intel_gvt *gvt) {int i, j;struct intel_vgpu_type *type;
@@ -144,7 +144,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt) gvt_vgpu_type_groups[i] = group; } -return true; +return 0 ; unwind:for (j =0 ; j < i; j++) {
@@ -152,7 +152,7 @@ unwind:kfree (group); } -return false; +return -ENOMEM ; }static void intel_gvt_cleanup_vgpu_type_groups (struct intel_gvt *gvt)
@@ -360,7 +360,7 @@ int intel_gvt_init_device(struct drm_i915_private *i915) goto out_clean_thread; ret =intel_gvt_init_vgpu_type_groups (gvt); -if (ret == false) { +if (ret) {gvt_err ("failed to init vgpu type groups: %d\n" , ret); goto out_clean_types; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 451/530 iommu/amd: Put newline after closing bracket in warning
In reply to Greg Kroah-HartmanFrom: Paul Menzel <[email protected]>
[ Upstream commit 304c73ba69459d4c18c2a4b843be6f5777b4b85c ]
Currently, on the Dell OptiPlex 5055 the EFR mismatch warning looks like below.
[ 1.479774] smpboot: CPU0: AMD Ryzen 5 PRO 1500 Quad-Core Processor (family: 0x17, model: 0x1, stepping: 0x1)
[…]
[ 2.507370] AMD-Vi: [Firmware Warn]: EFR mismatch. Use IVHD EFR (0xf77ef22294ada : 0x400f77ef22294ada
).Add the newline after the )., so it’s on one line.
--- drivers/iommu/amd/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/init.c +1 -1
@@ -1840,7 +1840,7 @@ static void __init late_iommu_features_init(struct amd_iommu *iommu)* IVHD and MMIO conflict. */ if (features != iommu->features) -pr_warn (FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n)." , +pr_warn (FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx).\n" , features, iommu->features); }
Signature · 8 lines
2.30.2 _______________________________________________ iommu mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/iommu
Greg Kroah-Hartman
maintainerPATCH 452/530 perf beauty: Fix fsconfig generator
In reply to Greg Kroah-HartmanFrom: Vitaly Chikunov <[email protected]>
[ Upstream commit 2e1daee14e67fbf9b27280b974e2c680a22cabea ]
After gnulib update sed stopped matching `[[:space:]]*+' as before, causing the following compilation error:
In file included from builtin-trace.c:719:
trace/beauty/generated/fsconfig_arrays.c:2:3: error: expected expression before ']' token
2 | [] = "", | ^
trace/beauty/generated/fsconfig_arrays.c:2:3: error: array index in initializer not of integer type trace/beauty/generated/fsconfig_arrays.c:2:3: note: (near initialization for 'fsconfig_cmds')
Fix this by correcting the regular expression used in the generator. Also, clean up the script by removing redundant egrep, xargs, and printf invocations.
Committer testing:
Continues to work:
$ cat tools/perf/trace/beauty/fsconfig.sh #!/bin/sh # SPDX-License-Identifier: LGPL-2.1
if [ $# -ne 1 ] ; then
linux_header_dir=tools/include/uapi/linux
else
linux_header_dir=$1
fi
linux_mount=${linux_header_dir}/mount.h
printf "static const char *fsconfig_cmds[] = {\n"
ms='[[:space:]]*'
sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \
${linux_mount}
printf "};\n"
$ tools/perf/trace/beauty/fsconfig.sh
static const char *fsconfig_cmds[] = {
[0] = "SET_FLAG",
[1] = "SET_STRING",
[2] = "SET_BINARY",
[3] = "SET_PATH",
[4] = "SET_PATH_EMPTY",
[5] = "SET_FD",
[6] = "CMD_CREATE",
[7] = "CMD_RECONFIGURE",
};
$--- tools/perf/trace/beauty/fsconfig.sh | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
tools/perf/trace/beauty/fsconfig.sh +3 -4
@@ -10,8 +10,7 @@ fi linux_mount=${linux_header_dir}/mount.h printf "static const char *fsconfig_cmds[] = {\n" -regex='^[[:space:]]*+FSCONFIG_([[:alnum:]_]+)[[:space:]]*=[[:space:]]*([[:digit:]]+)[[:space:]]*,[[:space:]]*.*' -egrep $regex ${linux_mount} | \ - sed -r "s/$regex/\2 \1/g" | \ - xargs printf "\t[%s] = \"%s\",\n" +ms='[[:space:]]*' +sed -nr "s/^${ms}FSCONFIG_([[:alnum:]_]+)${ms}=${ms}([[:digit:]]+)${ms},.*/\t[\2] = \"\1\",/p" \ + ${linux_mount} printf "};\n"
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 453/530 drm/amd/pm: fix error code in smu_set_power_limit()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit bbdfe5aaef3c1d5c5e62fa235ef13f064e4c1c17 ]
We should return -EINVAL instead of success if the "limit" is too high.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +1 -0
@@ -2001,6 +2001,7 @@ int smu_set_power_limit(struct smu_context *smu, uint32_t limit)dev_err (smu->adev->dev,"New power limit (%d) is over the max allowed %d\n" , limit, smu->max_power_limit); + ret = -EINVAL ; goto out; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 454/530 MIPS: pci-legacy: stop using of_pci_range_to_resource
In reply to Greg Kroah-HartmanFrom: Ilya Lipnitskiy <[email protected]>
[ Upstream commit 3ecb9dc1581eebecaee56decac70e35365260866 ]
Mirror commit aeba3731b150 ("powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change").
Most MIPS platforms do not define PCI_IOBASE, nor implement pci_address_to_pio(). Moreover, IO_SPACE_LIMIT is 0xffff for most MIPS platforms. of_pci_range_to_resource passes the _start address_ of the IO range into pci_address_to_pio, which then checks it against IO_SPACE_LIMIT and fails, because for MIPS platforms that use pci-legacy (pci-lantiq, pci-rt3883, pci-mt7620), IO ranges start much higher than 0xffff.
In fact, pci-mt7621 in staging already works around this problem, see commit 09dd629eeabb ("staging: mt7621-pci: fix io space and properly set resource limits")
So just stop using of_pci_range_to_resource, which does not work for MIPS.
Fixes PCI errors like:
pci_bus 0000:00: root bus resource [io 0xffffffff]
--- arch/mips/pci/pci-legacy.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/mips/pci/pci-legacy.c +7 -2
@@ -166,8 +166,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) res = hose->mem_resource;break ; } -if (res !=NULL ) -of_pci_range_to_resource (&range, node, res); +if (res !=NULL ) { + res->name = node->full_name; + res->flags = range.flags; + res->start = range.cpu_addr; + res->end = range.cpu_addr + range.size -1 ; + res->parent = res->child = res->sibling =NULL ; + } } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 455/530 powerpc/pseries: extract host bridge from pci_bus prior to bus removal
In reply to Greg Kroah-HartmanFrom: Tyrel Datwyler <[email protected]>
[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]
The pci_bus->bridge reference may no longer be valid after pci_bus_remove() resulting in passing a bad value to device_unregister() for the associated bridge device.
Store the host_bridge reference in a separate variable prior to pci_bus_remove().
--- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/platforms/pseries/pci_dlpar.c +3 -1
@@ -50,6 +50,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);int remove_phb_dynamic (struct pci_controller *phb) {struct pci_bus *b = phb->bus; +struct pci_host_bridge *host_bridge =to_pci_host_bridge (b->bridge);struct resource *res;int rc, i;
@@ -76,7 +77,8 @@ int remove_phb_dynamic(struct pci_controller *phb)/* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus =NULL ;pci_remove_bus (b); -device_unregister (b->bridge); + host_bridge->bus =NULL ; +device_unregister (&host_bridge->dev);/* Now release the IO resource */ if (res->flags &IORESOURCE_IO )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 456/530 powerpc/smp: Reintroduce cpu_core_mask
In reply to Greg Kroah-HartmanFrom: Srikar Dronamraju <[email protected]>
[ Upstream commit c47f892d7aa62765bf0689073f75990b4517a4cf ]
Daniel reported that with Commit 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask") QEMU was unable to set single NUMA node SMP topologies such as:
-smp 8,maxcpus=8,cores=2,threads=2,sockets=2
i.e he expected 2 sockets in one NUMA node.
The above commit helped to reduce boot time on Large Systems for example 4096 vCPU single socket QEMU instance. PAPR is silent on having more than one socket within a NUMA node.
cpu_core_mask and cpu_cpu_mask for any CPU would be same unless the number of sockets is different from the number of NUMA nodes.
One option is to reintroduce cpu_core_mask but use a slightly different method to arrive at the cpu_core_mask. Previously each CPU's chip-id would be compared with all other CPU's chip-id to verify if both the CPUs were related at the chip level. Now if a CPU 'A' is found related / (unrelated) to another CPU 'B', all the thread siblings of 'A' and thread siblings of 'B' are automatically marked as related / (unrelated).
Also if a platform doesn't support ibm,chip-id property, i.e its cpu_to_chip_id returns -1, cpu_core_map holds a copy of cpu_cpu_mask().
--- arch/powerpc/include/asm/smp.h | 5 +++++ arch/powerpc/kernel/smp.c | 39 ++++++++++++++++++++++++++++------ 2 files changed, 37 insertions(+), 7 deletions(-)
arch/powerpc/include/asm/smp.h +5 -0
@@ -121,6 +121,11 @@ static inline struct cpumask *cpu_sibling_mask(int cpu)return per_cpu (cpu_sibling_map, cpu); } +static inline struct cpumask *cpu_core_mask (int cpu) +{ +return per_cpu (cpu_core_map, cpu); +} +static inline struct cpumask *cpu_l2_cache_mask (int cpu) {return per_cpu (cpu_l2_cache_map, cpu);
arch/powerpc/kernel/smp.c +32 -7
@@ -975,17 +975,12 @@ void __init smp_prepare_cpus(unsigned int max_cpus) local_memory_node(numa_cpu_lookup_table[cpu])); }#endif -/* -* cpu_core_map is now more updated and exists only since -* its been exported for long. It only will have a snapshot -* of cpu_cpu_mask. -*/ -cpumask_copy (per_cpu (cpu_core_map, cpu),cpu_cpu_mask (cpu)); }/* Init the cpumasks so the boot CPU is related to itself */ cpumask_set_cpu (boot_cpuid,cpu_sibling_mask (boot_cpuid));cpumask_set_cpu (boot_cpuid,cpu_l2_cache_mask (boot_cpuid)); +cpumask_set_cpu (boot_cpuid,cpu_core_mask (boot_cpuid));if (has_coregroup_support ())cpumask_set_cpu (boot_cpuid,cpu_coregroup_mask (boot_cpuid));
@@ -1304,6 +1299,9 @@ static void remove_cpu_from_masks(int cpu)set_cpus_unrelated (cpu, i, cpu_smallcore_mask); } +for_each_cpu (i,cpu_core_mask (cpu)) +set_cpus_unrelated (cpu, i, cpu_core_mask); +if (has_coregroup_support ()) {for_each_cpu (i,cpu_coregroup_mask (cpu))set_cpus_unrelated (cpu, i, cpu_coregroup_mask);
@@ -1364,8 +1362,11 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)static void add_cpu_to_masks (int cpu) { +struct cpumask *(*submask_fn)(int ) = cpu_sibling_mask;int first_thread =cpu_first_thread_sibling (cpu); +int chip_id =cpu_to_chip_id (cpu);cpumask_var_t mask; +bool ret;int i;/*
@@ -1381,12 +1382,36 @@ static void add_cpu_to_masks(int cpu)add_cpu_to_smallcore_masks (cpu);/* In CPU-hotplug path, hence use GFP_ATOMIC */ -alloc_cpumask_var_node (&mask,GFP_ATOMIC ,cpu_to_node (cpu)); + ret =alloc_cpumask_var_node (&mask,GFP_ATOMIC ,cpu_to_node (cpu));update_mask_by_l2 (cpu, &mask);if (has_coregroup_support ())update_coregroup_mask (cpu, &mask); +if (chip_id ==-1 || !ret) { +cpumask_copy (per_cpu (cpu_core_map, cpu),cpu_cpu_mask (cpu)); + goto out; + } + +if (shared_caches) + submask_fn = cpu_l2_cache_mask; + +/* Update core_mask with all the CPUs that are part of submask */ +or_cpumasks_related (cpu, cpu, submask_fn, cpu_core_mask); + +/* Skip all CPUs already part of current CPU core mask */ +cpumask_andnot (mask, cpu_online_mask,cpu_core_mask (cpu)); + +for_each_cpu (i, mask) { +if (chip_id ==cpu_to_chip_id (i)) { +or_cpumasks_related (cpu, i, submask_fn, cpu_core_mask); +cpumask_andnot (mask, mask,submask_fn (i)); + }else { +cpumask_andnot (mask, mask,cpu_core_mask (i)); + } + } + +out:free_cpumask_var (mask); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 457/530 KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
In reply to Greg Kroah-HartmanFrom: David Edmondson <[email protected]>
[ Upstream commit d9e46d344e62a0d56fd86a8289db5bed8a57c92e ]
If the VM entry/exit controls for loading/saving MSR_EFER are either not available (an older processor or explicitly disabled) or not used (host and guest values are the same), reading GUEST_IA32_EFER from the VMCS returns an inaccurate value.
Because of this, in dump_vmcs() don't use GUEST_IA32_EFER to decide whether to print the PDPTRs - always do so if the fields exist.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
arch/x86/kvm/vmx/vmx.c +3 -6
@@ -5779,7 +5779,6 @@ void dump_vmcs(void)u32 vmentry_ctl, vmexit_ctl;u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control;unsigned long cr4; -u64 efer;if (!dump_invalid_vmcs) {pr_warn_ratelimited ("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n" );
@@ -5791,7 +5790,6 @@ void dump_vmcs(void) cpu_based_exec_ctrl =vmcs_read32 (CPU_BASED_VM_EXEC_CONTROL ); pin_based_exec_ctrl =vmcs_read32 (PIN_BASED_VM_EXEC_CONTROL ); cr4 =vmcs_readl (GUEST_CR4 ); - efer =vmcs_read64 (GUEST_IA32_EFER ); secondary_exec_control =0 ;if (cpu_has_secondary_exec_ctrls ()) secondary_exec_control =vmcs_read32 (SECONDARY_VM_EXEC_CONTROL );
@@ -5803,9 +5801,7 @@ void dump_vmcs(void)pr_err ("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n" , cr4,vmcs_readl (CR4_READ_SHADOW ),vmcs_readl (CR4_GUEST_HOST_MASK ));pr_err ("CR3 = 0x%016lx\n" ,vmcs_readl (GUEST_CR3 )); -if ((secondary_exec_control &SECONDARY_EXEC_ENABLE_EPT ) && - (cr4 &X86_CR4_PAE ) && !(efer &EFER_LMA )) - { +if (cpu_has_vmx_ept ()) {pr_err ("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n" ,vmcs_read64 (GUEST_PDPTR0 ),vmcs_read64 (GUEST_PDPTR1 )); pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
@@ -5831,7 +5827,8 @@ void dump_vmcs(void)if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT |VM_EXIT_SAVE_IA32_EFER )) || (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT |VM_ENTRY_LOAD_IA32_EFER )))pr_err ("EFER = 0x%016llx PAT = 0x%016llx\n" , - efer,vmcs_read64 (GUEST_IA32_PAT )); +vmcs_read64 (GUEST_IA32_EFER ), +vmcs_read64 (GUEST_IA32_PAT ));pr_err ("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n" ,vmcs_read64 (GUEST_IA32_DEBUGCTL ),vmcs_readl (GUEST_PENDING_DBG_EXCEPTIONS ));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 458/530 rtlwifi: 8821ae: upgrade PHY and RF parameters
In reply to Greg Kroah-HartmanFrom: Ping-Ke Shih <[email protected]>
[ Upstream commit 18fb0bedb5fc2fddc057dbe48b7360a6ffda34b3 ]
The signal strength of 5G is quite low, so user can't connect to an AP far away. New parameters with new format and its parser are updated by the commit 84d26fda52e2 ("rtlwifi: Update 8821ae new phy parameters and its parser."), but some parameters are missing. Use this commit to update to the novel parameters that use new format.
--- .../realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++----- 1 file changed, 370 insertions(+), 130 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +370 -130
@@ -249,7 +249,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x824 ,0x00030FE0 ,0x828 ,0x00000000 ,0x82C ,0x002081DD , -0x830 ,0x2AAA8E24 , +0x830 ,0x2AAAEEC8 ,0x834 ,0x0037A706 ,0x838 ,0x06489B44 , 0x83C, 0x0000095B,
@@ -324,10 +324,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {0x9D8 ,0x00000000 ,0x9DC ,0x00000000 ,0x9E0 ,0x00005D00 , -0x9E4 ,0x00000002 , +0x9E4 ,0x00000003 ,0x9E8 ,0x00000001 ,0xA00 ,0x00D047C8 , -0xA04 ,0x01FF000C , +0xA04 ,0x01FF800C ,0xA08 ,0x8C8A8300 ,0xA0C ,0x2E68000F , 0xA10, 0x9500BB78,
@@ -1320,7 +1320,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x083 ,0x00021800 ,0x084 ,0x00028000 ,0x085 ,0x00048000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x086 ,0x0009483A , +0xA0000000 ,0x00000000 ,0x086 ,0x00094838 , +0xB0000000 ,0x00000000 ,0x087 ,0x00044980 ,0x088 ,0x00048000 , 0x089, 0x0000D480,
@@ -1409,36 +1413,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x03C ,0x000CA000 ,0x0EF ,0x00000000 ,0x0EF ,0x00001100 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF3 ,0x034 ,0x00049DF0 , -0xFF0F0404 ,0xCDEF , -0x034 ,0x0004ADF3 , -0x034 ,0x00049DF0 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004ADF5 ,0x034 ,0x00049DF2 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004A0F3 , +0x034 ,0x000490B1 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0004A0F3 ,0x034 ,0x000490B1 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF5 , +0x034 ,0x00049DF2 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0004ADF3 , +0x034 ,0x00049DF0 , +0xA0000000 ,0x00000000 ,0x034 ,0x0004ADF7 ,0x034 ,0x00049DF3 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00048DED , -0x034 ,0x00047DEA , -0x034 ,0x00046DE7 , -0x034 ,0x00045CE9 , -0x034 ,0x00044CE6 , -0x034 ,0x000438C6 , -0x034 ,0x00042886 , -0x034 ,0x00041486 , -0x034 ,0x00040447 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1448,7 +1448,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00048DED ,0x034 ,0x00047DEA , 0x034, 0x00046DE7,
@@ -1458,7 +1458,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042886 ,0x034 ,0x00041486 ,0x034 ,0x00040447 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000480AE , +0x034 ,0x000470AB , +0x034 ,0x0004608B , +0x034 ,0x00045069 , +0x034 ,0x00044048 , +0x034 ,0x00043045 , +0x034 ,0x00042026 , +0x034 ,0x00041023 , +0x034 ,0x00040002 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000480AE ,0x034 ,0x000470AB , 0x034, 0x0004608B,
@@ -1468,7 +1478,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00042026 ,0x034 ,0x00041023 ,0x034 ,0x00040002 , -0xCDCDCDCD ,0xCDCD , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00048DED , +0x034 ,0x00047DEA , +0x034 ,0x00046DE7 , +0x034 ,0x00045CE9 , +0x034 ,0x00044CE6 , +0x034 ,0x000438C6 , +0x034 ,0x00042886 , +0x034 ,0x00041486 , +0x034 ,0x00040447 , +0xA0000000 ,0x00000000 ,0x034 ,0x00048DEF ,0x034 ,0x00047DEC , 0x034, 0x00046DE9,
@@ -1478,38 +1498,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x0004248A ,0x034 ,0x0004108D ,0x034 ,0x0004008A , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002ADF4 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002A0F3 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0002A0F3 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0002ADF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x0002ADF7 , -0xFF0F0200 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00029DF4 , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF4 , -0xFF0F0200 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00029DF1 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000290F0 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000290F0 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF1 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00029DF4 , +0xA0000000 ,0x00000000 ,0x034 ,0x00029DF2 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00028DF1 , -0x034 ,0x00027DEE , -0x034 ,0x00026DEB , -0x034 ,0x00025CEC , -0x034 ,0x00024CE9 , -0x034 ,0x000238CA , -0x034 ,0x00022889 , -0x034 ,0x00021489 , -0x034 ,0x0002044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1519,7 +1537,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00028DF1 ,0x034 ,0x00027DEE , 0x034, 0x00026DEB,
@@ -1529,7 +1547,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022889 ,0x034 ,0x00021489 ,0x034 ,0x0002044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x000280AF ,0x034 ,0x000270AC , 0x034, 0x0002608B,
@@ -1539,7 +1557,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022026 ,0x034 ,0x00021023 ,0x034 ,0x00020002 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x000280AF , +0x034 ,0x000270AC , +0x034 ,0x0002608B , +0x034 ,0x00025069 , +0x034 ,0x00024048 , +0x034 ,0x00023045 , +0x034 ,0x00022026 , +0x034 ,0x00021023 , +0x034 ,0x00020002 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00028DF1 , +0x034 ,0x00027DEE , +0x034 ,0x00026DEB , +0x034 ,0x00025CEC , +0x034 ,0x00024CE9 , +0x034 ,0x000238CA , +0x034 ,0x00022889 , +0x034 ,0x00021489 , +0x034 ,0x0002044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00028DEE ,0x034 ,0x00027DEB , 0x034, 0x00026CCD,
@@ -1549,27 +1587,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00022849 ,0x034 ,0x00021449 ,0x034 ,0x0002004D , -0xFF0F0104 ,0xDEAD , -0xFF0F02C0 ,0xABCD , +0xB0000000 ,0x00000000 , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000A0D7 , +0x034 ,0x000090D3 , +0x034 ,0x000080B1 , +0x034 ,0x000070AE , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000A0D7 ,0x034 ,0x000090D3 ,0x034 ,0x000080B1 ,0x034 ,0x000070AE , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x034 ,0x0000ADF7 ,0x034 ,0x00009DF4 ,0x034 ,0x00008DF1 ,0x034 ,0x00007DEE , -0xFF0F02C0 ,0xDEAD , -0xFF0F0104 ,0xABCD , -0x034 ,0x00006DEB , -0x034 ,0x00005CEC , -0x034 ,0x00004CE9 , -0x034 ,0x000038CA , -0x034 ,0x00002889 , -0x034 ,0x00001489 , -0x034 ,0x0000044A , -0xFF0F0204 ,0xCDEF , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1577,7 +1612,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F0404 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x00006DEB ,0x034 ,0x00005CEC , 0x034, 0x00004CE9,
@@ -1585,7 +1620,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002889 ,0x034 ,0x00001489 ,0x034 ,0x0000044A , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x034 ,0x0000608D ,0x034 ,0x0000506B , 0x034, 0x0000404A,
@@ -1593,7 +1628,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002044 ,0x034 ,0x00001025 ,0x034 ,0x00000004 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x0000608D , +0x034 ,0x0000506B , +0x034 ,0x0000404A , +0x034 ,0x00003047 , +0x034 ,0x00002044 , +0x034 ,0x00001025 , +0x034 ,0x00000004 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x034 ,0x00006DEB , +0x034 ,0x00005CEC , +0x034 ,0x00004CE9 , +0x034 ,0x000038CA , +0x034 ,0x00002889 , +0x034 ,0x00001489 , +0x034 ,0x0000044A , +0xA0000000 ,0x00000000 ,0x034 ,0x00006DCD ,0x034 ,0x00005CCD , 0x034, 0x00004CCA,
@@ -1601,11 +1652,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x034 ,0x00002888 ,0x034 ,0x00001488 ,0x034 ,0x00000486 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000040 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1615,7 +1666,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1625,7 +1676,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000145 , +0x035 ,0x00008145 , +0x035 ,0x00010145 , +0x035 ,0x00020196 , +0x035 ,0x00028196 , +0x035 ,0x00030196 , +0x035 ,0x000401C7 , +0x035 ,0x000481C7 , +0x035 ,0x000501C7 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x035 ,0x00000128 , +0x035 ,0x00008128 , +0x035 ,0x00010128 , +0x035 ,0x000201C8 , +0x035 ,0x000281C8 , +0x035 ,0x000301C8 , +0x035 ,0x000401C8 , +0x035 ,0x000481C8 , +0x035 ,0x000501C8 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x035 ,0x00000187 ,0x035 ,0x00008187 , 0x035, 0x00010187,
@@ -1635,7 +1716,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x00040188 ,0x035 ,0x00048188 ,0x035 ,0x00050188 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x035 ,0x00000145 ,0x035 ,0x00008145 , 0x035, 0x00010145,
@@ -1645,11 +1726,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x035 ,0x000401C7 ,0x035 ,0x000481C7 ,0x035 ,0x000501C7 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000010 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1662,7 +1743,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1675,7 +1756,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000056B3 , +0x036 ,0x0000D6B3 , +0x036 ,0x000156B3 , +0x036 ,0x0001D6B3 , +0x036 ,0x00026634 , +0x036 ,0x0002E634 , +0x036 ,0x00036634 , +0x036 ,0x0003E634 , +0x036 ,0x000467B4 , +0x036 ,0x0004E7B4 , +0x036 ,0x000567B4 , +0x036 ,0x0005E7B4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x036 ,0x000063B5 , +0x036 ,0x0000E3B5 , +0x036 ,0x000163B5 , +0x036 ,0x0001E3B5 , +0x036 ,0x000263B5 , +0x036 ,0x0002E3B5 , +0x036 ,0x000363B5 , +0x036 ,0x0003E3B5 , +0x036 ,0x000463B5 , +0x036 ,0x0004E3B5 , +0x036 ,0x000563B5 , +0x036 ,0x0005E3B5 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x036 ,0x00085733 ,0x036 ,0x0008D733 , 0x036, 0x00095733,
@@ -1688,7 +1808,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x000CE4B4 ,0x036 ,0x000D64B4 ,0x036 ,0x000DE4B4 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x036 ,0x000056B3 ,0x036 ,0x0000D6B3 , 0x036, 0x000156B3,
@@ -1701,103 +1821,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x036 ,0x0004E7B4 ,0x036 ,0x000567B4 ,0x036 ,0x0005E7B4 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0EF ,0x00000008 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x0000022A , +0x03C ,0x00000594 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x000001B6 , +0x03C ,0x00000492 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x000001C8 ,0x03C ,0x00000492 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x03C ,0x0000022A ,0x03C ,0x00000594 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000800 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x03C ,0x00000820 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000820 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x03C ,0x00000800 , +0xA0000000 ,0x00000000 ,0x03C ,0x00000900 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x018 ,0x0001712A ,0x0EF ,0x00000002 , -0xFF0F0104 ,0xABCD , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x008 ,0x00002000 , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x008 ,0x0004E400 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x008 ,0x00002000 , -0xFF0F0104 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x0EF ,0x00000000 ,0x0DF ,0x000000C0 , -0x01F ,0x00040064 , -0xFF0F0104 ,0xABCD , +0x01F ,0x00000064 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xFF0F0404 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x058 ,0x00081184 , +0x059 ,0x0006016C , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x058 ,0x000A7284 ,0x059 ,0x000600EC , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x058 ,0x00081184 ,0x059 ,0x0006016C , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EAD53 , +0x062 ,0x00093BC4 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x061 ,0x000EFD83 , +0x062 ,0x00093FCC , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x061 ,0x000E8D73 ,0x062 ,0x00093FC5 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x061 ,0x000EAD53 ,0x062 ,0x00093BC4 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0204 ,0xCDEF , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0404 ,0xCDEF , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xFF0F0200 ,0xCDEF , -0x063 ,0x000710E9 , -0xFF0F02C0 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x063 ,0x000110E9 , -0xCDCDCDCD ,0xCDCD , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110EB , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 , +0x063 ,0x000110E9 , +0xA0000000 ,0x00000000 ,0x063 ,0x000714E9 , -0xFF0F0104 ,0xDEAD , -0xFF0F0104 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C27C , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0204 ,0xCDEF , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x064 ,0x0001C67C , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xFF0F0404 ,0xCDEF , +0x90000410 ,0x00000000 ,0x40000000 ,0x00000000 ,0x064 ,0x0001C27C , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x064 ,0x0001C67C , -0xFF0F0104 ,0xDEAD , -0xFF0F0200 ,0xABCD , +0xB0000000 ,0x00000000 , +0x80000111 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000110 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00091016 , +0x90000210 ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093016 , -0xFF0F02C0 ,0xCDEF , +0x9000020c ,0x00000000 ,0x40000000 ,0x00000000 ,0x065 ,0x00093015 , -0xCDCDCDCD ,0xCDCD , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093015 , +0x90000200 ,0x00000000 ,0x40000000 ,0x00000000 , +0x065 ,0x00093016 , +0xA0000000 ,0x00000000 ,0x065 ,0x00091016 , -0xFF0F0200 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x018 ,0x00000006 ,0x0EF ,0x00002000 , 0x03B, 0x0003824B,
@@ -1895,9 +2074,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {0x0B4 ,0x0001214C ,0x0B7 ,0x0003000C ,0x01C ,0x000539D2 , +0x0C4 ,0x000AFE00 ,0x018 ,0x0001F12A , -0x0FE ,0x00000000 , -0x0FE ,0x00000000 , +0xFFE ,0x00000000 , +0xFFE ,0x00000000 , 0x018, 0x0001712A, };
@@ -2017,6 +2197,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {u32 RTL8812AE_MAC_1T_ARRAYLEN =ARRAY_SIZE (RTL8812AE_MAC_REG_ARRAY );u32 RTL8821AE_MAC_REG_ARRAY [] = { +0x421 ,0x0000000F ,0x428 ,0x0000000A ,0x429 ,0x00000010 ,0x430 ,0x00000000 ,
@@ -2485,7 +2666,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0xA6360001 ,0x81C ,0xA5380001 ,0x81C ,0xA43A0001 , -0x81C ,0xA33C0001 , +0x81C ,0x683C0001 ,0x81C ,0x673E0001 ,0x81C ,0x66400001 , 0x81C, 0x65420001,
@@ -2519,7 +2700,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x017A0001 ,0x81C ,0x017C0001 ,0x81C ,0x017E0001 , -0xFF0F02C0 ,0xABCD , +0x8000020c ,0x00000000 ,0x40000000 ,0x00000000 , +0x81C ,0xFB000101 , +0x81C ,0xFA020101 , +0x81C ,0xF9040101 , +0x81C ,0xF8060101 , +0x81C ,0xF7080101 , +0x81C ,0xF60A0101 , +0x81C ,0xF50C0101 , +0x81C ,0xF40E0101 , +0x81C ,0xF3100101 , +0x81C ,0xF2120101 , +0x81C ,0xF1140101 , +0x81C ,0xF0160101 , +0x81C ,0xEF180101 , +0x81C ,0xEE1A0101 , +0x81C ,0xED1C0101 , +0x81C ,0xEC1E0101 , +0x81C ,0xEB200101 , +0x81C ,0xEA220101 , +0x81C ,0xE9240101 , +0x81C ,0xE8260101 , +0x81C ,0xE7280101 , +0x81C ,0xE62A0101 , +0x81C ,0xE52C0101 , +0x81C ,0xE42E0101 , +0x81C ,0xE3300101 , +0x81C ,0xA5320101 , +0x81C ,0xA4340101 , +0x81C ,0xA3360101 , +0x81C ,0x87380101 , +0x81C ,0x863A0101 , +0x81C ,0x853C0101 , +0x81C ,0x843E0101 , +0x81C ,0x69400101 , +0x81C ,0x68420101 , +0x81C ,0x67440101 , +0x81C ,0x66460101 , +0x81C ,0x49480101 , +0x81C ,0x484A0101 , +0x81C ,0x474C0101 , +0x81C ,0x2A4E0101 , +0x81C ,0x29500101 , +0x81C ,0x28520101 , +0x81C ,0x27540101 , +0x81C ,0x26560101 , +0x81C ,0x25580101 , +0x81C ,0x245A0101 , +0x81C ,0x235C0101 , +0x81C ,0x055E0101 , +0x81C ,0x04600101 , +0x81C ,0x03620101 , +0x81C ,0x02640101 , +0x81C ,0x01660101 , +0x81C ,0x01680101 , +0x81C ,0x016A0101 , +0x81C ,0x016C0101 , +0x81C ,0x016E0101 , +0x81C ,0x01700101 , +0x81C ,0x01720101 , +0x9000040c ,0x00000000 ,0x40000000 ,0x00000000 ,0x81C ,0xFB000101 ,0x81C ,0xFA020101 , 0x81C, 0xF9040101,
@@ -2578,7 +2818,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x016E0101 ,0x81C ,0x01700101 ,0x81C ,0x01720101 , -0xCDCDCDCD ,0xCDCD , +0xA0000000 ,0x00000000 ,0x81C ,0xFF000101 ,0x81C ,0xFF020101 , 0x81C, 0xFE040101,
@@ -2637,7 +2877,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {0x81C ,0x046E0101 ,0x81C ,0x03700101 ,0x81C ,0x02720101 , -0xFF0F02C0 ,0xDEAD , +0xB0000000 ,0x00000000 ,0x81C ,0x01740101 ,0x81C ,0x01760101 , 0x81C, 0x01780101,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 459/530 wlcore: fix overlapping snprintf arguments in debugfs
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 7b0e2c4f6be3ec68bf807c84e985e81c21404cd1 ]
gcc complains about undefined behavior in calling snprintf() with the same buffer as input and output:
drivers/net/wireless/ti/wl18xx/debugfs.c: In function 'diversity_num_of_packets_per_ant_read':drivers/net/wireless/ti/wl18xx/../wlcore/debugfs.h:86:3: error: 'snprintf' argument 4 overlaps destination object 'buf' [-Werror=restrict]
86 | snprintf(buf, sizeof(buf), "%s[%d] = %d\n", \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
87 | buf, i, stats->sub.name[i]); \
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/ti/wl18xx/debugfs.c:24:2: note: in expansion of macro 'DEBUGFS_FWSTATS_FILE_ARRAY'
24 | DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~drivers/net/wireless/ti/wl18xx/debugfs.c:159:1: note: in expansion of macro 'WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY'
159 | WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(diversity, num_of_packets_per_ant,
There are probably other ways of handling the debugfs file, without using on-stack buffers, but a simple workaround here is to remember the current position in the buffer and just keep printing in there.
--- drivers/net/wireless/ti/wlcore/boot.c | 13 ++++++++----- drivers/net/wireless/ti/wlcore/debugfs.h | 7 ++++--- 2 files changed, 12 insertions(+), 8 deletions(-)
drivers/net/wireless/ti/wlcore/boot.c +8 -5
@@ -72,6 +72,7 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)unsigned int *min_ver = (wl->fw_type ==WL12XX_FW_TYPE_MULTI ) ? wl->min_mr_fw_ver : wl->min_sr_fw_ver;char min_fw_str[32 ] ="" ; +int off =0 ;int i;/* the chip must be exactly equal */
@@ -105,13 +106,15 @@ static int wlcore_validate_fw_ver(struct wl1271 *wl)return 0 ; fail: -for (i =0 ; i <NUM_FW_VER ; i++) +for (i =0 ; i <NUM_FW_VER && off <sizeof (min_fw_str); i++)if (min_ver[i] ==WLCORE_FW_VER_IGNORE ) -snprintf (min_fw_str,sizeof (min_fw_str), -"%s*." , min_fw_str); + off +=snprintf (min_fw_str + off, +sizeof (min_fw_str) - off, +"*." );else -snprintf (min_fw_str,sizeof (min_fw_str), -"%s%u." , min_fw_str, min_ver[i]); + off +=snprintf (min_fw_str + off, +sizeof (min_fw_str) - off, +"%u." , min_ver[i]);wl1271_error ("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n" "Please use at least FW %s\n"
drivers/net/wireless/ti/wlcore/debugfs.h +4 -3
@@ -78,13 +78,14 @@ static ssize_t sub## _ ##name## _read(struct file *file, \struct wl1271 *wl = file->private_data; \struct struct_type *stats = wl->stats.fw_stats; \char buf[DEBUGFS_FORMAT_BUFFER_SIZE ] ="" ; \ +int pos =0 ; \int i; \ \wl1271_debugfs_update_stats (wl); \ \ -for (i =0 ; i < len; i++) \ -snprintf (buf,sizeof (buf),"%s[%d] = %d\n" , \ - buf, i, stats->sub.name[i]); \ +for (i =0 ; i < len && pos <sizeof (buf); i++) \ + pos +=snprintf (buf + pos,sizeof (buf), \ +"[%d] = %d\n" , i, stats->sub.name[i]); \ \return wl1271_format_buffer (userbuf, count, ppos,"%s" , buf); \ } \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 460/530 i2c: sh7760: fix IRQ error path
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]
While adding the invalid IRQ check after calling platform_get_irq(), I managed to overlook that the driver has a complex error path in its probe() method, thus a simple *return* couldn't be used. Use a proper *goto* instead!
--- drivers/i2c/busses/i2c-sh7760.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-sh7760.c +1 -1
@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) ret =platform_get_irq (pdev,0 );if (ret <0 ) -return ret; + goto out3; id->irq = ret; id->adap.nr = pdev->id;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 461/530 i2c: mediatek: Fix wrong dma sync flag
In reply to Greg Kroah-HartmanFrom: Qii Wang <[email protected]>
[ Upstream commit 3186b880447ad3cc9b6487fa626a71d64b831524 ]
The right flag is apdma_sync when apdma remove hand-shake signel.
--- drivers/i2c/busses/i2c-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mt65xx.c +1 -1
@@ -479,7 +479,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) {u16 control_reg; -if (i2c->dev_comp->dma_sync) { +if (i2c->dev_comp->apdma_sync) {writel (I2C_DMA_WARM_RST , i2c->pdmabase +OFFSET_RST );udelay (10 );writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 462/530 mwl8k: Fix a double Free in mwl8k_probe_hw
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]
In mwl8k_probe_hw, hw->priv->txq is freed at the first time by dma_free_coherent() in the call chain:
if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).
Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().
My patch set txq->txd to NULL after the first free to avoid the double free.
--- drivers/net/wireless/marvell/mwl8k.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/mwl8k.c +1 -0
@@ -1469,6 +1469,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) txq->skb =kcalloc (MWL8K_TX_DESCS ,sizeof (*txq->skb),GFP_KERNEL );if (txq->skb ==NULL ) {pci_free_consistent (priv->pdev, size, txq->txd, txq->txd_dma); + txq->txd =NULL ;return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 463/530 netfilter: nft_payload: fix C-VLAN offload support
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 14c20643ef9457679cc6934d77adc24296505214 ]
- add another struct flow_dissector_key_vlan for C-VLAN
- update layer 3 dependency to allow to match on IPv4/IPv6
--- include/net/netfilter/nf_tables_offload.h | 1 + net/netfilter/nft_payload.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-)
include/net/netfilter/nf_tables_offload.h +1 -0
@@ -45,6 +45,7 @@ struct nft_flow_key {struct flow_dissector_key_ports tp;struct flow_dissector_key_ip ip;struct flow_dissector_key_vlan vlan; +struct flow_dissector_key_vlan cvlan;struct flow_dissector_key_eth_addrs eth_addrs;struct flow_dissector_key_meta meta; }__aligned(BITS_PER_LONG / 8) ;/* Ensure that we can do comparisons as longs. */
net/netfilter/nft_payload.c +3 -2
@@ -241,7 +241,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , vlan, +NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, vlan_tci,sizeof (__be16), reg);break ; case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
@@ -249,8 +249,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , vlan, +NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, vlan_tpid,sizeof (__be16), reg); +nft_offload_set_dependency (ctx,NFT_OFFLOAD_DEP_NETWORK );break ;default :return -EOPNOTSUPP ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 464/530 netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit ff4d90a89d3d4d9814e0a2696509a7d495be4163 ]
The flow dissector representation expects the VLAN id in host byteorder. Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp.
--- include/net/netfilter/nf_tables_offload.h | 11 +++++- net/netfilter/nft_cmp.c | 41 +++++++++++++++++++++-- net/netfilter/nft_payload.c | 10 +++--- 3 files changed, 55 insertions(+), 7 deletions(-)
include/net/netfilter/nf_tables_offload.h +10 -1
@@ -4,11 +4,16 @@#include <net/flow_offload.h> #include <net/netfilter/nf_tables.h> +enum nft_offload_reg_flags { +NFT_OFFLOAD_F_NETWORK2HOST = (1 <<0 ), +}; +struct nft_offload_reg {u32 key;u32 len;u32 base_offset;u32 offset; +u32 flags;struct nft_data data;struct nft_data mask; };
@@ -72,13 +77,17 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, const struct nft_rulvoid nft_flow_rule_destroy (struct nft_flow_rule *flow);int nft_flow_rule_offload_commit (struct net *net); -#define NFT_OFFLOAD_MATCH (__key, __base, __field, __len, __reg) \ +#define NFT_OFFLOAD_MATCH_FLAGS (__key, __base, __field, __len, __reg, __flags) \ (__reg)->base_offset = \ offsetof(struct nft_flow_key, __base); \ (__reg)->offset = \ offsetof(struct nft_flow_key, __base.__field); \ (__reg)->len = __len; \ (__reg)->key = __key; \ + (__reg)->flags = __flags; + +#define NFT_OFFLOAD_MATCH (__key, __base, __field, __len, __reg) \ + NFT_OFFLOAD_MATCH_FLAGS(__key, __base, __field, __len, __reg, 0)#define NFT_OFFLOAD_MATCH_EXACT (__key, __base, __field, __len, __reg) \ NFT_OFFLOAD_MATCH(__key, __base, __field, __len, __reg) \
net/netfilter/nft_cmp.c +39 -2
58 lines not on this page · raw message
net/netfilter/nft_payload.c +6 -4
@@ -226,8 +226,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_VLAN , vlan, - vlan_tci,sizeof (__be16), reg); +NFT_OFFLOAD_MATCH_FLAGS (FLOW_DISSECTOR_KEY_VLAN , vlan, + vlan_tci,sizeof (__be16), reg, +NFT_OFFLOAD_F_NETWORK2HOST );break ;case offsetof(struct vlan_ethhdr , h_vlan_encapsulated_proto):if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))
@@ -241,8 +242,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,if (!nft_payload_offload_mask (reg, priv->len,sizeof (__be16)))return -EOPNOTSUPP ; -NFT_OFFLOAD_MATCH (FLOW_DISSECTOR_KEY_CVLAN , cvlan, - vlan_tci,sizeof (__be16), reg); +NFT_OFFLOAD_MATCH_FLAGS (FLOW_DISSECTOR_KEY_CVLAN , cvlan, + vlan_tci,sizeof (__be16), reg, +NFT_OFFLOAD_F_NETWORK2HOST );break ;case offsetof(struct vlan_ethhdr , h_vlan_encapsulated_proto) +sizeof (struct vlan_hdr ):
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 465/530 netfilter: nftables_offload: special ethertype handling for VLAN
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 783003f3bb8a565326e89d18bbd948ad8ffc816a ]
The nftables offload parser sets FLOW_DISSECTOR_KEY_BASIC .n_proto to the ethertype field in the ethertype frame. However:
- FLOW_DISSECTOR_KEY_BASIC .n_proto field always stores either IPv4 or IPv6 ethertypes.
- FLOW_DISSECTOR_KEY_VLAN .vlan_tpid stores either the 802.1q and 802.1ad ethertypes. Same as for FLOW_DISSECTOR_KEY_CVLAN.
This function adjusts the flow dissector to handle two scenarios:
1) FLOW_DISSECTOR_KEY_VLAN .vlan_tpid is set to 802.1q or 802.1ad. Then, transfer:
- the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
- the original FLOW_DISSECTOR_KEY_VLAN .tpid to the FLOW_DISSECTOR_KEY_CVLAN .tpid
- the original FLOW_DISSECTOR_KEY_CVLAN .tpid to the .n_proto field.
2) .n_proto is set to 802.1q or 802.1ad. Then, transfer:
- the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
- the original FLOW_DISSECTOR_KEY_VLAN .tpid to the .n_proto field.
--- net/netfilter/nf_tables_offload.c | 44 +++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+)
net/netfilter/nf_tables_offload.c +44 -0
@@ -45,6 +45,48 @@ void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow, offsetof(struct nft_flow_key , control); } +struct nft_offload_ethertype { +__be16 value; +__be16 mask; +}; + +static void nft_flow_rule_transfer_vlan (struct nft_offload_ctx *ctx, +struct nft_flow_rule *flow) +{ +struct nft_flow_match *match = &flow->match; +struct nft_offload_ethertype ethertype; + +if (match->dissector.used_keys &BIT (FLOW_DISSECTOR_KEY_CONTROL ) && + match->key.basic.n_proto !=htons (ETH_P_8021Q ) && + match->key.basic.n_proto !=htons (ETH_P_8021AD )) +return ; + + ethertype.value = match->key.basic.n_proto; + ethertype.mask = match->mask.basic.n_proto; + +if (match->dissector.used_keys &BIT (FLOW_DISSECTOR_KEY_VLAN ) && + (match->key.vlan.vlan_tpid ==htons (ETH_P_8021Q ) || + match->key.vlan.vlan_tpid ==htons (ETH_P_8021AD ))) { + match->key.basic.n_proto = match->key.cvlan.vlan_tpid; + match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid; + match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid; + match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid; + match->key.vlan.vlan_tpid = ethertype.value; + match->mask.vlan.vlan_tpid = ethertype.mask; + match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN ] = + offsetof(struct nft_flow_key , cvlan); + match->dissector.used_keys |=BIT (FLOW_DISSECTOR_KEY_CVLAN ); + }else { + match->key.basic.n_proto = match->key.vlan.vlan_tpid; + match->mask.basic.n_proto = match->mask.vlan.vlan_tpid; + match->key.vlan.vlan_tpid = ethertype.value; + match->mask.vlan.vlan_tpid = ethertype.mask; + match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN ] = + offsetof(struct nft_flow_key , vlan); + match->dissector.used_keys |=BIT (FLOW_DISSECTOR_KEY_VLAN ); + } +} +struct nft_flow_rule *nft_flow_rule_create (struct net *net,const struct nft_rule *rule) {
@@ -89,6 +131,8 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net, expr =nft_expr_next (expr); } +nft_flow_rule_transfer_vlan (ctx, flow); + flow->proto = ctx->dep.l3num;kfree (ctx);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 466/530 vsock/vmci: log once the failed queue pair allocation
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]
VMCI feature is not supported in conjunction with the vSphere Fault Tolerance (FT) feature.
VMware Tools can repeatedly try to create a vsock connection. If FT is enabled the kernel logs is flooded with the following messages:
qp_alloc_hypercall result = -20
Could not attach to queue pair with -20
"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307 ("VMCI: Stop log spew when qp allocation isn't possible"), but "Could not attach to queue pair with -20" is still there flooding the log.
Since the error message can be useful in some cases, print it only once.
--- net/vmw_vsock/vmci_transport.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/vmw_vsock/vmci_transport.c +1 -2
@@ -568,8 +568,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, peer, flags, VMCI_NO_PRIVILEGE_FLAGS); out:if (err <0 ) { -pr_err ("Could not attach to queue pair with %d\n" , - err); +pr_err_once ("Could not attach to queue pair with %d\n" , err); err =vmci_transport_error_to_vsock_error (err); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 467/530 libbpf: Initialize the bpf_seq_printf parameters array field by field
In reply to Greg Kroah-HartmanFrom: Florent Revest <[email protected]>
[ Upstream commit 83cd92b46484aa8f64cdc0bff8ac6940d1f78519 ]
When initializing the __param array with a one liner, if all args are const, the initial array value will be placed in the rodata section but because libbpf does not support relocation in the rodata section, any pointer in this array will stay NULL.
--- tools/lib/bpf/bpf_tracing.h | 40 +++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 11 deletions(-)
tools/lib/bpf/bpf_tracing.h +29 -11
@@ -413,20 +413,38 @@ typeof(name(0)) name(struct pt_regs *ctx) \ } \ static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args) +#define ___bpf_fill0 (arr, p, x) do {} while (0) +#define ___bpf_fill1 (arr, p, x) arr[p] = x +#define ___bpf_fill2(arr, p, x, args...) arr[p] = x; ___bpf_fill1(arr, p + 1, args) +#define ___bpf_fill3(arr, p, x, args...) arr[p] = x; ___bpf_fill2(arr, p + 1, args) +#define ___bpf_fill4(arr, p, x, args...) arr[p] = x; ___bpf_fill3(arr, p + 1, args) +#define ___bpf_fill5(arr, p, x, args...) arr[p] = x; ___bpf_fill4(arr, p + 1, args) +#define ___bpf_fill6(arr, p, x, args...) arr[p] = x; ___bpf_fill5(arr, p + 1, args) +#define ___bpf_fill7(arr, p, x, args...) arr[p] = x; ___bpf_fill6(arr, p + 1, args) +#define ___bpf_fill8(arr, p, x, args...) arr[p] = x; ___bpf_fill7(arr, p + 1, args) +#define ___bpf_fill9(arr, p, x, args...) arr[p] = x; ___bpf_fill8(arr, p + 1, args) +#define ___bpf_fill10(arr, p, x, args...) arr[p] = x; ___bpf_fill9(arr, p + 1, args) +#define ___bpf_fill11(arr, p, x, args...) arr[p] = x; ___bpf_fill10(arr, p + 1, args) +#define ___bpf_fill12(arr, p, x, args...) arr[p] = x; ___bpf_fill11(arr, p + 1, args) +#define ___bpf_fill(arr, args...) \ + ___bpf_apply(___bpf_fill, ___bpf_narg(args))(arr, 0, args) +/* * BPF_SEQ_PRINTF to wrap bpf_seq_printf to-be-printed values * in a structure. */ -#define BPF_SEQ_PRINTF(seq, fmt, args...) \ - ({ \ - _Pragma("GCC diagnostic push") \ - _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ - static const char ___fmt[] = fmt; \ - unsigned long long ___param[] = { args }; \ - _Pragma("GCC diagnostic pop") \ - int ___ret = bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ - ___param, sizeof(___param)); \ - ___ret; \ - }) +#define BPF_SEQ_PRINTF(seq, fmt, args...) \ +({ \ + static const char ___fmt[] = fmt; \ + unsigned long long ___param[___bpf_narg(args)]; \ + \ + _Pragma("GCC diagnostic push") \ + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \ + ___bpf_fill(___param, args); \ + _Pragma("GCC diagnostic pop") \ + \ + bpf_seq_printf(seq, ___fmt, sizeof(___fmt), \ + ___param, sizeof(___param)); \ +})#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 468/530 net: ethernet: ixp4xx: Set the DMA masks explicitly
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 8d892d60941b00c86d2029c8a99db24ab4979673 ]
The former fix only papered over the actual problem: the ethernet core expects the netdev .dev member to have the proper DMA masks set, or there will be BUG_ON() triggered in kernel/dma/mapping.c.
Fix this by simply copying dma_mask and dma_mask_coherent from the parent device.
--- drivers/net/ethernet/xscale/ixp4xx_eth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/xscale/ixp4xx_eth.c +4 -1
@@ -1086,7 +1086,7 @@ static int init_queues(struct port *port)int i;if (!ports_open) { - dma_pool =dma_pool_create (DRV_NAME , port->netdev->dev.parent, + dma_pool =dma_pool_create (DRV_NAME , &port->netdev->dev,POOL_ALLOC_SIZE ,32 ,0 );if (!dma_pool)return -ENOMEM ;
@@ -1436,6 +1436,9 @@ static int ixp4xx_eth_probe(struct platform_device *pdev) ndev->netdev_ops = &ixp4xx_netdev_ops; ndev->ethtool_ops = &ixp4xx_ethtool_ops; ndev->tx_queue_len =100 ; +/* Inherit the DMA masks from the platform device */ + ndev->dev.dma_mask = dev->dma_mask; + ndev->dev.coherent_dma_mask = dev->coherent_dma_mask;netif_napi_add (ndev, &port->napi, eth_poll,NAPI_WEIGHT );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 469/530 gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit 7ad18ff6449cbd6beb26b53128ddf56d2685aa93 ]
Commit 38ec4944b593 ("gro: ensure frag0 meets IP header alignment") did the right thing, but missed the fact that napi_gro_frags() logics calls for skb_gro_reset_offset() *before* pulling Ethernet header to the skb linear space.
That said, the introduced check for frag0 address being aligned to 4 always fails for it as Ethernet header is obviously 14 bytes long, and in case with NET_IP_ALIGN its start is not aligned to 4.
Fix this by adding @nhoff argument to skb_gro_reset_offset() which tells if an IP header is placed right at the start of frag0 or not. This restores Fast GRO for napi_gro_frags() that became very slow after the mentioned commit, and preserves the introduced check to avoid silent unaligned accesses.
Quoted 1 line
From v1 [0]:
- inline tiny skb_gro_reset_offset() to let the code be optimized more efficively (esp. for the !NET_IP_ALIGN case) (Eric);
- pull in Reviewed-by from Eric.
[0] https://lore.kernel.org/netdev/[email protected]
--- net/core/dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/core/dev.c +4 -4
@@ -5857,7 +5857,7 @@ static struct list_head *gro_list_prepare(struct napi_struct *napi,return head; } -static void skb_gro_reset_offset (struct sk_buff *skb) +static inline void skb_gro_reset_offset (struct sk_buff *skb,u32 nhoff) {const struct skb_shared_info *pinfo =skb_shinfo (skb);const skb_frag_t *frag0 = &pinfo->frags[0 ];
@@ -5868,7 +5868,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)if (!skb_headlen (skb) && pinfo->nr_frags && !PageHighMem (skb_frag_page (frag0)) && - (!NET_IP_ALIGN || !(skb_frag_off (frag0) &3 ))) { + (!NET_IP_ALIGN || !((skb_frag_off (frag0) + nhoff) &3 ))) {NAPI_GRO_CB (skb)->frag0 =skb_frag_address (frag0); NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int, skb_frag_size(frag0),
@@ -6101,7 +6101,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)skb_mark_napi_id (skb, napi);trace_napi_gro_receive_entry (skb); -skb_gro_reset_offset (skb); +skb_gro_reset_offset (skb,0 ); ret =napi_skb_finish (napi, skb,dev_gro_receive (napi, skb));trace_napi_gro_receive_exit (ret);
@@ -6194,7 +6194,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi) napi->skb =NULL ;skb_reset_mac_header (skb); -skb_gro_reset_offset (skb); +skb_gro_reset_offset (skb, hlen);if (unlikely (skb_gro_header_hard (skb, hlen))) { eth =skb_gro_header_slow (skb, hlen,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 470/530 RDMA/cxgb4: add missing qpid increment
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 3a6684385928d00b29acac7658a5ae1f2a44494c ]
missing qpid increment leads to skipping few qpids while allocating QP. This eventually leads to adapter running out of qpids after establishing fewer connections than it actually supports.
Current patch increments the qpid correctly.
--- drivers/infiniband/hw/cxgb4/resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/resource.c +1 -1
@@ -216,7 +216,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx) goto out; entry->qid = qid;list_add_tail (&entry->entry, &uctx->cqids); -for (i = qid; i & rdev->qpmask; i++) { +for (i = qid +1 ; i & rdev->qpmask; i++) { entry =kmalloc (sizeof (*entry),GFP_KERNEL );if (!entry) goto out;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 471/530 RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit 783a11bf2400e5d5c42a943c3083dc0330751842 ]
When i40iw_hmc_sd_one fails, chunk is freed without the deletion of chunk entry in the PBLE info list.
Fix it by adding the chunk entry to the PBLE info list only after successful addition of SD in i40iw_hmc_sd_one.
This fixes a static checker warning reported here:
https://lore.kernel.org/linux-rdma/YHV4CFXzqTm23AOZ@mwanda/
--- drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/infiniband/hw/i40iw/i40iw_pble.c +2 -4
@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,i40iw_debug (dev,I40IW_DEBUG_PBLE ,"next_fpm_addr = %llx chunk_size[%u] = 0x%x\n" , pble_rsrc->next_fpm_addr, chunk->size, chunk->size); pble_rsrc->unallocated_pble -= (chunk->size >>3 ); -list_add (&chunk->list, &pble_rsrc->pinfo.clist); sd_reg_val = (sd_entry_type ==I40IW_SD_TYPE_PAGED ) ? sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; -if (sd_entry->valid) -return 0 ; -if (dev->is_pf) { +if (dev->is_pf && !sd_entry->valid) { ret_code =i40iw_hmc_sd_one (dev, hmc_info->hmc_fn_id, sd_reg_val, idx->sd_idx, sd_entry->entry_type, true);
@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, } sd_entry->valid = true; +list_add (&chunk->list, &pble_rsrc->pinfo.clist);return 0 ; error:kfree (chunk);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 472/530 ALSA: usb: midi: dont return -ENOMEM when usb_urb_ep_type_check fails
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit cfd577acb769301b19c31361d45ae1f145318b7a ]
Currently when the call to usb_urb_ep_type_check fails (returning -EINVAL) the error return path returns -ENOMEM via the exit label "error". Other uses of the same error exit label set the err variable to -ENOMEM but this is not being used. I believe the original intent was for the error exit path to return the value in err rather than the hard coded -ENOMEM, so return this rather than the hard coded -ENOMEM.
Addresses-Coverity: ("Unused value")
--- sound/usb/midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/midi.c +1 -1
@@ -1332,7 +1332,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi, error:snd_usbmidi_in_endpoint_delete (ep); -return -ENOMEM ; +return err; }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 473/530 sfc: ef10: fix TX queue lookup in TX event handling
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
[ Upstream commit 172e269edfce34bac7c61c15551816bda4b0f140 ]
We're starting from a TXQ label, not a TXQ type, so
efx_channel_get_tx_queue() is inappropriate. This worked by chance, because labels and types currently match on EF10, but we shouldn't rely on that.
--- drivers/net/ethernet/sfc/ef10.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/sfc/ef10.c +1 -2
@@ -2928,8 +2928,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)/* Get the transmit queue */ tx_ev_q_label =EFX_QWORD_FIELD (*event,ESF_DZ_TX_QLABEL ); - tx_queue =efx_channel_get_tx_queue (channel, - tx_ev_q_label %EFX_MAX_TXQ_PER_CHANNEL ); + tx_queue = channel->tx_queue + (tx_ev_q_label %EFX_MAX_TXQ_PER_CHANNEL );if (!tx_queue->timestamping) {/* Transmit completion */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 474/530 vsock/virtio: free queued packets when closing socket
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
[ Upstream commit 8432b8114957235f42e070a16118a7f750de9d39 ]
As reported by syzbot [1], there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b ("vsock/virtio: free packets during the socket release"), but we forgot to drain the RX queue when the socket is definitely closed by the scheduled work.
To avoid future issues, let's use the new virtio_transport_remove_sock() to drain the RX queue before removing the socket from the af_vsock lists calling vsock_remove_sock().
[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9
--- net/vmw_vsock/virtio_transport_common.c | 28 +++++++++++++++++-------- 1 file changed, 19 insertions(+), 9 deletions(-)
net/vmw_vsock/virtio_transport_common.c +19 -9
@@ -733,6 +733,23 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t,return t->send_pkt (reply); } +/* This function should be called with sk_lock held and SOCK_DONE set */ +static void virtio_transport_remove_sock (struct vsock_sock *vsk) +{ +struct virtio_vsock_sock *vvs = vsk->trans; +struct virtio_vsock_pkt *pkt, *tmp; + +/* We don't need to take rx_lock, as the socket is closing and we are +* removing it. +*/ +list_for_each_entry_safe (pkt, tmp, &vvs->rx_queue, list) { +list_del (&pkt->list); +virtio_transport_free_pkt (pkt); + } + +vsock_remove_sock (vsk); +} +static void virtio_transport_wait_close (struct sock *sk,long timeout) {if (timeout) {
@@ -765,7 +782,7 @@ static void virtio_transport_do_close(struct vsock_sock *vsk, (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) { vsk->close_work_scheduled = false; -vsock_remove_sock (vsk); +virtio_transport_remove_sock (vsk);/* Release refcnt obtained when we scheduled the timeout */ sock_put (sk);
@@ -828,22 +845,15 @@ static bool virtio_transport_close(struct vsock_sock *vsk)void virtio_transport_release (struct vsock_sock *vsk) { -struct virtio_vsock_sock *vvs = vsk->trans; -struct virtio_vsock_pkt *pkt, *tmp;struct sock *sk = &vsk->sk;bool remove_sock = true;if (sk->sk_type ==SOCK_STREAM ) remove_sock =virtio_transport_close (vsk); -list_for_each_entry_safe (pkt, tmp, &vvs->rx_queue, list) { -list_del (&pkt->list); -virtio_transport_free_pkt (pkt); - } -if (remove_sock) {sock_set_flag (sk,SOCK_DONE ); -vsock_remove_sock (vsk); +virtio_transport_remove_sock (vsk); } }EXPORT_SYMBOL_GPL (virtio_transport_release);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 475/530 net: marvell: prestera: fix port event handling on init
In reply to Greg Kroah-HartmanFrom: Vadym Kochan <[email protected]>
[ Upstream commit 333980481b99edb24ebd5d1a53af70a15d9146de ]
For some reason there might be a crash during ports creation if port events are handling at the same time because fw may send initial port event with down state.
The crash points to cancel_delayed_work() which is called when port went is down. Currently I did not find out the real cause of the issue, so fixed it by cancel port stats work only if previous port's state was up & runnig.
The following is the crash which can be triggered:
[ 28.311104] Unable to handle kernel paging request at virtual address 000071775f776600 [ 28.319097] Mem abort info: [ 28.321914] ESR = 0x96000004 [ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits [ 28.330350] SET = 0, FnV = 0 [ 28.333430] EA = 0, S1PTW = 0 [ 28.336597] Data abort info: [ 28.339499] ISV = 0, ISS = 0x00000004 [ 28.343362] CM = 0, WnR = 0 [ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000 [ 28.352842] [000071775f776600] pgd=0000000000000000, p4d=0000000000000000 [ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 28.365310] Modules linked in: prestera_pci(+) prestera uio_pdrv_genirq [ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted 5.11.0-rc4 #1 [ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn [prestera_pci] [ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--) [ 28.397468] pc : get_work_pool+0x48/0x60 [ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0 [ 28.406018] sp : ffff80001391bc60 [ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000 [ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88 [ 28.420089] x25: 0000000000000000 x24: ffff000106119760 [ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000 [ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0 [ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0 [ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88 [ 28.446898] x15: 0000000000000001 x14: 00000000000002ba [ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4 [ 28.457622] x11: 0000000000000030 x10: 000000000000000c [ 28.462985] x9 : 000000000000000c x8 : 0000000000000030 [ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758 [ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60 [ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060 [ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8 [ 28.489791] Call trace: [ 28.492259] get_work_pool+0x48/0x60 [ 28.495874] cancel_delayed_work+0x38/0xb0 [ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera] [ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera] [ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci] [ 28.516660] process_one_work+0x1e8/0x360 [ 28.520710] worker_thread+0x44/0x480 [ 28.524412] kthread+0x154/0x160 [ 28.527670] ret_from_fork+0x10/0x38 [ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020) [ 28.537429] ---[ end trace 5eced933df3a080b ]---
--- drivers/net/ethernet/marvell/prestera/prestera_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/prestera/prestera_main.c +2 -1
@@ -436,7 +436,8 @@ static void prestera_port_handle_event(struct prestera_switch *sw,netif_carrier_on (port->dev);if (!delayed_work_pending (caching_dw))queue_delayed_work (prestera_wq, caching_dw,0 ); - }else { + }else if (netif_running (port->dev) && +netif_carrier_ok (port->dev)) {netif_carrier_off (port->dev);if (delayed_work_pending (caching_dw))cancel_delayed_work (caching_dw);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 476/530 net: davinci_emac: Fix incorrect masking of tx and rx error channel
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]
The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels) are incorrect and always lead to a zero result. The mask values are currently the incorrect post-right shifted values, fix this by setting them to the currect values.
(I double checked these against the TMS320TCI6482 data sheet, section 5.30, page 127 to ensure I had the correct mask values for the TXERRCH and RXERRCH fields in the MACSTATUS register).
Addresses-Coverity: ("Operands don't affect result")
--- drivers/net/ethernet/ti/davinci_emac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/davinci_emac.c +2 -2
@@ -169,11 +169,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";/* EMAC mac_status register */ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)#define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) -#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)#define EMAC_MACSTATUS_TXERRCH_SHIFT (16)#define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)#define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) -#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) +#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)#define EMAC_MACSTATUS_RXERRCH_SHIFT (8)/* EMAC RX register masks */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 477/530 mt76: mt7615: fix memleak when mt7615_unregister_device()
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit 8ab31da7b89f71c4c2defcca989fab7b42f87d71 ]
mt7615_tx_token_put() should get call before mt76_free_pending_txwi().
--- drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +1 -2
@@ -161,10 +161,9 @@ void mt7615_unregister_device(struct mt7615_dev *dev)mt76_unregister_device (&dev->mt76);if (mcu_running)mt7615_mcu_exit (dev); -mt7615_dma_cleanup (dev);mt7615_tx_token_put (dev); - +mt7615_dma_cleanup (dev);tasklet_disable (&dev->irq_tasklet);mt76_free_device (&dev->mt76);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 478/530 crypto: ccp: Detect and reject "invalid" addresses destined for PSP
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 74c1f1366eb7714b8b211554f6c5cee315ff3fbc ]
Explicitly reject using pointers that are not virt_to_phys() friendly as the source for SEV commands that are sent to the PSP. The PSP works with physical addresses, and __pa()/virt_to_phys() will not return the correct address in these cases, e.g. for a vmalloc'd pointer. At best, the bogus address will cause the command to fail, and at worst lead to system instability.
While it's unlikely that callers will deliberately use a bad pointer for SEV buffers, a caller can easily use a vmalloc'd pointer unknowingly when running with CONFIG_VMAP_STACK=y as it's not obvious that putting the command buffers on the stack would be bad. The command buffers are relative small and easily fit on the stack, and the APIs to do not document that the incoming pointer must be a physically contiguous, __pa() friendly pointer.
Message-Id: <[email protected]>
--- drivers/crypto/ccp/sev-dev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/ccp/sev-dev.c +3 -0
@@ -149,6 +149,9 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) sev = psp->sev_data; +if (data &&WARN_ON_ONCE (!virt_addr_valid (data))) +return -EINVAL ; +/* Get the physical address of the command buffer */ phys_lsb = data ?lower_32_bits (__psp_pa (data)) :0 ; phys_msb = data ?upper_32_bits (__psp_pa (data)) :0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 479/530 nfp: devlink: initialize the devlink port attribute "lanes"
In reply to Greg Kroah-HartmanFrom: Yinjun Zhang <[email protected]>
[ Upstream commit 90b669d65d99a3ee6965275269967cdee4da106e ]
The number of lanes of devlink port should be correctly initialized when registering the port, so that the input check when running "devlink port split <port> count <N>" can pass.
--- drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/netronome/nfp/nfp_devlink.c +1 -0
@@ -364,6 +364,7 @@ int nfp_devlink_port_register(struct nfp_app *app, struct nfp_port *port) attrs.split = eth_port.is_split; attrs.splittable = !attrs.split; + attrs.lanes = eth_port.port_lanes; attrs.flavour =DEVLINK_PORT_FLAVOUR_PHYSICAL ; attrs.phys.port_number = eth_port.label_port; attrs.phys.split_subport_number = eth_port.label_subport;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 480/530 net: stmmac: fix TSO and TBS feature enabling during driver open
In reply to Greg Kroah-HartmanFrom: Ong Boon Leong <[email protected]>
[ Upstream commit 5e6038b88a5718910dd74b949946d9d9cee9a041 ]
TSO and TBS cannot co-exist and current implementation requires two fixes:
1) stmmac_open() does not need to call stmmac_enable_tbs() because the MAC is reset in stmmac_init_dma_engine() anyway.
2) Inside stmmac_hw_setup(), we should call stmmac_enable_tso() for TX Q that is _not_ configured for TBS.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +9 -3
@@ -2727,8 +2727,15 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)/* Enable TSO */ if (priv->tso) { -for (chan =0 ; chan < tx_cnt; chan++) +for (chan =0 ; chan < tx_cnt; chan++) { +struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan]; + +/* TSO and TBS cannot co-exist */ +if (tx_q->tbs &STMMAC_TBS_AVAIL ) +continue ; +stmmac_enable_tso (priv, priv->ioaddr,1 , chan); + } }/* Enable Split Header */
@@ -2820,9 +2827,8 @@ static int stmmac_open(struct net_device *dev)struct stmmac_tx_queue *tx_q = &priv->tx_queue[chan];int tbs_en = priv->plat->tx_queues_cfg[chan].tbs_en; +/* Setup per-TXQ tbs flag before TX descriptor alloc */ tx_q->tbs |= tbs_en ?STMMAC_TBS_AVAIL :0 ; -if (stmmac_enable_tbs (priv, priv->ioaddr, tbs_en, chan)) - tx_q->tbs &= ~STMMAC_TBS_AVAIL ; } ret =alloc_dma_desc_resources (priv);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 481/530 net: renesas: ravb: Fix a stuck issue when a lot of frames are received
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 5718458b092bf6bf4482c5df32affba3c3259517 ]
When a lot of frames were received in the short term, the driver caused a stuck of receiving until a new frame was received. For example, the following command from other device could cause this issue.
$ sudo ping -f -l 1000 -c 1000 <this driver's ipaddress>
The previous code always cleared the interrupt flag of RX but checks the interrupt flags in ravb_poll(). So, ravb_poll() could not call ravb_rx() in the next time until a new RX frame was received if ravb_rx() returned true. To fix the issue, always calls ravb_rx() regardless the interrupt flags condition.
--- drivers/net/ethernet/renesas/ravb_main.c | 35 ++++++++---------------- 1 file changed, 12 insertions(+), 23 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +12 -23
@@ -911,31 +911,20 @@ static int ravb_poll(struct napi_struct *napi, int budget)int q = napi - priv->napi;int mask =BIT (q);int quota = budget; -u32 ris0, tis; -for (;;) { - tis =ravb_read (ndev,TIS ); - ris0 =ravb_read (ndev,RIS0 ); -if (!((ris0 & mask) || (tis & mask))) -break ; +/* Processing RX Descriptor Ring */ +/* Clear RX interrupt */ +ravb_write (ndev, ~(mask |RIS0_RESERVED ),RIS0 ); +if (ravb_rx (ndev, "a, q)) + goto out; -/* Processing RX Descriptor Ring */ -if (ris0 & mask) { -/* Clear RX interrupt */ -ravb_write (ndev, ~(mask |RIS0_RESERVED ),RIS0 ); -if (ravb_rx (ndev, "a, q)) - goto out; - } -/* Processing TX Descriptor Ring */ -if (tis & mask) { -spin_lock_irqsave (&priv->lock, flags); -/* Clear TX interrupt */ -ravb_write (ndev, ~(mask |TIS_RESERVED ),TIS ); -ravb_tx_free (ndev, q, true); -netif_wake_subqueue (ndev, q); -spin_unlock_irqrestore (&priv->lock, flags); - } - } +/* Processing RX Descriptor Ring */ +spin_lock_irqsave (&priv->lock, flags); +/* Clear TX interrupt */ +ravb_write (ndev, ~(mask |TIS_RESERVED ),TIS ); +ravb_tx_free (ndev, q, true); +netif_wake_subqueue (ndev, q); +spin_unlock_irqrestore (&priv->lock, flags);napi_complete (napi);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 482/530 net: phy: intel-xway: enable integrated led functions
In reply to Greg Kroah-HartmanFrom: Martin Schiller <[email protected]>
[ Upstream commit 357a07c26697a770d39d28b6b111f978deb4017d ]
The Intel xway phys offer the possibility to deactivate the integrated LED function and to control the LEDs manually.
If this was set by the bootloader, it must be ensured that the integrated LED function is enabled for all LEDs when loading the driver.
Before commit 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") the LEDs were enabled by a soft-reset of the PHY (using genphy_soft_reset). Initialize the XWAY_MDIO_LED with it's default value (which is applied during a soft reset) instead of adding back the soft reset. This brings back the default LED configuration while still preventing an excessive amount of soft resets.
--- drivers/net/phy/intel-xway.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/net/phy/intel-xway.c +21 -0
@@ -11,6 +11,18 @@#define XWAY_MDIO_IMASK 0x19/* interrupt mask */ #define XWAY_MDIO_ISTAT 0x1A/* interrupt status */ +#define XWAY_MDIO_LED 0x1B/* led control */ + +/* bit 15:12 are reserved */ +#define XWAY_MDIO_LED_LED3_EN BIT(11)/* Enable the integrated function of LED3 */ +#define XWAY_MDIO_LED_LED2_EN BIT(10)/* Enable the integrated function of LED2 */ +#define XWAY_MDIO_LED_LED1_EN BIT(9)/* Enable the integrated function of LED1 */ +#define XWAY_MDIO_LED_LED0_EN BIT(8)/* Enable the integrated function of LED0 */ +/* bit 7:4 are reserved */ +#define XWAY_MDIO_LED_LED3_DA BIT(3)/* Direct Access to LED3 */ +#define XWAY_MDIO_LED_LED2_DA BIT(2)/* Direct Access to LED2 */ +#define XWAY_MDIO_LED_LED1_DA BIT(1)/* Direct Access to LED1 */ +#define XWAY_MDIO_LED_LED0_DA BIT(0)/* Direct Access to LED0 */ #define XWAY_MDIO_INIT_WOL BIT(15)/* Wake-On-LAN */ #define XWAY_MDIO_INIT_MSRE BIT(14)
@@ -159,6 +171,15 @@ static int xway_gphy_config_init(struct phy_device *phydev)/* Clear all pending interrupts */ phy_read (phydev,XWAY_MDIO_ISTAT ); +/* Ensure that integrated led function is enabled for all leds */ + err =phy_write (phydev,XWAY_MDIO_LED , +XWAY_MDIO_LED_LED0_EN | +XWAY_MDIO_LED_LED1_EN | +XWAY_MDIO_LED_LED2_EN | +XWAY_MDIO_LED_LED3_EN ); +if (err) +return err; + phy_write_mmd(phydev, MDIO_MMD_VEND2, XWAY_MMD_LEDCH, XWAY_MMD_LEDCH_NACS_NONE | XWAY_MMD_LEDCH_SBF_F02HZ |
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 483/530 RDMA/rxe: Fix a bug in rxe_fill_ip_info()
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit 45062f441590810772959d8e1f2b24ba57ce1bd9 ]
Fix a bug in rxe_fill_ip_info() which was attempting to convert from RDMA_NETWORK_XXX to RXE_NETWORK_XXX. .._IPV6 should have mapped to .._IPV6 not .._IPV4.
--- drivers/infiniband/sw/rxe/rxe_av.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_av.c +1 -1
@@ -88,7 +88,7 @@ void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr) type =RXE_NETWORK_TYPE_IPV4 ;break ;case RDMA_NETWORK_IPV6 : - type =RXE_NETWORK_TYPE_IPV4 ; + type =RXE_NETWORK_TYPE_IPV6 ;break ;default :/* not reached - checked in rxe_av_chk_attr */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 484/530 RDMA/core: Add CM to restrack after successful attachment to a device
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa ]
The device attach triggers addition of CM_ID to the restrack DB. However, when error occurs, we releasing this device, but defer CM_ID release. This causes to the situation where restrack sees CM_ID that is not valid anymore.
As a solution, add the CM_ID to the resource tracking DB only after the attachment is finished.
Found by syzcaller:
infiniband syz0: added syz_tunrdma_rxe: ignoring netdev event = 10 for syz_tun infiniband syz0: set down
infiniband syz0: ib_query_port failed (-19)
restrack: ------------[ cut here ]------------
infiniband syz0: BUG: RESTRACK detected leak of resources
restrack: User CM_ID object allocated by syz-executor716 is not freed
restrack: ------------[ cut here ]------------
--- drivers/infiniband/core/cma.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/infiniband/core/cma.c +10 -2
@@ -463,7 +463,6 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv, id_priv->id.route.addr.dev_addr.transport =rdma_node_get_transport (cma_dev->device->node_type);list_add_tail (&id_priv->list, &cma_dev->id_list); -rdma_restrack_add (&id_priv->res);trace_cm_id_attach (id_priv, cma_dev->device); }
@@ -700,6 +699,7 @@ static int cma_ib_acquire_dev(struct rdma_id_private *id_priv,mutex_lock (&lock);cma_attach_to_dev (id_priv, listen_id_priv->cma_dev);mutex_unlock (&lock); +rdma_restrack_add (&id_priv->res);return 0 ; }
@@ -754,8 +754,10 @@ static int cma_iw_acquire_dev(struct rdma_id_private *id_priv, } out: -if (!ret) +if (!ret) {cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res); + }mutex_unlock (&lock);return ret;
@@ -816,6 +818,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) found:cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res);mutex_unlock (&lock); addr = (struct sockaddr_ib *)cma_src_addr (id_priv);memcpy (&addr->sib_addr, &sgid,sizeof (sgid));
@@ -2529,6 +2532,7 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv, rdma_addr_size(cma_src_addr(id_priv)));_cma_attach_to_dev (dev_id_priv, cma_dev); +rdma_restrack_add (&dev_id_priv->res);cma_id_get (id_priv); dev_id_priv->internal_id =1 ; dev_id_priv->afonly = id_priv->afonly;
@@ -3169,6 +3173,7 @@ port_found:ib_addr_set_pkey (&id_priv->id.route.addr.dev_addr, pkey); id_priv->id.port_num = p;cma_attach_to_dev (id_priv, cma_dev); +rdma_restrack_add (&id_priv->res);cma_set_loopback (cma_src_addr (id_priv)); out:mutex_unlock (&lock);
@@ -3201,6 +3206,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,if (status)pr_debug_ratelimited ("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n" , status); +rdma_restrack_add (&id_priv->res); }else if (status) {pr_debug_ratelimited ("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n" , status); }
@@ -3812,6 +3818,8 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)if (ret) goto err2; +if (!cma_any_addr (addr)) +rdma_restrack_add (&id_priv->res);return 0 ; err2:if (id_priv->cma_dev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 485/530 powerpc/64: Fix the definition of the fixmap area
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 9ccba66d4d2aff9a3909aa77d57ea8b7cc166f3c ]
At the time being, the fixmap area is defined at the top of the address space or just below KASAN.
This definition is not valid for PPC64.
For PPC64, use the top of the I/O space.
Because of circular dependencies, it is not possible to include asm/fixmap.h in asm/book3s/64/pgtable.h , so define a fixed size AREA at the top of the I/O space for fixmap and ensure during build that the size is big enough.
--- arch/powerpc/include/asm/book3s/64/pgtable.h | 4 +++- arch/powerpc/include/asm/fixmap.h | 9 +++++++++ arch/powerpc/include/asm/nohash/64/pgtable.h | 5 ++++- 3 files changed, 16 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/book3s/64/pgtable.h +3 -1
@@ -7,6 +7,7 @@#ifndef __ASSEMBLY__#include <linux/mmdebug.h> #include <linux/bug.h> +#include <linux/sizes.h> #endif /*
@@ -323,7 +324,8 @@ extern unsigned long pci_io_base;#define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)#define IOREMAP_BASE (PHB_IO_END)#define IOREMAP_START (ioremap_bot) -#define IOREMAP_END (KERN_IO_END) +#define IOREMAP_END (KERN_IO_END - FIXADDR_SIZE) +#define FIXADDR_SIZE SZ_32M/* Advertise special mapping type for AGP */ #define HAVE_PAGE_AGP
arch/powerpc/include/asm/fixmap.h +9 -0
@@ -23,12 +23,17 @@#include <asm/kmap_types.h> #endif +#ifdef CONFIG_PPC64 +#define FIXADDR_TOP (IOREMAP_END + FIXADDR_SIZE) +#else +#define FIXADDR_SIZE 0#ifdef CONFIG_KASAN #include <asm/kasan.h> #define FIXADDR_TOP (KASAN_SHADOW_START - PAGE_SIZE)#else #define FIXADDR_TOP ((unsigned long)(-PAGE_SIZE))#endif +#endif /* * Here we define all the compile-time 'special' virtual
@@ -50,6 +55,7 @@*/ enum fixed_addresses {FIX_HOLE , +#ifdef CONFIG_PPC32 /* reserve the top 128K for early debugging purposes */ FIX_EARLY_DEBUG_TOP =FIX_HOLE ,FIX_EARLY_DEBUG_BASE =FIX_EARLY_DEBUG_TOP +(ALIGN (SZ_128K ,PAGE_SIZE )/PAGE_SIZE )-1 ,
@@ -72,6 +78,7 @@ enum fixed_addresses { FIX_IMMR_SIZE,#endif /* FIX_PCIE_MCFG, */ +#endif /* CONFIG_PPC32 */ __end_of_permanent_fixed_addresses, #define NR_FIX_BTMAPS (SZ_256K / PAGE_SIZE)
@@ -98,6 +105,8 @@ enum fixed_addresses {static inline void __set_fixmap (enum fixed_addresses idx,phys_addr_t phys,pgprot_t flags) { +BUILD_BUG_ON (IS_ENABLED (CONFIG_PPC64 ) && __FIXADDR_SIZE >FIXADDR_SIZE ); +if (__builtin_constant_p (idx))BUILD_BUG_ON (idx >= __end_of_fixed_addresses);else if (WARN_ON (idx >= __end_of_fixed_addresses))
arch/powerpc/include/asm/nohash/64/pgtable.h +4 -1
@@ -6,6 +6,8 @@* the ppc64 non-hashed page table. */ +#include <linux/sizes.h> +#include <asm/nohash/64/pgtable-4k.h> #include <asm/barrier.h> #include <asm/asm-const.h>
@@ -54,7 +56,8 @@#define PHB_IO_END (KERN_IO_START + FULL_IO_SIZE)#define IOREMAP_BASE (PHB_IO_END)#define IOREMAP_START (ioremap_bot) -#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE) +#define IOREMAP_END (KERN_VIRT_START + KERN_VIRT_SIZE - FIXADDR_SIZE) +#define FIXADDR_SIZE SZ_32M/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 486/530 ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]
When the error check in ath9k_hw_read_revisions() was added, it checked for -EIO which is what ath9k_regread() in the ath9k_htc driver uses. However, for plain ath9k, the register read function uses ioread32(), which just returns -1 on error. So if such a read fails, it still gets passed through and ends up as a weird mac revision in the log output.
Fix this by changing ath9k_regread() to return -1 on error like ioread32() does, and fix the error check to look for that instead of -EIO.
--- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- drivers/net/wireless/ath/ath9k/hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_init.c +1 -1
@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)if (unlikely (r)) {ath_dbg (common,WMI ,"REGISTER READ FAILED: (0x%04x, %d)\n" , reg_offset, r); -return -EIO ; +return -1 ; }return be32_to_cpu (val);
drivers/net/wireless/ath/ath9k/hw.c +1 -1
@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) srev =REG_READ (ah,AR_SREV ); -if (srev == -EIO ) { +if (srev ==-1 ) {ath_err (ath9k_hw_common (ah),"Failed to read SREV register" );return false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 487/530 ath10k: Fix a use after free in ath10k_htc_send_bundle
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 8392df5d7e0b6a7d21440da1fc259f9938f4dec3 ]
In ath10k_htc_send_bundle, the bundle_skb could be freed by dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later by bundle_skb->len.
As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to skb_len after the bundle_skb was freed.
--- drivers/net/wireless/ath/ath10k/htc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/htc.c +1 -1
@@ -665,7 +665,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,ath10k_dbg (ar,ATH10K_DBG_HTC ,"bundle tx status %d eid %d req count %d count %d len %d\n" , - ret, ep->eid,skb_queue_len (&ep->tx_req_head), cn, bundle_skb->len); + ret, ep->eid,skb_queue_len (&ep->tx_req_head), cn, skb_len);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 488/530 ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
[ Upstream commit eaaf52e4b866f265eb791897d622961293fd48c1 ]
ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock winthout locking it first when peer reason doesn't match the valid cases for this function.
Add a default case to return without unlocking.
--- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath10k/wmi-tlv.c +3 -0
@@ -592,6 +592,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)GFP_ATOMIC );break ; +default : +kfree (tb); +return ; } exit:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 489/530 wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ]
The size of the buffer than can be written to is currently incorrect, it is always the size of the entire buffer even though the snprintf is writing as position pos into the buffer. Fix this by setting the buffer size to be the number of bytes left in the buffer, namely sizeof(buf) - pos.
Addresses-Coverity: ("Out-of-bounds access")
--- drivers/net/wireless/ti/wlcore/debugfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ti/wlcore/debugfs.h +1 -1
@@ -84,7 +84,7 @@ static ssize_t sub## _ ##name## _read(struct file *file, \wl1271_debugfs_update_stats (wl); \ \for (i =0 ; i < len && pos <sizeof (buf); i++) \ - pos +=snprintf (buf + pos,sizeof (buf), \ + pos +=snprintf (buf + pos,sizeof (buf) - pos, \"[%d] = %d\n" , i, stats->sub.name[i]); \ \return wl1271_format_buffer (userbuf, count, ppos,"%s" , buf); \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 490/530 powerpc/perf: Fix the threshold event selection for memory events in power10
In reply to Greg Kroah-HartmanFrom: Athira Rajeev <[email protected]>
[ Upstream commit 66d9b7492887d34c711bc05b36c22438acba51b4 ]
Memory events (mem-loads and mem-stores) currently use the threshold event selection as issue to finish. Power10 supports issue to complete as part of thresholding which is more appropriate for mem-loads and mem-stores. Hence fix the event code for memory events to use issue to complete.
--- arch/powerpc/perf/power10-events-list.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/perf/power10-events-list.h +2 -2
@@ -66,5 +66,5 @@ EVENT(PM_RUN_INST_CMPL_ALT, 0x00002);* thresh end (TE) */ -EVENT (MEM_LOADS ,0x34340401e0 ); -EVENT (MEM_STORES ,0x343c0401e0 ); +EVENT (MEM_LOADS ,0x35340401e0 ); +EVENT (MEM_STORES ,0x353c0401e0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 491/530 powerpc/52xx: Fix an invalid ASM expression (addi used instead of add)
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]
AS arch/powerpc/platforms/52xx/lite5200_sleep.oarch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression
In the following code, 'addi' is wrong, has to be 'add'
/* local udelay in sram is needed */ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ addi r12, r13, r12 /* end */
--- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/52xx/lite5200_sleep.S +1 -1
@@ -181,7 +181,7 @@ sram_code: udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ mullw r12, r12, r11 mftb r13 /* start */ - addi r12, r13, r12 /* end */ + add r12, r13, r12 /* end */ 1: mftb r13 /* current */ cmp cr0, r13, r12
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 492/530 net: phy: marvell: fix m88e1011_set_downshift
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit 990875b299b8612aeb85cb2e2751796f1add65ff ]
Changing downshift params without software reset has no effect, so call genphy_soft_reset() after change downshift params.
As the datasheet says:
Changes to these bits are disruptive to the normal operation therefore, any changes to these registers must be followed by software reset to take effect.
--- drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/phy/marvell.c +16 -10
@@ -919,22 +919,28 @@ static int m88e1011_get_downshift(struct phy_device *phydev, u8 *data)static int m88e1011_set_downshift (struct phy_device *phydev,u8 cnt) { -int val; +int val, err;if (cnt >MII_M1011_PHY_SCR_DOWNSHIFT_MAX )return -E2BIG ; -if (!cnt) -return phy_clear_bits (phydev,MII_M1011_PHY_SCR , -MII_M1011_PHY_SCR_DOWNSHIFT_EN ); +if (!cnt) { + err =phy_clear_bits (phydev,MII_M1011_PHY_SCR , +MII_M1011_PHY_SCR_DOWNSHIFT_EN ); + }else { + val =MII_M1011_PHY_SCR_DOWNSHIFT_EN ; + val |=FIELD_PREP (MII_M1011_PHY_SCR_DOWNSHIFT_MASK , cnt -1 ); - val =MII_M1011_PHY_SCR_DOWNSHIFT_EN ; - val |=FIELD_PREP (MII_M1011_PHY_SCR_DOWNSHIFT_MASK , cnt -1 ); + err =phy_modify (phydev,MII_M1011_PHY_SCR , +MII_M1011_PHY_SCR_DOWNSHIFT_EN | +MII_M1011_PHY_SCR_DOWNSHIFT_MASK , + val); + } -return phy_modify (phydev,MII_M1011_PHY_SCR , -MII_M1011_PHY_SCR_DOWNSHIFT_EN | -MII_M1011_PHY_SCR_DOWNSHIFT_MASK , - val); +if (err <0 ) +return err; + +return genphy_soft_reset (phydev); } static int m88e1011_get_tunable(struct phy_device *phydev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 493/530 net: phy: marvell: fix m88e1111_set_downshift
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit e7679c55a7249f1315256cfc672d53e84072e223 ]
Changing downshift params without software reset has no effect, so call genphy_soft_reset() after change downshift params.
As the datasheet says:
Changes to these bits are disruptive to the normal operation therefore, any changes to these registers must be followed by software reset to take effect.
--- drivers/net/phy/marvell.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
drivers/net/phy/marvell.c +16 -10
@@ -861,22 +861,28 @@ static int m88e1111_get_downshift(struct phy_device *phydev, u8 *data)static int m88e1111_set_downshift (struct phy_device *phydev,u8 cnt) { -int val; +int val, err;if (cnt >MII_M1111_PHY_EXT_CR_DOWNSHIFT_MAX )return -E2BIG ; -if (!cnt) -return phy_clear_bits (phydev,MII_M1111_PHY_EXT_CR , -MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ); +if (!cnt) { + err =phy_clear_bits (phydev,MII_M1111_PHY_EXT_CR , +MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ); + }else { + val =MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ; + val |=FIELD_PREP (MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , cnt -1 ); - val =MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN ; - val |=FIELD_PREP (MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , cnt -1 ); + err =phy_modify (phydev,MII_M1111_PHY_EXT_CR , +MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | +MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , + val); + } -return phy_modify (phydev,MII_M1111_PHY_EXT_CR , -MII_M1111_PHY_EXT_CR_DOWNSHIFT_EN | -MII_M1111_PHY_EXT_CR_DOWNSHIFT_MASK , - val); +if (err <0 ) +return err; + +return genphy_soft_reset (phydev); } static int m88e1111_get_tunable(struct phy_device *phydev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 494/530 net: enetc: fix link error again
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 74c97ea3b61e4ce149444f904ee8d4fc7073505b ]
A link time bug that I had fixed before has come back now that another sub-module was added to the enetc driver:
ERROR: modpost: "enetc_ierb_register_pf" [drivers/net/ethernet/freescale/enetc/fsl-enetc.ko] undefined!
The problem is that the enetc Makefile is not actually used for the ierb module if that is the only built-in driver in there and everything else is a loadable module.
Fix it by always entering the directory this time, regardless of which symbols are configured. This should reliably fix the problem and prevent it from coming back another time.
--- drivers/net/ethernet/freescale/Makefile | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/freescale/Makefile +1 -3
@@ -24,6 +24,4 @@ obj-$(CONFIG_FSL_DPAA_ETH) += dpaa/ obj-$(CONFIG_FSL_DPAA2_ETH) += dpaa2/ -obj-$(CONFIG_FSL_ENETC) += enetc/ -obj-$(CONFIG_FSL_ENETC_MDIO) += enetc/ -obj-$(CONFIG_FSL_ENETC_VF) += enetc/ +obj-y += enetc/
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 495/530 bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 27537929f30d3136a71ef29db56127a33c92dad7 ]
The problem is that bnxt_show_temp() returns long but "rc" is an int and "len" is a u32. With ternary operations the type promotion is quite tricky. The negative "rc" is first promoted to u32 and then to long so it ends up being a high positive value instead of a a negative as we intended.
Fix this by removing the ternary.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -1
@@ -9546,7 +9546,9 @@ static ssize_t bnxt_show_temp(struct device *dev,if (!rc) len =sprintf (buf,"%u\n" , resp->temp *1000 );/* display millidegree */ mutex_unlock (&bp->hwrm_cmd_lock); -return rc ?: len; +if (rc) +return rc; +return len; } static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 496/530 ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 9ba585cc5b56ea14a453ba6be9bdb984ed33471a ]
UniPhier PXs2 boards have RTL8211E ethernet phy, and the phy have the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"), the delays are working correctly, however, "rgmii" means no delay and the phy doesn't work. So need to set the phy-mode to "rgmii-id" to show that RX/TX delays are enabled.
--- arch/arm/boot/dts/uniphier-pxs2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/uniphier-pxs2.dtsi +1 -1
@@ -583,7 +583,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 497/530 arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit dcabb06bf127b3e0d3fbc94a2b65dd56c2725851 ]
UniPhier LD20 and PXs3 boards have RTL8211E ethernet phy, and the phy have the RX/TX delays of RGMII interface using pull-ups on the RXDLY and TXDLY pins.
After the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"), the delays are working correctly, however, "rgmii" means no delay and the phy doesn't work. So need to set the phy-mode to "rgmii-id" to show that RX/TX delays are enabled.
--- arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi | 2 +- arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +1 -1
@@ -734,7 +734,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi +2 -2
@@ -564,7 +564,7 @@ clocks = <&sys_clk 6>; reset-names = "ether"; resets = <&sys_rst 6>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 0>;
@@ -585,7 +585,7 @@ clocks = <&sys_clk 7>; reset-names = "ether"; resets = <&sys_rst 7>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; local-mac-address = [00 00 00 00 00 00]; socionext,syscon-phy-mode = <&soc_glue 1>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 498/530 net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
[ Upstream commit d13f048dd40e8577260cd43faea8ec9b77520197 ]
Modify the header size check in geneve6_xmit_skb and geneve_xmit_skb to use pskb_inet_may_pull rather than pskb_network_may_pull. This fixes two kernel selftest failures introduced by the commit introducing the checks:
IPv4 over geneve6: PMTU exceptions
IPv4 over geneve6: PMTU exceptions - nexthop objects
It does this by correctly accounting for the fact that IPv4 packets may transit over geneve IPv6 tunnels (and vice versa), and still fixes the uninit-value bug fixed by the original commit.
--- drivers/net/geneve.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/geneve.c +2 -2
@@ -890,7 +890,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_network_may_pull (skb,sizeof (struct iphdr ))) +if (!pskb_inet_may_pull (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -987,7 +987,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,__be16 sport;int err; -if (!pskb_network_may_pull (skb,sizeof (struct ipv6hdr ))) +if (!pskb_inet_may_pull (skb))return -EINVAL ; sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 499/530 selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit c8d0260cdd96fdccdef0509c4160e28a1012a5d7 ]
The FDB roaming test installs a destination MAC address on the wrong interface of an FDB database and tests whether the mirroring fails, because packets are sent to the wrong port. The test by mistake installs the FDB entry as local. This worked previously, because drivers were notified of local FDB entries in the same way as of static entries. However that has been fixed in the commit 6ab4c3117aec ("net: bridge: don't notify switchdev for local FDB addresses"), and local entries are not notified anymore. As a result, the HW is not reconfigured for the FDB roam, and mirroring keeps working, failing the test.
To fix the issue, mark the FDB entry as static.
--- .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh +1 -1
@@ -271,7 +271,7 @@ test_span_gre_fdb_roaming() while ((RET == 0)); do bridge fdb del dev $swp3 $h3mac vlan 555 master 2>/dev/null - bridge fdb add dev $swp2 $h3mac vlan 555 master + bridge fdb add dev $swp2 $h3mac vlan 555 master static sleep 1 fail_test_span_gre_dir $tundev ingress
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 500/530 selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
In reply to Greg Kroah-HartmanFrom: Danielle Ratson <[email protected]>
[ Upstream commit 1f1c92139e36223b89d8140f2b72f75e79baf8bd ]
Currently, the error return code of the failure condition is lost after using an if statement, so the test doesn't fail when it should.
Remove the if statement that separates the condition and the error code check, so the test won't always pass.
--- .../testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
tools/testing/selftests/drivers/net/mlxsw/tc_flower_scale.sh +1 -5
@@ -98,11 +98,7 @@ __tc_flower_test() jq -r '[ .[] | select(.kind == "flower") | .options | .in_hw ]' | jq .[] | wc -l) [[ $((offload_count - 1)) -eq $count ]] - if [[ $should_fail -eq 0 ]]; then - check_err $? "Offload mismatch" - else - check_err_fail $should_fail $? "Offload more than expacted" - fi + check_err_fail $should_fail $? "Attempt to offload $count rules (actual result $((offload_count - 1)))" } tc_flower_test()
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 501/530 bnxt_en: Fix RX consumer index logic in the error path.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit bbd6f0a948139970f4a615dff189d9a503681a39 ]
In bnxt_rx_pkt(), the RX buffers are expected to complete in order. If the RX consumer index indicates an out of order buffer completion, it means we are hitting a hardware bug and the driver will abort all remaining RX packets and reset the RX ring. The RX consumer index that we pass to bnxt_discard_rx() is not correct. We should be passing the current index (tmp_raw_cons) instead of the old index (raw_cons). This bug can cause us to be at the wrong index when trying to abort the next RX packet. It can crash like this:
#0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e
#3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978
#4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5
[exception RIP: bnxt_rx_pkt+237]
RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213
RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000
RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000
RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d
R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0
R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -2
@@ -1731,14 +1731,16 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, cons = rxcmp->rx_cmp_opaque;if (unlikely (cons != rxr->rx_next_cons)) { -int rc1 =bnxt_discard_rx (bp, cpr, raw_cons, rxcmp); +int rc1 =bnxt_discard_rx (bp, cpr, &tmp_raw_cons, rxcmp);/* 0xffff is forced error, don't print it */ if (rxr->rx_next_cons !=0xffff )netdev_warn (bp->dev,"RX cons %x != expected cons %x\n" , cons, rxr->rx_next_cons);bnxt_sched_reset (bp, rxr); -return rc1; +if (rc1) +return rc1; + goto next_rx_no_prod_no_len; } rx_buf = &rxr->rx_buf_ring[cons]; data = rx_buf->data;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 502/530 KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit dbdd096a5a74b94f6b786a47baef2085859b0dce ]
Disable pass-through of the FS and GS base MSRs for 32-bit KVM. Intel's SDM unequivocally states that the MSRs exist if and only if the CPU supports x86-64. FS_BASE and GS_BASE are mostly a non-issue; a clever guest could opportunistically use the MSRs without issue. KERNEL_GS_BASE is a bigger problem, as a clever guest would subtly be broken if it were migrated, as KVM disallows software access to the MSRs, and unlike the direct variants, KERNEL_GS_BASE needs to be explicitly migrated as it's not captured in the VMCS.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 4 ++++ 2 files changed, 6 insertions(+)
arch/x86/kvm/vmx/nested.c +2 -0
@@ -618,6 +618,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu, }/* KVM unconditionally exposes the FS/GS base MSRs to L1. */ +#ifdef CONFIG_X86_64 nested_vmx_disable_intercept_for_msr (msr_bitmap_l1, msr_bitmap_l0,MSR_FS_BASE ,MSR_TYPE_RW );
@@ -626,6 +627,7 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,nested_vmx_disable_intercept_for_msr (msr_bitmap_l1, msr_bitmap_l0,MSR_KERNEL_GS_BASE ,MSR_TYPE_RW ); +#endif /* * Checking the L0->L1 bitmap is trying to verify two things:
arch/x86/kvm/vmx/vmx.c +4 -0
@@ -156,9 +156,11 @@ static u32 vmx_possible_passthrough_msrs[MAX_POSSIBLE_PASSTHROUGH_MSRS] = {MSR_IA32_SPEC_CTRL ,MSR_IA32_PRED_CMD ,MSR_IA32_TSC , +#ifdef CONFIG_X86_64MSR_FS_BASE ,MSR_GS_BASE ,MSR_KERNEL_GS_BASE , +#endifMSR_IA32_SYSENTER_CS ,MSR_IA32_SYSENTER_ESP , MSR_IA32_SYSENTER_EIP,
@@ -6904,9 +6906,11 @@ static int vmx_create_vcpu(struct kvm_vcpu *vcpu)bitmap_fill (vmx->shadow_msr_intercept.write,MAX_POSSIBLE_PASSTHROUGH_MSRS );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_TSC ,MSR_TYPE_R ); +#ifdef CONFIG_X86_64 vmx_disable_intercept_for_msr (vcpu,MSR_FS_BASE ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_GS_BASE ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_KERNEL_GS_BASE ,MSR_TYPE_RW ); +#endif vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_CS ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_ESP ,MSR_TYPE_RW );vmx_disable_intercept_for_msr (vcpu,MSR_IA32_SYSENTER_EIP ,MSR_TYPE_RW );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 503/530 net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ]
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later.
--- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/emac/emac-mac.c +3 -1
@@ -1437,6 +1437,7 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt, {struct emac_tpd tpd;u32 prod_idx; +int len;memset (&tpd,0 ,sizeof (tpd));
@@ -1456,9 +1457,10 @@ netdev_tx_t emac_mac_tx_buf_send(struct emac_adapter *adpt,if (skb_network_offset (skb) !=ETH_HLEN )TPD_TYP_SET (&tpd,1 ); + len = skb->len;emac_tx_fill_tpd (adpt, tx_q, skb, &tpd); -netdev_sent_queue (adpt->netdev, skb->len); +netdev_sent_queue (adpt->netdev, len);/* Make sure the are enough free descriptors to hold one * maximum-sized SKB. We need one desc for each fragment,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 504/530 selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 0f20615d64ee2ad5e2a133a812382d0c4071589b ]
Fix BPF_CORE_READ_BITFIELD() macro used for reading CO-RE-relocatable bitfields. Missing breaks in a switch caused 8-byte reads always. This can confuse libbpf because it does strict checks that memory load size corresponds to the original size of the field, which in this case quite often would be wrong.
After fixing that, we run into another problem, which quite subtle, so worth documenting here. The issue is in Clang optimization and CO-RE relocation interactions. Without that asm volatile construct (also known as barrier_var()), Clang will re-order BYTE_OFFSET and BYTE_SIZE relocations and will apply BYTE_OFFSET 4 times for each switch case arm. This will result in the same error from libbpf about mismatch of memory load size and original field size. I.e., if we were reading u32, we'd still have *(u8 *), *(u16 *), *(u32 *), and *(u64 *) memory loads, three of which will fail. Using barrier_var() forces Clang to apply BYTE_OFFSET relocation first (and once) to calculate p, after which value of p is used without relocation in each of switch case arms, doing appropiately-sized memory load.
Here's the list of relevant relocations and pieces of generated BPF code before and after this patch for test_core_reloc_bitfields_direct selftests.
BEFORE
=====
#45: core_reloc: insn #160 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32 #46: core_reloc: insn #167 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #47: core_reloc: insn #174 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #48: core_reloc: insn #178 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #49: core_reloc: insn #182 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32
157: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
159: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
160: b7 02 00 00 04 00 00 00 r2 = 4
; BYTE_SIZE relocation here ^^^
161: 66 02 07 00 03 00 00 00 if w2 s> 3 goto +7 <LBB0_63>
162: 16 02 0d 00 01 00 00 00 if w2 == 1 goto +13 <LBB0_65>
163: 16 02 01 00 02 00 00 00 if w2 == 2 goto +1 <LBB0_66>
164: 05 00 12 00 00 00 00 00 goto +18 <LBB0_69>0000000000000528 <LBB0_66>:
165: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
167: 69 11 08 00 00 00 00 00 r1 = *(u16 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
168: 05 00 0e 00 00 00 00 00 goto +14 <LBB0_69>0000000000000548 <LBB0_63>:
169: 16 02 0a 00 04 00 00 00 if w2 == 4 goto +10 <LBB0_67>
170: 16 02 01 00 08 00 00 00 if w2 == 8 goto +1 <LBB0_68>
171: 05 00 0b 00 00 00 00 00 goto +11 <LBB0_69>0000000000000560 <LBB0_68>:
172: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
174: 79 11 08 00 00 00 00 00 r1 = *(u64 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
175: 05 00 07 00 00 00 00 00 goto +7 <LBB0_69>0000000000000580 <LBB0_65>:
176: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
178: 71 11 08 00 00 00 00 00 r1 = *(u8 *)(r1 + 8)
; BYTE_OFFSET relo here w/ WRONG size ^^^^^^^^^^^^^^^^
179: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>00000000000005a0 <LBB0_67>:
180: 18 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r1 = 0 ll
182: 61 11 08 00 00 00 00 00 r1 = *(u32 *)(r1 + 8); BYTE_OFFSET relo here w/ RIGHT size ^^^^^^^^^^^^^^^^
00000000000005b8 <LBB0_69>:
183: 67 01 00 00 20 00 00 00 r1 <<= 32
184: b7 02 00 00 00 00 00 00 r2 = 0
185: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
186: c7 01 00 00 20 00 00 00 r1 s>>= 32
187: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>00000000000005e0 <LBB0_71>:
188: 77 01 00 00 20 00 00 00 r1 >>= 32
AFTER
=====
#30: core_reloc: insn #132 --> [5] + 0:5: byte_off --> struct core_reloc_bitfields.u32 #31: core_reloc: insn #134 --> [5] + 0:5: byte_sz --> struct core_reloc_bitfields.u32
129: 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r2 = 0 ll
131: 7b 12 20 01 00 00 00 00 *(u64 *)(r2 + 288) = r1
132: b7 01 00 00 08 00 00 00 r1 = 8
; BYTE_OFFSET relo here ^^^
; no size check for non-memory dereferencing instructions
133: 0f 12 00 00 00 00 00 00 r2 += r1
134: b7 03 00 00 04 00 00 00 r3 = 4
; BYTE_SIZE relocation here ^^^
135: 66 03 05 00 03 00 00 00 if w3 s> 3 goto +5 <LBB0_63>
136: 16 03 09 00 01 00 00 00 if w3 == 1 goto +9 <LBB0_65>
137: 16 03 01 00 02 00 00 00 if w3 == 2 goto +1 <LBB0_66>
138: 05 00 0a 00 00 00 00 00 goto +10 <LBB0_69>0000000000000458 <LBB0_66>:
139: 69 21 00 00 00 00 00 00 r1 = *(u16 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
140: 05 00 08 00 00 00 00 00 goto +8 <LBB0_69>0000000000000468 <LBB0_63>:
141: 16 03 06 00 04 00 00 00 if w3 == 4 goto +6 <LBB0_67>
142: 16 03 01 00 08 00 00 00 if w3 == 8 goto +1 <LBB0_68>
143: 05 00 05 00 00 00 00 00 goto +5 <LBB0_69>0000000000000480 <LBB0_68>:
144: 79 21 00 00 00 00 00 00 r1 = *(u64 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
145: 05 00 03 00 00 00 00 00 goto +3 <LBB0_69>0000000000000490 <LBB0_65>:
146: 71 21 00 00 00 00 00 00 r1 = *(u8 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
147: 05 00 01 00 00 00 00 00 goto +1 <LBB0_69>00000000000004a0 <LBB0_67>:
148: 61 21 00 00 00 00 00 00 r1 = *(u32 *)(r2 + 0)
; NO CO-RE relocation here ^^^^^^^^^^^^^^^^
00000000000004a8 <LBB0_69>:
149: 67 01 00 00 20 00 00 00 r1 <<= 32
150: b7 02 00 00 00 00 00 00 r2 = 0
151: 16 02 02 00 00 00 00 00 if w2 == 0 goto +2 <LBB0_71>
152: c7 01 00 00 20 00 00 00 r1 s>>= 32
153: 05 00 01 00 00 00 00 00 goto +1 <LBB0_72>00000000000004d0 <LBB0_71>:
154: 77 01 00 00 20 00 00 00 r1 >>= 323
--- tools/lib/bpf/bpf_core_read.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
tools/lib/bpf/bpf_core_read.h +12 -4
@@ -88,11 +88,19 @@ enum bpf_enum_value_kind {const void *p = (const void *)s +__CORE_RELO (s, field,BYTE_OFFSET ); \unsigned long long val; \ \ +/* This is a so-called barrier_var() operation that makes specified \ +* variable "a black box" for optimizing compiler. \ +* It forces compiler to perform BYTE_OFFSET relocation on p and use \ +* its calculated value in the switch below, instead of applying \ +* the same relocation 4 times for each individual memory load. \ +*/ \ + asmvolatile ("" :"=r" (p) :"0" (p)); \ + \switch (__CORE_RELO (s, field,BYTE_SIZE )) { \ -case 1 : val = *(const unsigned char *)p; \ -case 2 : val = *(const unsigned short *)p; \ -case 4 : val = *(const unsigned int *)p; \ -case 8 : val = *(const unsigned long long *)p; \ +case 1 : val = *(const unsigned char *)p;break ; \ +case 2 : val = *(const unsigned short *)p;break ; \ +case 4 : val = *(const unsigned int *)p;break ; \ +case 8 : val = *(const unsigned long long *)p;break ; \ } \ val <<=__CORE_RELO (s, field,LSHIFT_U64 ); \if (__CORE_RELO (s, field,SIGNED )) \
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 505/530 selftests/bpf: Fix field existence CO-RE reloc tests
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 5a30eb23922b52f33222c6729b6b3ff1c37a6c66 ]
Negative field existence cases for have a broken assumption that FIELD_EXISTS CO-RE relo will fail for fields that match the name but have incompatible type signature. That's not how CO-RE relocations generally behave. Types and fields that match by name but not by expected type are treated as non-matching candidates and are skipped. Error later is reported if no matching candidate was found. That's what happens for most relocations, but existence relocations (FIELD_EXISTS and TYPE_EXISTS) are more permissive and they are designed to return 0 or 1, depending if a match is found. This allows to handle name-conflicting but incompatible types in BPF code easily. Combined with ___flavor suffixes, it's possible to handle pretty much any structural type changes in kernel within the compiled once BPF source code.
So, long story short, negative field existence test cases are invalid in their assumptions, so this patch reworks them into a single consolidated positive case that doesn't match any of the fields.
--- .../selftests/bpf/prog_tests/core_reloc.c | 31 ++++++++++++------- ...ore_reloc_existence___err_wrong_arr_kind.c | 3 -- ...loc_existence___err_wrong_arr_value_type.c | 3 -- ...ore_reloc_existence___err_wrong_int_kind.c | 3 -- ..._core_reloc_existence___err_wrong_int_sz.c | 3 -- ...ore_reloc_existence___err_wrong_int_type.c | 3 -- ..._reloc_existence___err_wrong_struct_type.c | 3 -- ..._core_reloc_existence___wrong_field_defs.c | 3 ++ .../selftests/bpf/progs/core_reloc_types.h | 20 ++---------- 9 files changed, 24 insertions(+), 48 deletions(-) delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c delete mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c create mode 100644 tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c
tools/testing/selftests/bpf/prog_tests/core_reloc.c +19 -12
@@ -185,11 +185,6 @@ static int duration = 0; .bpf_obj_file = "test_core_reloc_existence.o", \ .btf_src_file = "btf__core_reloc_" #name ".o" \ -#define FIELD_EXISTS_ERR_CASE (name) { \ - FIELD_EXISTS_CASE_COMMON(name), \ - .fails = true, \ -} -#define BITFIELDS_CASE_COMMON (objfile, test_name_prefix, name) \ .case_name = test_name_prefix#name, \ .bpf_obj_file = objfile, \
@@ -592,13 +587,25 @@ static struct core_reloc_test_case test_cases[] = { }, .output_len = sizeof(struct core_reloc_existence_output), }, - - FIELD_EXISTS_ERR_CASE(existence__err_int_sz), - FIELD_EXISTS_ERR_CASE(existence__err_int_type), - FIELD_EXISTS_ERR_CASE(existence__err_int_kind), - FIELD_EXISTS_ERR_CASE(existence__err_arr_kind), - FIELD_EXISTS_ERR_CASE(existence__err_arr_value_type), - FIELD_EXISTS_ERR_CASE(existence__err_struct_type), + { + FIELD_EXISTS_CASE_COMMON(existence___wrong_field_defs), + .input = STRUCT_TO_CHAR_PTR(core_reloc_existence___wrong_field_defs) { + }, + .input_len = sizeof(struct core_reloc_existence___wrong_field_defs), + .output = STRUCT_TO_CHAR_PTR(core_reloc_existence_output) { + .a_exists = 0, + .b_exists = 0, + .c_exists = 0, + .arr_exists = 0, + .s_exists = 0, + .a_value = 0xff000001u, + .b_value = 0xff000002u, + .c_value = 0xff000003u, + .arr_value = 0xff000004u, + .s_value = 0xff000005u, + }, + .output_len = sizeof(struct core_reloc_existence_output), + }, /* bitfield relocation checks */ BITFIELDS_CASE(bitfields, {
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_kind.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_arr_kind x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_arr_value_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_arr_value_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_kind.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_kind x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_sz.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_sz x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_int_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_int_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___err_wrong_struct_type.c deleted +0 -3
@@ -1,3 +0,0 @@ -#include "core_reloc_types.h" - -void f (struct core_reloc_existence___err_wrong_struct_type x) {}
tools/testing/selftests/bpf/progs/btf__core_reloc_existence___wrong_field_defs.c new file +3 -0
@@ -0,0 +1,3 @@ +#include "core_reloc_types.h" + +void f (struct core_reloc_existence___wrong_field_defs x) {}
tools/testing/selftests/bpf/progs/core_reloc_types.h +2 -18
@@ -683,27 +683,11 @@ struct core_reloc_existence___minimal {int a; }; -struct core_reloc_existence___err_wrong_int_sz { -short a; -}; - -struct core_reloc_existence___err_wrong_int_type { +struct core_reloc_existence___wrong_field_defs { +void *a;int b[1 ]; -}; - -struct core_reloc_existence___err_wrong_int_kind {struct {int x; } c; -}; - -struct core_reloc_existence___err_wrong_arr_kind {int arr; -}; - -struct core_reloc_existence___err_wrong_arr_value_type { -short arr[1 ]; -}; - -struct core_reloc_existence___err_wrong_struct_type {int s; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 506/530 selftests/bpf: Fix core_reloc test runner
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit bede0ebf0be87e9678103486a77f39e0334c6791 ]
Fix failed tests checks in core_reloc test runner, which allowed failing tests to pass quietly. Also add extra check to make sure that expected to fail test cases with invalid names are caught as test failure anyway, as this is not an expected failure mode. Also fix mislabeled probed vs direct bitfield test cases.
--- .../selftests/bpf/prog_tests/core_reloc.c | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
tools/testing/selftests/bpf/prog_tests/core_reloc.c +12 -8
@@ -192,7 +192,7 @@ static int duration = 0;#define BITFIELDS_CASE (name, ...) { \ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_probed.o", \ - "direct:", name), \ + "probed:", name), \ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ .input_len = sizeof(struct core_reloc_##name), \ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
@@ -200,7 +200,7 @@ static int duration = 0; .output_len = sizeof(struct core_reloc_bitfields_output), \ }, { \ BITFIELDS_CASE_COMMON("test_core_reloc_bitfields_direct.o", \ - "probed:", name), \ + "direct:", name), \ .input = STRUCT_TO_CHAR_PTR(core_reloc_##name) __VA_ARGS__, \ .input_len = sizeof(struct core_reloc_##name), \ .output = STRUCT_TO_CHAR_PTR(core_reloc_bitfields_output) \
@@ -495,8 +495,7 @@ static struct core_reloc_test_case test_cases[] = {ARRAYS_ERR_CASE (arrays___err_too_small),ARRAYS_ERR_CASE (arrays___err_too_shallow),ARRAYS_ERR_CASE (arrays___err_non_array), -ARRAYS_ERR_CASE (arrays___err_wrong_val_type1), -ARRAYS_ERR_CASE (arrays___err_wrong_val_type2), +ARRAYS_ERR_CASE (arrays___err_wrong_val_type), ARRAYS_ERR_CASE(arrays___err_bad_zero_sz_arr),/* enum/ptr/int handling scenarios */
@@ -811,13 +810,20 @@ void test_core_reloc(void) "prog '%s' not found\n", probe_name)) goto cleanup; + +if (test_case->btf_src_file) { + err =access (test_case->btf_src_file,R_OK ); +if (!ASSERT_OK (err,"btf_src_file" )) + goto cleanup; + } + load_attr.obj = obj; load_attr.log_level =0 ; load_attr.target_btf_path = test_case->btf_src_file; err =bpf_object__load_xattr (&load_attr);if (err) {if (!test_case->fails) -CHECK (false,"obj_load" ,"failed to load prog '%s': %d\n" , probe_name, err); +ASSERT_OK (err,"obj_load" ); goto cleanup; }
@@ -851,10 +857,8 @@ void test_core_reloc(void) goto cleanup; } -if (test_case->fails) { -CHECK (false,"obj_load_fail" ,"should fail to load prog '%s'\n" , probe_name); +if (!ASSERT_FALSE (test_case->fails,"obj_load_should_fail" )) goto cleanup; - } equal =memcmp (data->out, test_case->output, test_case->output_len) ==0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 507/530 bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit 10bf4e83167cc68595b85fd73bb91e8f2c086e36 ]
Similarly as b02709587ea3 ("bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds."), we also need to fix the propagation of 32 bit unsigned bounds from 64 bit counterparts. That is, really only set the u32_{min,max}_value when /both/ {umin,umax}_value safely fit in 32 bit space. For example, the register with a umin_value == 1 does /not/ imply that u32_min_value is also equal to 1, since umax_value could be much larger than 32 bit subregister can hold, and thus u32_min_value is in the interval [0,1] instead.
Before fix, invalid tracking result of R2_w=inv1:
[...]
5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
5: (35) if r2 >= 0x1 goto pc+1
[...] // goto path
7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
7: (b6) if w2 <= 0x1 goto pc+1
[...] // goto path
9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smin_value=-9223372036854775807,smax_value=9223372032559808513,umin_value=1,umax_value=18446744069414584321,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_max_value=1) R10=fp0 9: (bc) w2 = w2
10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv1 R10=fp0
[...]
After fix, correct tracking result of R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)):
[...]
5: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0) R10=fp0
5: (35) if r2 >= 0x1 goto pc+1
[...] // goto path
7: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,umin_value=1) R10=fp0
7: (b6) if w2 <= 0x1 goto pc+1
[...] // goto path
9: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2=inv(id=0,smax_value=9223372032559808513,umax_value=18446744069414584321,var_off=(0x0; 0xffffffff00000001),s32_min_value=0,s32_max_value=1,u32_max_value=1) R10=fp0 9: (bc) w2 = w2
10: R0=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,umax_value=1,var_off=(0x0; 0x1)) R10=fp0
[...]
Thus, same issue as in b02709587ea3 holds for unsigned subregister tracking. Also, align __reg64_bound_u32() similarly to __reg64_bound_s32() as done in b02709587ea3 to make them uniform again.
--- kernel/bpf/verifier.c | 8 +++----- tools/testing/selftests/bpf/verifier/array_access.c | 2 +- 2 files changed, 4 insertions(+), 6 deletions(-)
kernel/bpf/verifier.c +3 -5
@@ -1303,9 +1303,7 @@ static bool __reg64_bound_s32(s64 a)static bool __reg64_bound_u32 (u64 a) { -if (a >U32_MIN && a <U32_MAX ) -return true; -return false; +return a >U32_MIN && a <U32_MAX ; }static void __reg_combine_64_into_32 (struct bpf_reg_state *reg)
@@ -1316,10 +1314,10 @@ static void __reg_combine_64_into_32(struct bpf_reg_state *reg) reg->s32_min_value = (s32 )reg->smin_value; reg->s32_max_value = (s32 )reg->smax_value; } -if (__reg64_bound_u32 (reg->umin_value)) +if (__reg64_bound_u32 (reg->umin_value) &&__reg64_bound_u32 (reg->umax_value)) { reg->u32_min_value = (u32 )reg->umin_value; -if (__reg64_bound_u32 (reg->umax_value)) reg->u32_max_value = (u32 )reg->umax_value; + }/* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
tools/testing/selftests/bpf/verifier/array_access.c +1 -1
@@ -186,7 +186,7 @@ }, .fixup_map_hash_48b = { 3 }, .errstr_unpriv = "R0 leaks addr", - .errstr = "invalid access to map value, value_size=48 off=44 size=8", + .errstr = "R0 unbounded memory access", .result_unpriv = REJECT, .result = REJECT, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 508/530 RDMA/siw: Fix a use after free in siw_alloc_mr
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 3093ee182f01689b89e9f8797b321603e5de4f63 ]
Our code analyzer reported a UAF.
In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a freed object. After, the execution continue up to the err_out branch of siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {} section, to avoid the uaf.
--- drivers/infiniband/sw/siw/siw_mem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/sw/siw/siw_mem.c +2 -2
@@ -106,8 +106,6 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj, mem->perms = rights &IWARP_ACCESS_MASK ;kref_init (&mem->ref); - mr->mem = mem; -get_random_bytes (&next,4 ); next &=0x00ffffff ;
@@ -116,6 +114,8 @@ int siw_mr_add_mem(struct siw_mr *mr, struct ib_pd *pd, void *mem_obj,kfree (mem);return -ENOMEM ; } + + mr->mem = mem;/* Set the STag index part */ mem->stag = id <<8 ; mr->base_mr.lkey = mr->base_mr.rkey = mem->stag;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 509/530 RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ]
In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via pci_iounmap() in unmap_io error branch. After the callee returns err code, bnxt_qplib_alloc_res calls bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap().
My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by pci_iounmap() in the first time, to avoid the double free.
--- drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/bnxt_re/qplib_res.c +1 -0
@@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res, unmap_io:pci_iounmap (res->pdev, dpit->dbr_bar_reg_iomem); + dpit->dbr_bar_reg_iomem =NULL ;return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 510/530 net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
In reply to Greg Kroah-HartmanFrom: Linus Lüssing <[email protected]>
[ Upstream commit 99014088156cd78867d19514a0bc771c4b86b93b ]
The IPv6 Multicast Router Advertisements parsing has the following two issues:
For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes, assuming MLDv2 Reports with at least one multicast address entry). When ipv6_mc_check_mld_msg() tries to parse an Multicast Router Advertisement its MLD length check will fail - and it will wrongly return -EINVAL, even if we have a valid MRD Advertisement. With the returned -EINVAL the bridge code will assume a broken packet and will wrongly discard it, potentially leading to multicast packet loss towards multicast routers.
The second issue is the MRD header parsing in br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header immediately after the IPv6 header (IPv6 next header type). However according to RFC4286, section 2 all MRD messages contain a Router Alert option (just like MLD). So instead there is an IPv6 Hop-by-Hop option for the Router Alert between the IPv6 and ICMPv6 header, again leading to the bridge wrongly discarding Multicast Router Advertisements.
To fix these two issues, introduce a new return value -ENODATA to ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop option which is not an MLD but potentially an MRD packet. This also simplifies further parsing in the bridge code, as ipv6_mc_check_mld() already fully checks the ICMPv6 header and hop-by-hop option.
These issues were found and fixed with the help of the mrdisc tool
(https://github.com/troglobit/mrdisc).
--- include/net/addrconf.h | 1 - net/bridge/br_multicast.c | 33 ++++++++------------------------- net/ipv6/mcast_snoop.c | 12 +++++++----- 3 files changed, 15 insertions(+), 31 deletions(-)
include/net/addrconf.h +0 -1
@@ -233,7 +233,6 @@ void ipv6_mc_unmap(struct inet6_dev *idev);void ipv6_mc_remap (struct inet6_dev *idev);void ipv6_mc_init_dev (struct inet6_dev *idev);void ipv6_mc_destroy_dev (struct inet6_dev *idev); -int ipv6_mc_check_icmpv6 (struct sk_buff *skb);int ipv6_mc_check_mld (struct sk_buff *skb);void addrconf_dad_failure (struct sk_buff *skb,struct inet6_ifaddr *ifp);
net/bridge/br_multicast.c +8 -25
@@ -3070,25 +3070,14 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br, }#if IS_ENABLED (CONFIG_IPV6 ) -static int br_ip6_multicast_mrd_rcv (struct net_bridge *br, -struct net_bridge_port *port, -struct sk_buff *skb) +static void br_ip6_multicast_mrd_rcv (struct net_bridge *br, +struct net_bridge_port *port, +struct sk_buff *skb) { -int ret; - -if (ipv6_hdr (skb)->nexthdr !=IPPROTO_ICMPV6 ) -return -ENOMSG ; - - ret =ipv6_mc_check_icmpv6 (skb); -if (ret <0 ) -return ret; -if (icmp6_hdr (skb)->icmp6_type !=ICMPV6_MRDISC_ADV ) -return -ENOMSG ; +return ;br_multicast_mark_router (br, port); - -return 0 ; } static int br_multicast_ipv6_rcv(struct net_bridge *br,
@@ -3102,18 +3091,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, err =ipv6_mc_check_mld (skb); -if (err == -ENOMSG ) { +if (err == -ENOMSG || err == -ENODATA ) {if (!ipv6_addr_is_ll_all_nodes (&ipv6_hdr (skb)->daddr))BR_INPUT_SKB_CB (skb)->mrouters_only =1 ; - -if (ipv6_addr_is_all_snoopers (&ipv6_hdr (skb)->daddr)) { - err =br_ip6_multicast_mrd_rcv (br, port, skb); - -if (err <0 && err != -ENOMSG ) { -br_multicast_err_count (br, port, skb->protocol); -return err; - } - } +if (err == -ENODATA && +ipv6_addr_is_all_snoopers (&ipv6_hdr (skb)->daddr)) +br_ip6_multicast_mrd_rcv (br, port, skb);return 0 ; }else if (err <0 ) {
net/ipv6/mcast_snoop.c +7 -5
@@ -109,7 +109,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)struct mld_msg *mld;if (!ipv6_mc_may_pull (skb, len)) -return -EINVAL ; +return -ENODATA ; mld = (struct mld_msg *)skb_transport_header (skb);
@@ -122,7 +122,7 @@ static int ipv6_mc_check_mld_msg(struct sk_buff *skb)case ICMPV6_MGM_QUERY :return ipv6_mc_check_mld_query (skb);default : -return -ENOMSG ; +return -ENODATA ; } }
@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)return skb_checksum_validate (skb,IPPROTO_ICMPV6 , ip6_compute_pseudo); } -int ipv6_mc_check_icmpv6 (struct sk_buff *skb) +static int ipv6_mc_check_icmpv6 (struct sk_buff *skb) {unsigned int len =skb_transport_offset (skb) +sizeof (struct icmp6hdr );unsigned int transport_len =ipv6_transport_len (skb);
@@ -150,7 +150,6 @@ int ipv6_mc_check_icmpv6(struct sk_buff *skb)return 0 ; } -EXPORT_SYMBOL (ipv6_mc_check_icmpv6);/** * ipv6_mc_check_mld - checks whether this is a sane MLD packet
@@ -161,7 +160,10 @@ EXPORT_SYMBOL(ipv6_mc_check_icmpv6);* * -EINVAL: A broken packet was detected, i.e. it violates some internet * standard -* -ENOMSG: IP header validation succeeded but it is not an MLD packet. +* -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet +* with a hop-by-hop option. +* -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded +* but it is not an MLD packet. * -ENOMEM: A memory allocation failure happened. * * Caller needs to set the skb network header and free any returned skb if it
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 511/530 net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]
In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp). If nfc_tm_data_received() failed, the callee will free the resp via kfree_skb() and return error. But in the exit branch, the resp will be freed again.
My patch sets resp to NULL if nfc_tm_data_received() failed, to avoid the double free.
--- net/nfc/digital_dep.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/digital_dep.c +2 -0
@@ -1273,6 +1273,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, } rc =nfc_tm_data_received (ddev->nfc_dev, resp); +if (rc) + resp =NULL ; exit:kfree_skb (ddev->chaining_skb);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 512/530 perf tools: Change fields type in perf_record_time_conv
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit e1d380ea8b00db4bb14d1f513000d4b62aa9d3f0 ]
C standard claims "An object declared as type _Bool is large enough to store the values 0 and 1", bool type size can be 1 byte or larger than 1 byte. Thus it's uncertian for bool type size with different compilers.
This patch changes the bool type in structure perf_record_time_conv to __u8 type, and pads extra bytes for 8-byte alignment; this can give reliable structure size.
--- tools/lib/perf/include/perf/event.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/lib/perf/include/perf/event.h +3 -2
@@ -336,8 +336,9 @@ struct perf_record_time_conv {__u64 time_zero;__u64 time_cycles;__u64 time_mask; -bool cap_user_time_zero; -bool cap_user_time_short; +__u8 cap_user_time_zero; +__u8 cap_user_time_short; +__u8 reserved[6 ];/* For alignment */ };struct perf_record_header_feature {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 513/530 perf jit: Let convert_timestamp() to be backwards-compatible
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit aa616f5a8a2d22a179d5502ebd85045af66fa656 ]
Commit d110162cafc80dad ("perf tsc: Support cap_user_time_short for event TIME_CONV") supports the extended parameters for event TIME_CONV, but it broke the backwards compatibility, so any perf data file with old event format fails to convert timestamp.
This patch introduces a helper event_contains() to check if an event contains a specific member or not. For the backwards-compatibility, if the event size confirms the extended parameters are supported in the event TIME_CONV, then copies these parameters.
Committer notes:
To make this compiler backwards compatible add this patch:
- struct perf_tsc_conversion tc = { 0 };
+ struct perf_tsc_conversion tc = { .time_shift = 0, };
--- tools/lib/perf/include/perf/event.h | 2 ++ tools/perf/util/jitdump.c | 30 +++++++++++++++++++---------- 2 files changed, 22 insertions(+), 10 deletions(-)
tools/lib/perf/include/perf/event.h +2 -0
@@ -8,6 +8,8 @@#include <linux/bpf.h> #include <sys/types.h> /* pid_t */ +#define event_contains (obj, mem) ((obj).header.size > offsetof(typeof(obj), mem)) +struct perf_record_mmap {struct perf_event_header header;__u32 pid, tid;
tools/perf/util/jitdump.c +20 -10
@@ -369,21 +369,31 @@ jit_inject_event(struct jit_buf_desc *jd, union perf_event *event)static uint64_t convert_timestamp (struct jit_buf_desc *jd,uint64_t timestamp) { -struct perf_tsc_conversion tc; +struct perf_tsc_conversion tc = { .time_shift =0 , }; +struct perf_record_time_conv *time_conv = &jd->session->time_conv;if (!jd->use_arch_timestamp)return timestamp; - tc.time_shift = jd->session->time_conv.time_shift; - tc.time_mult = jd->session->time_conv.time_mult; - tc.time_zero = jd->session->time_conv.time_zero; - tc.time_cycles = jd->session->time_conv.time_cycles; - tc.time_mask = jd->session->time_conv.time_mask; - tc.cap_user_time_zero = jd->session->time_conv.cap_user_time_zero; - tc.cap_user_time_short = jd->session->time_conv.cap_user_time_short; + tc.time_shift = time_conv->time_shift; + tc.time_mult = time_conv->time_mult; + tc.time_zero = time_conv->time_zero; -if (!tc.cap_user_time_zero) -return 0 ; +/* +* The event TIME_CONV was extended for the fields from "time_cycles" +* when supported cap_user_time_short, for backward compatibility, +* checks the event size and assigns these extended fields if these +* fields are contained in the event. +*/ +if (event_contains (*time_conv, time_cycles)) { + tc.time_cycles = time_conv->time_cycles; + tc.time_mask = time_conv->time_mask; + tc.cap_user_time_zero = time_conv->cap_user_time_zero; + tc.cap_user_time_short = time_conv->cap_user_time_short; + +if (!tc.cap_user_time_zero) +return 0 ; + }return tsc_to_perf_time (timestamp, &tc); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 514/530 perf session: Add swap operation for event TIME_CONV
In reply to Greg Kroah-HartmanFrom: Leo Yan <[email protected]>
[ Upstream commit 050ffc449008eeeafc187dec337d9cf1518f89bc ]
Since commit d110162cafc8 ("perf tsc: Support cap_user_time_short for event TIME_CONV"), the event PERF_RECORD_TIME_CONV has extended the data structure for clock parameters.
To be backwards-compatible, this patch adds a dedicated swap operation for the event PERF_RECORD_TIME_CONV, based on checking if the event contains field "time_cycles", it can support both for the old and new event formats.
--- tools/perf/util/session.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
tools/perf/util/session.c +14 -1
@@ -945,6 +945,19 @@ static void perf_event__stat_round_swap(union perf_event *event, event->stat_round.time =bswap_64 (event->stat_round.time); } +static void perf_event__time_conv_swap (union perf_event *event, +bool sample_id_all__maybe_unused ) +{ + event->time_conv.time_shift =bswap_64 (event->time_conv.time_shift); + event->time_conv.time_mult =bswap_64 (event->time_conv.time_mult); + event->time_conv.time_zero =bswap_64 (event->time_conv.time_zero); + +if (event_contains (event->time_conv, time_cycles)) { + event->time_conv.time_cycles =bswap_64 (event->time_conv.time_cycles); + event->time_conv.time_mask =bswap_64 (event->time_conv.time_mask); + } +} +typedef void (*perf_event__swap_op )(union perf_event *event,bool sample_id_all);
@@ -981,7 +994,7 @@ static perf_event__swap_op perf_event__swap_ops[] = { [PERF_RECORD_STAT] = perf_event__stat_swap, [PERF_RECORD_STAT_ROUND] = perf_event__stat_round_swap, [PERF_RECORD_EVENT_UPDATE] = perf_event__event_update_swap, - [PERF_RECORD_TIME_CONV] = perf_event__all64_swap, + [PERF_RECORD_TIME_CONV] = perf_event__time_conv_swap, [PERF_RECORD_HEADER_MAX] = NULL, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 515/530 ia64: fix EFI_DEBUG build
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit e3db00b79d74caaf84cd9e1d4927979abfd0d7c9 ]
When enabled local debugging via #define EFI_DEBUG 1 noticed build failure:
arch/ia64/kernel/efi.c:564:8: error: 'i' undeclared (first use in this function)
While at it fixed benign string format mismatches visible only when EFI_DEBUG is enabled:
arch/ia64/kernel/efi.c:589:11:
warning: format '%lx' expects argument of type 'long unsigned int', but argument 5 has type 'u64' {aka 'long long unsigned int'} [-Wformat=]
--- arch/ia64/kernel/efi.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/ia64/kernel/efi.c +6 -5
@@ -413,10 +413,10 @@ efi_get_pal_addr (void) mask = ~((1 <<IA64_GRANULE_SHIFT ) -1 );printk (KERN_INFO "CPU %d: mapping PAL code " -"[0x%lx-0x%lx) into [0x%lx-0x%lx)\n" , -smp_processor_id (), md->phys_addr, - md->phys_addr +efi_md_size (md), - vaddr & mask, (vaddr & mask) +IA64_GRANULE_SIZE ); +"[0x%llx-0x%llx) into [0x%llx-0x%llx)\n" , +smp_processor_id (), md->phys_addr, + md->phys_addr +efi_md_size (md), + vaddr & mask, (vaddr & mask) +IA64_GRANULE_SIZE );#endif return __va (md->phys_addr); }
@@ -558,6 +558,7 @@ efi_init (void) {efi_memory_desc_t *md;void *p; +unsigned int i;for (i =0 , p = efi_map_start; p < efi_map_end; ++i, p += efi_desc_size)
@@ -584,7 +585,7 @@ efi_init (void) }printk ("mem%02d: %s " -"range=[0x%016lx-0x%016lx) (%4lu%s)\n" , +"range=[0x%016llx-0x%016llx) (%4lu%s)\n" , i,efi_md_typeattr_format (buf,sizeof (buf), md), md->phys_addr, md->phys_addr +efi_md_size (md), size, unit);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 516/530 kfifo: fix ternary sign extension bugs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]
The intent with this code was to return negative error codes but instead it returns positives.
The problem is how type promotion works with ternary operations. These functions return long, "ret" is an int and "copied" is a u32. The negative error code is first cast to u32 so it becomes a high positive and then cast to long where it's still a positive.
We could fix this by declaring "ret" as a ssize_t but let's just get rid of the ternaries instead.
--- samples/kfifo/bytestream-example.c | 8 ++++++-- samples/kfifo/inttype-example.c | 8 ++++++-- samples/kfifo/record-example.c | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-)
samples/kfifo/bytestream-example.c +6 -2
@@ -122,8 +122,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -138,8 +140,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
samples/kfifo/inttype-example.c +6 -2
@@ -115,8 +115,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -131,8 +133,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
samples/kfifo/record-example.c +6 -2
@@ -129,8 +129,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -145,8 +147,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 517/530 mm/sl?b.c: remove ctor argument from kmem_cache_flags
In reply to Greg Kroah-HartmanFrom: Nikolay Borisov <[email protected]>
[ Upstream commit 3754000872188e3e4713d9d847fe3c615a47c220 ]
This argument hasn't been used since e153362a50a3 ("slub: Remove objsize check in kmem_cache_flags()") so simply remove it.
--- mm/slab.c | 3 +-- mm/slab.h | 6 ++---- mm/slab_common.c | 2 +- mm/slub.c | 9 +++------ 4 files changed, 7 insertions(+), 13 deletions(-)
mm/slab.c +1 -2
@@ -1789,8 +1789,7 @@ static int __ref setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp) }slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
mm/slab.h +2 -4
@@ -110,8 +110,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, slab_flags_t flags, void (*ctor)(void *));slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)); +slab_flags_t flags,const char *name);#else static inline struct kmem_cache * __kmem_cache_alias(const char *name, unsigned int size, unsigned int align,
@@ -119,8 +118,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, {return NULL ; }static inline slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
mm/slab_common.c +1 -1
@@ -196,7 +196,7 @@ struct kmem_cache *find_mergeable(unsigned int size, unsigned int align, size =ALIGN (size,sizeof (void *)); align =calculate_alignment (flags, align, size); size =ALIGN (size, align); - flags =kmem_cache_flags (size, flags, name,NULL ); + flags =kmem_cache_flags (size, flags, name);if (flags &SLAB_NEVER_MERGE )return NULL ;
mm/slub.c +3 -6
@@ -1397,7 +1397,6 @@ __setup("slub_debug", setup_slub_debug);* @object_size: the size of an object without meta data * @flags: flags to set * @name: name of the cache -* @ctor: constructor function * * Debug option(s) are applied to @flags. In addition to the debug * option(s), if a slab name (or multiple) is specified i.e.
@@ -1405,8 +1404,7 @@ __setup("slub_debug", setup_slub_debug);* then only the select slabs will receive the debug option(s). */ slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {char *iter;size_t len;
@@ -1471,8 +1469,7 @@ static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,static inline void remove_full (struct kmem_cache *s,struct kmem_cache_node *n,struct page *page) {}slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
@@ -3782,7 +3779,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { - s->flags =kmem_cache_flags (s->size, flags, s->name, s->ctor); + s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 518/530 mm, slub: enable slub_debug static key when creating cache with explicit debug flags
In reply to Greg Kroah-HartmanFrom: Vlastimil Babka <[email protected]>
[ Upstream commit 1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66 ]
Commit ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled when slub_debug boot parameter is passed, or CONFIG_SLUB_DEBUG_ON enabled.
However, some caches might be created with one or more debugging flags explicitly passed to kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.
This patch fixes it by checking for debugging flags passed to kmem_cache_create() and enabling the static key accordingly.
Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally. btrfs_init_cachep() creates a cache with SLAB_RED_ZONE but that's a mistake that's being corrected [1]. rcu_torture_stats() creates a cache with SLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.
Also note that in case of backports to kernels before v5.12 that don't have 59450bbc12be ("mm, slab, slub: stop taking cpu hotplug lock"), static_branch_enable_cpuslocked() should be used.
[1] https://lore.kernel.org/linux-btrfs/[email protected]/
--- mm/slub.c | 9 +++++++++ 1 file changed, 9 insertions(+)
mm/slub.c +9 -0
@@ -3779,6 +3779,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { +#ifdef CONFIG_SLUB_DEBUG +/* +* If no slub_debug was enabled globally, the static key is not yet +* enabled by setup_slub_debug(). Enable it if the cache is being +* created with any of the debugging flags passed explicitly. +*/ +if (flags &SLAB_DEBUG_FLAGS ) +static_branch_enable (&slub_debug_enabled); +#endif s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();
Signature · 1 line
2.30.2
Re: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
Quoted 30 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.
Quoted 12 lines
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/
Quoted 25 lines
--- mm/slub.c | 9 +++++++++ 1 file changed, 9 insertions(+)mm/slub.c +9
-0@@ -3779,6 +3779,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { +#ifdef CONFIG_SLUB_DEBUG +/* +* If no slub_debug was enabled globally, the static key is not yet +* enabled by setup_slub_debug(). Enable it if the cache is being +* created with any of the debugging flags passed explicitly. +*/ +if (flags &SLAB_DEBUG_FLAGS ) +static_branch_enable (&slub_debug_enabled); +#endif s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();
Re: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
Quoted 25 lines · Vlastimil Babka
Quoted 24 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.
Quoted 3 lines
Quoted 3 lines
Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.
Geez, and this part was also missed. Also why I chose not to Cc stable in the first place.
Quoted 44 lines
Quoted 14 lines
[1] https://lore.kernel.org/linux-btrfs/[email protected]/
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/Quoted 25 lines
--- mm/slub.c | 9 +++++++++ 1 file changed, 9 insertions(+)mm/slub.c +9
-0@@ -3779,6 +3779,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { +#ifdef CONFIG_SLUB_DEBUG +/* +* If no slub_debug was enabled globally, the static key is not yet +* enabled by setup_slub_debug(). Enable it if the cache is being +* created with any of the debugging flags passed explicitly. +*/ +if (flags &SLAB_DEBUG_FLAGS ) +static_branch_enable (&slub_debug_enabled); +#endif s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
In reply to Vlastimil BabkaQuoted 44 lines · Vlastimil Babka
Quoted 30 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.Quoted 12 lines
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 2 lines
Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/
Is that in Linus's tree yet? If so, what is the git id?
thanks,
greg k-h
Re: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
Quoted 45 lines · Greg Kroah-Hartman
Quoted 44 lines · Vlastimil Babka
Quoted 42 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.[1] https://lore.kernel.org/linux-btrfs/[email protected]/
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 4 lines
Quoted 2 lines
Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/Is that in Linus's tree yet? If so, what is the git id?
No, it's in mmotm, so no git id yet, but should make it to Linus during 5.13 rc's.
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
Quoted 46 lines · Vlastimil Babka
Quoted 45 lines · Greg Kroah-Hartman
Quoted 44 lines · Vlastimil Babka
Quoted 42 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.[1] https://lore.kernel.org/linux-btrfs/[email protected]/
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/Is that in Linus's tree yet? If so, what is the git id?
No, it's in mmotm, so no git id yet, but should make it to Linus during 5.13 rc's.
Ok, thanks, now dropped from all 3 queues.
greg k-h
Sasha Levin
maintainerRe: [PATCH 5.10 518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags
In reply to Vlastimil BabkaQuoted 46 lines · Vlastimil Babka
Quoted 45 lines · Greg Kroah-Hartman
Quoted 44 lines · Vlastimil Babka
Quoted 42 lines · Greg Kroah-Hartman
From: Vlastimil Babka <[email protected]>
[ Upstream commit
1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66]Commit
ca0cab65ea2b("mm, slub: introduce static key forslub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled whenslub_debugboot parameter is passed, orCONFIG_SLUB_DEBUG_ONenabled.However, some caches might be created with one or more debugging flags explicitly passed to
kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.This patch fixes it by checking for debugging flags passed to
kmem_cache_create()and enabling the static key accordingly.Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally.
btrfs_init_cachep()creates a cache withSLAB_RED_ZONEbut that's a mistake that's being corrected [1].rcu_torture_stats()creates a cache withSLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.Also note that in case of backports to kernels before v5.12 that don't have
59450bbc12be("mm, slab, slub: stop taking cpu hotplug lock"),static_branch_enable_cpuslocked()should be used.[1] https://lore.kernel.org/linux-btrfs/[email protected]/
Fixes ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()")Signed-off-by Vlastimil Babka <[email protected]>Reported-by Oliver Glitta <[email protected]>Acked-by David Rientjes <[email protected]>Cc Christoph Lameter <[email protected]>Cc Pekka Enberg <[email protected]>Cc Joonsoo Kim <[email protected]>Cc "Paul E. McKenney" <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
Uh, rather not release this to stable without the followup fix:
https://lore.kernel.org/linux-mm/[email protected]/Is that in Linus's tree yet? If so, what is the git id?
No, it's in mmotm, so no git id yet, but should make it to Linus during 5.13 rc's.
I'll drop it for now, thanks!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 519/530 mm: memcontrol: slab: fix obtain a reference to a freeing memcg
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
[ Upstream commit 9f38f03ae8d5f57371b71aa6b4275765b65454fd ]
Patch series "Use obj_cgroup APIs to charge kmem pages", v5.
Since Roman's series "The new cgroup slab memory controller" applied. All slab objects are charged with the new APIs of obj_cgroup. The new APIs introduce a struct obj_cgroup to charge slab objects. It prevents long-living objects from pinning the original memory cgroup in the memory. But there are still some corner objects (e.g. allocations larger than order-1 page on SLUB) which are not charged with the new APIs. Those objects (include the pages which are allocated from buddy allocator directly) are charged as kmem pages which still hold a reference to the memory cgroup.
E.g. We know that the kernel stack is charged as kmem pages because the size of the kernel stack can be greater than 2 pages (e.g. 16KB on x86_64 or arm64). If we create a thread (suppose the thread stack is charged to memory cgroup A) and then move it from memory cgroup A to memory cgroup B. Because the kernel stack of the thread hold a reference to the memory cgroup A. The thread can pin the memory cgroup A in the memory even if we remove the cgroup A. If we want to see this scenario by using the following script. We can see that the system has added 500 dying cgroups (This is not a real world issue, just a script to show that the large kmallocs are charged as kmem pages which can pin the memory cgroup in the memory).
#!/bin/bash
cat /proc/cgroups | grep memory
cd /sys/fs/cgroup/memory
echo 1 > memory.move_charge_at_immigrate
for i in range{1..500}
do
mkdir kmem_test
echo $$ > kmem_test/cgroup.procs
sleep 3600 &
echo $$ > cgroup.procs
echo cat kmem_test/cgroup.procs > cgroup.procs rmdir kmem_test
done
cat /proc/cgroups | grep memory
This patchset aims to make those kmem pages to drop the reference to memory cgroup by using the APIs of obj_cgroup. Finally, we can see that the number of the dying cgroups will not increase if we run the above test script.
This patch (of 7):
The rcu_read_lock/unlock only can guarantee that the memcg will not be freed, but it cannot guarantee the success of css_get (which is in the refill_stock when cached memcg changed) to memcg.
rcu_read_lock()
memcg = obj_cgroup_memcg(old)
__memcg_kmem_uncharge(memcg)
refill_stock(memcg)
if (stock->cached != memcg)
// css_get can change the ref counter from 0 back to 1.
css_get(&memcg->css) rcu_read_unlock()
This fix is very like the commit:
eefbfa7fd678 ("mm: memcg/slab: fix use after free in obj_cgroup_charge")
Fix this by holding a reference to the memcg which is passed to the __memcg_kmem_uncharge() before calling __memcg_kmem_uncharge().
--- mm/memcontrol.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
mm/memcontrol.c +9 -1
@@ -3162,9 +3162,17 @@ static void drain_obj_stock(struct memcg_stock_pcp *stock)unsigned int nr_bytes = stock->nr_bytes & (PAGE_SIZE -1 );if (nr_pages) { +struct mem_cgroup *memcg; +rcu_read_lock (); -__memcg_kmem_uncharge (obj_cgroup_memcg (old), nr_pages); +retry: + memcg =obj_cgroup_memcg (old); +if (unlikely (!css_tryget (&memcg->css))) + goto retry;rcu_read_unlock (); + +__memcg_kmem_uncharge (memcg, nr_pages); +css_put (&memcg->css); }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 520/530 mm/sparse: add the missing sparse_buffer_fini() in error branch
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ]
sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a WARN issue would be through the next time sparse_buffer_init() runs.
Add the missing sparse_buffer_fini() in error branch.
--- mm/sparse.c | 1 + 1 file changed, 1 insertion(+)
mm/sparse.c +1 -0
@@ -547,6 +547,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin,pr_err ("%s: node[%d] memory map backing failed. Some memory will not be available." , __func__, nid); pnum_begin = pnum; +sparse_buffer_fini (); goto failed; }check_usemap_section_nr (nid, usage);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 521/530 mm/memory-failure: unnecessary amount of unmapping
In reply to Greg Kroah-HartmanFrom: Jane Chu <[email protected]>
[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ]
It appears that unmap_mapping_range() actually takes a 'size' as its third argument rather than a location, the current calling fashion causes unnecessary amount of unmapping to occur.
--- mm/memory-failure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memory-failure.c +1 -1
@@ -1293,7 +1293,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,* communicated in siginfo, see kill_proc() */ start = (page->index <<PAGE_SHIFT ) & ~(size -1 ); -unmap_mapping_range (page->mapping, start, start + size,0 ); +unmap_mapping_range (page->mapping, start, size,0 ); }kill_procs (&tokill, flags &MF_MUST_KILL , !unmap_success, pfn, flags); rc =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 522/530 afs: Fix speculative status fetches
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 22650f148126571be1098d34160eb4931fc77241 ]
The generic/464 xfstest causes kAFS to emit occasional warnings of the form:
kAFS: vnode modified {100055:8a} 30->31 YFS.StoreData64 (c=6015)This indicates that the data version received back from the server did not match the expected value (the DV should be incremented monotonically for each individual modification op committed to a vnode).
What is happening is that a lookup call is doing a bulk status fetch speculatively on a bunch of vnodes in a directory besides getting the status of the vnode it's actually interested in. This is racing with a StoreData operation (though it could also occur with, say, a MakeDir op).
On the client, a modification operation locks the vnode, but the bulk status fetch only locks the parent directory, so no ordering is imposed there (thereby avoiding an avenue to deadlock).
On the server, the StoreData op handler doesn't lock the vnode until it's received all the request data, and downgrades the lock after committing the data until it has finished sending change notifications to other clients - which allows the status fetch to occur before it has finished.
This means that:
- a status fetch can access the target vnode either side of the exclusive section of the modification
- the status fetch could start before the modification, yet finish after, and vice-versa.
- the status fetch and the modification RPCs can complete in either order.
- the status fetch can return either the before or the after DV from the modification.
- the status fetch might regress the locally cached DV.
Some of these are handled by the previous fix[1], but that's not sufficient because it checks the DV it received against the DV it cached at the start of the op, but the DV might've been updated in the meantime by a locally generated modification op.
Fix this by the following means:
(1) Keep track of when we're performing a modification operation on a vnode. This is done by marking vnode parameters with a 'modification' note that causes the AFS_VNODE_MODIFYING flag to be set on the vnode for the duration.
(2) Alter the speculation race detection to ignore speculative status fetches if either the vnode is marked as being modified or the data version number is not what we expected.
Note that whilst the "vnode modified" warning does get recovered from as it causes the client to refetch the status at the next opportunity, it will also invalidate the pagecache, so changes might get lost.
--- fs/afs/dir.c | 7 +++++++ fs/afs/dir_silly.c | 3 +++ fs/afs/fs_operation.c | 6 ++++++ fs/afs/inode.c | 6 ++++-- fs/afs/internal.h | 2 ++ fs/afs/write.c | 1 + 6 files changed, 23 insertions(+), 2 deletions(-)
fs/afs/dir.c +7 -0
@@ -1337,6 +1337,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry; op->create.mode =S_IFDIR | mode;
@@ -1418,6 +1419,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry;
@@ -1554,6 +1556,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true;/* Try to make sure we have a callback promise on the victim. */
@@ -1636,6 +1639,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry;
@@ -1710,6 +1714,7 @@ static int afs_link(struct dentry *from, struct inode *dir,afs_op_set_vnode (op,0 , dvnode);afs_op_set_vnode (op,1 , vnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
@@ -1905,6 +1910,8 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,afs_op_set_vnode (op,1 , new_dvnode);/* May be same as orig_dvnode */ op->file[0 ].dv_delta =1 ; op->file[1 ].dv_delta =1 ; + op->file[0 ].modification = true; + op->file[1 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
fs/afs/dir_silly.c +3 -0
@@ -73,6 +73,8 @@ static int afs_do_silly_rename(struct afs_vnode *dvnode, struct afs_vnode *vnodeafs_op_set_vnode (op,1 , dvnode); op->file[0 ].dv_delta =1 ; op->file[1 ].dv_delta =1 ; + op->file[0 ].modification = true; + op->file[1 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
@@ -201,6 +203,7 @@ static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnodeafs_op_set_vnode (op,0 , dvnode);afs_op_set_vnode (op,1 , vnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].op_unlinked = true; op->file[1 ].update_ctime = true;
fs/afs/fs_operation.c +6 -0
@@ -118,6 +118,8 @@ static void afs_prepare_vnode(struct afs_operation *op, struct afs_vnode_param * vp->cb_break_before =afs_calc_vnode_cb_break (vnode);if (vnode->lock_state !=AFS_VNODE_LOCK_NONE ) op->flags |=AFS_OPERATION_CUR_ONLY ; +if (vp->modification) +set_bit (AFS_VNODE_MODIFYING , &vnode->flags); }if (vp->fid.vnode)
@@ -223,6 +225,10 @@ int afs_put_operation(struct afs_operation *op)if (op->ops && op->ops->put) op->ops->put (op); +if (op->file[0 ].modification) +clear_bit (AFS_VNODE_MODIFYING , &op->file[0 ].vnode->flags); +if (op->file[1 ].modification && op->file[1 ].vnode != op->file[0 ].vnode) +clear_bit (AFS_VNODE_MODIFYING , &op->file[1 ].vnode->flags);if (op->file[0 ].put_vnode)iput (&op->file[0 ].vnode->vfs_inode);if (op->file[1 ].put_vnode)
fs/afs/inode.c +4 -2
@@ -293,8 +293,9 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v op->flags &= ~AFS_OPERATION_DIR_CONFLICT ; } }else if (vp->scb.have_status) { -if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version && - vp->speculative) +if (vp->speculative && + (test_bit (AFS_VNODE_MODIFYING , &vnode->flags) || + vp->dv_before != vnode->status.data_version))/* Ignore the result of a speculative bulk status fetch * if it splits around a modification op, thereby * appearing to regress the data version.
@@ -909,6 +910,7 @@ int afs_setattr(struct dentry *dentry, struct iattr *attr) } op->ctime = attr->ia_ctime; op->file[0 ].update_ctime =1 ; + op->file[0 ].modification = true; op->ops = &afs_setattr_operation; ret =afs_do_sync_operation (op);
fs/afs/internal.h +2 -0
@@ -640,6 +640,7 @@ struct afs_vnode {#define AFS_VNODE_PSEUDODIR 7/* set if Vnode is a pseudo directory */ #define AFS_VNODE_NEW_CONTENT 8/* Set if file has new content (create/trunc-0) */ #define AFS_VNODE_SILLY_DELETED 9/* Set if file has been silly-deleted */ +#define AFS_VNODE_MODIFYING 10/* Set if we're performing a modification op */ struct list_head wb_keys;/* List of keys available for writeback */ struct list_head pending_locks;/* locks waiting to be granted */
@@ -756,6 +757,7 @@ struct afs_vnode_param { bool set_size:1; /* Must update i_size */ bool op_unlinked:1; /* True if file was unlinked by op */ bool speculative:1; /* T if speculative status fetch (no vnode lock) */ + bool modification:1; /* Set if the content gets modified */ };/*
fs/afs/write.c +1 -0
@@ -450,6 +450,7 @@ static int afs_store_data(struct address_space *mapping,afs_op_set_vnode (op,0 , vnode); op->file[0 ].dv_delta =1 ; op->store.mapping = mapping; + op->file[0 ].modification = true; op->store.first = first; op->store.last = last; op->store.first_offset = offset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 523/530 bpf: Fix alu32 const subreg bound tracking on bitwise operations
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit 049c4e13714ecbca567b4d5f6d563f05d431c80e upstream.
Fix a bug in the verifier's scalar32_min_max_*() functions which leads to incorrect tracking of 32 bit bounds for the simulation of and/or/xor bitops. When both the src & dst subreg is a known constant, then the assumption is that scalar_min_max_*() will take care to update bounds correctly. However, this is not the case, for example, consider a register R2 which has a tnum of 0xffffffff00000000, meaning, lower 32 bits are known constant and in this case of value 0x00000001. R2 is then and'ed with a register R3 which is a 64 bit known constant, here, 0x100000002.
What can be seen in line '10:' is that 32 bit bounds reach an invalid state where {u,s}32_min_value > {u,s}32_max_value. The reason is scalar32_min_max_*() delegates 32 bit bounds updates to scalar_min_max_*(), however, that really only takes place when both the 64 bit src & dst register is a known constant. Given scalar32_min_max_*() is intended to be designed as closely as possible to scalar_min_max_*(), update the 32 bit bounds in this situation through __mark_reg32_known() which will set all {u,s}32_{min,max}_value to the correct constant, which is 0x00000000 after the fix (given 0x00000001 & 0x00000002 in 32 bit space). This is possible given var32_off already holds the final value as dst_reg->var_off is updated before calling scalar32_min_max_*().
Before fix, invalid tracking of R2:
[...]
9: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=-9223372036854775807 (0x8000000000000001),smax_value=9223372032559808513 (0x7fffffff00000001),umin_value=1,umax_value=0xffffffff00000001,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_min_value=1,u32_max_value=1) R3_w=inv4294967298 R10=fp0 9: (5f) r2 &= r3
10: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=0,smax_value=4294967296 (0x100000000),umin_value=0,umax_value=0x100000000,var_off=(0x0; 0x100000000),s32_min_value=1,s32_max_value=0,u32_min_value=1,u32_max_value=0) R3_w=inv4294967298 R10=fp0
[...]
After fix, correct tracking of R2:
[...]
9: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=-9223372036854775807 (0x8000000000000001),smax_value=9223372032559808513 (0x7fffffff00000001),umin_value=1,umax_value=0xffffffff00000001,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_min_value=1,u32_max_value=1) R3_w=inv4294967298 R10=fp0 9: (5f) r2 &= r3
10: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=0,smax_value=4294967296 (0x100000000),umin_value=0,umax_value=0x100000000,var_off=(0x0; 0x100000000),s32_min_value=0,s32_max_value=0,u32_min_value=0,u32_max_value=0) R3_w=inv4294967298 R10=fp0
[...]
--- kernel/bpf/verifier.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
kernel/bpf/verifier.c +9 -13
@@ -6341,11 +6341,10 @@ static void scalar32_min_max_and(structs32 smin_val = src_reg->s32_min_value;u32 umax_val = src_reg->u32_max_value; -/* Assuming scalar64_min_max_and will be called so its safe -* to skip updating register for known 32-bit case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get our minimum from the var_off, since that's inherently * bitwise. Our maximum is the minimum of the operands' maxima.
@@ -6365,7 +6364,6 @@ static void scalar32_min_max_and(struct dst_reg->s32_min_value = dst_reg->u32_min_value; dst_reg->s32_max_value = dst_reg->u32_max_value; } - } static void scalar_min_max_and(struct bpf_reg_state *dst_reg,
@@ -6412,11 +6410,10 @@ static void scalar32_min_max_or(struct bs32 smin_val = src_reg->s32_min_value;u32 umin_val = src_reg->u32_min_value; -/* Assuming scalar64_min_max_or will be called so it is safe -* to skip updating register for known case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get our maximum from the var_off, and our minimum is the * maximum of the operands' minima
@@ -6481,11 +6478,10 @@ static void scalar32_min_max_xor(structstruct tnum var32_off =tnum_subreg (dst_reg->var_off);s32 smin_val = src_reg->s32_min_value; -/* Assuming scalar64_min_max_xor will be called so it is safe -* to skip updating register for known case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get both minimum and maximum from the var32_off. */ dst_reg->u32_min_value = var32_off.value;
Greg Kroah-Hartman
maintainerPATCH 524/530 bpf, ringbuf: Deny reserve of buffers larger than ringbuf
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea upstream.
A BPF program might try to reserve a buffer larger than the ringbuf size. If the consumer pointer is way ahead of the producer, that would be successfully reserved, allowing the BPF program to read or write out of the ringbuf allocated area.
--- kernel/bpf/ringbuf.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/ringbuf.c +3 -0
@@ -334,6 +334,9 @@ static void *__bpf_ringbuf_reserve(strucreturn NULL ; len =round_up (size +BPF_RINGBUF_HDR_SZ ,8 ); +if (len > rb->mask +1 ) +return NULL ; + cons_pos =smp_load_acquire (&rb->consumer_pos);if (in_nmi ()) {
Greg Kroah-Hartman
maintainerPATCH 525/530 bpf: Prevent writable memory-mapping of read-only ringbuf pages
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
commit 04ea3086c4d73da7009de1e84962a904139af219 upstream.
Only the very first page of BPF ringbuf that contains consumer position counter is supposed to be mapped as writeable by user-space. Producer position is read-only and can be modified only by the kernel code. BPF ringbuf data pages are read-only as well and are not meant to be modified by user-code to maintain integrity of per-record headers.
This patch allows to map only consumer position page as writeable and everything else is restricted to be read-only. remap_vmalloc_range() internally adds VM_DONTEXPAND, so all the established memory mappings can't be extended, which prevents any future violations through mremap()'ing.
--- kernel/bpf/ringbuf.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
kernel/bpf/ringbuf.c +8 -13
@@ -240,25 +240,20 @@ static int ringbuf_map_get_next_key(strureturn -ENOTSUPP ; } -static size_t bpf_ringbuf_mmap_page_cnt (const struct bpf_ringbuf *rb) -{ -size_t data_pages = (rb->mask +1 ) >>PAGE_SHIFT ; - -/* consumer page + producer page + 2 x data pages */ -return RINGBUF_POS_PAGES +2 * data_pages; -} -static int ringbuf_map_mmap (struct bpf_map *map,struct vm_area_struct *vma) {struct bpf_ringbuf_map *rb_map; -size_t mmap_sz; rb_map = container_of(map, struct bpf_ringbuf_map, map); - mmap_sz =bpf_ringbuf_mmap_page_cnt (rb_map->rb) <<PAGE_SHIFT ; - -if (vma->vm_pgoff *PAGE_SIZE + (vma->vm_end - vma->vm_start) > mmap_sz) -return -EINVAL ; +if (vma->vm_flags &VM_WRITE ) { +/* allow writable mapping for the consumer_pos only */ +if (vma->vm_pgoff !=0 || vma->vm_end - vma->vm_start !=PAGE_SIZE ) +return -EPERM ; + }else { + vma->vm_flags &= ~VM_MAYWRITE ; + } +/* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range (vma, rb_map->rb, vma->vm_pgoff +RINGBUF_PGOFF ); }
Greg Kroah-Hartman
maintainerPATCH 526/530 arm64: Remove arm64_dma32_phys_limit and its uses
In reply to Greg Kroah-HartmanFrom: Catalin Marinas <[email protected]>
commit d78050ee35440d7879ed94011c52994b8932e96e upstream.
With the introduction of a dynamic ZONE_DMA range based on DT or IORT information, there's no need for CMA allocations from the wider ZONE_DMA32 since on most platforms ZONE_DMA will cover the 32-bit addressable range. Remove the arm64_dma32_phys_limit and set arm64_dma_phys_limit to cover the smallest DMA range required on the platform. CMA allocation and crashkernel reservation now go in the dynamically sized ZONE_DMA, allowing correct functionality on RPi4.
--- arch/arm64/include/asm/processor.h | 3 +-- arch/arm64/mm/init.c | 33 ++++++++++++++++++--------------- 2 files changed, 19 insertions(+), 17 deletions(-)
arch/arm64/include/asm/processor.h +1 -2
@@ -96,8 +96,7 @@#endif /* CONFIG_ARM64_FORCE_52BIT */ extern phys_addr_t arm64_dma_phys_limit; -extern phys_addr_t arm64_dma32_phys_limit; -#define ARCH_LOW_ADDRESS_LIMIT ((arm64_dma_phys_limit ? : arm64_dma32_phys_limit) - 1) +#define ARCH_LOW_ADDRESS_LIMIT (arm64_dma_phys_limit - 1)struct debug_info {#ifdef CONFIG_HAVE_HW_BREAKPOINT
arch/arm64/mm/init.c +18 -15
@@ -53,13 +53,13 @@ s64 memstart_addr __ro_after_init = -1;EXPORT_SYMBOL (memstart_addr);/* -* We create both ZONE_DMA and ZONE_DMA32. ZONE_DMA covers the first 1G of -* memory as some devices, namely the Raspberry Pi 4, have peripherals with -* this limited view of the memory. ZONE_DMA32 will cover the rest of the 32 -* bit addressable memory area. +* If the corresponding config options are enabled, we create both ZONE_DMA +* and ZONE_DMA32. By default ZONE_DMA covers the 32-bit addressable memory +* unless restricted on specific platforms (e.g. 30-bit on Raspberry Pi 4). +* In such case, ZONE_DMA32 covers the rest of the 32-bit addressable memory, +* otherwise it is empty. */ phys_addr_t arm64_dma_phys_limit__ro_after_init ; -phys_addr_t arm64_dma32_phys_limit__ro_after_init ;#ifdef CONFIG_KEXEC_CORE /*
@@ -84,7 +84,7 @@ static void __init reserve_crashkernel(vif (crash_base ==0 ) {/* Current arm64 boot protocol requires 2MB alignment */ - crash_base =memblock_find_in_range (0 , arm64_dma32_phys_limit, + crash_base =memblock_find_in_range (0 , arm64_dma_phys_limit, crash_size,SZ_2M );if (crash_base ==0 ) { pr_warn("cannot allocate crashkernel (size:0x%llx)\n",
@@ -189,6 +189,7 @@ static void __init zone_sizes_init(unsigunsigned long max_zone_pfns[MAX_NR_ZONES ] = {0 };unsigned int __maybe_unused acpi_zone_dma_bits;unsigned int __maybe_unused dt_zone_dma_bits; +phys_addr_t __maybe_unused dma32_phys_limit =max_zone_phys (32 );#ifdef CONFIG_ZONE_DMA acpi_zone_dma_bits =fls64 (acpi_iort_dma_get_max_cpu_address ());
@@ -198,8 +199,12 @@ static void __init zone_sizes_init(unsig max_zone_pfns[ZONE_DMA ] =PFN_DOWN (arm64_dma_phys_limit);#endif #ifdef CONFIG_ZONE_DMA32 - max_zone_pfns[ZONE_DMA32 ] =PFN_DOWN (arm64_dma32_phys_limit); + max_zone_pfns[ZONE_DMA32 ] =PFN_DOWN (dma32_phys_limit); +if (!arm64_dma_phys_limit) + arm64_dma_phys_limit = dma32_phys_limit;#endif +if (!arm64_dma_phys_limit) + arm64_dma_phys_limit =PHYS_MASK +1 ; max_zone_pfns[ZONE_NORMAL ] = max;free_area_init (max_zone_pfns);
@@ -393,16 +398,9 @@ void __init arm64_memblock_init(void)early_init_fdt_scan_reserved_mem (); -if (IS_ENABLED (CONFIG_ZONE_DMA32 )) - arm64_dma32_phys_limit =max_zone_phys (32 ); -else - arm64_dma32_phys_limit =PHYS_MASK +1 ; -reserve_elfcorehdr (); high_memory =__va (memblock_end_of_DRAM () -1 ) +1 ; - -dma_contiguous_reserve (arm64_dma32_phys_limit); }void __init bootmem_init (void )
@@ -438,6 +436,11 @@ void __init bootmem_init(void)zone_sizes_init (min, max);/* +* Reserve the CMA area after arm64_dma_phys_limit was initialised. +*/ +dma_contiguous_reserve (arm64_dma_phys_limit); + +/* * request_standard_resources() depends on crashkernel's memory being * reserved, so do it here. */
@@ -519,7 +522,7 @@ static void __init free_unused_memmap(vovoid __init mem_init (void ) {if (swiotlb_force ==SWIOTLB_FORCE || - max_pfn >PFN_DOWN (arm64_dma_phys_limit ? : arm64_dma32_phys_limit)) + max_pfn >PFN_DOWN (arm64_dma_phys_limit))swiotlb_init (1 );else swiotlb_force =SWIOTLB_NO_FORCE ;
Greg Kroah-Hartman
maintainerPATCH 527/530 net: Only allow init netns to set default tcp cong to a restricted algo
In reply to Greg Kroah-HartmanFrom: Jonathon Reinhart <[email protected]>
commit 8d432592f30fcc34ef5a10aac4887b4897884493 upstream.
tcp_set_default_congestion_control() is netns-safe in that it writes to &net->ipv4.tcp_congestion_control, but it also sets ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended side-effect of changing the global net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in non-init netns")
Resolve this netns "leak" by only allowing the init netns to set the default algorithm to one that is restricted. This restriction could be removed if tcp_allowed_congestion_control were namespace-ified in the future.
This bug was uncovered with
https://github.com/JonathonReinhart/linux-netns-sysctl-verify
--- net/ipv4/tcp_cong.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/tcp_cong.c +4 -0
@@ -230,6 +230,10 @@ int tcp_set_default_congestion_control(s ret = -ENOENT ; }else if (!bpf_try_module_get (ca, ca->owner)) { ret = -EBUSY ; + }else if (!net_eq (net, &init_net) && + !(ca->flags &TCP_CONG_NON_RESTRICTED )) { +/* Only init netns can set default to a restricted algorithm */ + ret = -EPERM ; }else { prev =xchg (&net->ipv4.tcp_congestion_control, ca);if (prev)
Greg Kroah-Hartman
maintainerPATCH 528/530 smp: Fix smp_call_function_single_async prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 1139aeb1c521eb4a050920ce6c64c36c4f2a3ab7 upstream.
As of commit 966a967116e6 ("smp: Avoid using two cache lines for struct call_single_data"), the smp code prefers 32-byte aligned call_single_data objects for performance reasons, but the block layer includes an instance of this structure in the main 'struct request' that is more senstive to size than to performance here, see 4ccafe032005 ("block: unalign call_single_data in struct request").
The result is a violation of the calling conventions that clang correctly points out:
block/blk-mq.c:630:39: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch]
smp_call_function_single_async(cpu, &rq->csd);
It does seem that the usage of the call_single_data without cache line alignment should still be allowed by the smp code, so just change the function prototype so it accepts both, but leave the default alignment unchanged for the other users. This seems better to me than adding a local hack to shut up an otherwise correct warning in the caller.
--- include/linux/smp.h | 2 +- kernel/sched/core.c | 2 +- kernel/smp.c | 20 ++++++++++---------- kernel/up.c | 2 +- 4 files changed, 13 insertions(+), 13 deletions(-)
include/linux/smp.h +1 -1
@@ -74,7 +74,7 @@ void on_each_cpu_cond(smp_cond_func_t covoid on_each_cpu_cond_mask (smp_cond_func_t cond_func,smp_call_func_t func,void *info,bool wait,const struct cpumask *mask); -int smp_call_function_single_async (int cpu,call_single_data_t *csd); +int smp_call_function_single_async (int cpu,struct __call_single_data *csd);#ifdef CONFIG_SMP
kernel/sched/core.c +1 -1
@@ -321,7 +321,7 @@ void update_rq_clock(struct rq *rq) }static inline void -rq_csd_init (struct rq *rq,call_single_data_t *csd,smp_call_func_t func) +rq_csd_init (struct rq *rq,struct __call_single_data *csd,smp_call_func_t func) { csd->flags =0 ; csd->func = func;
kernel/smp.c +10 -10
@@ -110,7 +110,7 @@ static DEFINE_PER_CPU(void *, cur_csd_instatic atomic_t csd_bug_count =ATOMIC_INIT (0 );/* Record current CSD work for current CPU, NULL to erase. */ -static void csd_lock_record (call_single_data_t *csd) +static void csd_lock_record (struct __call_single_data *csd) {if (!csd) {smp_mb ();/* NULL cur_csd after unlock. */
@@ -125,7 +125,7 @@ static void csd_lock_record(call_single_/* Or before unlock, as the case may be. */ } -static __always_inline int csd_lock_wait_getcpu(call_single_data_t *csd) +static __always_inline int csd_lock_wait_getcpu(struct __call_single_data *csd) {unsigned int csd_type;
@@ -140,7 +140,7 @@ static __always_inline int csd_lock_wait* the CSD_TYPE_SYNC/ASYNC types provide the destination CPU, * so waiting on other types gets much less information. */ -static __always_inline bool csd_lock_wait_toolong(call_single_data_t *csd, u64 ts0, u64 *ts1, int *bug_id) +static __always_inline bool csd_lock_wait_toolong(struct __call_single_data *csd, u64 ts0, u64 *ts1, int *bug_id) {int cpu =-1 ;int cpux;
@@ -204,7 +204,7 @@ static __always_inline bool csd_lock_wai* previous function call. For multi-cpu calls its even more interesting * as we'll have to ensure no other cpu is observing our csd. */ -static __always_inline void csd_lock_wait(call_single_data_t *csd) +static __always_inline void csd_lock_wait(struct __call_single_data *csd) {int bug_id =0 ;u64 ts0, ts1;
@@ -219,17 +219,17 @@ static __always_inline void csd_lock_wai }#else -static void csd_lock_record (call_single_data_t *csd) +static void csd_lock_record (struct __call_single_data *csd) { } -static __always_inline void csd_lock_wait(call_single_data_t *csd) +static __always_inline void csd_lock_wait(struct __call_single_data *csd) {smp_cond_load_acquire (&csd->flags, !(VAL &CSD_FLAG_LOCK )); }#endif -static __always_inline void csd_lock(call_single_data_t *csd) +static __always_inline void csd_lock(struct __call_single_data *csd) {csd_lock_wait (csd); csd->flags |=CSD_FLAG_LOCK ;
@@ -242,7 +242,7 @@ static __always_inline void csd_lock(calsmp_wmb (); } -static __always_inline void csd_unlock(call_single_data_t *csd) +static __always_inline void csd_unlock(struct __call_single_data *csd) {WARN_ON (!(csd->flags &CSD_FLAG_LOCK ));
@@ -276,7 +276,7 @@ void __smp_call_single_queue(int cpu, st* for execution on the given CPU. data must already have * ->func, ->info, and ->flags set. */ -static int generic_exec_single (int cpu,call_single_data_t *csd) +static int generic_exec_single (int cpu,struct __call_single_data *csd) {if (cpu ==smp_processor_id ()) {smp_call_func_t func = csd->func;
@@ -542,7 +542,7 @@ EXPORT_SYMBOL(smp_call_function_single);* NOTE: Be careful, there is unfortunately no current debugging facility to * validate the correctness of this serialization. */ -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {int err =0 ;
kernel/up.c +1 -1
@@ -25,7 +25,7 @@ int smp_call_function_single(int cpu, vo }EXPORT_SYMBOL (smp_call_function_single); -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {unsigned long flags;
Greg Kroah-Hartman
maintainerPATCH 529/530 Revert "net/sctp: fix race condition in sctp_destroy_sock"
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 01bfe5e8e428b475982a98a46cca5755726f3f7f upstream.
This reverts commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b.
This one has to be reverted as it introduced a dead lock, as syzbot reported:
CPU0 CPU1
---- ----
lock(&net->sctp.addr_wq_lock);
lock(slock-AF_INET6);
lock(&net->sctp.addr_wq_lock); lock(slock-AF_INET6);
CPU0 is the thread of sctp_addr_wq_timeout_handler(), and CPU1 is that of sctp_close().
The original issue this commit fixed will be fixed in the next patch.
--- net/sctp/socket.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/sctp/socket.c +8 -5
@@ -1520,9 +1520,11 @@ static void sctp_close(struct sock *sk,/* Supposedly, no process has access to the socket, but * the net layers still may. +* Also, sctp_destroy_sock() needs to be called with addr_wq_lock +* held and that should be grabbed before socket lock. */ -local_bh_disable (); -bh_lock_sock (sk); +spin_lock_bh (&net->sctp.addr_wq_lock); +bh_lock_sock_nested (sk);/* Hold the sock, since sk_common_release() will put sock_put() * and we have just a little more cleanup.
@@ -1531,7 +1533,7 @@ static void sctp_close(struct sock *sk,sk_common_release (sk);bh_unlock_sock (sk); -local_bh_enable (); +spin_unlock_bh (&net->sctp.addr_wq_lock);sock_put (sk);
@@ -4937,6 +4939,9 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); +/* Nothing can fail after this block, otherwise +* sctp_destroy_sock() will be called without addr_wq_lock held +*/ if (net->sctp.default_auto_asconf) {spin_lock (&sock_net (sk)->sctp.addr_wq_lock); list_add_tail(&sp->auto_asconf_list,
@@ -4971,9 +4976,7 @@ static void sctp_destroy_sock(struct socif (sp->do_auto_asconf) { sp->do_auto_asconf =0 ; -spin_lock_bh (&sock_net (sk)->sctp.addr_wq_lock);list_del (&sp->auto_asconf_list); -spin_unlock_bh (&sock_net (sk)->sctp.addr_wq_lock); }sctp_endpoint_free (sp->ep);local_bh_disable ();
Greg Kroah-Hartman
maintainerPATCH 530/530 sctp: delay auto_asconf init until binding the first addr
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 34e5b01186858b36c4d7c87e1a025071e8e2401f upstream.
As Or Cohen described:
If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking.
This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program attached to BPF_CGROUP_INET_SOCK_CREATE which denies creation of the sctp socket.
This patch is to fix it by moving the auto_asconf init out of sctp_init_sock(), by which inet_create()/inet6_create() won't need to operate it in sctp_destroy_sock() when calling sk_common_release().
It also makes more sense to do auto_asconf init while binding the first addr, as auto_asconf actually requires an ANY addr bind, see it in sctp_addr_wq_timeout_handler().
This addresses CVE-2021-23133.
--- net/sctp/socket.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-)
net/sctp/socket.c +17 -14
@@ -357,6 +357,18 @@ static struct sctp_af *sctp_sockaddr_af(return af; } +static void sctp_auto_asconf_init (struct sctp_sock *sp) +{ +struct net *net =sock_net (&sp->inet.sk); + +if (net->sctp.default_auto_asconf) { +spin_lock (&net->sctp.addr_wq_lock); +list_add_tail (&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +spin_unlock (&net->sctp.addr_wq_lock); + sp->do_auto_asconf =1 ; + } +} +/* Bind a local address either to an endpoint or to an association. */ static int sctp_do_bind (struct sock *sk,union sctp_addr *addr,int len) {
@@ -418,8 +430,10 @@ static int sctp_do_bind(struct sock *sk,return -EADDRINUSE ;/* Refresh ephemeral port. */ -if (!bp->port) +if (!bp->port) { bp->port =inet_sk (sk)->inet_num; +sctp_auto_asconf_init (sp); + }/* Add the address to the bind address list. * Use GFP_ATOMIC since BHs will be disabled.
@@ -4939,19 +4953,6 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); -/* Nothing can fail after this block, otherwise -* sctp_destroy_sock() will be called without addr_wq_lock held -*/ -if (net->sctp.default_auto_asconf) { -spin_lock (&sock_net (sk)->sctp.addr_wq_lock); -list_add_tail (&sp->auto_asconf_list, - &net->sctp.auto_asconf_splist); - sp->do_auto_asconf =1 ; -spin_unlock (&sock_net (sk)->sctp.addr_wq_lock); - }else { - sp->do_auto_asconf =0 ; - } -local_bh_enable ();return 0 ;
@@ -9285,6 +9286,8 @@ static int sctp_sock_migrate(struct sockreturn err; } +sctp_auto_asconf_init (newsp); +/* Move any messages in the old socket's receive queue that are for the * peeled off association to the new socket's receive queue. */
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
12 builds: 12 pass, 0 fail
28 boots: 28 pass, 0 fail
70 tests: 70 pass, 0 failLinux version: 5.10.37-rc1-g77806d1ee43e
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
While trying to review the patches... I discovered 5.10.36 is not tagged in origin/queue:
commit 72bb632d15f2eabf22b085d79590125a6e2e1aa3
Author: Greg Kroah-Hartman <[email protected]> Date: Tue May 11 14:47:41 2021 +0200
Linux 5.10.36
...
commit f53a3a4808625f876aebc5a0bfb354480bbf0c21 (tag: v5.10.35)
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerQuoted 17 lines · Pavel Machek
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
While trying to review the patches... I discovered 5.10.36 is not tagged in origin/queue:
commit
72bb632d15f2eabf22b085d79590125a6e2e1aa3Author: Greg Kroah-Hartman <[email protected]> Date: Tue May 11 14:47:41 2021 +0200
Quoted 7 lines
Linux 5.10.36...
commitf53a3a4808625f876aebc5a0bfb354480bbf0c21(tag: v5.10.35)Best regards,
Pavel
Are you sure? I see it here locally...
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.4.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
5.10.37-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
Build test:
mips (gcc version 11.1.1 20210430): 63 configs -> 1 new failure
malta_qemu_32r6_defconfig fails due to:
[PATCH 5.10 052/530] MIPS: Reinstate platform `__div64_32 handler
arm (gcc version 11.1.1 20210430): 105 configs -> no new failure x86_64 (gcc version 10.2.1 20210110): 2 configs -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression.
--
Regards
Sudip
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Apart from mips clang build failures no other new test failures noticed.
## Build
* kernel: 5.10.37-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: 77806d1ee43e1bea3aa5095445eb7a69f02ec8d3
* git describe: v5.10.35-831-g77806d1ee43e
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.35-831-g77806d1ee43e
## Regressions (compared to v5.10.35-300-g4edc8f7e8676)
* mips, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
## No fixes (compared to v5.10.35-300-g4edc8f7e8676)
## Test result summary
total: 71368, pass: 60228, fail: 866, skip: 10020, xfail: 254,
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 193 total, 193 passed, 0 failed
* arm64: 27 total, 27 passed, 0 failed
* i386: 25 total, 25 passed, 0 failed
* mips: 45 total, 36 passed, 9 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x86_64: 27 total, 27 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kvm
* kselftest-lib
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
Build results:
total: 156 pass: 156 fail: 0 Qemu test results: total: 455 pass: 454 fail: 1
Failed tests:
mipsel:mips32r6-generic:malta_32r6_defconfig:nocd:smp:net,pcnet:ide:rootfs
Failure as already reported.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.37 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.37-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Tested on arm64 and x86 for 5.10.37-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.37-rc1
Commit: 77806d1ee43e1bea3aa5095445eb7a69f02ec8d3
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8476
passed: 8476
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8476
passed: 8476
failed: 0
timeout: 0
--------------------------------------------------------------------