5.15.12-rc1 review
Greg Kroah-Hartman
maintainercover 5.15.12-rc1 review
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.12-rc1
Rémi Denis-Courmont <[email protected]>
phonet/pep: refuse to enable an unbound pipe
George Kennedy <[email protected]>
tun: avoid double free in tun_free_netdev
Lin Ma <[email protected]>
hamradio: improve the incomplete fix to avoid NPD
Lin Ma <[email protected]>
hamradio: defer ax25 kfree after unregister_netdev
Lin Ma <[email protected]>
ax25: NPD bug when detaching AX25 device
Hayes Wang <[email protected]>
r8152: sync ocp base
Guenter Roeck <[email protected]>
hwmon: (lm90) Do not report 'busy' status bit as alarm
Guenter Roeck <[email protected]>
hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
Guodong Liu <[email protected]>
pinctrl: mediatek: fix global-out-of-bounds issue
Derek Fang <[email protected]>
ASoC: rt5682: fix the wrong jack type detected
Kai Vehmanen <[email protected]>
ASoC: SOF: Intel: pci-tgl: add ADL-N support
Kai Vehmanen <[email protected]>
ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
Martin Povišer <[email protected]>
ASoC: tas2770: Fix setting of high sample rates
Hans de Goede <[email protected]>
Input: goodix - add id->model mapping for the "9111" model
Samuel Čavoj <[email protected]>
Input: i8042 - enable deferred probe quirk for ASUS UM325UA
Johnny Chuang <[email protected]>
Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
Jeff LaBundy <[email protected]>
Input: iqs626a - prohibit inlining of channel parsing functions
Baokun Li <[email protected]>
kfence: fix memory leak when cat kfence objects
Zhang Ying-22455 <[email protected]>
arm64: dts: lx2160a: fix scl-gpios property name
Sean Christopherson <[email protected]>
KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
Jeffle Xu <[email protected]>
netfs: fix parameter of cleanup()
Chao Yu <[email protected]>
f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
Sumit Garg <[email protected]>
tee: optee: Fix incorrect page free bug
SeongJae Park <[email protected]>
mm/damon/dbgfs: protect targets destructions with kdamond_lock
Liu Shixin <[email protected]>
mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
Naoya Horiguchi <[email protected]>
mm, hwpoison: fix condition in free hugetlb page path
Andrey Ryabinin <[email protected]>
mm: mempolicy: fix THP allocations escaping mempolicy restrictions
Johannes Berg <[email protected]>
mac80211: fix locking in ieee80211_start_ap error path
Marcos Del Sol Vives <[email protected]>
ksmbd: disable SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
Namjae Jeon <[email protected]>
ksmbd: fix uninitialized symbol 'pntsd_size'
Dan Carpenter <[email protected]>
ksmbd: fix error code in ndr_read_int32()
Ard Biesheuvel <[email protected]>
ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
Yann Gautier <[email protected]>
mmc: mmci: stm32: clear DLYB_CR after sending tuning command
Ulf Hansson <[email protected]>
mmc: core: Disable card detect during shutdown
Martin Blumenstingl <[email protected]>
mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
Prathamesh Shete <[email protected]>
mmc: sdhci-tegra: Fix switch to HS400ES mode
Noralf Trønnes <[email protected]>
gpio: dln2: Fix interrupts when replugging the device
Fabien Dessenne <[email protected]>
pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
Sean Christopherson <[email protected]>
KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
Sean Christopherson <[email protected]>
KVM: VMX: Always clear vmx->fail on emulation_required
Sean Christopherson <[email protected]>
KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
Sean Christopherson <[email protected]>
KVM: x86/mmu: Don't advance iterator after restart due to yielding
Marc Orr <[email protected]>
KVM: x86: Always set kvm_run->if_flag
Johan Hovold <[email protected]>
platform/x86: intel_pmc_core: fix memleak on registration failure
Mario Limonciello <[email protected]>
platform/x86: amd-pmc: only use callbacks for suspend
Andrew Cooper <[email protected]>
x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
Jens Wiklander <[email protected]>
tee: handle lookup of shm with reference count 0
John David Anglin <[email protected]>
parisc: Fix mask used to select futex spinlock
John David Anglin <[email protected]>
parisc: Correct completer in lws start
Thadeu Lima de Souza Cascardo <[email protected]>
ipmi: fix initialization when workqueue allocation fails
Mian Yousaf Kaukab <[email protected]>
ipmi: ssif: initialize ssif_info->client early
Thadeu Lima de Souza Cascardo <[email protected]>
ipmi: bail out if init_srcu_struct fails
José Expósito <[email protected]>
Input: atmel_mxt_ts - fix double free in mxt_read_info_block
Dmitry Osipenko <[email protected]>
ASoC: tegra: Restore headphones jack name on Nyan Big
Dmitry Osipenko <[email protected]>
ASoC: tegra: Add DAPM switches for headphones and mic jack
Martin Blumenstingl <[email protected]>
ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
Werner Sembach <[email protected]>
ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
Bradley Scott <[email protected]>
ALSA: hda/realtek: Add new alc285-hp-amp-init model
Bradley Scott <[email protected]>
ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
Ville Syrjälä <[email protected]>
ALSA: hda/hdmi: Disable silent stream on GLK
Jaroslav Kysela <[email protected]>
ALSA: rawmidi - fix the uninitalized user_pversion
Colin Ian King <[email protected]>
ALSA: drivers: opl3: Fix incorrect use of vp->state
Xiaoke Wang <[email protected]>
ALSA: jack: Check the return value of kstrdup()
Mike Rapoport <[email protected]>
x86/boot: Move EFI range reservation after cmdline parsing
Borislav Petkov <[email protected]>
Revert "x86/boot: Pull up cmdline preparation and early param parsing"
Philipp Rudo <[email protected]>
kernel/crash_core: suppress unknown crashkernel parameter warning
Andy Shevchenko <[email protected]>
platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
Josh Poimboeuf <[email protected]>
compiler.h: Fix annotation macro misplacement with Clang
Ismael Luceno <[email protected]>
uapi: Fix undefined __always_inline on non-glibc systems
Vladimir Murzin <[email protected]>
ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
Guenter Roeck <[email protected]>
hwmon: (lm90) Drop critical attribute support for MAX6654
Guenter Roeck <[email protected]>
hwmon: (lm90) Add basic support for TI TMP461
Guenter Roeck <[email protected]>
hwmon: (lm90) Introduce flag indicating extended temperature support
Guenter Roeck <[email protected]>
hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
Guenter Roeck <[email protected]>
hwmon: (lm90) Fix usage of CONFIG2 register in detect function
Phil Elwell <[email protected]>
pinctrl: bcm2835: Change init order for gpio hogs
Andrea Righi <[email protected]>
Input: elantech - fix stack out of bound access in elantech_change_report_id()
Nobuhiro Iwamatsu <[email protected]>
net: stmmac: dwmac-visconti: Fix value of ETHER_CLK_SEL_FREQ_SEL_2P5M
Hayes Wang <[email protected]>
r8152: fix the force speed doesn't work for RTL8156
Remi Pommarel <[email protected]>
net: bridge: fix ioctl old_deviceless bridge argument
Gustavo A. R. Silva <[email protected]>
net: bridge: Use array_size() helper in copy_to_user()
Xiaoliang Yang <[email protected]>
net: stmmac: ptp: fix potentially overflowing expression
Paolo Abeni <[email protected]>
veth: ensure skb entering GRO are not cloned.
Jens Axboe <[email protected]>
io_uring: zero iocb->ki_pos for stream file types
Pavel Skripkin <[email protected]>
asix: fix wrong return value in asix_check_host_enable()
Pavel Skripkin <[email protected]>
asix: fix uninit-value in asix_mdio_read()
Jiasheng Jiang <[email protected]>
sfc: falcon: Check null pointer of rx_queue->page_ring
Jiasheng Jiang <[email protected]>
sfc: Check null pointer of rx_queue->page_ring
Jiasheng Jiang <[email protected]>
net: ks8851: Check for error irq
Jiasheng Jiang <[email protected]>
drivers: net: smc911x: Check for error irq
Jiasheng Jiang <[email protected]>
fjes: Check for error irq
Fernando Fernandez Mancera <[email protected]>
bonding: fix ad_actor_system option setting to default
Vincent Whitchurch <[email protected]>
gpio: virtio: remove timeout
Wu Bo <[email protected]>
ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
Heiner Kallweit <[email protected]>
igb: fix deadlock caused by taking RTNL in RPM resume path
Willem de Bruijn <[email protected]>
net: skip virtio_net_hdr_set_proto if protocol already set
Willem de Bruijn <[email protected]>
net: accept UFOv6 packages in virtio_net_hdr_to_skb
Eric Dumazet <[email protected]>
inet: fully convert sk->sk_rx_dst to RCU rules
Eric Dumazet <[email protected]>
ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
Eric Dumazet <[email protected]>
tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
Jiasheng Jiang <[email protected]>
qlcnic: potential dereference null pointer of rx_queue->page_ring
Yevhen Orlov <[email protected]>
net: marvell: prestera: fix incorrect structure access
Yevhen Orlov <[email protected]>
net: marvell: prestera: fix incorrect return of port_find
Maciej Fijalkowski <[email protected]>
ice: xsk: return xsk buffers back to pool when cleaning the ring
Magnus Karlsson <[email protected]>
ice: Use xdp_buf instead of rx_buf for xsk zero-copy
Martin Haaß <[email protected]>
ARM: dts: imx6qdl-wandboard: Fix Ethernet support
Ignacy Gawędzki <[email protected]>
netfilter: fix regression in looped (broad|multi)cast's MAC handling
Eric Dumazet <[email protected]>
netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
Jiacheng Shi <[email protected]>
RDMA/hns: Replace kfree() with kvfree()
José Expósito <[email protected]>
IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
Yangyang Li <[email protected]>
RDMA/hns: Fix RNR retransmission issue for HIP08
Martin Blumenstingl <[email protected]>
ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
Alexey Gladkov <[email protected]>
ucounts: Fix rlimit max values check
Dongliang Mu <[email protected]>
spi: change clk_disable_unprepare to clk_unprepare
Jernej Skrabec <[email protected]>
bus: sunxi-rsb: Fix shutdown
Robert Marko <[email protected]>
arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
Rafael J. Wysocki <[email protected]>
PM: sleep: Fix error handling in dpm_prepare()
Chuck Lever <[email protected]>
NFSD: Fix READDIR buffer overflow
Jiasheng Jiang <[email protected]>
HID: potential dereference of null pointer
Benjamin Tissoires <[email protected]>
HID: holtek: fix mouse probing
Andrew Jones <[email protected]>
selftests: KVM: Fix non-x86 compiling
Zhang Yi <[email protected]>
ext4: check for inconsistent extents between index and leaf block
Zhang Yi <[email protected]>
ext4: check for out-of-order index extents in ext4_valid_extent_entries()
Zhang Yi <[email protected]>
ext4: prevent partial update of the extent blocks
Greg Jesionowski <[email protected]>
net: usb: lan78xx: add Allied Telesis AT29M2-AF
Nick Desaulniers <[email protected]>
arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 8 +- Documentation/hwmon/lm90.rst | 10 ++ Documentation/networking/bonding.rst | 11 +- Documentation/sound/hd-audio/models.rst | 2 + Makefile | 4 +- arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 + arch/arm/kernel/entry-armv.S | 8 +- arch/arm/kernel/head-nommu.S | 1 + arch/arm64/Kconfig | 3 +- .../dts/allwinner/sun50i-h5-orangepi-zero-plus.dts | 2 +- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 4 +- arch/arm64/kernel/vdso32/Makefile | 17 +- arch/parisc/include/asm/futex.h | 4 +- arch/parisc/kernel/syscall.S | 2 +- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/include/asm/pkru.h | 4 +- arch/x86/kernel/setup.c | 72 ++++----- arch/x86/kvm/mmu/tdp_iter.c | 6 + arch/x86/kvm/mmu/tdp_iter.h | 6 + arch/x86/kvm/mmu/tdp_mmu.c | 29 ++-- arch/x86/kvm/svm/svm.c | 21 +-- arch/x86/kvm/vmx/vmx.c | 45 ++++-- arch/x86/kvm/x86.c | 9 +- drivers/base/power/main.c | 2 +- drivers/bus/sunxi-rsb.c | 8 +- drivers/char/ipmi/ipmi_msghandler.c | 21 ++- drivers/char/ipmi/ipmi_ssif.c | 7 +- drivers/gpio/gpio-dln2.c | 19 ++- drivers/gpio/gpio-virtio.c | 6 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 12 +- drivers/hid/hid-holtek-mouse.c | 15 ++ drivers/hid/hid-vivaldi.c | 3 + drivers/hwmon/Kconfig | 2 +- drivers/hwmon/lm90.c | 175 +++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 +++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 + drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +- drivers/input/misc/iqs626a.c | 21 +-- drivers/input/mouse/elantech.c | 8 +- drivers/input/serio/i8042-x86ia64io.h | 7 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/elants_i2c.c | 46 +++++- drivers/input/touchscreen/goodix.c | 1 + drivers/mmc/core/core.c | 7 +- drivers/mmc/core/core.h | 1 + drivers/mmc/core/host.c | 9 ++ drivers/mmc/host/meson-mx-sdhc-mmc.c | 16 ++ drivers/mmc/host/mmci_stm32_sdmmc.c | 2 + drivers/mmc/host/sdhci-tegra.c | 43 +++-- drivers/net/bonding/bond_options.c | 2 +- drivers/net/ethernet/intel/ice/ice_txrx.h | 16 +- drivers/net/ethernet/intel/ice/ice_xsk.c | 64 ++++---- drivers/net/ethernet/intel/igb/igb_main.c | 19 ++- .../net/ethernet/marvell/prestera/prestera_main.c | 35 +++-- drivers/net/ethernet/micrel/ks8851_par.c | 2 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +- drivers/net/ethernet/sfc/falcon/rx.c | 5 +- drivers/net/ethernet/sfc/rx_common.c | 5 +- drivers/net/ethernet/smsc/smc911x.c | 5 + .../net/ethernet/stmicro/stmmac/dwmac-visconti.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +- drivers/net/fjes/fjes_main.c | 5 + drivers/net/hamradio/mkiss.c | 5 +- drivers/net/tun.c | 115 +++++++------- drivers/net/usb/asix_common.c | 8 +- drivers/net/usb/lan78xx.c | 6 + drivers/net/usb/r8152.c | 43 ++++- drivers/net/veth.c | 8 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 29 ++-- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 8 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 8 +- drivers/platform/x86/Makefile | 2 +- drivers/platform/x86/amd-pmc.c | 3 +- drivers/platform/x86/intel/Kconfig | 15 -- drivers/platform/x86/intel/pmc/pltdrv.c | 2 +- drivers/spi/spi-armada-3700.c | 2 +- drivers/tee/optee/shm_pool.c | 6 +- drivers/tee/tee_shm.c | 171 ++++++++------------ fs/ext4/extents.c | 95 +++++++---- fs/f2fs/xattr.c | 11 +- fs/io_uring.c | 10 +- fs/ksmbd/ndr.c | 2 +- fs/ksmbd/smb2ops.c | 3 - fs/ksmbd/smb2pdu.c | 29 +++- fs/netfs/read_helper.c | 6 +- fs/nfsd/nfs3proc.c | 11 +- fs/nfsd/nfsproc.c | 8 +- include/linux/compiler.h | 4 +- include/linux/instrumentation.h | 4 +- include/linux/ipv6.h | 1 - include/linux/tee_drv.h | 4 +- include/linux/virtio_net.h | 25 ++- include/net/inet_sock.h | 3 +- include/net/sock.h | 7 +- include/uapi/linux/byteorder/big_endian.h | 1 + include/uapi/linux/byteorder/little_endian.h | 1 + kernel/crash_core.c | 11 ++ kernel/ucount.c | 15 +- mm/damon/dbgfs.c | 2 + mm/kfence/core.c | 1 + mm/memory-failure.c | 14 +- mm/mempolicy.c | 3 +- net/ax25/af_ax25.c | 4 +- net/bridge/br_ioctl.c | 8 +- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 17 +- net/ipv4/udp.c | 6 +- net/ipv6/tcp_ipv6.c | 23 +-- net/ipv6/udp.c | 8 +- net/mac80211/cfg.c | 3 + net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_log.c | 3 +- net/netfilter/nfnetlink_queue.c | 3 +- net/phonet/pep.c | 2 + sound/core/jack.c | 4 + sound/core/rawmidi.c | 1 + sound/drivers/opl3/opl3_midi.c | 2 +- sound/pci/hda/patch_hdmi.c | 21 ++- sound/pci/hda/patch_realtek.c | 29 +++- sound/soc/codecs/rt5682.c | 4 + sound/soc/codecs/tas2770.c | 4 +- sound/soc/meson/aiu-encoder-i2s.c | 33 ---- sound/soc/meson/aiu-fifo-i2s.c | 19 +++ sound/soc/meson/aiu-fifo.c | 6 + sound/soc/sof/intel/pci-tgl.c | 4 + sound/soc/tegra/tegra_asoc_machine.c | 11 +- sound/soc/tegra/tegra_asoc_machine.h | 1 + tools/testing/selftests/kvm/include/kvm_util.h | 10 +- tools/testing/selftests/kvm/lib/kvm_util.c | 5 + 135 files changed, 1181 insertions(+), 723 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/128 arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
From: Nick Desaulniers <[email protected]>
commit 3e6f8d1fa18457d54b20917bd9174d27daf09ab9 upstream.
Similar to
commit 231ad7f409f1 ("Makefile: infer --target from ARCH for CC=clang") There really is no point in setting --target based on $CROSS_COMPILE_COMPAT for clang when the integrated assembler is being used, since
commit ef94340583ee ("arm64: vdso32: drop -no-integrated-as flag").
Allows COMPAT_VDSO to be selected without setting $CROSS_COMPILE_COMPAT when using clang and lld together.
Before:
$ ARCH=arm64 CROSS_COMPILE_COMPAT=arm-linux-gnueabi- make -j72 LLVM=1 defconfig $ grep CONFIG_COMPAT_VDSO .config CONFIG_COMPAT_VDSO=y $ ARCH=arm64 make -j72 LLVM=1 defconfig $ grep CONFIG_COMPAT_VDSO .config $
After:
$ ARCH=arm64 CROSS_COMPILE_COMPAT=arm-linux-gnueabi- make -j72 LLVM=1 defconfig $ grep CONFIG_COMPAT_VDSO .config CONFIG_COMPAT_VDSO=y $ ARCH=arm64 make -j72 LLVM=1 defconfig $ grep CONFIG_COMPAT_VDSO .config CONFIG_COMPAT_VDSO=y
--- arch/arm64/Kconfig | 3 ++- arch/arm64/kernel/vdso32/Makefile | 17 +++++------------ 2 files changed, 7 insertions(+), 13 deletions(-)
arch/arm64/Kconfig +2 -1
@@ -1264,7 +1264,8 @@ config KUSER_HELPERS config COMPAT_VDSO bool "Enable vDSO for 32-bit applications" - depends on !CPU_BIG_ENDIAN && "$(CROSS_COMPILE_COMPAT)" != "" + depends on !CPU_BIG_ENDIAN + depends on (CC_IS_CLANG && LD_IS_LLD) || "$(CROSS_COMPILE_COMPAT)" != "" select GENERIC_COMPAT_VDSO default y help
arch/arm64/kernel/vdso32/Makefile +5 -12
@@ -10,18 +10,15 @@ include $(srctree)/lib/vdso/Makefile # Same as cc-*option, but using CC_COMPAT instead of CC ifeq ($(CONFIG_CC_IS_CLANG), y) -CC_COMPAT_CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE_COMPAT:%-=%)) - CC_COMPAT ?= $(CC) -CC_COMPAT += $(CC_COMPAT_CLANG_FLAGS) - -ifneq ($(LLVM),) -LD_COMPAT ?= $(LD) +CC_COMPAT += --target=arm-linux-gnueabi else -LD_COMPAT ?= $(CROSS_COMPILE_COMPAT)ld +CC_COMPAT ?= $(CROSS_COMPILE_COMPAT)gcc endif + +ifeq ($(CONFIG_LD_IS_LLD), y) +LD_COMPAT ?= $(LD) else -CC_COMPAT ?= $(CROSS_COMPILE_COMPAT)gcc LD_COMPAT ?= $(CROSS_COMPILE_COMPAT)ld endif
@@ -47,10 +44,6 @@ VDSO_CPPFLAGS += $(LINUXINCLUDE) # Common C and assembly flags # From top-level Makefile VDSO_CAFLAGS := $(VDSO_CPPFLAGS) -ifneq ($(shell $(CC_COMPAT) --version 2>&1 | head -n 1 | grep clang),) -VDSO_CAFLAGS += --target=$(notdir $(CROSS_COMPILE_COMPAT:%-=%)) -endif - VDSO_CAFLAGS += $(call cc32-option,-fno-PIE) ifdef CONFIG_DEBUG_INFO VDSO_CAFLAGS += -g
Greg Kroah-Hartman
maintainerPATCH 2/128 net: usb: lan78xx: add Allied Telesis AT29M2-AF
In reply to Greg Kroah-HartmanFrom: Greg Jesionowski <[email protected]>
commit ef8a0f6eab1ca5d1a75c242c5c7b9d386735fa0a upstream.
This adds the vendor and product IDs for the AT29M2-AF which is a lan7801-based device.
--- drivers/net/usb/lan78xx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/lan78xx.c +6 -0
@@ -76,6 +76,8 @@#define LAN7801_USB_PRODUCT_ID (0x7801)#define LAN78XX_EEPROM_MAGIC (0x78A5)#define LAN78XX_OTP_MAGIC (0x78F3) +#define AT29M2AF_USB_VENDOR_ID (0x07C9) +#define AT29M2AF_USB_PRODUCT_ID (0x0012)#define MII_READ 1#define MII_WRITE 0
@@ -4734,6 +4736,10 @@ static const struct usb_device_id produc/* LAN7801 USB Gigabit Ethernet Device */ USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID), }, + { +/* ATM2-AF USB Gigabit Ethernet Device */ + USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID), + }, {}, };MODULE_DEVICE_TABLE (usb, products);
Greg Kroah-Hartman
maintainerPATCH 3/128 ext4: prevent partial update of the extent blocks
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit 0f2f87d51aebcf71a709b52f661d681594c7dffa upstream.
In the most error path of current extents updating operations are not roll back partial updates properly when some bad things happens(.e.g in ext4_ext_insert_extent()). So we may get an inconsistent extents tree if journal has been aborted due to IO error, which may probability lead to BUGON later when we accessing these extent entries in errors=continue mode. This patch drop extent buffer's verify flag before updatng the contents in ext4_ext_get_access(), and reset it after updating in __ext4_ext_dirty(). After this patch we could force to check the extent buffer if extents tree updating was break off, make sure the extents are consistent.
--- fs/ext4/extents.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
fs/ext4/extents.c +16 -3
@@ -136,15 +136,25 @@ int ext4_datasem_ensure_credits(handle_tstatic int ext4_ext_get_access (handle_t *handle,struct inode *inode,struct ext4_ext_path *path) { +int err =0 ; +if (path->p_bh) {/* path points to block */ BUFFER_TRACE (path->p_bh,"get_write_access" ); -return ext4_journal_get_write_access (handle, inode->i_sb, - path->p_bh,EXT4_JTR_NONE ); + err =ext4_journal_get_write_access (handle, inode->i_sb, + path->p_bh,EXT4_JTR_NONE ); +/* +* The extent buffer's verified bit will be set again in +* __ext4_ext_dirty(). We could leave an inconsistent +* buffer if the extents updating procudure break off du +* to some error happens, force to check it again. +*/ +if (!err) +clear_buffer_verified (path->p_bh); }/* path points to leaf/index in inode body */ /* we use in-core data, no need to protect them */ -return 0 ; +return err; }/*
@@ -165,6 +175,9 @@ static int __ext4_ext_dirty(const char */* path points to block */ err =__ext4_handle_dirty_metadata (where, line, handle, inode, path->p_bh); +/* Extents updating done, re-set verified flag */ +if (!err) +set_buffer_verified (path->p_bh); }else {/* path points to leaf/index in inode body */ err =ext4_mark_inode_dirty (handle, inode);
Greg Kroah-Hartman
maintainerPATCH 4/128 ext4: check for out-of-order index extents in ext4_valid_extent_entries()
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit 8dd27fecede55e8a4e67eef2878040ecad0f0d33 upstream.
After commit 5946d089379a ("ext4: check for overlapping extents in ext4_valid_extent_entries()"), we can check out the overlapping extent entry in leaf extent blocks. But the out-of-order extent entry in index extent blocks could also trigger bad things if the filesystem is inconsistent. So this patch add a check to figure out the out-of-order index extents and return error.
--- fs/ext4/extents.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/ext4/extents.c +12 -5
@@ -370,6 +370,9 @@ static int ext4_valid_extent_entries(str ext4_fsblk_t *pblk, int depth) {unsigned short entries; +ext4_lblk_t lblock =0 ; +ext4_lblk_t prev =0 ; +if (eh->eh_entries ==0 )return 1 ;
@@ -378,31 +381,35 @@ static int ext4_valid_extent_entries(strif (depth ==0 ) {/* leaf entries */ struct ext4_extent *ext =EXT_FIRST_EXTENT (eh); -ext4_lblk_t lblock =0 ; -ext4_lblk_t prev =0 ; -int len =0 ;while (entries) {if (!ext4_valid_extent (inode, ext))return 0 ;/* Check for overlapping extents */ lblock =le32_to_cpu (ext->ee_block); - len =ext4_ext_get_actual_len (ext);if ((lblock <= prev) && prev) { *pblk =ext4_ext_pblock (ext);return 0 ; } + prev = lblock +ext4_ext_get_actual_len (ext) -1 ; ext++; entries--; - prev = lblock + len -1 ; } }else {struct ext4_extent_idx *ext_idx =EXT_FIRST_INDEX (eh);while (entries) {if (!ext4_valid_extent_idx (inode, ext_idx))return 0 ; + +/* Check for overlapping index extents */ + lblock =le32_to_cpu (ext_idx->ei_block); +if ((lblock <= prev) && prev) { + *pblk =ext4_idx_pblock (ext_idx); +return 0 ; + } ext_idx++; entries--; + prev = lblock; } }return 1 ;
Greg Kroah-Hartman
maintainerPATCH 5/128 ext4: check for inconsistent extents between index and leaf block
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit 9c6e071913792d80894cd0be98cc3c4b770e26d3 upstream.
Now that we can check out overlapping extents in leaf block and out-of-order index extents in index block. But the .ee_block in the first extent of one leaf block should equal to the .ei_block in it's parent index extent entry. This patch add a check to verify such inconsistent between the index and leaf block.
--- fs/ext4/extents.c | 59 ++++++++++++++++++++++++++++++++---------------------- 1 file changed, 36 insertions(+), 23 deletions(-)
fs/ext4/extents.c +36 -23
@@ -367,7 +367,8 @@ static int ext4_valid_extent_idx(structstatic int ext4_valid_extent_entries (struct inode *inode,struct ext4_extent_header *eh, -ext4_fsblk_t *pblk,int depth) +ext4_lblk_t lblk,ext4_fsblk_t *pblk, +int depth) {unsigned short entries;ext4_lblk_t lblock =0 ;
@@ -381,6 +382,14 @@ static int ext4_valid_extent_entries(strif (depth ==0 ) {/* leaf entries */ struct ext4_extent *ext =EXT_FIRST_EXTENT (eh); + +/* +* The logical block in the first entry should equal to +* the number in the index block. +*/ +if (depth !=ext_depth (inode) && + lblk !=le32_to_cpu (ext->ee_block)) +return 0 ;while (entries) {if (!ext4_valid_extent (inode, ext))return 0 ;
@@ -397,6 +406,14 @@ static int ext4_valid_extent_entries(str } }else {struct ext4_extent_idx *ext_idx =EXT_FIRST_INDEX (eh); + +/* +* The logical block in the first entry should equal to +* the number in the parent index block. +*/ +if (depth !=ext_depth (inode) && + lblk !=le32_to_cpu (ext_idx->ei_block)) +return 0 ;while (entries) {if (!ext4_valid_extent_idx (inode, ext_idx))return 0 ;
@@ -417,7 +434,7 @@ static int ext4_valid_extent_entries(strstatic int __ext4_ext_check (const char *function,unsigned int line,struct inode *inode,struct ext4_extent_header *eh, -int depth,ext4_fsblk_t pblk) +int depth,ext4_fsblk_t pblk,ext4_lblk_t lblk) {const char *error_msg;int max =0 , err = -EFSCORRUPTED ;
@@ -443,7 +460,7 @@ static int __ext4_ext_check(const char * error_msg ="invalid eh_entries" ; goto corrupted; } -if (!ext4_valid_extent_entries (inode, eh, &pblk, depth)) { +if (!ext4_valid_extent_entries (inode, eh, lblk, &pblk, depth)) { error_msg ="invalid extent entries" ; goto corrupted; }
@@ -473,7 +490,7 @@ corrupted: }#define ext4_ext_check (inode, eh, depth, pblk) \ - __ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk)) + __ext4_ext_check(__func__, __LINE__, (inode), (eh), (depth), (pblk), 0)int ext4_ext_check_inode (struct inode *inode) {
@@ -506,16 +523,18 @@ static void ext4_cache_extents(struct instatic struct buffer_head *__read_extent_tree_block (const char *function,unsigned int line, -struct inode *inode,ext4_fsblk_t pblk,int depth, -int flags) +struct inode *inode,struct ext4_extent_idx *idx, +int depth,int flags) {struct buffer_head *bh;int err;gfp_t gfp_flags = __GFP_MOVABLE |GFP_NOFS ; +ext4_fsblk_t pblk;if (flags &EXT4_EX_NOFAIL ) gfp_flags |= __GFP_NOFAIL; + pblk =ext4_idx_pblock (idx); bh =sb_getblk_gfp (inode->i_sb, pblk, gfp_flags);if (unlikely (!bh))return ERR_PTR (-ENOMEM );
@@ -528,8 +547,8 @@ __read_extent_tree_block(const char *fun }if (buffer_verified (bh) && !(flags &EXT4_EX_FORCE_CACHE ))return bh; - err =__ext4_ext_check (function, line, inode, -ext_block_hdr (bh), depth, pblk); + err =__ext4_ext_check (function, line, inode,ext_block_hdr (bh), + depth, pblk,le32_to_cpu (idx->ei_block));if (err) goto errout;set_buffer_verified (bh);
@@ -547,8 +566,8 @@ errout: } -#define read_extent_tree_block (inode, pblk, depth, flags) \ - __read_extent_tree_block(__func__, __LINE__, (inode), (pblk), \ +#define read_extent_tree_block (inode, idx, depth, flags) \ + __read_extent_tree_block(__func__, __LINE__, (inode), (idx), \ (depth), (flags))/*
@@ -598,8 +617,7 @@ int ext4_ext_precache(struct inode *inod i--;continue ; } - bh =read_extent_tree_block (inode, -ext4_idx_pblock (path[i].p_idx++), + bh =read_extent_tree_block (inode, path[i].p_idx++, depth - i -1 ,EXT4_EX_FORCE_CACHE );if (IS_ERR (bh)) {
@@ -904,8 +922,7 @@ ext4_find_extent(struct inode *inode, ex path[ppos].p_depth = i; path[ppos].p_ext =NULL ; - bh =read_extent_tree_block (inode, path[ppos].p_block, --i, - flags); + bh =read_extent_tree_block (inode, path[ppos].p_idx, --i, flags);if (IS_ERR (bh)) { ret =PTR_ERR (bh); goto err;
@@ -1514,7 +1531,6 @@ static int ext4_ext_search_right(structstruct ext4_extent_header *eh;struct ext4_extent_idx *ix;struct ext4_extent *ex; -ext4_fsblk_t block;int depth;/* Note, NOT eh_depth; depth from top of tree */ int ee_len;
@@ -1581,20 +1597,17 @@ got_index:* follow it and find the closest allocated * block to the right */ ix++; - block =ext4_idx_pblock (ix);while (++depth < path->p_depth) {/* subtract from p_depth to get proper eh_depth */ - bh =read_extent_tree_block (inode, block, - path->p_depth - depth,0 ); + bh =read_extent_tree_block (inode, ix, path->p_depth - depth,0 );if (IS_ERR (bh))return PTR_ERR (bh); eh =ext_block_hdr (bh); ix =EXT_FIRST_INDEX (eh); - block =ext4_idx_pblock (ix);put_bh (bh); } - bh =read_extent_tree_block (inode, block, path->p_depth - depth,0 ); + bh =read_extent_tree_block (inode, ix, path->p_depth - depth,0 );if (IS_ERR (bh))return PTR_ERR (bh); eh =ext_block_hdr (bh);
@@ -2973,9 +2986,9 @@ again:ext_debug (inode,"move to level %d (block %llu)\n" , i +1 ,ext4_idx_pblock (path[i].p_idx));memset (path + i +1 ,0 ,sizeof (*path)); - bh =read_extent_tree_block (inode, -ext4_idx_pblock (path[i].p_idx), depth - i -1 , -EXT4_EX_NOCACHE ); + bh =read_extent_tree_block (inode, path[i].p_idx, + depth - i -1 , +EXT4_EX_NOCACHE );if (IS_ERR (bh)) {/* should we reset i_size? */ err =PTR_ERR (bh);
Greg Kroah-Hartman
maintainerPATCH 6/128 selftests: KVM: Fix non-x86 compiling
In reply to Greg Kroah-HartmanFrom: Andrew Jones <[email protected]>
commit 577e022b7b41854911dcfb03678d8d2b930e8a3f upstream.
Attempting to compile on a non-x86 architecture fails with
include/kvm_util.h: In function ‘vm_compute_max_gfn’:include/kvm_util.h:79:21: error: dereferencing pointer to incomplete type ‘struct kvm_vm’
return ((1ULL << vm->pa_bits) >> vm->page_shift) - 1;
^~This is because the declaration of struct kvm_vm is in lib/kvm_util_internal.h as an effort to make it private to the test lib code. We can still provide arch specific functions, though, by making the generic function symbols weak. Do that to fix the compile error.
Message-Id: <[email protected]>
--- tools/testing/selftests/kvm/include/kvm_util.h | 10 +--------- tools/testing/selftests/kvm/lib/kvm_util.c | 5 +++++ 2 files changed, 6 insertions(+), 9 deletions(-)
tools/testing/selftests/kvm/include/kvm_util.h +1 -9
@@ -69,15 +69,6 @@ enum vm_guest_mode {#endif -#if defined(__x86_64__) -unsigned long vm_compute_max_gfn (struct kvm_vm *vm); -#else -static inline unsigned long vm_compute_max_gfn (struct kvm_vm *vm) -{ -return ((1ULL << vm->pa_bits) >> vm->page_shift) -1 ; -} -#endif -#define MIN_PAGE_SIZE (1U << MIN_PAGE_SHIFT)#define PTES_PER_MIN_PAGE ptes_per_page(MIN_PAGE_SIZE)
@@ -318,6 +309,7 @@ bool vm_is_unrestricted_guest(struct kvmunsigned int vm_get_page_size (struct kvm_vm *vm);unsigned int vm_get_page_shift (struct kvm_vm *vm); +unsigned long vm_compute_max_gfn (struct kvm_vm *vm);uint64_t vm_get_max_gfn (struct kvm_vm *vm);int vm_get_fd (struct kvm_vm *vm);
tools/testing/selftests/kvm/lib/kvm_util.c +5 -0
@@ -2282,6 +2282,11 @@ unsigned int vm_get_page_shift(struct kvreturn vm->page_shift; } +unsigned long __attribute__((weak))vm_compute_max_gfn (struct kvm_vm *vm) +{ +return ((1ULL << vm->pa_bits) >> vm->page_shift) -1 ; +} +uint64_t vm_get_max_gfn (struct kvm_vm *vm) {return vm->max_gfn;
Greg Kroah-Hartman
maintainerPATCH 7/128 HID: holtek: fix mouse probing
In reply to Greg Kroah-HartmanFrom: Benjamin Tissoires <[email protected]>
commit 93a2207c254ca102ebbdae47b00f19bbfbfa7ecd upstream.
An overlook from the previous commit: we don't even parse or start the device, meaning that the device is not presented to user space.
--- drivers/hid/hid-holtek-mouse.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/hid/hid-holtek-mouse.c +15 -0
@@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(sstatic int holtek_mouse_probe (struct hid_device *hdev,const struct hid_device_id *id) { +int ret; +if (!hid_is_usb (hdev))return -EINVAL ; + + ret =hid_parse (hdev); +if (ret) { +hid_err (hdev,"hid parse failed: %d\n" , ret); +return ret; + } + + ret =hid_hw_start (hdev,HID_CONNECT_DEFAULT ); +if (ret) { +hid_err (hdev,"hw start failed: %d\n" , ret); +return ret; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 8/128 HID: potential dereference of null pointer
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
commit 13251ce1dd9bb525da2becb9b26fdfb94ca58659 upstream.
The return value of devm_kzalloc() needs to be checked. To avoid hdev->dev->driver_data to be null in case of the failure of alloc.
--- drivers/hid/hid-vivaldi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-vivaldi.c +3 -0
@@ -57,6 +57,9 @@ static int vivaldi_probe(struct hid_deviint ret; drvdata =devm_kzalloc (&hdev->dev,sizeof (*drvdata),GFP_KERNEL ); +if (!drvdata) +return -ENOMEM ; +hid_set_drvdata (hdev, drvdata); ret =hid_parse (hdev);
Greg Kroah-Hartman
maintainerPATCH 9/128 NFSD: Fix READDIR buffer overflow
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 53b1119a6e5028b125f431a0116ba73510d82a72 upstream.
If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer.
This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly.
With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space().
Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. Also, we have no unit tests that exercise the behavior of READDIR at the lower bound of @count values. Thus this case was missed during testing.
--- fs/nfsd/nfs3proc.c | 11 ++++------- fs/nfsd/nfsproc.c | 8 ++++---- 2 files changed, 8 insertions(+), 11 deletions(-)
fs/nfsd/nfs3proc.c +4 -7
@@ -439,22 +439,19 @@ nfsd3_proc_link(struct svc_rqst *rqstp)static void nfsd3_init_dirlist_pages (struct svc_rqst *rqstp,struct nfsd3_readdirres *resp, -int count) +u32 count) {struct xdr_buf *buf = &resp->dirlist;struct xdr_stream *xdr = &resp->xdr; - count =min_t (u32, count,svc_max_payload (rqstp)); + count =clamp (count, (u32)(XDR_UNIT *2 ),svc_max_payload (rqstp));memset (buf,0 ,sizeof (*buf));/* Reserve room for the NULL ptr & eof flag (-2 words) */ buf->buflen = count -XDR_UNIT *2 ; buf->pages = rqstp->rq_next_page; -while (count >0 ) { - rqstp->rq_next_page++; - count -=PAGE_SIZE ; - } + rqstp->rq_next_page += (buf->buflen +PAGE_SIZE -1 ) >>PAGE_SHIFT ;/* This is xdr_init_encode(), but it assumes that * the head kvec has already been consumed. */
@@ -463,7 +460,7 @@ static void nfsd3_init_dirlist_pages(str xdr->page_ptr = buf->pages; xdr->iov =NULL ; xdr->p =page_address (*buf->pages); - xdr->end = xdr->p + (PAGE_SIZE >>2 ); + xdr->end = (void *)xdr->p +min_t (u32, buf->buflen,PAGE_SIZE ); xdr->rqst =NULL ; }
fs/nfsd/nfsproc.c +4 -4
@@ -557,17 +557,17 @@ nfsd_proc_rmdir(struct svc_rqst *rqstp)static void nfsd_init_dirlist_pages (struct svc_rqst *rqstp,struct nfsd_readdirres *resp, -int count) +u32 count) {struct xdr_buf *buf = &resp->dirlist;struct xdr_stream *xdr = &resp->xdr; - count =min_t (u32, count,PAGE_SIZE ); + count =clamp (count, (u32)(XDR_UNIT *2 ),svc_max_payload (rqstp));memset (buf,0 ,sizeof (*buf));/* Reserve room for the NULL ptr & eof flag (-2 words) */ - buf->buflen = count -sizeof (__be32) *2 ; + buf->buflen = count -XDR_UNIT *2 ; buf->pages = rqstp->rq_next_page; rqstp->rq_next_page++;
@@ -578,7 +578,7 @@ static void nfsd_init_dirlist_pages(stru xdr->page_ptr = buf->pages; xdr->iov =NULL ; xdr->p =page_address (*buf->pages); - xdr->end = xdr->p + (PAGE_SIZE >>2 ); + xdr->end = (void *)xdr->p +min_t (u32, buf->buflen,PAGE_SIZE ); xdr->rqst =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 10/128 PM: sleep: Fix error handling in dpm_prepare()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 544e737dea5ad1a457f25dbddf68761ff25e028b upstream.
Commit 2aa36604e824 ("PM: sleep: Avoid calling put_device() under dpm_list_mtx") forgot to update the while () loop termination condition to also break the loop if error is nonzero, which causes the loop to become infinite if device_prepare() returns an error for one device.
Add the missing !error check.
--- drivers/base/power/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/power/main.c +1 -1
@@ -1906,7 +1906,7 @@ int dpm_prepare(pm_message_t state)device_block_probing ();mutex_lock (&dpm_list_mtx); -while (!list_empty (&dpm_list)) { +while (!list_empty (&dpm_list) && !error) {struct device *dev =to_device (dpm_list.next);get_device (dev);
Greg Kroah-Hartman
maintainerPATCH 11/128 arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 08d2061ff9c5319a07bf9ca6bbf11fdec68f704a ]
Orange Pi Zero Plus uses a Realtek RTL8211E RGMII Gigabit PHY, but its currently set to plain RGMII mode meaning that it doesn't introduce delays.
With this setup, TX packets are completely lost and changing the mode to RGMII-ID so the PHY will add delays internally fixes the issue.
--- arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts +1 -1
@@ -69,7 +69,7 @@ pinctrl-0 = <&emac_rgmii_pins>; phy-supply = <®_gmac_3v3>; phy-handle = <&ext_rgmii_phy>; - phy-mode = "rgmii"; + phy-mode = "rgmii-id"; status = "okay"; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 12/128 bus: sunxi-rsb: Fix shutdown
In reply to Greg Kroah-HartmanFrom: Jernej Skrabec <[email protected]>
[ Upstream commit 017a716e7b0e9d4ac06a4d7779bd04fca009bbc9 ]
Function sunxi_rsb_hw_exit() is sometimes called with pm runtime disabled, so in such cases pm_runtime_resume() will fail with -EACCES.
Instead of doing whole dance of enabling pm runtime and thus clock just to disable it again immediately, just check if disabling clock is needed. That way calling pm_runtime_resume() is not needed at all.
--- drivers/bus/sunxi-rsb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/bus/sunxi-rsb.c +4 -4
@@ -687,11 +687,11 @@ err_clk_disable:static void sunxi_rsb_hw_exit (struct sunxi_rsb *rsb) { -/* Keep the clock and PM reference counts consistent. */ -if (pm_runtime_status_suspended (rsb->dev)) -pm_runtime_resume (rsb->dev);reset_control_assert (rsb->rstc); -clk_disable_unprepare (rsb->clk); + +/* Keep the clock and PM reference counts consistent. */ +if (!pm_runtime_status_suspended (rsb->dev)) +clk_disable_unprepare (rsb->clk); }static int __maybe_unused sunxi_rsb_runtime_suspend (struct device *dev)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 13/128 spi: change clk_disable_unprepare to clk_unprepare
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit db6689b643d8653092f5853751ea2cdbc299f8d3 ]
The corresponding API for clk_prepare is clk_unprepare, other than clk_disable_unprepare.
Fix this by changing clk_disable_unprepare to clk_unprepare.
--- drivers/spi/spi-armada-3700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-armada-3700.c +1 -1
@@ -901,7 +901,7 @@ static int a3700_spi_probe(struct platform_device *pdev)return 0 ; error_clk: -clk_disable_unprepare (spi->clk); +clk_unprepare (spi->clk); error:spi_master_put (master); out:
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 14/128 ucounts: Fix rlimit max values check
In reply to Greg Kroah-HartmanFrom: Alexey Gladkov <[email protected]>
[ Upstream commit 59ec71575ab440cd5ca0aa53b2a2985b3639fad4 ]
The semantics of the rlimit max values differs from ucounts itself. When creating a new userns, we store the current rlimit of the process in ucount_max. Thus, the value of the limit in the parent userns is saved in the created one.
The problem is that now we are taking the maximum value for counter from the same userns. So for init_user_ns it will always be RLIM_INFINITY.
To fix the problem we need to check the counter value with the max value stored in userns.
Reproducer:
su - test -c "ulimit -u 3; sleep 5 & sleep 6 & unshare -U --map-root-user sh -c 'sleep 7 & sleep 8 & date; wait'"
Before:
[1] 175
[2] 176
Fri Nov 26 13:48:20 UTC 2021
[1]- Done sleep 5 [2]+ Done sleep 6
After:
[1] 167
[2] 168
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: retry: Resource temporarily unavailable
sh: fork: Interrupted system call
[1]- Done sleep 5 [2]+ Done sleep 6
--- kernel/ucount.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
kernel/ucount.c +9 -6
@@ -258,15 +258,16 @@ void dec_ucount(struct ucounts *ucounts, enum ucount_type type)long inc_rlimit_ucounts (struct ucounts *ucounts,enum ucount_type type,long v) {struct ucounts *iter; +long max =LONG_MAX ;long ret =0 ;for (iter = ucounts; iter; iter = iter->ns->ucounts) { -long max =READ_ONCE (iter->ns->ucount_max[type]);long new =atomic_long_add_return (v, &iter->ucount[type]);if (new <0 || new > max) ret =LONG_MAX ;else if (iter == ucounts) ret = new; + max =READ_ONCE (iter->ns->ucount_max[type]); }return ret; }
@@ -306,15 +307,16 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum ucount_type type) {/* Caller must hold a reference to ucounts */ struct ucounts *iter; +long max =LONG_MAX ;long dec, ret =0 ;for (iter = ucounts; iter; iter = iter->ns->ucounts) { -long max =READ_ONCE (iter->ns->ucount_max[type]);long new =atomic_long_add_return (1 , &iter->ucount[type]);if (new <0 || new > max) goto unwind;if (iter == ucounts) ret = new; + max =READ_ONCE (iter->ns->ucount_max[type]);/* * Grab an extra ucount reference for the caller when * the rlimit count was previously 0.
@@ -333,15 +335,16 @@ unwind:return 0 ; } -bool is_ucounts_overlimit (struct ucounts *ucounts,enum ucount_type type,unsigned long max) +bool is_ucounts_overlimit (struct ucounts *ucounts,enum ucount_type type,unsigned long rlimit) {struct ucounts *iter; -if (get_ucounts_value (ucounts, type) > max) -return true; +long max = rlimit; +if (rlimit >LONG_MAX ) + max =LONG_MAX ;for (iter = ucounts; iter; iter = iter->ns->ucounts) { - max =READ_ONCE (iter->ns->ucount_max[type]);if (get_ucounts_value (iter, type) > max)return true; + max =READ_ONCE (iter->ns->ucount_max[type]); }return false; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 15/128 drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 3b8e19a0aa3933a785be9f1541afd8d398c4ec69 ]
In commit 41ca9caaae0b
("drm/mediatek: hdmi: Add check for CEA modes only") a check for CEA modes was added to function mtk_hdmi_bridge_mode_valid() in order to address possible issues on MT8167;
moreover, with commit c91026a938c2
("drm/mediatek: hdmi: Add optional limit on maximal HDMI mode clock") another similar check was introduced.
Unfortunately though, at the time of writing, MT8173 does not provide any mtk_hdmi_conf structure and this is crashing the kernel with NULL pointer upon entering mtk_hdmi_bridge_mode_valid(), which happens as soon as a HDMI cable gets plugged in.
To fix this regression, add a NULL pointer check for hdmi->conf in the said function, restoring HDMI functionality and avoiding NULL pointer kernel panics.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +7 -5
@@ -1224,12 +1224,14 @@ static int mtk_hdmi_bridge_mode_valid(struct drm_bridge *bridge,return MODE_BAD ; } -if (hdmi->conf->cea_modes_only && !drm_match_cea_mode (mode)) -return MODE_BAD ; +if (hdmi->conf) { +if (hdmi->conf->cea_modes_only && !drm_match_cea_mode (mode)) +return MODE_BAD ; -if (hdmi->conf->max_mode_clock && - mode->clock > hdmi->conf->max_mode_clock) -return MODE_CLOCK_HIGH ; +if (hdmi->conf->max_mode_clock && + mode->clock > hdmi->conf->max_mode_clock) +return MODE_CLOCK_HIGH ; + }if (mode->clock <27000 )return MODE_CLOCK_LOW ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 16/128 ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent()
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 1bcd326631dc4faa3322d60b4fc45e8b3747993e ]
The FIFO registers which take an DMA-able address are only 32-bit wide on AIU. Add dma_coerce_mask_and_coherent() to make the DMA core aware of this limitation.
--- sound/soc/meson/aiu-fifo.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/soc/meson/aiu-fifo.c +6 -0
@@ -5,6 +5,7 @@#include <linux/bitfield.h> #include <linux/clk.h> +#include <linux/dma-mapping.h> #include <sound/pcm_params.h> #include <sound/soc.h> #include <sound/soc-dai.h>
@@ -179,6 +180,11 @@ int aiu_fifo_pcm_new(struct snd_soc_pcm_runtime *rtd,struct snd_card *card = rtd->card->snd_card;struct aiu_fifo *fifo = dai->playback_dma_data;size_t size = fifo->pcm->buffer_bytes_max; +int ret; + + ret =dma_coerce_mask_and_coherent (card->dev,DMA_BIT_MASK (32 )); +if (ret) +return ret;snd_pcm_set_managed_buffer_all (rtd->pcm,SNDRV_DMA_TYPE_DEV , card->dev, size, size);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 17/128 RDMA/hns: Fix RNR retransmission issue for HIP08
In reply to Greg Kroah-HartmanFrom: Yangyang Li <[email protected]>
[ Upstream commit 4ad8181426df92976feee5fbc55236293d069b37 ]
Due to the discrete nature of the HIP08 timer unit, a requester might finish the timeout period sooner, in elapsed real time, than its responder does, even when both sides share the identical RNR timeout length included in the RNR Nak packet and the responder indeed starts the timing prior to the requester. Furthermore, if a 'providential' resend packet arrived before the responder's timeout period expired, the responder is certainly entitled to drop the packet silently in the light of IB protocol.
To address this problem, our team made good use of certain hardware facts:
1) The timing resolution regards the transmission arrangements is 1 microsecond, e.g. if cq_period field is set to 3, it would be interpreted as 3 microsecond by hardware
2) A QPC field shall inform the hardware how many timing unit (ticks) constitutes a full microsecond, which, by default, is 1000
3) It takes 14ns for the processor to handle a packet in the buffer, so the RNR timeout length of 10ns would ensure our processing mechanism is disabled during the entire timeout period and the packet won't be dropped silently
To achieve (3), we permanently set the QPC field mentioned in (2) to zero which nominally indicates every time tick is equivalent to a microsecond in wall-clock time; now, a RNR timeout period at face value of 10 would only last 10 ticks, which is 10ns in wall-clock time.
It's worth noting that we adapt the driver by magnifying certain configuration parameters(cq_period, eq_period and ack_timeout)by 1000 given the user assumes the configuring timing unit to be microseconds.
Also, this particular improvisation is only deployed on HIP08 since other hardware has already solved this issue.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 +++++++++++++++++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 8 +++ 2 files changed, 65 insertions(+), 7 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +57 -7
@@ -1604,11 +1604,17 @@ static int hns_roce_config_global_param(struct hns_roce_dev *hr_dev) {struct hns_roce_cmq_desc desc;struct hns_roce_cmq_req *req = (struct hns_roce_cmq_req *)desc.data; +u32 clock_cycles_of_1us;hns_roce_cmq_setup_basic_desc (&desc,HNS_ROCE_OPC_CFG_GLOBAL_PARAM , false); -hr_reg_write (req,CFG_GLOBAL_PARAM_1US_CYCLES ,0x3e8 ); +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) + clock_cycles_of_1us =HNS_ROCE_1NS_CFG ; +else + clock_cycles_of_1us =HNS_ROCE_1US_CFG ; + +hr_reg_write (req,CFG_GLOBAL_PARAM_1US_CYCLES , clock_cycles_of_1us);hr_reg_write (req,CFG_GLOBAL_PARAM_UDP_PORT ,ROCE_V2_UDP_DPORT );return hns_roce_cmq_send (hr_dev, &desc,1 );
@@ -4812,6 +4818,30 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp,return ret; } +static bool check_qp_timeout_cfg_range (struct hns_roce_dev *hr_dev,u8 *timeout) +{ +#define QP_ACK_TIMEOUT_MAX_HIP08 20 +#define QP_ACK_TIMEOUT_OFFSET 10 +#define QP_ACK_TIMEOUT_MAX 31 + +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) { +if (*timeout >QP_ACK_TIMEOUT_MAX_HIP08 ) { +ibdev_warn (&hr_dev->ib_dev, +"Local ACK timeout shall be 0 to 20.\n" ); +return false; + } + *timeout +=QP_ACK_TIMEOUT_OFFSET ; + }else if (hr_dev->pci_dev->revision >PCI_REVISION_ID_HIP08 ) { +if (*timeout >QP_ACK_TIMEOUT_MAX ) { +ibdev_warn (&hr_dev->ib_dev, +"Local ACK timeout shall be 0 to 31.\n" ); +return false; + } + } + +return true; +} + static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp, const struct ib_qp_attr *attr, int attr_mask,
@@ -4821,6 +4851,7 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,struct hns_roce_dev *hr_dev =to_hr_dev (ibqp->device);struct hns_roce_qp *hr_qp =to_hr_qp (ibqp);int ret =0 ; +u8 timeout;if (attr_mask &IB_QP_AV ) { ret = hns_roce_v2_set_path(ibqp, attr, attr_mask, context,
@@ -4830,12 +4861,10 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp, }if (attr_mask &IB_QP_TIMEOUT ) { -if (attr->timeout <31 ) { -hr_reg_write (context,QPC_AT , attr->timeout); + timeout = attr->timeout; +if (check_qp_timeout_cfg_range (hr_dev, &timeout)) { +hr_reg_write (context,QPC_AT , timeout);hr_reg_clear (qpc_mask,QPC_AT ); - }else { -ibdev_warn (&hr_dev->ib_dev, -"Local ACK timeout shall be 0 to 30.\n" ); } }
@@ -4892,7 +4921,9 @@ static int hns_roce_v2_set_opt_fields(struct ib_qp *ibqp,set_access_flags (hr_qp, context, qpc_mask, attr, attr_mask);if (attr_mask &IB_QP_MIN_RNR_TIMER ) { -hr_reg_write (context,QPC_MIN_RNR_TIME , attr->min_rnr_timer); +hr_reg_write (context,QPC_MIN_RNR_TIME , + hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ? +HNS_ROCE_RNR_TIMER_10NS : attr->min_rnr_timer);hr_reg_clear (qpc_mask,QPC_MIN_RNR_TIME ); }
@@ -5509,6 +5540,16 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period)hr_reg_write (cq_context,CQC_CQ_MAX_CNT , cq_count);hr_reg_clear (cqc_mask,CQC_CQ_MAX_CNT ); + +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) { +if (cq_period *HNS_ROCE_CLOCK_ADJUST >USHRT_MAX ) { +dev_info (hr_dev->dev, +"cq_period(%u) reached the upper limit, adjusted to 65.\n" , + cq_period); + cq_period =HNS_ROCE_MAX_CQ_PERIOD ; + } + cq_period *=HNS_ROCE_CLOCK_ADJUST ; + }hr_reg_write (cq_context,CQC_CQ_PERIOD , cq_period);hr_reg_clear (cqc_mask,CQC_CQ_PERIOD );
@@ -5904,6 +5945,15 @@ static int config_eqc(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq,hr_reg_write (eqc,EQC_EQ_PROD_INDX ,HNS_ROCE_EQ_INIT_PROD_IDX );hr_reg_write (eqc,EQC_EQ_MAX_CNT , eq->eq_max_cnt); +if (hr_dev->pci_dev->revision ==PCI_REVISION_ID_HIP08 ) { +if (eq->eq_period *HNS_ROCE_CLOCK_ADJUST >USHRT_MAX ) { +dev_info (hr_dev->dev,"eq_period(%u) reached the upper limit, adjusted to 65.\n" , + eq->eq_period); + eq->eq_period =HNS_ROCE_MAX_EQ_PERIOD ; + } + eq->eq_period *=HNS_ROCE_CLOCK_ADJUST ; + } +hr_reg_write (eqc,EQC_EQ_PERIOD , eq->eq_period);hr_reg_write (eqc,EQC_EQE_REPORT_TIMER ,HNS_ROCE_EQ_INIT_REPORT_TIMER );hr_reg_write (eqc,EQC_EQE_BA_L , bt_ba >>3 );
drivers/infiniband/hw/hns/hns_roce_hw_v2.h +8 -0
@@ -1444,6 +1444,14 @@ struct hns_roce_dip {struct list_head node;/* all dips are on a list */ }; +/* only for RNR timeout issue of HIP08 */ +#define HNS_ROCE_CLOCK_ADJUST 1000 +#define HNS_ROCE_MAX_CQ_PERIOD 65 +#define HNS_ROCE_MAX_EQ_PERIOD 65 +#define HNS_ROCE_RNR_TIMER_10NS 1 +#define HNS_ROCE_1US_CFG 999 +#define HNS_ROCE_1NS_CFG 0 +#define HNS_ROCE_AEQ_DEFAULT_BURST_NUM 0x0#define HNS_ROCE_AEQ_DEFAULT_INTERVAL 0x0#define HNS_ROCE_CEQ_DEFAULT_BURST_NUM 0x0
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 18/128 IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit bee90911e0138c76ee67458ac0d58b38a3190f65 ]
The wrong goto label was used for the error case and missed cleanup of the pkt allocation.
Addresses-Coverity-ID: 1493352 ("Resource leak")
--- drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/qib/qib_user_sdma.c +1 -1
@@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, &addrlimit) || addrlimit > type_max(typeof(pkt->addrlimit))) { ret = -EINVAL ; - goto free_pbc; + goto free_pkt; } pkt->addrlimit = addrlimit;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 19/128 RDMA/hns: Replace kfree() with kvfree()
In reply to Greg Kroah-HartmanFrom: Jiacheng Shi <[email protected]>
[ Upstream commit 12d3bbdd6bd2780b71cc466f3fbc6eb7d43bbc2a ]
Variables allocated by kvmalloc_array() should not be freed by kfree. Because they may be allocated by vmalloc. So we replace kfree() with kvfree() here.
--- drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_srq.c +1 -1
@@ -259,7 +259,7 @@ static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)static void free_srq_wrid (struct hns_roce_srq *srq) { -kfree (srq->wrid); +kvfree (srq->wrid); srq->wrid =NULL ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 20/128 netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0f7d9b31ce7abdbb29bf018131ac920c9f698518 ]
We need to use list_for_each_entry_safe() iterator because we can not access @catchall after kfree_rcu() call.
syzbot reported:
BUG: KASAN: use-after-free in nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
BUG: KASAN: use-after-free in nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
BUG: KASAN: use-after-free in nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
Read of size 8 at addr ffff8880716e5b80 by task syz-executor.3/8871
CPU: 1 PID: 8871 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x2ed mm/kasan/report.c:247
__kasan_report mm/kasan/report.c:433 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
__nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626
nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:318 [inline]
blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:306
netlink_release+0xcb6/0x1dd0 net/netlink/af_netlink.c:788
__sock_release+0xcd/0x280 net/socket.c:649
sock_close+0x18/0x20 net/socket.c:1314
__fput+0x286/0x9f0 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f75fbf28adb
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd8da7ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f75fbf28adb
RDX: 00007f75fc08e828 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f75fc08a960 R08: 0000000000000000 R09: 00007f75fc08e830
R10: 00007ffd8da7ed10 R11: 0000000000000293 R12: 00000000002067c3
R13: 00007ffd8da7ed10 R14: 00007f75fc088f60 R15: 0000000000000032
</TASK>
Allocated by task 8886:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
____kasan_kmalloc mm/kasan/common.c:472 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3575
kmalloc include/linux/slab.h:590 [inline]
nft_setelem_catchall_insert net/netfilter/nf_tables_api.c:5544 [inline]
nft_setelem_insert net/netfilter/nf_tables_api.c:5562 [inline]
nft_add_set_elem+0x232e/0x2f40 net/netfilter/nf_tables_api.c:5936
nf_tables_newsetelem+0x6ff/0xbb0 net/netfilter/nf_tables_api.c:6032
nfnetlink_rcv_batch+0x1710/0x25f0 net/netfilter/nfnetlink.c:513
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:652
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:724
____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
___sys_sendmsg+0xf3/0x170 net/socket.c:2463
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 15335:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:46
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0xd1/0x110 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:235 [inline]
__cache_free mm/slab.c:3445 [inline]
kmem_cache_free_bulk+0x67/0x1e0 mm/slab.c:3766
kfree_bulk include/linux/slab.h:446 [inline]
kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3273
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Last potentially related work creation:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
__kasan_record_aux_stack+0xb5/0xe0 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3550
nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4489 [inline]
nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
nft_set_destroy+0x34a/0x4f0 net/netfilter/nf_tables_api.c:4493
__nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626
nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:318 [inline]
blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:306
netlink_release+0xcb6/0x1dd0 net/netlink/af_netlink.c:788
__sock_release+0xcd/0x280 net/socket.c:649
sock_close+0x18/0x20 net/socket.c:1314
__fput+0x286/0x9f0 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff8880716e5b80
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
64-byte region [ffff8880716e5b80, ffff8880716e5bc0)
The buggy address belongs to the page:
page:ffffea0001c5b940 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880716e5c00 pfn:0x716e5
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000911848 ffffea00007c4d48 ffff888010c40200
raw: ffff8880716e5c00 ffff8880716e5000 000000010000001e 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x242040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3638, ts 211086074437, free_ts 211031029429
prep_new_page mm/page_alloc.c:2418 [inline]
get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
__alloc_pages_node include/linux/gfp.h:570 [inline]
kmem_getpages mm/slab.c:1377 [inline]
cache_grow_begin+0x75/0x470 mm/slab.c:2593
cache_alloc_refill+0x27f/0x380 mm/slab.c:2965
____cache_alloc mm/slab.c:3048 [inline]
____cache_alloc mm/slab.c:3031 [inline]
__do_cache_alloc mm/slab.c:3275 [inline]
slab_alloc mm/slab.c:3316 [inline]
__do_kmalloc mm/slab.c:3700 [inline]
__kmalloc+0x3b3/0x4d0 mm/slab.c:3711
kmalloc include/linux/slab.h:595 [inline]
kzalloc include/linux/slab.h:724 [inline]
tomoyo_get_name+0x234/0x480 security/tomoyo/memory.c:173
tomoyo_parse_name_union+0xbc/0x160 security/tomoyo/util.c:260
tomoyo_update_path_number_acl security/tomoyo/file.c:687 [inline]
tomoyo_write_file+0x629/0x7f0 security/tomoyo/file.c:1034
tomoyo_write_domain2+0x116/0x1d0 security/tomoyo/common.c:1152
tomoyo_add_entry security/tomoyo/common.c:2042 [inline]
tomoyo_supervisor+0xbc7/0xf00 security/tomoyo/common.c:2103
tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline]
tomoyo_path_number_perm+0x419/0x590 security/tomoyo/file.c:734
security_file_ioctl+0x50/0xb0 security/security.c:1541
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0xb3/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1338 [inline]
free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389
free_unref_page_prepare mm/page_alloc.c:3309 [inline]
free_unref_page+0x19/0x690 mm/page_alloc.c:3388
slab_destroy mm/slab.c:1627 [inline]
slabs_destroy+0x89/0xc0 mm/slab.c:1647
cache_flusharray mm/slab.c:3418 [inline]
___cache_free+0x4cc/0x610 mm/slab.c:3480
qlink_free mm/kasan/quarantine.c:146 [inline]
qlist_free_all+0x4e/0x110 mm/kasan/quarantine.c:165
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x97/0xb0 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slab.c:3261 [inline]
kmem_cache_alloc_node+0x2ea/0x590 mm/slab.c:3599
__alloc_skb+0x215/0x340 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1126 [inline]
nlmsg_new include/net/netlink.h:953 [inline]
rtmsg_ifinfo_build_skb+0x72/0x1a0 net/core/rtnetlink.c:3808
rtmsg_ifinfo_event net/core/rtnetlink.c:3844 [inline]
rtmsg_ifinfo_event net/core/rtnetlink.c:3835 [inline]
rtmsg_ifinfo+0x83/0x120 net/core/rtnetlink.c:3853
netdev_state_change net/core/dev.c:1395 [inline]
netdev_state_change+0x114/0x130 net/core/dev.c:1386
linkwatch_do_dev+0x10e/0x150 net/core/link_watch.c:167
__linkwatch_run_queue+0x233/0x6a0 net/core/link_watch.c:213
linkwatch_event+0x4a/0x60 net/core/link_watch.c:252
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
Memory state around the buggy address:
ffff8880716e5a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880716e5b00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff8880716e5b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff8880716e5c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880716e5c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -4481,9 +4481,9 @@ struct nft_set_elem_catchall {static void nft_set_catchall_destroy (const struct nft_ctx *ctx,struct nft_set *set) { -struct nft_set_elem_catchall *catchall; +struct nft_set_elem_catchall *next, *catchall; -list_for_each_entry_rcu (catchall, &set->catchall_list, list) { +list_for_each_entry_safe (catchall, next, &set->catchall_list, list) {list_del_rcu (&catchall->list);nft_set_elem_destroy (set, catchall->elem, true);kfree_rcu (catchall);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 21/128 netfilter: fix regression in looped (broad|multi)casts MAC handling
In reply to Greg Kroah-HartmanFrom: Ignacy Gawędzki <[email protected]>
[ Upstream commit ebb966d3bdfed581ecccbb4a7432341baf7619b4 ]
In commit 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac header was cleared"), the test for non-empty MAC header introduced in commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling") has been replaced with a test for a set MAC header.
This breaks the case when the MAC header has been reset (using skb_reset_mac_header), as is the case with looped-back multicast packets. As a result, the packets ending up in NFQUEUE get a bogus hwaddr interpreted from the first bytes of the IP header.
This patch adds a test for a non-empty MAC header in addition to the test for a set MAC header. The same two tests are also implemented in nfnetlink_log.c, where the initial code of commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling") has not been touched, but where supposedly the same situation may happen.
--- net/netfilter/nfnetlink_log.c | 3 ++- net/netfilter/nfnetlink_queue.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nfnetlink_log.c +2 -1
@@ -556,7 +556,8 @@ __build_packet_message(struct nfnl_log_net *log, goto nla_put_failure;if (indev && skb->dev && - skb->mac_header != skb->network_header) { +skb_mac_header_was_set (skb) && +skb_mac_header_len (skb) !=0 ) {struct nfulnl_msg_packet_hw phw;int len;
net/netfilter/nfnetlink_queue.c +2 -1
@@ -560,7 +560,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, goto nla_put_failure;if (indev && entskb->dev && -skb_mac_header_was_set (entskb)) { +skb_mac_header_was_set (entskb) && +skb_mac_header_len (entskb) !=0 ) {struct nfqnl_msg_packet_hw phw;int len;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 22/128 ARM: dts: imx6qdl-wandboard: Fix Ethernet support
In reply to Greg Kroah-HartmanFrom: Martin Haaß <[email protected]>
[ Upstream commit 39e660687ac0c57499134765abbecf71cfd11eae ]
Currently, the imx6q-wandboard Ethernet does not transmit any data.
This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q:
remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs").
Fix it by describing the qca,clk-out-frequency property as suggested by the commit above.
--- arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6qdl-wandboard.dtsi +1 -0
@@ -309,6 +309,7 @@ ethphy: ethernet-phy@1 { reg = <1>; + qca,clk-out-frequency = <125000000>; }; }; };
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 23/128 ice: Use xdp_buf instead of rx_buf for xsk zero-copy
In reply to Greg Kroah-HartmanFrom: Magnus Karlsson <[email protected]>
[ Upstream commit 57f7f8b6bc0bc80d94443f94fe5f21f266499a2b ]
In order to use the new xsk batched buffer allocation interface, a pointer to an array of struct xsk_buff pointers need to be provided so that the function can put the result of the allocation there. In the ice driver, we already have a ring that stores pointers to xdp_buffs. This is only used for the xsk zero-copy driver and is a union with the structure that is used for the regular non zero-copy path. Unfortunately, that structure is larger than the xdp_buffs pointers which mean that there will be a stride (of 20 bytes) between each xdp_buff pointer. And feeding this into the xsk_buff_alloc_batch interface will not work since it assumes a regular array of xdp_buff pointers (each 8 bytes with 0 bytes in-between them on a 64-bit system).
To fix this, remove the xdp_buff pointer from the rx_buf union and move it one step higher to the union above which only has pointers to arrays in it. This solves the problem and we can directly feed the SW ring of xdp_buff pointers straight into the allocation function in the next patch when that interface is used. This will improve performance.
--- drivers/net/ethernet/intel/ice/ice_txrx.h | 16 ++----- drivers/net/ethernet/intel/ice/ice_xsk.c | 56 +++++++++++------------ 2 files changed, 33 insertions(+), 39 deletions(-)
drivers/net/ethernet/intel/ice/ice_txrx.h +5 -11
@@ -164,17 +164,10 @@ struct ice_tx_offload_params { };struct ice_rx_buf { -union { -struct { -dma_addr_t dma; -struct page *page; -unsigned int page_offset; -u16 pagecnt_bias; - }; -struct { -struct xdp_buff *xdp; - }; - }; +dma_addr_t dma; +struct page *page; +unsigned int page_offset; +u16 pagecnt_bias; };struct ice_q_stats {
@@ -270,6 +263,7 @@ struct ice_ring {union {struct ice_tx_buf *tx_buf;struct ice_rx_buf *rx_buf; +struct xdp_buff **xdp_buf; };/* CL2 - 2nd cacheline starts here */ u16 q_index;/* Queue number of ring */
drivers/net/ethernet/intel/ice/ice_xsk.c +28 -28
137 lines not on this page · raw message
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 24/128 ice: xsk: return xsk buffers back to pool when cleaning the ring
In reply to Greg Kroah-HartmanFrom: Maciej Fijalkowski <[email protected]>
[ Upstream commit afe8a3ba85ec2a6b6849367e25c06a2f8e0ddd05 ]
Currently we only NULL the xdp_buff pointer in the internal SW ring but we never give it back to the xsk buffer pool. This means that buffers can be leaked out of the buff pool and never be used again.
Add missing xsk_buff_free() call to the routine that is supposed to clean the entries that are left in the ring so that these buffers in the umem can be used by other sockets.
Also, only go through the space that is actually left to be cleaned instead of a whole ring.
--- drivers/net/ethernet/intel/ice/ice_xsk.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/ice/ice_xsk.c +6 -6
@@ -810,14 +810,14 @@ bool ice_xsk_any_rx_ring_ena(struct ice_vsi *vsi)*/ void ice_xsk_clean_rx_ring (struct ice_ring *rx_ring) { -u16 i; - -for (i =0 ; i < rx_ring->count; i++) { -struct xdp_buff **xdp = &rx_ring->xdp_buf[i]; +u16 count_mask = rx_ring->count -1 ; +u16 ntc = rx_ring->next_to_clean; +u16 ntu = rx_ring->next_to_use; -if (!xdp) -continue ; +for ( ; ntc != ntu; ntc = (ntc +1 ) & count_mask) { +struct xdp_buff **xdp = &rx_ring->xdp_buf[ntc]; +xsk_buff_free (*xdp); *xdp =NULL ; } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 25/128 net: marvell: prestera: fix incorrect return of port_find
In reply to Greg Kroah-HartmanFrom: Yevhen Orlov <[email protected]>
[ Upstream commit 8b681bd7c301c423fbe97a6b23388a2180ff04ca ]
In case, when some ports is in list and we don't find requested - we return last iterator state and not return NULL as expected.
--- .../ethernet/marvell/prestera/prestera_main.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/prestera/prestera_main.c +10 -6
@@ -54,12 +54,14 @@ int prestera_port_pvid_set(struct prestera_port *port, u16 vid)struct prestera_port *prestera_port_find_by_hwid (struct prestera_switch *sw,u32 dev_id,u32 hw_id) { -struct prestera_port *port =NULL ; +struct prestera_port *port =NULL , *tmp;read_lock (&sw->port_list_lock); -list_for_each_entry (port, &sw->port_list, list) { -if (port->dev_id == dev_id && port->hw_id == hw_id) +list_for_each_entry (tmp, &sw->port_list, list) { +if (tmp->dev_id == dev_id && tmp->hw_id == hw_id) { + port = tmp;break ; + } }read_unlock (&sw->port_list_lock);
@@ -68,12 +70,14 @@ struct prestera_port *prestera_port_find_by_hwid(struct prestera_switch *sw,struct prestera_port *prestera_find_port (struct prestera_switch *sw,u32 id) { -struct prestera_port *port =NULL ; +struct prestera_port *port =NULL , *tmp;read_lock (&sw->port_list_lock); -list_for_each_entry (port, &sw->port_list, list) { -if (port->id == id) +list_for_each_entry (tmp, &sw->port_list, list) { +if (tmp->id == id) { + port = tmp;break ; + } }read_unlock (&sw->port_list_lock);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 26/128 net: marvell: prestera: fix incorrect structure access
In reply to Greg Kroah-HartmanFrom: Yevhen Orlov <[email protected]>
[ Upstream commit 2efc2256febf214e7b2bdaa21fe6c3c3146acdcb ]
In line:
upper = info->upper_dev;
We access upper_dev field, which is related only for particular events (e.g. event == NETDEV_CHANGEUPPER). So, this line cause invalid memory access for another events,
when ptr is not netdev_notifier_changeupper_info.
The KASAN logs are as follows:
[ 30.123165] BUG: KASAN: stack-out-of-bounds in prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera] [ 30.133336] Read of size 8 at addr ffff80000cf772b0 by task udevd/778 [ 30.139866] [ 30.141398] CPU: 0 PID: 778 Comm: udevd Not tainted 5.16.0-rc3 #6 [ 30.147588] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 30.153056] Call trace: [ 30.155547] dump_backtrace+0x0/0x2c0 [ 30.159320] show_stack+0x18/0x30 [ 30.162729] dump_stack_lvl+0x68/0x84 [ 30.166491] print_address_description.constprop.0+0x74/0x2b8 [ 30.172346] kasan_report+0x1e8/0x250 [ 30.176102] __asan_load8+0x98/0xe0 [ 30.179682] prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera] [ 30.186847] prestera_netdev_event_handler+0x1b4/0x1c0 [prestera] [ 30.193313] raw_notifier_call_chain+0x74/0xa0 [ 30.197860] call_netdevice_notifiers_info+0x68/0xc0 [ 30.202924] register_netdevice+0x3cc/0x760 [ 30.207190] register_netdev+0x24/0x50 [ 30.211015] prestera_device_register+0x8a0/0xba0 [prestera]
--- .../ethernet/marvell/prestera/prestera_main.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/net/ethernet/marvell/prestera/prestera_main.c +12 -7
@@ -707,23 +707,27 @@ static int prestera_netdev_port_event(struct net_device *lower,struct net_device *dev, unsigned long event, void *ptr) { - struct netdev_notifier_changeupper_info *info = ptr; + struct netdev_notifier_info *info = ptr; +struct netdev_notifier_changeupper_info *cu_info;struct prestera_port *port =netdev_priv (dev);struct netlink_ext_ack *extack;struct net_device *upper; - extack =netdev_notifier_info_to_extack (&info->info); - upper = info->upper_dev; + extack =netdev_notifier_info_to_extack (info); + cu_info =container_of (info, + struct netdev_notifier_changeupper_info, + info);switch (event) {case NETDEV_PRECHANGEUPPER : + upper = cu_info->upper_dev;if (!netif_is_bridge_master (upper) && !netif_is_lag_master (upper)) {NL_SET_ERR_MSG_MOD (extack,"Unknown upper device type" );return -EINVAL ; } -if (!info->linking) +if (!cu_info->linking)break ;if (netdev_has_any_upper_dev (upper)) {
@@ -732,7 +736,7 @@ static int prestera_netdev_port_event(struct net_device *lower, }if (netif_is_lag_master (upper) && - !prestera_lag_master_check (upper, info->upper_info, extack)) + !prestera_lag_master_check (upper, cu_info->upper_info, extack))return -EOPNOTSUPP ;if (netif_is_lag_master (upper) &&vlan_uses_dev (dev)) { NL_SET_ERR_MSG_MOD(extack,
@@ -748,14 +752,15 @@ static int prestera_netdev_port_event(struct net_device *lower,break ;case NETDEV_CHANGEUPPER : + upper = cu_info->upper_dev;if (netif_is_bridge_master (upper)) { -if (info->linking) +if (cu_info->linking)return prestera_bridge_port_join (upper, port, extack);else prestera_bridge_port_leave (upper, port); }else if (netif_is_lag_master (upper)) { -if (info->linking) +if (cu_info->linking)return prestera_lag_port_add (port, upper);else prestera_lag_port_del (port);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 27/128 qlcnic: potential dereference null pointer of rx_queue->page_ring
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 60ec7fcfe76892a1479afab51ff17a4281923156 ]
The return value of kcalloc() needs to be checked.
To avoid dereference of null pointer in case of the failure of alloc. Therefore, it might be better to change the return type of qlcnic_sriov_alloc_vlans() and return -ENOMEM when alloc fails and return 0 the others.
Also, qlcnic_sriov_set_guest_vlan_mode() and __qlcnic_pci_sriov_enable() should deal with the return value of qlcnic_sriov_alloc_vlans().
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +++++++++--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +++- 3 files changed, 13 insertions(+), 5 deletions(-)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +1 -1
@@ -201,7 +201,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, struct qlcnic_info *, u16);int qlcnic_sriov_cfg_vf_guest_vlan (struct qlcnic_adapter *,u16 ,u8 );void qlcnic_sriov_free_vlans (struct qlcnic_adapter *); -void qlcnic_sriov_alloc_vlans (struct qlcnic_adapter *); +int qlcnic_sriov_alloc_vlans (struct qlcnic_adapter *);bool qlcnic_sriov_check_any_vlan (struct qlcnic_vf_info *);void qlcnic_sriov_del_vlan_id (struct qlcnic_sriov *,struct qlcnic_vf_info *,u16 );
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +9 -3
@@ -432,7 +432,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, struct qlcnic_cmd_args *cmd) {struct qlcnic_sriov *sriov = adapter->ahw->sriov; -int i, num_vlans; +int i, num_vlans, ret;u16 *vlans;if (sriov->allowed_vlans)
@@ -443,7 +443,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,dev_info (&adapter->pdev->dev,"Number of allowed Guest VLANs = %d\n" , sriov->num_allowed_vlans); -qlcnic_sriov_alloc_vlans (adapter); + ret =qlcnic_sriov_alloc_vlans (adapter); +if (ret) +return ret;if (!sriov->any_vlan)return 0 ;
@@ -2154,7 +2156,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)return err; } -void qlcnic_sriov_alloc_vlans (struct qlcnic_adapter *adapter) +int qlcnic_sriov_alloc_vlans (struct qlcnic_adapter *adapter) {struct qlcnic_sriov *sriov = adapter->ahw->sriov;struct qlcnic_vf_info *vf;
@@ -2164,7 +2166,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) vf = &sriov->vf_info[i]; vf->sriov_vlans =kcalloc (sriov->num_allowed_vlans,sizeof (*vf->sriov_vlans),GFP_KERNEL ); +if (!vf->sriov_vlans) +return -ENOMEM ; } + +return 0 ; }void qlcnic_sriov_free_vlans (struct qlcnic_adapter *adapter)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +3 -1
@@ -597,7 +597,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,if (err) goto del_flr_queue; -qlcnic_sriov_alloc_vlans (adapter); + err =qlcnic_sriov_alloc_vlans (adapter); +if (err) + goto del_flr_queue;return err;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 28/128 tcp: move inet->rx_dst_ifindex to sk->sk_rx_dst_ifindex
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0c0a5ef809f9150e9229e7b13e43183b681b7a39 ]
Increase cache locality by moving rx_dst_ifindex next to sk->sk_rx_dst
This is part of an effort to reduce cache line misses in TCP fast path.
This removes one cache line miss in early demux.
--- include/net/inet_sock.h | 3 +-- include/net/sock.h | 3 +++ net/ipv4/tcp_ipv4.c | 6 +++--- net/ipv6/tcp_ipv6.c | 6 +++--- 4 files changed, 10 insertions(+), 8 deletions(-)
include/net/inet_sock.h +1 -2
@@ -207,11 +207,10 @@ struct inet_sock {__be32 inet_saddr;__s16 uc_ttl;__u16 cmsg_flags; +struct ip_options_rcu __rcu *inet_opt;__be16 inet_sport;__u16 inet_id; -struct ip_options_rcu __rcu *inet_opt; -int rx_dst_ifindex;__u8 tos;__u8 min_ttl;__u8 mc_ttl;
include/net/sock.h +3 -0
@@ -259,6 +259,7 @@ struct bpf_local_storage;* @sk_rcvbuf: size of receive buffer in bytes * @sk_wq: sock wait queue and async head * @sk_rx_dst: receive input route used by early demux +* @sk_rx_dst_ifindex: ifindex for @sk_rx_dst * @sk_dst_cache: destination cache * @sk_dst_pending_confirm: need to confirm neighbour * @sk_policy: flow policy
@@ -431,6 +432,8 @@ struct sock {struct xfrm_policy __rcu *sk_policy[2 ];#endif struct dst_entry *sk_rx_dst; +int sk_rx_dst_ifindex; +struct dst_entry __rcu *sk_dst_cache;atomic_t sk_omem_alloc;int sk_sndbuf;
net/ipv4/tcp_ipv4.c +3 -3
@@ -1703,7 +1703,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)sock_rps_save_rxhash (sk, skb);sk_mark_napi_id (sk, skb);if (dst) { -if (inet_sk (sk)->rx_dst_ifindex != skb->skb_iif || +if (sk->sk_rx_dst_ifindex != skb->skb_iif || !INDIRECT_CALL_1 (dst->ops->check, ipv4_dst_check, dst,0 )) {dst_release (dst);
@@ -1788,7 +1788,7 @@ int tcp_v4_early_demux(struct sk_buff *skb)if (dst) dst =dst_check (dst,0 );if (dst && -inet_sk (sk)->rx_dst_ifindex == skb->skb_iif) + sk->sk_rx_dst_ifindex == skb->skb_iif)skb_dst_set_noref (skb, dst); } }
@@ -2201,7 +2201,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)if (dst &&dst_hold_safe (dst)) { sk->sk_rx_dst = dst; -inet_sk (sk)->rx_dst_ifindex = skb->skb_iif; + sk->sk_rx_dst_ifindex = skb->skb_iif; } }EXPORT_SYMBOL (inet_sk_rx_dst_set);
net/ipv6/tcp_ipv6.c +3 -3
@@ -108,7 +108,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)const struct rt6_info *rt = (const struct rt6_info *)dst; sk->sk_rx_dst = dst; -inet_sk (sk)->rx_dst_ifindex = skb->skb_iif; + sk->sk_rx_dst_ifindex = skb->skb_iif;tcp_inet6_sk (sk)->rx_dst_cookie =rt6_get_cookie (rt); } }
@@ -1509,7 +1509,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)sock_rps_save_rxhash (sk, skb);sk_mark_napi_id (sk, skb);if (dst) { -if (inet_sk (sk)->rx_dst_ifindex != skb->skb_iif || +if (sk->sk_rx_dst_ifindex != skb->skb_iif ||INDIRECT_CALL_1 (dst->ops->check, ip6_dst_check, dst, np->rx_dst_cookie) ==NULL ) {dst_release (dst);
@@ -1880,7 +1880,7 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb)if (dst) dst =dst_check (dst,tcp_inet6_sk (sk)->rx_dst_cookie);if (dst && -inet_sk (sk)->rx_dst_ifindex == skb->skb_iif) + sk->sk_rx_dst_ifindex == skb->skb_iif)skb_dst_set_noref (skb, dst); } }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 29/128 ipv6: move inet6_sk(sk)->rx_dst_cookie to sk->sk_rx_dst_cookie
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit ef57c1610dd8fba5031bf71e0db73356190de151 ]
Increase cache locality by moving rx_dst_coookie next to sk->sk_rx_dst
This removes one or two cache line misses in IPv6 early demux (TCP/UDP)
--- include/linux/ipv6.h | 1 - include/net/sock.h | 2 ++ net/ipv6/tcp_ipv6.c | 6 +++--- net/ipv6/udp.c | 4 ++-- 4 files changed, 7 insertions(+), 6 deletions(-)
include/linux/ipv6.h +0 -1
@@ -282,7 +282,6 @@ struct ipv6_pinfo {__be32 rcv_flowinfo;__u32 dst_cookie; -__u32 rx_dst_cookie;struct ipv6_mc_socklist __rcu *ipv6_mc_list;struct ipv6_ac_socklist *ipv6_ac_list;
include/net/sock.h +2 -0
@@ -260,6 +260,7 @@ struct bpf_local_storage;* @sk_wq: sock wait queue and async head * @sk_rx_dst: receive input route used by early demux * @sk_rx_dst_ifindex: ifindex for @sk_rx_dst +* @sk_rx_dst_cookie: cookie for @sk_rx_dst * @sk_dst_cache: destination cache * @sk_dst_pending_confirm: need to confirm neighbour * @sk_policy: flow policy
@@ -433,6 +434,7 @@ struct sock {#endif struct dst_entry *sk_rx_dst;int sk_rx_dst_ifindex; +u32 sk_rx_dst_cookie;struct dst_entry __rcu *sk_dst_cache;atomic_t sk_omem_alloc;
net/ipv6/tcp_ipv6.c +3 -3
@@ -109,7 +109,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) sk->sk_rx_dst = dst; sk->sk_rx_dst_ifindex = skb->skb_iif; -tcp_inet6_sk (sk)->rx_dst_cookie =rt6_get_cookie (rt); + sk->sk_rx_dst_cookie =rt6_get_cookie (rt); } }
@@ -1511,7 +1511,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)if (dst) {if (sk->sk_rx_dst_ifindex != skb->skb_iif ||INDIRECT_CALL_1 (dst->ops->check, ip6_dst_check, - dst, np->rx_dst_cookie) ==NULL ) { + dst, sk->sk_rx_dst_cookie) ==NULL ) {dst_release (dst); sk->sk_rx_dst =NULL ; }
@@ -1878,7 +1878,7 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb)struct dst_entry *dst =READ_ONCE (sk->sk_rx_dst);if (dst) - dst =dst_check (dst,tcp_inet6_sk (sk)->rx_dst_cookie); + dst =dst_check (dst, sk->sk_rx_dst_cookie);if (dst && sk->sk_rx_dst_ifindex == skb->skb_iif)skb_dst_set_noref (skb, dst);
net/ipv6/udp.c +2 -2
@@ -884,7 +884,7 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)if (udp_sk_rx_dst_set (sk, dst)) {const struct rt6_info *rt = (const struct rt6_info *)dst; -inet6_sk (sk)->rx_dst_cookie =rt6_get_cookie (rt); + sk->sk_rx_dst_cookie =rt6_get_cookie (rt); } }
@@ -1073,7 +1073,7 @@ INDIRECT_CALLABLE_SCOPE void udp_v6_early_demux(struct sk_buff *skb) dst =READ_ONCE (sk->sk_rx_dst);if (dst) - dst =dst_check (dst,inet6_sk (sk)->rx_dst_cookie); + dst =dst_check (dst, sk->sk_rx_dst_cookie);if (dst) {/* set noref for now. * any place which wants to hold dst has to call
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 30/128 inet: fully convert sk->sk_rx_dst to RCU rules
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 8f905c0e7354ef261360fb7535ea079b1082c105 ]
syzbot reported various issues around early demux, one being included in this changelog [1]
sk->sk_rx_dst is using RCU protection without clearly documenting it.
And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules.
[a] dst_release(dst);
[b] sk->sk_rx_dst = NULL;
They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before
the call_rcu()/synchronize_rcu() guarding actual memory freeing.
In some cases indeed, dst could be freed before [b] is done.
We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities.
[1]
BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline]
BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792
Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204
CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247
__kasan_report mm/kasan/report.c:433 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
dst_check include/net/dst.h:470 [inline]
tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792
ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340
ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583
ip_sublist_rcv net/ipv4/ip_input.c:609 [inline]
ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644
__netif_receive_skb_list_ptype net/core/dev.c:5508 [inline]
__netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556
__netif_receive_skb_list net/core/dev.c:5608 [inline]
netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699
gro_normal_list net/core/dev.c:5853 [inline]
gro_normal_list net/core/dev.c:5849 [inline]
napi_complete_done+0x1f1/0x880 net/core/dev.c:6590
virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557
__napi_poll+0xaf/0x440 net/core/dev.c:7023
napi_poll net/core/dev.c:7090 [inline]
net_rx_action+0x801/0xb40 net/core/dev.c:7177
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629
RIP: 0033:0x7f5e972bfd57
Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73
RSP: 002b:00007fff8a413210 EFLAGS: 00000283
RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45
RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45
RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9
R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0
R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019
</TASK>
Allocated by task 13:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slub.c:3234 [inline]
slab_alloc mm/slub.c:3242 [inline]
kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247
dst_alloc+0x146/0x1f0 net/core/dst.c:92
rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613
ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:2340
ip_route_input_rcu net/ipv4/route.c:2470 [inline]
ip_route_input_noref+0x116/0x2a0 net/ipv4/route.c:2415
ip_rcv_finish_core.constprop.0+0x288/0x1e80 net/ipv4/ip_input.c:354
ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583
ip_sublist_rcv net/ipv4/ip_input.c:609 [inline]
ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644
__netif_receive_skb_list_ptype net/core/dev.c:5508 [inline]
__netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556
__netif_receive_skb_list net/core/dev.c:5608 [inline]
netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699
gro_normal_list net/core/dev.c:5853 [inline]
gro_normal_list net/core/dev.c:5849 [inline]
napi_complete_done+0x1f1/0x880 net/core/dev.c:6590
virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]
virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557
__napi_poll+0xaf/0x440 net/core/dev.c:7023
napi_poll net/core/dev.c:7090 [inline]
net_rx_action+0x801/0xb40 net/core/dev.c:7177
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
Freed by task 13:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:46
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0xff/0x130 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:1723 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749
slab_free mm/slub.c:3513 [inline]
kmem_cache_free+0xbd/0x5d0 mm/slub.c:3530
dst_destroy+0x2d6/0x3f0 net/core/dst.c:127
rcu_do_batch kernel/rcu/tree.c:2506 [inline]
rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2741
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
Last potentially related work creation:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
__kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348
__call_rcu kernel/rcu/tree.c:2985 [inline]
call_rcu+0xb1/0x740 kernel/rcu/tree.c:3065
dst_release net/core/dst.c:177 [inline]
dst_release+0x79/0xe0 net/core/dst.c:167
tcp_v4_do_rcv+0x612/0x8d0 net/ipv4/tcp_ipv4.c:1712
sk_backlog_rcv include/net/sock.h:1030 [inline]
__release_sock+0x134/0x3b0 net/core/sock.c:2768
release_sock+0x54/0x1b0 net/core/sock.c:3300
tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1441
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:724
sock_write_iter+0x289/0x3c0 net/socket.c:1057
call_write_iter include/linux/fs.h:2162 [inline]
new_sync_write+0x429/0x660 fs/read_write.c:503
vfs_write+0x7cd/0xae0 fs/read_write.c:590
ksys_write+0x1ee/0x250 fs/read_write.c:643
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff88807f1cb700
which belongs to the cache ip_dst_cache of size 176
The buggy address is located 58 bytes inside of
176-byte region [ffff88807f1cb700, ffff88807f1cb7b0)
The buggy address belongs to the page:
page:ffffea0001fc72c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f1cb
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 dead000000000100 dead000000000122 ffff8881413bb780
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 5, ts 108466983062, free_ts 108048976062
prep_new_page mm/page_alloc.c:2418 [inline]
get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191
alloc_slab_page mm/slub.c:1793 [inline]
allocate_slab mm/slub.c:1930 [inline]
new_slab+0x32d/0x4a0 mm/slub.c:1993
___slab_alloc+0x918/0xfe0 mm/slub.c:3022
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3109
slab_alloc_node mm/slub.c:3200 [inline]
slab_alloc mm/slub.c:3242 [inline]
kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3247
dst_alloc+0x146/0x1f0 net/core/dst.c:92
rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613
__mkroute_output net/ipv4/route.c:2564 [inline]
ip_route_output_key_hash_rcu+0x921/0x2d00 net/ipv4/route.c:2791
ip_route_output_key_hash+0x18b/0x300 net/ipv4/route.c:2619
__ip_route_output_key include/net/route.h:126 [inline]
ip_route_output_flow+0x23/0x150 net/ipv4/route.c:2850
ip_route_output_key include/net/route.h:142 [inline]
geneve_get_v4_rt+0x3a6/0x830 drivers/net/geneve.c:809
geneve_xmit_skb drivers/net/geneve.c:899 [inline]
geneve_xmit+0xc4a/0x3540 drivers/net/geneve.c:1082
__netdev_start_xmit include/linux/netdevice.h:4994 [inline]
netdev_start_xmit include/linux/netdevice.h:5008 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3606
__dev_queue_xmit+0x299a/0x3650 net/core/dev.c:4229
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1338 [inline]
free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389
free_unref_page_prepare mm/page_alloc.c:3309 [inline]
free_unref_page+0x19/0x690 mm/page_alloc.c:3388
qlink_free mm/kasan/quarantine.c:146 [inline]
qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slub.c:3234 [inline]
kmem_cache_alloc_node+0x255/0x3f0 mm/slub.c:3270
__alloc_skb+0x215/0x340 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1126 [inline]
alloc_skb_with_frags+0x93/0x620 net/core/skbuff.c:6078
sock_alloc_send_pskb+0x783/0x910 net/core/sock.c:2575
mld_newpack+0x1df/0x770 net/ipv6/mcast.c:1754
add_grhead+0x265/0x330 net/ipv6/mcast.c:1857
add_grec+0x1053/0x14e0 net/ipv6/mcast.c:1995
mld_send_initial_cr.part.0+0xf6/0x230 net/ipv6/mcast.c:2242
mld_send_initial_cr net/ipv6/mcast.c:1232 [inline]
mld_dad_work+0x1d3/0x690 net/ipv6/mcast.c:2268
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
Memory state around the buggy address:
ffff88807f1cb600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88807f1cb680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
>ffff88807f1cb700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88807f1cb780: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
ffff88807f1cb800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- include/net/sock.h | 2 +- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 3 +-- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 11 +++++++---- net/ipv4/udp.c | 6 +++--- net/ipv6/tcp_ipv6.c | 11 +++++++---- net/ipv6/udp.c | 4 ++-- 8 files changed, 23 insertions(+), 18 deletions(-)
include/net/sock.h +1 -1
@@ -432,7 +432,7 @@ struct sock {#ifdef CONFIG_XFRM struct xfrm_policy __rcu *sk_policy[2 ];#endif -struct dst_entry *sk_rx_dst; +struct dst_entry __rcu *sk_rx_dst;int sk_rx_dst_ifindex;u32 sk_rx_dst_cookie;
net/ipv4/af_inet.c +1 -1
@@ -158,7 +158,7 @@ void inet_sock_destruct(struct sock *sk)kfree (rcu_dereference_protected (inet->inet_opt,1 ));dst_release (rcu_dereference_protected (sk->sk_dst_cache,1 )); -dst_release (sk->sk_rx_dst); +dst_release (rcu_dereference_protected (sk->sk_rx_dst,1 ));sk_refcnt_debug_dec (sk); }EXPORT_SYMBOL (inet_sock_destruct);
net/ipv4/tcp.c +1 -2
@@ -3039,8 +3039,7 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_ack.rcv_mss =TCP_MIN_MSS ;memset (&tp->rx_opt,0 ,sizeof (tp->rx_opt));__sk_dst_reset (sk); -dst_release (sk->sk_rx_dst); - sk->sk_rx_dst =NULL ; +dst_release (xchg ((__force struct dst_entry **)&sk->sk_rx_dst,NULL ));tcp_saved_syn_free (tp); tp->compressed_ack =0 ; tp->segs_in =0 ;
net/ipv4/tcp_input.c +1 -1
@@ -5770,7 +5770,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb)trace_tcp_probe (sk, skb);tcp_mstamp_refresh (tp); -if (unlikely (!sk->sk_rx_dst)) +if (unlikely (!rcu_access_pointer (sk->sk_rx_dst)))inet_csk (sk)->icsk_af_ops->sk_rx_dst_set (sk, skb);/* * Header prediction.
net/ipv4/tcp_ipv4.c +7 -4
@@ -1698,7 +1698,10 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)struct sock *rsk;if (sk->sk_state ==TCP_ESTABLISHED ) {/* Fast path */ -struct dst_entry *dst = sk->sk_rx_dst; +struct dst_entry *dst; + + dst =rcu_dereference_protected (sk->sk_rx_dst, +lockdep_sock_is_held (sk));sock_rps_save_rxhash (sk, skb);sk_mark_napi_id (sk, skb);
@@ -1706,8 +1709,8 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)if (sk->sk_rx_dst_ifindex != skb->skb_iif || !INDIRECT_CALL_1 (dst->ops->check, ipv4_dst_check, dst,0 )) { +RCU_INIT_POINTER (sk->sk_rx_dst,NULL );dst_release (dst); - sk->sk_rx_dst =NULL ; } }tcp_rcv_established (sk, skb);
@@ -1783,7 +1786,7 @@ int tcp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux;if (sk_fullsock (sk)) { -struct dst_entry *dst =READ_ONCE (sk->sk_rx_dst); +struct dst_entry *dst =rcu_dereference (sk->sk_rx_dst);if (dst) dst =dst_check (dst,0 );
@@ -2200,7 +2203,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)struct dst_entry *dst =skb_dst (skb);if (dst &&dst_hold_safe (dst)) { - sk->sk_rx_dst = dst; +rcu_assign_pointer (sk->sk_rx_dst, dst); sk->sk_rx_dst_ifindex = skb->skb_iif; } }
net/ipv4/udp.c +3 -3
@@ -2251,7 +2251,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)struct dst_entry *old;if (dst_hold_safe (dst)) { - old =xchg (&sk->sk_rx_dst, dst); + old =xchg ((__force struct dst_entry **)&sk->sk_rx_dst, dst);dst_release (old);return old != dst; }
@@ -2441,7 +2441,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,struct dst_entry *dst =skb_dst (skb);int ret; -if (unlikely (sk->sk_rx_dst != dst)) +if (unlikely (rcu_dereference (sk->sk_rx_dst) != dst))udp_sk_rx_dst_set (sk, dst); ret =udp_unicast_rcv_skb (sk, skb, uh);
@@ -2600,7 +2600,7 @@ int udp_v4_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst =READ_ONCE (sk->sk_rx_dst); + dst =rcu_dereference (sk->sk_rx_dst);if (dst) dst =dst_check (dst,0 );
net/ipv6/tcp_ipv6.c +7 -4
@@ -107,7 +107,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)if (dst &&dst_hold_safe (dst)) {const struct rt6_info *rt = (const struct rt6_info *)dst; - sk->sk_rx_dst = dst; +rcu_assign_pointer (sk->sk_rx_dst, dst); sk->sk_rx_dst_ifindex = skb->skb_iif; sk->sk_rx_dst_cookie =rt6_get_cookie (rt); }
@@ -1504,7 +1504,10 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) opt_skb =skb_clone (skb,sk_gfp_mask (sk,GFP_ATOMIC ));if (sk->sk_state ==TCP_ESTABLISHED ) {/* Fast path */ -struct dst_entry *dst = sk->sk_rx_dst; +struct dst_entry *dst; + + dst =rcu_dereference_protected (sk->sk_rx_dst, +lockdep_sock_is_held (sk));sock_rps_save_rxhash (sk, skb);sk_mark_napi_id (sk, skb);
@@ -1512,8 +1515,8 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)if (sk->sk_rx_dst_ifindex != skb->skb_iif ||INDIRECT_CALL_1 (dst->ops->check, ip6_dst_check, dst, sk->sk_rx_dst_cookie) ==NULL ) { +RCU_INIT_POINTER (sk->sk_rx_dst,NULL );dst_release (dst); - sk->sk_rx_dst =NULL ; } }
@@ -1875,7 +1878,7 @@ INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_edemux;if (sk_fullsock (sk)) { -struct dst_entry *dst =READ_ONCE (sk->sk_rx_dst); +struct dst_entry *dst =rcu_dereference (sk->sk_rx_dst);if (dst) dst =dst_check (dst, sk->sk_rx_dst_cookie);
net/ipv6/udp.c +2 -2
@@ -956,7 +956,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,struct dst_entry *dst =skb_dst (skb);int ret; -if (unlikely (sk->sk_rx_dst != dst)) +if (unlikely (rcu_dereference (sk->sk_rx_dst) != dst))udp6_sk_rx_dst_set (sk, dst);if (!uh->check && !udp_sk (sk)->no_check6_rx) {
@@ -1070,7 +1070,7 @@ INDIRECT_CALLABLE_SCOPE void udp_v6_early_demux(struct sk_buff *skb) skb->sk = sk; skb->destructor = sock_efree; - dst =READ_ONCE (sk->sk_rx_dst); + dst =rcu_dereference (sk->sk_rx_dst);if (dst) dst =dst_check (dst, sk->sk_rx_dst_cookie);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 31/128 net: accept UFOv6 packages in virtio_net_hdr_to_skb
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit 7e5cced9ca84df52d874aca6b632f930b3dc5bc6 ]
Skb with skb->protocol 0 at the time of virtio_net_hdr_to_skb may have a protocol inferred from virtio_net_hdr with virtio_net_hdr_set_proto.
Unlike TCP, UDP does not have separate types for IPv4 and IPv6. Type VIRTIO_NET_HDR_GSO_UDP is guessed to be IPv4/UDP. As of the below commit, UFOv6 packets are dropped due to not matching the protocol as obtained from dev_parse_header_protocol.
Invert the test to take that L2 protocol field as starting point and pass both UFOv4 and UFOv6 for VIRTIO_NET_HDR_GSO_UDP.
--- include/linux/virtio_net.h | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
include/linux/virtio_net.h +20 -2
@@ -7,6 +7,21 @@#include <uapi/linux/udp.h> #include <uapi/linux/virtio_net.h> +static inline bool virtio_net_hdr_match_proto (__be16 protocol,__u8 gso_type) +{ +switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN ) { +case VIRTIO_NET_HDR_GSO_TCPV4 : +return protocol ==cpu_to_be16 (ETH_P_IP ); +case VIRTIO_NET_HDR_GSO_TCPV6 : +return protocol ==cpu_to_be16 (ETH_P_IPV6 ); +case VIRTIO_NET_HDR_GSO_UDP : +return protocol ==cpu_to_be16 (ETH_P_IP ) || + protocol ==cpu_to_be16 (ETH_P_IPV6 ); +default : +return false; + } +} +static inline int virtio_net_hdr_set_proto (struct sk_buff *skb,const struct virtio_net_hdr *hdr) {
@@ -88,9 +103,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (!skb->protocol) {__be16 protocol =dev_parse_header_protocol (skb); -virtio_net_hdr_set_proto (skb, hdr); -if (protocol && protocol != skb->protocol) +if (!protocol) +virtio_net_hdr_set_proto (skb, hdr); +else if (!virtio_net_hdr_match_proto (protocol, hdr->gso_type))return -EINVAL ; +else + skb->protocol = protocol; } retry: if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 32/128 net: skip virtio_net_hdr_set_proto if protocol already set
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit 1ed1d592113959f00cc552c3b9f47ca2d157768f ]
virtio_net_hdr_set_proto infers skb->protocol from the virtio_net_hdr gso_type, to avoid packets getting dropped for lack of a proto type.
Its protocol choice is a guess, especially in the case of UFO, where the single VIRTIO_NET_HDR_GSO_UDP label covers both UFOv4 and UFOv6.
Skip this best effort if the field is already initialized. Whether explicitly from userspace, or implicitly based on an earlier call to dev_parse_header_protocol (which is more robust, but was introduced after this patch).
--- include/linux/virtio_net.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/virtio_net.h +3 -0
@@ -25,6 +25,9 @@ static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)static inline int virtio_net_hdr_set_proto (struct sk_buff *skb,const struct virtio_net_hdr *hdr) { +if (skb->protocol) +return 0 ; +switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN ) {case VIRTIO_NET_HDR_GSO_TCPV4 :case VIRTIO_NET_HDR_GSO_UDP :
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 33/128 igb: fix deadlock caused by taking RTNL in RPM resume path
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit ac8c58f5b535d6272324e2b8b4a0454781c9147e ]
Recent net core changes caused an issue with few Intel drivers (reportedly igb), where taking RTNL in RPM resume path results in a deadlock. See [0] for a bug report. I don't think the core changes are wrong, but taking RTNL in RPM resume path isn't needed. The Intel drivers are the only ones doing this. See [1] for a discussion on the issue. Following patch changes the RPM resume path to not take RTNL.
[0] https://bugzilla.kernel.org/show_bug.cgi?id=215129
[1] https://lore.kernel.org/netdev/20211125074949.5f897431@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com/t/
--- drivers/net/ethernet/intel/igb/igb_main.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +13 -6
@@ -9247,7 +9247,7 @@ static int __maybe_unused igb_suspend(struct device *dev)return __igb_shutdown (to_pci_dev (dev),NULL ,0 ); } -static int __maybe_unused igb_resume (struct device *dev) +static int __maybe_unused __igb_resume (struct device *dev,bool rpm) {struct pci_dev *pdev =to_pci_dev (dev);struct net_device *netdev =pci_get_drvdata (pdev);
@@ -9290,17 +9290,24 @@ static int __maybe_unused igb_resume(struct device *dev)wr32 (E1000_WUS , ~0 ); -rtnl_lock (); +if (!rpm) +rtnl_lock ();if (!err &&netif_running (netdev)) err =__igb_open (netdev, true);if (!err)netif_device_attach (netdev); -rtnl_unlock (); +if (!rpm) +rtnl_unlock ();return err; } +static int __maybe_unused igb_resume (struct device *dev) +{ +return __igb_resume (dev, false); +} +static int __maybe_unused igb_runtime_idle (struct device *dev) {struct net_device *netdev =dev_get_drvdata (dev);
@@ -9319,7 +9326,7 @@ static int __maybe_unused igb_runtime_suspend(struct device *dev)static int __maybe_unused igb_runtime_resume (struct device *dev) { -return igb_resume (dev); +return __igb_resume (dev, true); }static void igb_shutdown (struct pci_dev *pdev)
@@ -9435,7 +9442,7 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,* @pdev: Pointer to PCI device * * Restart the card from scratch, as if from a cold-boot. Implementation -* resembles the first-half of the igb_resume routine. +* resembles the first-half of the __igb_resume routine. **/ static pci_ers_result_t igb_io_slot_reset (struct pci_dev *pdev) {
@@ -9475,7 +9482,7 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev)* * This callback is called when the error recovery driver tells us that * its OK to resume normal operation. Implementation resembles the -* second-half of the igb_resume routine. +* second-half of the __igb_resume routine. */ static void igb_io_resume (struct pci_dev *pdev) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 34/128 ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
In reply to Greg Kroah-HartmanFrom: Wu Bo <[email protected]>
[ Upstream commit ffb76a86f8096a8206be03b14adda6092e18e275 ]
Hi,
When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed.
The log as follows:
[ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 [ 141.088009] Workqueue: events 0xffffffffc09b3a40 [ 141.088009] RIP: 0010:0xffffffffc09b3a5a [ 141.088009] Code: Bad RIP value. [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.088009] PKRU: 55555554 [ 141.088009] Call Trace: [ 141.088009] ? process_one_work+0x195/0x390 [ 141.088009] ? worker_thread+0x30/0x390 [ 141.088009] ? process_one_work+0x390/0x390 [ 141.088009] ? kthread+0x10d/0x130 [ 141.088009] ? kthread_flush_work_fn+0x10/0x10 [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 [ 200.223464] Oops: 0010 [#1] SMP NOPTI [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 [ 200.224008] Workqueue: events 0xffffffffc0b28a40 [ 200.224008] RIP: 0010:0xffffffffc0b28a5a [ 200.224008] Code: Bad RIP value. [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.224008] PKRU: 55555554 [ 200.224008] Call Trace: [ 200.224008] ? process_one_work+0x195/0x390 [ 200.224008] ? worker_thread+0x30/0x390 [ 200.224008] ? process_one_work+0x390/0x390 [ 200.224008] ? kthread+0x10d/0x130 [ 200.224008] ? kthread_flush_work_fn+0x10/0x10 [ 200.224008] ? ret_from_fork+0x35/0x40 [ 200.224008] kernel fault(0x1) notification starting on CPU 63 [ 200.224008] kernel fault(0x1) notification finished on CPU 63 [ 200.224008] CR2: ffffffffc0b28a5a [ 200.224008] ---[ end trace c82a412d93f57412 ]---
The reason is as follows:
T1: rmmod ipmi_si.
->ipmi_unregister_smi()
-> ipmi_bmc_unregister()
-> __ipmi_bmc_unregister()
-> kref_put(&bmc->usecount, cleanup_bmc_device);
-> schedule_work(&bmc->remove_work);T2: rmmod ipmi_msghandler.
ipmi_msghander module uninstalled, and the module space will be freed.
T3: bmc->remove_work doing cleanup the bmc resource.
-> cleanup_bmc_work()
-> platform_device_unregister(&bmc->pdev);
-> platform_device_del(pdev);
-> device_del(&pdev->dev);
-> kobject_uevent(&dev->kobj, KOBJ_REMOVE);
-> kobject_uevent_env()
-> dev_uevent()
-> if (dev->type && dev->type->name)'dev->type'(bmc_device_type) pointer space has freed when uninstall
ipmi_msghander module, 'dev->type->name' cause the system crash.
drivers/char/ipmi/ipmi_msghandler.c:
2820 static const struct device_type bmc_device_type = {
2821 .groups = bmc_dev_attr_groups,
2822 };
Steps to reproduce:
Add a time delay in cleanup_bmc_work() function,
and uninstall ipmi_si and ipmi_msghandler module.
2910 static void cleanup_bmc_work(struct work_struct *work) 2911 {
2912 struct bmc_device *bmc = container_of(work, struct bmc_device,
2913 remove_work);
2914 int id = bmc->pdev.id; /* Unregister overwrites id */
2915
2916 msleep(3000); <--- 2917 platform_device_unregister(&bmc->pdev); 2918 ida_simple_remove(&ipmi_bmc_ida, id);
2919 }
Use 'remove_work_wq' instead of 'system_wq' to solve this issues.
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +1 -1
@@ -2932,7 +2932,7 @@ cleanup_bmc_device(struct kref *ref)* with removing the device attributes while reading a device * attribute. */ -schedule_work (&bmc->remove_work); +queue_work (remove_work_wq, &bmc->remove_work); }/*
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 35/128 gpio: virtio: remove timeout
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit 3e4d9a485029aa9e172dab5420abe775fd86f8e8 ]
The driver imposes an arbitrary one second timeout on virtio requests, but the specification doesn't prevent the virtio device from taking longer to process requests, so remove this timeout to support all systems and device implementations.
--- drivers/gpio/gpio-virtio.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/gpio/gpio-virtio.c +1 -5
@@ -81,11 +81,7 @@ static int _virtio_gpio_req(struct virtio_gpio *vgpio, u16 type, u16 gpio,virtqueue_kick (vgpio->request_vq);mutex_unlock (&vgpio->lock); -if (!wait_for_completion_timeout (&line->completion,HZ )) { -dev_err (dev,"GPIO operation timed out\n" ); - ret = -ETIMEDOUT ; - goto out; - } +wait_for_completion (&line->completion);if (unlikely (res->status !=VIRTIO_GPIO_STATUS_OK )) {dev_err (dev,"GPIO request failed: %d\n" , gpio);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 36/128 bonding: fix ad_actor_system option setting to default
In reply to Greg Kroah-HartmanFrom: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 1c15b05baea71a5ff98235783e3e4ad227760876 ]
When 802.3ad bond mode is configured the ad_actor_system option is set to "00:00:00:00:00:00". But when trying to set the all-zeroes MAC as actors' system address it was failing with EINVAL.
An all-zeroes ethernet address is valid, only multicast addresses are not valid values.
--- Documentation/networking/bonding.rst | 11 ++++++----- drivers/net/bonding/bond_options.c | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-)
Documentation/networking/bonding.rst +6 -5
@@ -196,11 +196,12 @@ ad_actor_sys_prio ad_actor_system In an AD system, this specifies the mac-address for the actor in - protocol packet exchanges (LACPDUs). The value cannot be NULL or - multicast. It is preferred to have the local-admin bit set for this - mac but driver does not enforce it. If the value is not given then - system defaults to using the masters' mac address as actors' system - address. + protocol packet exchanges (LACPDUs). The value cannot be a multicast + address. If the all-zeroes MAC is specified, bonding will internally + use the MAC of the bond itself. It is preferred to have the + local-admin bit set for this mac but driver does not enforce it. If + the value is not given then system defaults to using the masters' + mac address as actors' system address. This parameter has effect only in 802.3ad mode and is available through SysFs interface.
drivers/net/bonding/bond_options.c +1 -1
@@ -1526,7 +1526,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, mac = (u8 *)&newval->value; } -if (!is_valid_ether_addr (mac)) +if (is_multicast_ether_addr (mac)) goto err;netdev_dbg (bond->dev,"Setting ad_actor_system to %pM\n" , mac);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 37/128 fjes: Check for error irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit db6d6afe382de5a65d6ccf51253ab48b8e8336c3 ]
I find that platform_get_irq() will not always succeed.
It will return error irq in case of the failure.
Therefore, it might be better to check it if order to avoid the use of error irq.
--- drivers/net/fjes/fjes_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/fjes/fjes_main.c +5 -0
@@ -1261,6 +1261,11 @@ static int fjes_probe(struct platform_device *plat_dev) hw->hw_res.start = res->start; hw->hw_res.size =resource_size (res); hw->hw_res.irq =platform_get_irq (plat_dev,0 ); +if (hw->hw_res.irq <0 ) { + err = hw->hw_res.irq; + goto err_free_control_wq; + } + err =fjes_hw_init (&adapter->hw);if (err) goto err_free_control_wq;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 38/128 drivers: net: smc911x: Check for error irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit cb93b3e11d405f20a405a07482d01147ef4934a3 ]
Because platform_get_irq() could fail and return error irq. Therefore, it might be better to check it if order to avoid the use of error irq.
--- drivers/net/ethernet/smsc/smc911x.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/smsc/smc911x.c +5 -0
@@ -2070,6 +2070,11 @@ static int smc911x_drv_probe(struct platform_device *pdev) ndev->dma = (unsigned char )-1 ; ndev->irq =platform_get_irq (pdev,0 ); +if (ndev->irq <0 ) { + ret = ndev->irq; + goto release_both; + } + lp =netdev_priv (ndev); lp->netdev = ndev;#ifdef SMC_DYNAMIC_BUS_CONFIG
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 39/128 net: ks8851: Check for error irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 99d7fbb5cedf598f67e8be106d6c7b8d91366aef ]
Because platform_get_irq() could fail and return error irq. Therefore, it might be better to check it if order to avoid the use of error irq.
--- drivers/net/ethernet/micrel/ks8851_par.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/micrel/ks8851_par.c +2 -0
@@ -321,6 +321,8 @@ static int ks8851_probe_par(struct platform_device *pdev)return ret; netdev->irq =platform_get_irq (pdev,0 ); +if (netdev->irq <0 ) +return netdev->irq;return ks8851_probe_common (netdev, dev, msg_enable); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 40/128 sfc: Check null pointer of rx_queue->page_ring
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit bdf1b5c3884f6a0dc91b0dbdb8c3b7d205f449e0 ]
Because of the possible failure of the kcalloc, it should be better to set rx_queue->page_ptr_mask to 0 when it happens in order to maintain the consistency.
--- drivers/net/ethernet/sfc/rx_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/sfc/rx_common.c +4 -1
@@ -150,7 +150,10 @@ static void efx_init_rx_recycle_ring(struct efx_rx_queue *rx_queue) efx->rx_bufs_per_page); rx_queue->page_ring =kcalloc (page_ring_size,sizeof (*rx_queue->page_ring),GFP_KERNEL ); - rx_queue->page_ptr_mask = page_ring_size -1 ; +if (!rx_queue->page_ring) + rx_queue->page_ptr_mask =0 ; +else + rx_queue->page_ptr_mask = page_ring_size -1 ; }static void efx_fini_rx_recycle_ring (struct efx_rx_queue *rx_queue)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 41/128 sfc: falcon: Check null pointer of rx_queue->page_ring
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 9b8bdd1eb5890aeeab7391dddcf8bd51f7b07216 ]
Because of the possible failure of the kcalloc, it should be better to set rx_queue->page_ptr_mask to 0 when it happens in order to maintain the consistency.
--- drivers/net/ethernet/sfc/falcon/rx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/sfc/falcon/rx.c +4 -1
@@ -728,7 +728,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx, efx->rx_bufs_per_page); rx_queue->page_ring =kcalloc (page_ring_size,sizeof (*rx_queue->page_ring),GFP_KERNEL ); - rx_queue->page_ptr_mask = page_ring_size -1 ; +if (!rx_queue->page_ring) + rx_queue->page_ptr_mask =0 ; +else + rx_queue->page_ptr_mask = page_ring_size -1 ; }void ef4_init_rx_queue (struct ef4_rx_queue *rx_queue)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 42/128 asix: fix uninit-value in asix_mdio_read()
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 8035b1a2a37a29d8c717ef84fca8fe7278bc9f03 ]
asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.
Fail log:
BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
--- drivers/net/usb/asix_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/asix_common.c +1 -1
@@ -77,7 +77,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm) 0, 0, 1, &smsr, in_pm);if (ret == -ENODEV )break ; -else if (ret <0 ) +else if (ret <sizeof (smsr))continue ;else if (smsr &AX_HOST_EN )break ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 43/128 asix: fix wrong return value in asix_check_host_enable()
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit d1652b70d07cc3eed96210c876c4879e1655f20e ]
If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from asix_check_host_enable(), which is logically wrong. Fix it by returning -ETIMEDOUT explicitly if we have exceeded 30 iterations
Also, replaced 30 with #define as suggested by Andrew
--- drivers/net/usb/asix_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/usb/asix_common.c +4 -2
@@ -9,6 +9,8 @@#include "asix.h" +#define AX_HOST_EN_RETRIES 30 +int asix_read_cmd (struct usbnet *dev,u8 cmd,u16 value,u16 index,u16 size,void *data,int in_pm) {
@@ -68,7 +70,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)int i, ret;u8 smsr; -for (i =0 ; i <30 ; ++i) { +for (i =0 ; i <AX_HOST_EN_RETRIES ; ++i) { ret =asix_set_sw_mii (dev, in_pm);if (ret == -ENODEV || ret == -ETIMEDOUT )break ;
@@ -83,7 +85,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)break ; } -return ret; +return i >=AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret; }static void reset_asix_rx_fixup_info (struct asix_rx_fixup_info *rx)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 44/128 io_uring: zero iocb->ki_pos for stream file types
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 7b9762a5e8837b92a027d58d396a9d27f6440c36 ]
io_uring supports using offset == -1 for using the current file position, and we read that in as part of read/write command setup. For the non-iter read/write types we pass in NULL for the position pointer, but for the iter types we should not be passing any anything but 0 for the position for a stream.
Clear kiocb->ki_pos if the file is a stream, don't leave it as -1. If we do, then the request will error with -ESPIPE.
--- fs/io_uring.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/io_uring.c +7 -3
@@ -2879,9 +2879,13 @@ static int io_prep_rw(struct io_kiocb *req, const struct io_uring_sqe *sqe, req->flags |=REQ_F_ISREG ; kiocb->ki_pos =READ_ONCE (sqe->off); -if (kiocb->ki_pos ==-1 && !(file->f_mode &FMODE_STREAM )) { - req->flags |=REQ_F_CUR_POS ; - kiocb->ki_pos = file->f_pos; +if (kiocb->ki_pos ==-1 ) { +if (!(file->f_mode &FMODE_STREAM )) { + req->flags |=REQ_F_CUR_POS ; + kiocb->ki_pos = file->f_pos; + }else { + kiocb->ki_pos =0 ; + } } kiocb->ki_hint =ki_hint_validate (file_write_hint (kiocb->ki_filp)); kiocb->ki_flags =iocb_flags (kiocb->ki_filp);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 45/128 veth: ensure skb entering GRO are not cloned.
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 9695b7de5b4760ed22132aca919570c0190cb0ce ]
After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer device, TCP skbs will go through the NAPI callback. If there is no XDP program attached, the veth code does not perform any share check, and shared/cloned skbs could enter the GRO engine.
Ignat reported a BUG triggered later-on due to the above condition:
[ 53.970529][ C1] kernel BUG at net/core/skbuff.c:3574! [ 53.981755][ C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 53.982634][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25 [ 53.982634][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 53.982634][ C1] RIP: 0010:skb_shift+0x13ef/0x23b0 [ 53.982634][ C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f 85 74 f5 ff ff <0f> 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89 f7 4c 89 8c [ 53.982634][ C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246 [ 53.982634][ C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000 [ 53.982634][ C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2 [ 53.982634][ C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0 [ 53.982634][ C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590 [ 53.982634][ C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0 [ 53.982634][ C1] FS: 0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000 [ 53.982634][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.982634][ C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0 [ 53.982634][ C1] Call Trace: [ 53.982634][ C1] <TASK> [ 53.982634][ C1] tcp_sacktag_walk+0xaba/0x18e0 [ 53.982634][ C1] tcp_sacktag_write_queue+0xe7b/0x3460 [ 53.982634][ C1] tcp_ack+0x2666/0x54b0 [ 53.982634][ C1] tcp_rcv_established+0x4d9/0x20f0 [ 53.982634][ C1] tcp_v4_do_rcv+0x551/0x810 [ 53.982634][ C1] tcp_v4_rcv+0x22ed/0x2ed0 [ 53.982634][ C1] ip_protocol_deliver_rcu+0x96/0xaf0 [ 53.982634][ C1] ip_local_deliver_finish+0x1e0/0x2f0 [ 53.982634][ C1] ip_sublist_rcv_finish+0x211/0x440 [ 53.982634][ C1] ip_list_rcv_finish.constprop.0+0x424/0x660 [ 53.982634][ C1] ip_list_rcv+0x2c8/0x410 [ 53.982634][ C1] __netif_receive_skb_list_core+0x65c/0x910 [ 53.982634][ C1] netif_receive_skb_list_internal+0x5f9/0xcb0 [ 53.982634][ C1] napi_complete_done+0x188/0x6e0 [ 53.982634][ C1] gro_cell_poll+0x10c/0x1d0 [ 53.982634][ C1] __napi_poll+0xa1/0x530 [ 53.982634][ C1] net_rx_action+0x567/0x1270 [ 53.982634][ C1] __do_softirq+0x28a/0x9ba [ 53.982634][ C1] run_ksoftirqd+0x32/0x60 [ 53.982634][ C1] smpboot_thread_fn+0x559/0x8c0 [ 53.982634][ C1] kthread+0x3b9/0x490 [ 53.982634][ C1] ret_from_fork+0x22/0x30 [ 53.982634][ C1] </TASK>
Address the issue by skipping the GRO stage for shared or cloned skbs. To reduce the chance of OoO, try to unclone the skbs before giving up.
v1 -> v2:
- use avoid skb_copy and fallback to netif_receive_skb - Eric
--- drivers/net/veth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/veth.c +6 -2
@@ -879,8 +879,12 @@ static int veth_xdp_rcv(struct veth_rq *rq, int budget, stats->xdp_bytes += skb->len; skb =veth_xdp_rcv_skb (rq, skb, bq, stats); -if (skb) -napi_gro_receive (&rq->xdp_napi, skb); +if (skb) { +if (skb_shared (skb) ||skb_unclone (skb,GFP_ATOMIC )) +netif_receive_skb (skb); +else +napi_gro_receive (&rq->xdp_napi, skb); + } } done++; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 46/128 net: stmmac: ptp: fix potentially overflowing expression
In reply to Greg Kroah-HartmanFrom: Xiaoliang Yang <[email protected]>
[ Upstream commit eccffcf4657ab9a148faaa0eb354d2a091caf552 ]
Convert the u32 variable to type u64 in a context where expression of type u64 is required to avoid potential overflow.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +1 -1
@@ -102,7 +102,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta) time.tv_nsec = priv->plat->est->btr_reserve[0 ]; time.tv_sec = priv->plat->est->btr_reserve[1 ]; basetime =timespec64_to_ktime (time); - cycle_time = priv->plat->est->ctr[1 ] *NSEC_PER_SEC + + cycle_time = (u64 )priv->plat->est->ctr[1 ] *NSEC_PER_SEC + priv->plat->est->ctr[0 ]; time = stmmac_calc_tas_basetime(basetime, current_time_ns,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 47/128 net: bridge: Use array_size() helper in copy_to_user()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 865bfb2affa8eff5182b29aa90803a2df4409834 ]
Use array_size() helper instead of the open-coded version in copy_to_user(). These sorts of multiplication factors need to be wrapped in array_size().
--- net/bridge/br_ioctl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/bridge/br_ioctl.c +5 -3
@@ -71,7 +71,8 @@ static int get_fdb_entries(struct net_bridge *br, void __user *userbuf, num =br_fdb_fillbuf (br, buf, maxnum, offset);if (num >0 ) { -if (copy_to_user (userbuf, buf, num*sizeof (struct __fdb_entry ))) +if (copy_to_user (userbuf, buf, +array_size (num,sizeof (struct __fdb_entry )))) num = -EFAULT ; }kfree (buf);
@@ -188,7 +189,7 @@ int br_dev_siocdevprivate(struct net_device *dev, struct ifreq *rq, void __userreturn -ENOMEM ;get_port_ifindices (br, indices, num); -if (copy_to_user (argp, indices, num *sizeof (int ))) +if (copy_to_user (argp, indices,array_size (num,sizeof (int )))) num = -EFAULT ;kfree (indices);return num;
@@ -336,7 +337,8 @@ static int old_deviceless(struct net *net, void __user *uarg) args[2 ] =get_bridge_ifindices (net, indices, args[2 ]); - ret =copy_to_user (uarg, indices, args[2 ]*sizeof (int )) + ret =copy_to_user (uarg, indices, +array_size (args[2 ],sizeof (int ))) ? -EFAULT : args[2 ];kfree (indices);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 48/128 net: bridge: fix ioctl old_deviceless bridge argument
In reply to Greg Kroah-HartmanFrom: Remi Pommarel <[email protected]>
[ Upstream commit d95a56207c078e2019cf6659d890ec1e987e8420 ]
Commit 561d8352818f ("bridge: use ndo_siocdevprivate") changed the source and destination arguments of copy_{to,from}_user in bridge's old_deviceless() from args[1] to uarg breaking SIOC{G,S}IFBR ioctls.
Commit cbd7ad29a507 ("net: bridge: fix ioctl old_deviceless bridge argument") fixed only BRCTL_{ADD,DEL}_BRIDGES commands leaving BRCTL_GET_BRIDGES one untouched.
The fixes BRCTL_GET_BRIDGES as well and has been tested with busybox's brctl.
Example of broken brctl:
$ brctl show bridge name bridge id STP enabled interfaces brctl: can't get bridge name for index 0: No such device or address
Example of fixed brctl:
$ brctl show bridge name bridge id STP enabled interfaces br0 8000.000000000000 no
--- net/bridge/br_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_ioctl.c +1 -1
@@ -337,7 +337,7 @@ static int old_deviceless(struct net *net, void __user *uarg) args[2 ] =get_bridge_ifindices (net, indices, args[2 ]); - ret =copy_to_user (uarg, indices, + ret =copy_to_user ((void __user *)args[1 ], indices,array_size (args[2 ],sizeof (int ))) ? -EFAULT : args[2 ];
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 49/128 r8152: fix the force speed doesnt work for RTL8156
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 45bf944e6703d43fe5e285808312acd8a34c1a24 ]
It needs to set mdio force mode. Otherwise, link off always occurs when setting force speed.
--- drivers/net/usb/r8152.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/net/usb/r8152.c +17 -0
@@ -6584,6 +6584,21 @@ static bool rtl8153_in_nway(struct r8152 *tp)return true; } +static void r8156_mdio_force_mode (struct r8152 *tp) +{ +u16 data; + +/* Select force mode through 0xa5b4 bit 15 +* 0: MDIO force mode +* 1: MMD force mode +*/ + data =ocp_reg_read (tp,0xa5b4 ); +if (data &BIT (15 )) { + data &= ~BIT (15 ); +ocp_reg_write (tp,0xa5b4 , data); + } +} +static void set_carrier (struct r8152 *tp) {struct net_device *netdev = tp->netdev;
@@ -8016,6 +8031,7 @@ static void r8156_init(struct r8152 *tp) ocp_data |=ACT_ODMA ;ocp_write_byte (tp,MCU_TYPE_USB ,USB_BMU_CONFIG , ocp_data); +r8156_mdio_force_mode (tp);rtl_tally_reset (tp); tp->coalesce =15000 ;/* 15 us */
@@ -8145,6 +8161,7 @@ static void r8156b_init(struct r8152 *tp) ocp_data &= ~(RX_AGG_DISABLE |RX_ZERO_EN );ocp_write_word (tp,MCU_TYPE_USB ,USB_USB_CTRL , ocp_data); +r8156_mdio_force_mode (tp);rtl_tally_reset (tp); tp->coalesce =15000 ;/* 15 us */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 50/128 net: stmmac: dwmac-visconti: Fix value of ETHER_CLK_SEL_FREQ_SEL_2P5M
In reply to Greg Kroah-HartmanFrom: Nobuhiro Iwamatsu <[email protected]>
[ Upstream commit 391e5975c0208ce3739587b33eba08be3e473d79 ]
ETHER_CLK_SEL_FREQ_SEL_2P5M is not 0 bit of the register. This is a value, which is 0. Fix from BIT(0) to 0.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-visconti.c +1 -1
@@ -26,7 +26,7 @@#define ETHER_CLK_SEL_FREQ_SEL_125M (BIT(9) | BIT(8))#define ETHER_CLK_SEL_FREQ_SEL_50M BIT(9)#define ETHER_CLK_SEL_FREQ_SEL_25M BIT(8) -#define ETHER_CLK_SEL_FREQ_SEL_2P5M BIT(0) +#define ETHER_CLK_SEL_FREQ_SEL_2P5M 0#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_IN BIT(0)#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_TXC BIT(10)#define ETHER_CLK_SEL_TX_CLK_EXT_SEL_DIV BIT(11)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 51/128 Input: elantech - fix stack out of bound access in elantech_change_report_id()
In reply to Greg Kroah-HartmanFrom: Andrea Righi <[email protected]>
[ Upstream commit 1d72d9f960ccf1052a0630a68c3d358791dbdaaa ]
The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN:
[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118
[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 [ 6.512436] Workqueue: events_long serio_handle_event [ 6.512453] Call Trace: [ 6.512462] show_stack+0x52/0x58 [ 6.512474] dump_stack+0xa1/0xd3 [ 6.512487] print_address_description.constprop.0+0x1d/0x140 [ 6.512502] ? __ps2_command+0x372/0x7e0 [ 6.512516] __kasan_report.cold+0x7d/0x112 [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 [ 6.512539] ? __ps2_command+0x372/0x7e0 [ 6.512552] kasan_report+0x3c/0x50 [ 6.512564] __asan_load1+0x6a/0x70 [ 6.512575] __ps2_command+0x372/0x7e0 [ 6.512589] ? ps2_drain+0x240/0x240 [ 6.512601] ? dev_printk_emit+0xa2/0xd3 [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 [ 6.512621] ? __kasan_check_write+0x14/0x20 [ 6.512634] ? mutex_lock+0x8f/0xe0 [ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 [ 6.512655] ps2_command+0x52/0x90 [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] [ 6.512863] ? ps2_command+0x7f/0x90 [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] [ 6.513122] ? phys_pmd_init+0x30e/0x521 [ 6.513137] elantech_init+0x8a/0x200 [psmouse] [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] [ 6.513519] ? mutex_unlock+0x22/0x40 [ 6.513526] ? ps2_command+0x7f/0x90 [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] [ 6.513624] psmouse_connect+0x272/0x530 [psmouse] [ 6.513669] serio_driver_probe+0x55/0x70 [ 6.513679] really_probe+0x190/0x720 [ 6.513689] driver_probe_device+0x160/0x1f0 [ 6.513697] device_driver_attach+0x119/0x130 [ 6.513705] ? device_driver_attach+0x130/0x130 [ 6.513713] __driver_attach+0xe7/0x1a0 [ 6.513720] ? device_driver_attach+0x130/0x130 [ 6.513728] bus_for_each_dev+0xfb/0x150 [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 [ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 [ 6.513757] driver_attach+0x2d/0x40 [ 6.513764] serio_handle_event+0x199/0x3d0 [ 6.513775] process_one_work+0x471/0x740 [ 6.513785] worker_thread+0x2d2/0x790 [ 6.513794] ? process_one_work+0x740/0x740 [ 6.513802] kthread+0x1b4/0x1e0 [ 6.513809] ? set_kthread_struct+0x80/0x80 [ 6.513816] ret_from_fork+0x22/0x30
[ 6.513832] The buggy address belongs to the page: [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 6.513860] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 [ 6.513867] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 6.513872] page dumped because: kasan: bad access detected
[ 6.513879] addr ffff8881024d77c2 is located in stack of task kworker/2:1/118 at offset 34 in frame: [ 6.513887] elantech_change_report_id+0x0/0x256 [psmouse]
[ 6.513941] this frame has 1 object: [ 6.513947] [32, 34) 'param'
[ 6.513956] Memory state around the buggy address: [ 6.513962] ffff8881024d7680: f2 f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 [ 6.513969] ffff8881024d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 6.513976] >ffff8881024d7780: 00 00 00 00 f1 f1 f1 f1 02 f3 f3 f3 00 00 00 00 [ 6.513982] ^ [ 6.513988] ffff8881024d7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 6.513995] ffff8881024d7880: 00 f1 f1 f1 f1 03 f2 03 f2 03 f3 f3 f3 00 00 00 [ 6.514000] ==================================================================
Define param[] in elantech_change_report_id() as an array of 3 bytes to prevent the out-of-bounds access in the stack.
--- drivers/input/mouse/elantech.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/input/mouse/elantech.c +7 -1
@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {*/ static int elantech_change_report_id (struct psmouse *psmouse) { -unsigned char param[2 ] = {0x10 ,0x03 }; +/* +* NOTE: the code is expecting to receive param[] as an array of 3 +* items (see __ps2_command()), even if in this case only 2 are +* actually needed. Make sure the array size is 3 to avoid potential +* stack out-of-bound accesses. +*/ +unsigned char param[3 ] = {0x10 ,0x03 }; if (elantech_write_reg_params(psmouse, 0x7, param) || elantech_read_reg_params(psmouse, 0x7, param) ||
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 52/128 pinctrl: bcm2835: Change init order for gpio hogs
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 266423e60ea1b953fcc0cd97f3dad85857e434d1 ]
...and gpio-ranges
pinctrl-bcm2835 is a combined pinctrl/gpio driver. Currently the gpio side is registered first, but this breaks gpio hogs (which are configured during gpiochip_add_data). Part of the hog initialisation is a call to pinctrl_gpio_request, and since the pinctrl driver hasn't yet been registered this results in an -EPROBE_DEFER from which it can never recover.
Change the initialisation sequence to register the pinctrl driver first.
This also solves a similar problem with the gpio-ranges property, which is required in order for released pins to be returned to inputs.
--- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 29 +++++++++++++++------------ 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/pinctrl/bcm/pinctrl-bcm2835.c +16 -13
@@ -1243,6 +1243,18 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)raw_spin_lock_init (&pc->irq_lock[i]); } + pc->pctl_desc = *pdata->pctl_desc; + pc->pctl_dev =devm_pinctrl_register (dev, &pc->pctl_desc, pc); +if (IS_ERR (pc->pctl_dev)) { +gpiochip_remove (&pc->gpio_chip); +return PTR_ERR (pc->pctl_dev); + } + + pc->gpio_range = *pdata->gpio_range; + pc->gpio_range.base = pc->gpio_chip.base; + pc->gpio_range.gc = &pc->gpio_chip; +pinctrl_add_gpio_range (pc->pctl_dev, &pc->gpio_range); + girq = &pc->gpio_chip.irq; girq->chip = &bcm2835_gpio_irq_chip; girq->parent_handler = bcm2835_gpio_irq_handler;
@@ -1250,8 +1262,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) girq->parents =devm_kcalloc (dev,BCM2835_NUM_IRQS ,sizeof (*girq->parents),GFP_KERNEL ); -if (!girq->parents) +if (!girq->parents) { +pinctrl_remove_gpio_range (pc->pctl_dev, &pc->gpio_range);return -ENOMEM ; + }if (is_7211) { pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS,
@@ -1306,21 +1320,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) err =gpiochip_add_data (&pc->gpio_chip, pc);if (err) {dev_err (dev,"could not add GPIO chip\n" ); +pinctrl_remove_gpio_range (pc->pctl_dev, &pc->gpio_range);return err; } - pc->pctl_desc = *pdata->pctl_desc; - pc->pctl_dev =devm_pinctrl_register (dev, &pc->pctl_desc, pc); -if (IS_ERR (pc->pctl_dev)) { -gpiochip_remove (&pc->gpio_chip); -return PTR_ERR (pc->pctl_dev); - } - - pc->gpio_range = *pdata->gpio_range; - pc->gpio_range.base = pc->gpio_chip.base; - pc->gpio_range.gc = &pc->gpio_chip; -pinctrl_add_gpio_range (pc->pctl_dev, &pc->gpio_range); -return 0 ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 53/128 hwmon: (lm90) Fix usage of CONFIG2 register in detect function
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit fce15c45d3fbd9fc1feaaf3210d8e3f8b33dfd3a ]
The detect function had a comment "Make compiler happy" when id did not read the second configuration register. As it turns out, the code was checking the contents of this register for manufacturer ID 0xA1 (NXP Semiconductor/Philips), but never actually read the register. So it wasn't surprising that the compiler complained, and it indeed had a point. Fix the code to read the register contents for manufacturer ID 0xa1.
At the same time, the code was reading the register for manufacturer ID 0x41 (Analog Devices), but it was not using the results. In effect it was just checking if reading the register returned an error. That doesn't really add much if any value, so stop doing that.
--- drivers/hwmon/lm90.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/hwmon/lm90.c +2 -3
@@ -1448,12 +1448,11 @@ static int lm90_detect(struct i2c_client *client,if (man_id <0 || chip_id <0 || config1 <0 || convrate <0 )return -ENODEV ; -if (man_id ==0x01 || man_id ==0x5C || man_id ==0x41 ) { +if (man_id ==0x01 || man_id ==0x5C || man_id ==0xA1 ) { config2 =i2c_smbus_read_byte_data (client,LM90_REG_R_CONFIG2 );if (config2 <0 )return -ENODEV ; - }else - config2 =0 ;/* Make compiler happy */ + }if ((address ==0x4C || address ==0x4D ) && man_id ==0x01 ) {/* National Semiconductor */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 54/128 hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 55840b9eae5367b5d5b29619dc2fb7e4596dba46 ]
Commit b50aa49638c7 ("hwmon: (lm90) Prevent integer underflows of temperature calculations") addressed a number of underflow situations when writing temperature limits. However, it missed one situation, seen when an attempt is made to set the hysteresis value to MAX_LONG and the critical temperature limit is negative.
Use clamp_val() when setting the hysteresis temperature to ensure that the provided value can never overflow or underflow.
--- drivers/hwmon/lm90.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/lm90.c +2 -2
@@ -1143,8 +1143,8 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)else temp =temp_from_s8 (data->temp8[LOCAL_CRIT ]); -/* prevent integer underflow */ - val =max (val,-128000l ); +/* prevent integer overflow/underflow */ + val =clamp_val (val,-128000l ,255000l ); data->temp_hyst =hyst_to_reg (temp - val); err = i2c_smbus_write_byte_data(client, LM90_REG_W_TCRIT_HYST,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 55/128 hwmon: (lm90) Introduce flag indicating extended temperature support
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit f347e249fcf920ad6974cbd898e2ec0b366a1c34 ]
A flag indicating extended temperature support makes it easier to add support for additional chips with this functionality.
--- drivers/hwmon/lm90.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/hwmon/lm90.c +11 -10
@@ -182,7 +182,8 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,#define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */ #define LM90_HAVE_TEMP3 (1 << 6)/* 3rd temperature sensor */ #define LM90_HAVE_BROKEN_ALERT (1 << 7)/* Broken alert */ -#define LM90_PAUSE_FOR_CONFIG (1 << 8)/* Pause conversion for config */ +#define LM90_HAVE_EXTENDED_TEMP (1 << 8)/* extended temperature support*/ +#define LM90_PAUSE_FOR_CONFIG (1 << 9)/* Pause conversion for config */ /* LM90 status */ #define LM90_STATUS_LTHRM (1 << 0)/* local THERM limit tripped */
@@ -350,7 +351,7 @@ static const struct lm90_params lm90_params[] = { }, [adt7461] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - | LM90_HAVE_BROKEN_ALERT, + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, .alert_alarms = 0x7c, .max_convrate = 10, },
@@ -422,7 +423,7 @@ static const struct lm90_params lm90_params[] = { }, [tmp451] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - | LM90_HAVE_BROKEN_ALERT, + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, .alert_alarms = 0x7c, .max_convrate = 9, .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
@@ -998,7 +999,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index)s16 temp11 = data->temp11[index];int temp; -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) temp =temp_from_u16_adt7461 (data, temp11);else if (data->kind == max6646) temp =temp_from_u16 (temp11);
@@ -1035,7 +1036,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val) val -=16000 ; } -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) data->temp11[index] =temp_to_u16_adt7461 (data, val);else if (data->kind == max6646) data->temp11[index] =temp_to_u8 (val) <<8 ;
@@ -1062,7 +1063,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index)s8 temp8 = data->temp8[index];int temp; -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) temp =temp_from_u8_adt7461 (data, temp8);else if (data->kind == max6646) temp =temp_from_u8 (temp8);
@@ -1098,7 +1099,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val) val -=16000 ; } -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) data->temp8[index] =temp_to_u8_adt7461 (data, val);else if (data->kind == max6646) data->temp8[index] =temp_to_u8 (val);
@@ -1116,7 +1117,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index) {int temp; -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) temp =temp_from_u8_adt7461 (data, data->temp8[index]);else if (data->kind == max6646) temp =temp_from_u8 (data->temp8[index]);
@@ -1136,7 +1137,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)int temp;int err; -if (data->kind == adt7461 || data->kind == tmp451) +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) temp =temp_from_u8_adt7461 (data, data->temp8[LOCAL_CRIT ]);else if (data->kind == max6646) temp =temp_from_u8 (data->temp8[LOCAL_CRIT ]);
@@ -1684,7 +1685,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)lm90_set_convrate (client, data,500 );/* 500ms; 2Hz conversion rate */ /* Check Temperature Range Select */ -if (data->kind == adt7461 || data->kind == tmp451) { +if (data->flags &LM90_HAVE_EXTENDED_TEMP ) {if (config &0x04 ) data->flags |=LM90_FLAG_ADT7461_EXT ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 56/128 hwmon: (lm90) Add basic support for TI TMP461
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit f8344f7693a25d9025a59d164450b50c6f5aa3c0 ]
TMP461 is almost identical to TMP451 and was actually detected as TMP451 with the existing lm90 driver if its I2C address is 0x4c. Add support for it to the lm90 driver. At the same time, improve the chip detection function to at least try to distinguish between TMP451 and TMP461.
As a side effect, this fixes commit 24333ac26d01 ("hwmon: (tmp401) use smb word operations instead of 2 smb byte operations"). TMP461 does not support word operations on temperature registers, which causes bad temperature readings with the tmp401 driver. The lm90 driver does not perform word operations on temperature registers and thus does not have this problem.
Support is listed as basic because TMP461 supports a sensor resolution of 0.0625 degrees C, while the lm90 driver assumes a resolution of 0.125 degrees C. Also, the TMP461 supports negative temperatures with its default temperature range, which is not the case for similar chips supported by the lm90 and the tmp401 drivers. Those limitations will be addressed with follow-up patches.
--- Documentation/hwmon/lm90.rst | 10 +++++++ drivers/hwmon/Kconfig | 2 +- drivers/hwmon/lm90.c | 54 ++++++++++++++++++++++++++---------- 3 files changed, 50 insertions(+), 16 deletions(-)
Documentation/hwmon/lm90.rst +10 -0
@@ -265,6 +265,16 @@ Supported chips: https://www.ti.com/litv/pdf/sbos686 + * Texas Instruments TMP461 + + Prefix: 'tmp461' + + Addresses scanned: I2C 0x48 through 0x4F + + Datasheet: Publicly available at TI website + + https://www.ti.com/lit/gpn/tmp461 + Author: Jean Delvare <[email protected]>
drivers/hwmon/Kconfig +1 -1
@@ -1317,7 +1317,7 @@ config SENSORS_LM90 Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, - Philips SA56004, GMT G781, and Texas Instruments TMP451 + Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461 sensor chips. This driver can also be built as a module. If so, the module
drivers/hwmon/lm90.c +39 -15
100 lines not on this page · raw message
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 57/128 hwmon: (lm90) Drop critical attribute support for MAX6654
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 16ba51b5dcd3f6dde2e51d5ccc86313119dcf889 ]
Tests with a real chip and a closer look into the datasheet show that MAX6654 does not support CRIT/THERM/OVERTEMP limits, so drop support of the respective attributes for this chip.
Introduce LM90_HAVE_CRIT flag and use it to instantiate critical limit attributes to solve the problem.
--- drivers/hwmon/lm90.c | 86 +++++++++++++++++++++++++------------------- 1 file changed, 49 insertions(+), 37 deletions(-)
drivers/hwmon/lm90.c +49 -37
@@ -35,13 +35,14 @@* explicitly as max6659, or if its address is not 0x4c. * These chips lack the remote temperature offset feature. * -* This driver also supports the MAX6654 chip made by Maxim. This chip can -* be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is -* otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available -* by setting the configuration register accordingly, and is done during -* initialization. Extended precision is only available at conversion rates -* of 1 Hz and slower. Note that extended precision is not enabled by -* default, as this driver initializes all chips to 2 Hz by design. +* This driver also supports the MAX6654 chip made by Maxim. This chip can be +* at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar +* to MAX6657/MAX6658/MAX6659, but does not support critical temperature +* limits. Extended range is available by setting the configuration register +* accordingly, and is done during initialization. Extended precision is only +* available at conversion rates of 1 Hz and slower. Note that extended +* precision is not enabled by default, as this driver initializes all chips +* to 2 Hz by design. * * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and * MAX6692 chips made by Maxim. These are again similar to the LM86,
@@ -188,6 +189,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,#define LM90_HAVE_BROKEN_ALERT (1 << 7)/* Broken alert */ #define LM90_HAVE_EXTENDED_TEMP (1 << 8)/* extended temperature support*/ #define LM90_PAUSE_FOR_CONFIG (1 << 9)/* Pause conversion for config */ +#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ /* LM90 status */ #define LM90_STATUS_LTHRM (1 << 0)/* local THERM limit tripped */
@@ -354,38 +356,43 @@ struct lm90_params {static const struct lm90_params lm90_params[] = { [adm1032] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - |LM90_HAVE_BROKEN_ALERT , + |LM90_HAVE_BROKEN_ALERT |LM90_HAVE_CRIT , .alert_alarms =0x7c , .max_convrate =10 , }, [adt7461] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - |LM90_HAVE_BROKEN_ALERT |LM90_HAVE_EXTENDED_TEMP , + |LM90_HAVE_BROKEN_ALERT |LM90_HAVE_EXTENDED_TEMP + |LM90_HAVE_CRIT , .alert_alarms =0x7c , .max_convrate =10 , }, [g781] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - |LM90_HAVE_BROKEN_ALERT , + |LM90_HAVE_BROKEN_ALERT |LM90_HAVE_CRIT , .alert_alarms =0x7c , .max_convrate =8 , }, [lm86] = { - .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT , + .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT + |LM90_HAVE_CRIT , .alert_alarms =0x7b , .max_convrate =9 , }, [lm90] = { - .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT , + .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT + |LM90_HAVE_CRIT , .alert_alarms =0x7b , .max_convrate =9 , }, [lm99] = { - .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT , + .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT + |LM90_HAVE_CRIT , .alert_alarms =0x7b , .max_convrate =9 , }, [max6646] = { + .flags =LM90_HAVE_CRIT , .alert_alarms =0x7c , .max_convrate =6 , .reg_local_ext =MAX6657_REG_R_LOCAL_TEMPL ,
@@ -396,50 +403,50 @@ static const struct lm90_params lm90_params[] = { .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [max6657] = { - .flags = LM90_PAUSE_FOR_CONFIG, + .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 8, .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [max6659] = { - .flags = LM90_HAVE_EMERGENCY, + .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 8, .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [max6680] = { - .flags = LM90_HAVE_OFFSET, + .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 7, }, [max6696] = { .flags =LM90_HAVE_EMERGENCY - | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3, + | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT, .alert_alarms = 0x1c7c, .max_convrate = 6, .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [w83l771] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 8, }, [sa56004] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, .alert_alarms = 0x7b, .max_convrate = 9, .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL, }, [tmp451] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 9, .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, }, [tmp461] = { .flags =LM90_HAVE_OFFSET |LM90_HAVE_REM_LIMIT_EXT - | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, .alert_alarms = 0x7c, .max_convrate = 9, .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
@@ -668,20 +675,22 @@ static int lm90_update_limits(struct device *dev)struct i2c_client *client = data->client;int val; - val =lm90_read_reg (client,LM90_REG_R_LOCAL_CRIT ); -if (val <0 ) -return val; - data->temp8[LOCAL_CRIT ] = val; +if (data->flags &LM90_HAVE_CRIT ) { + val =lm90_read_reg (client,LM90_REG_R_LOCAL_CRIT ); +if (val <0 ) +return val; + data->temp8[LOCAL_CRIT ] = val; - val =lm90_read_reg (client,LM90_REG_R_REMOTE_CRIT ); -if (val <0 ) -return val; - data->temp8[REMOTE_CRIT ] = val; + val =lm90_read_reg (client,LM90_REG_R_REMOTE_CRIT ); +if (val <0 ) +return val; + data->temp8[REMOTE_CRIT ] = val; - val =lm90_read_reg (client,LM90_REG_R_TCRIT_HYST ); -if (val <0 ) -return val; - data->temp_hyst = val; + val =lm90_read_reg (client,LM90_REG_R_TCRIT_HYST ); +if (val <0 ) +return val; + data->temp_hyst = val; + } val =lm90_read_reg (client,LM90_REG_R_REMOTE_LOWH );if (val <0 )
@@ -1902,11 +1911,14 @@ static int lm90_probe(struct i2c_client *client) info->config = data->channel_config; data->channel_config[0 ] =HWMON_T_INPUT |HWMON_T_MIN |HWMON_T_MAX | -HWMON_T_CRIT |HWMON_T_CRIT_HYST |HWMON_T_MIN_ALARM | -HWMON_T_MAX_ALARM |HWMON_T_CRIT_ALARM ; +HWMON_T_MIN_ALARM |HWMON_T_MAX_ALARM ; data->channel_config[1 ] =HWMON_T_INPUT |HWMON_T_MIN |HWMON_T_MAX | -HWMON_T_CRIT |HWMON_T_CRIT_HYST |HWMON_T_MIN_ALARM | -HWMON_T_MAX_ALARM |HWMON_T_CRIT_ALARM |HWMON_T_FAULT ; +HWMON_T_MIN_ALARM |HWMON_T_MAX_ALARM |HWMON_T_FAULT ; + +if (data->flags &LM90_HAVE_CRIT ) { + data->channel_config[0 ] |=HWMON_T_CRIT |HWMON_T_CRIT_ALARM |HWMON_T_CRIT_HYST ; + data->channel_config[1 ] |=HWMON_T_CRIT |HWMON_T_CRIT_ALARM |HWMON_T_CRIT_HYST ; + }if (data->flags &LM90_HAVE_OFFSET ) data->channel_config[1 ] |=HWMON_T_OFFSET ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 58/128 ARM: 9160/1: NOMMU: Reload __secondary_data after PROCINFO_INITFUNC
In reply to Greg Kroah-HartmanFrom: Vladimir Murzin <[email protected]>
[ Upstream commit 7202216a6f34d571a22274e729f841256bf8b1ef ]
__secondary_data used to reside in r7 around call to PROCINFO_INITFUNC. After commit 95731b8ee63e ("ARM: 9059/1: cache-v7:
get rid of mini-stack") r7 is used as a scratch register, so we have to reload __secondary_data before we setup the stack pointer.
--- arch/arm/kernel/head-nommu.S | 1 + 1 file changed, 1 insertion(+)
arch/arm/kernel/head-nommu.S +1 -0
@@ -114,6 +114,7 @@ ENTRY(secondary_startup) add r12, r12, r10 ret r12 1: bl __after_proc_init + ldr r7, __secondary_data @ reload r7 ldr sp, [r7, #12] @ set up the stack pointer mov fp, #0 b secondary_start_kernel
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 59/128 uapi: Fix undefined __always_inline on non-glibc systems
In reply to Greg Kroah-HartmanFrom: Ismael Luceno <[email protected]>
[ Upstream commit cb8747b7d2a9e3d687a19a007575071d4b71cd05 ]
This macro is defined by glibc itself, which makes the issue go unnoticed on those systems. On non-glibc systems it causes build failures on several utilities and libraries, like bpftool and objtool.
--- include/uapi/linux/byteorder/big_endian.h | 1 + include/uapi/linux/byteorder/little_endian.h | 1 + 2 files changed, 2 insertions(+)
include/uapi/linux/byteorder/big_endian.h +1 -0
@@ -9,6 +9,7 @@#define __BIG_ENDIAN_BITFIELD#endif +#include <linux/stddef.h> #include <linux/types.h> #include <linux/swab.h>
include/uapi/linux/byteorder/little_endian.h +1 -0
@@ -9,6 +9,7 @@#define __LITTLE_ENDIAN_BITFIELD#endif +#include <linux/stddef.h> #include <linux/types.h> #include <linux/swab.h>
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 60/128 compiler.h: Fix annotation macro misplacement with Clang
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit dcce50e6cc4d86a63dc0a9a6ee7d4f948ccd53a1 ]
When building with Clang and CONFIG_TRACE_BRANCH_PROFILING, there are a lot of unreachable warnings, like:
arch/x86/kernel/traps.o: warning: objtool: handle_xfd_event()+0x134: unreachable instruction
Without an input to the inline asm, 'volatile' is ignored for some reason and Clang feels free to move the reachable() annotation away from its intended location.
Fix that by re-adding the counter value to the inputs.
--- include/linux/compiler.h | 4 ++-- include/linux/instrumentation.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
include/linux/compiler.h +2 -2
@@ -121,7 +121,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, asm volatile(__stringify_label(c) ":\n\t" \".pushsection .discard.reachable\n\t" \ ".long " __stringify_label(c) "b - .\n\t" \ - ".popsection\n\t"); \ + ".popsection\n\t" : : "i" (c)); \ })#define annotate_reachable () __annotate_reachable(__COUNTER__)
@@ -129,7 +129,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, asm volatile(__stringify_label(c) ":\n\t" \".pushsection .discard.unreachable\n\t" \ ".long " __stringify_label(c) "b - .\n\t" \ - ".popsection\n\t"); \ + ".popsection\n\t" : : "i" (c)); \ })#define annotate_unreachable () __annotate_unreachable(__COUNTER__)
include/linux/instrumentation.h +2 -2
@@ -11,7 +11,7 @@ asm volatile(__stringify(c) ": nop\n\t" \".pushsection .discard.instr_begin\n\t" \ ".long " __stringify(c) "b - .\n\t" \ - ".popsection\n\t"); \ + ".popsection\n\t" : : "i" (c)); \ })#define instrumentation_begin () __instrumentation_begin(__COUNTER__)
@@ -50,7 +50,7 @@ asm volatile(__stringify(c) ": nop\n\t" \".pushsection .discard.instr_end\n\t" \ ".long " __stringify(c) "b - .\n\t" \ - ".popsection\n\t"); \ + ".popsection\n\t" : : "i" (c)); \ })#define instrumentation_end () __instrumentation_end(__COUNTER__)#else
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 61/128 platform/x86/intel: Remove X86_PLATFORM_DRIVERS_INTEL
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 4f6c131c3c31b9f68470ebd01320d5403d8719bb ]
While introduction of this menu brings a nice view in the configuration tools, it brought more issues than solves, i.e. it prevents to locate files in the intel/ subfolder without touching non-related Kconfig dependencies elsewhere. Drop X86_PLATFORM_DRIVERS_INTEL altogether.
Note, on x86 it's enabled by default and it's quite unlikely anybody wants to disable all of the modules in this submenu.
--- drivers/platform/x86/Makefile | 2 +- drivers/platform/x86/intel/Kconfig | 15 --------------- 2 files changed, 1 insertion(+), 16 deletions(-)
drivers/platform/x86/Makefile +1 -1
@@ -67,7 +67,7 @@ obj-$(CONFIG_THINKPAD_ACPI) += thinkpad_acpi.o obj-$(CONFIG_THINKPAD_LMI) += think-lmi.o # Intel -obj-$(CONFIG_X86_PLATFORM_DRIVERS_INTEL) += intel/ +obj-y += intel/ # MSI obj-$(CONFIG_MSI_LAPTOP) += msi-laptop.o
drivers/platform/x86/intel/Kconfig +0 -15
@@ -3,19 +3,6 @@ # Intel x86 Platform Specific Drivers # -menuconfig X86_PLATFORM_DRIVERS_INTEL - bool "Intel x86 Platform Specific Device Drivers" - default y - help - Say Y here to get to see options for device drivers for - various Intel x86 platforms, including vendor-specific - drivers. This option alone does not add any kernel code. - - If you say N, all options in this submenu will be skipped - and disabled. - -if X86_PLATFORM_DRIVERS_INTEL - source "drivers/platform/x86/intel/atomisp2/Kconfig" source "drivers/platform/x86/intel/int1092/Kconfig" source "drivers/platform/x86/intel/int33fe/Kconfig"
@@ -167,5 +154,3 @@ config INTEL_UNCORE_FREQ_CONTROL To compile this driver as a module, choose M here: the module will be called intel-uncore-frequency. - -endif # X86_PLATFORM_DRIVERS_INTEL
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 62/128 kernel/crash_core: suppress unknown crashkernel parameter warning
In reply to Greg Kroah-HartmanFrom: Philipp Rudo <[email protected]>
[ Upstream commit 71d2bcec2d4d69ff109c497e6611d6c53c8926d4 ]
When booting with crashkernel= on the kernel command line a warning similar to
Kernel command line: ro console=ttyS0 crashkernel=256M
Unknown kernel command line parameters "crashkernel=256M", will be passed to user space.
is printed.
This comes from crashkernel= being parsed independent from the kernel parameter handling mechanism. So the code in init/main.c doesn't know that crashkernel= is a valid kernel parameter and prints this incorrect warning.
Suppress the warning by adding a dummy early_param handler for crashkernel=.
--- kernel/crash_core.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
kernel/crash_core.c +11 -0
@@ -6,6 +6,7 @@#include <linux/buildid.h> #include <linux/crash_core.h> +#include <linux/init.h> #include <linux/utsname.h> #include <linux/vmalloc.h>
@@ -295,6 +296,16 @@ int __init parse_crashkernel_low(char *cmdline, "crashkernel=", suffix_tbl[SUFFIX_LOW]); } +/* +* Add a dummy early_param handler to mark crashkernel= as a known command line +* parameter and suppress incorrect warnings in init/main.c. +*/ +static int __init parse_crashkernel_dummy (char *arg) +{ +return 0 ; +} +early_param ("crashkernel" , parse_crashkernel_dummy); +Elf_Word *append_elf_note (Elf_Word *buf,char *name,unsigned int type,void *data,size_t data_len) {
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 63/128 Revert "x86/boot: Pull up cmdline preparation and early param parsing"
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit fbe6183998546f8896ee0b620ece86deff5a2fd1 upstream.
This reverts commit 8d48bf8206f77aa8687f0e241e901e5197e52423.
It turned out to be a bad idea as it broke supplying mem= cmdline parameters due to parse_memopt() requiring preparatory work like setting up the e820 table in e820__memory_setup() in order to be able to exclude the range specified by mem=.
Pulling that up would've broken Xen PV again, see threads at
https://lkml.kernel.org/r/[email protected]
due to xen_memory_setup() needing the first reservations in early_reserve_memory() - kernel and initrd - to have happened already.
This could be fixed again by having Xen do those reservations itself...
Long story short, revert this and do a simpler fix in a later patch.
--- arch/x86/kernel/setup.c | 66 +++++++++++++++++++----------------------------- 1 file changed, 27 insertions(+), 39 deletions(-)
arch/x86/kernel/setup.c +27 -39
@@ -742,28 +742,6 @@ dump_kernel_offset(struct notifier_blockreturn 0 ; } -static char *prepare_command_line (void ) -{ -#ifdef CONFIG_CMDLINE_BOOL -#ifdef CONFIG_CMDLINE_OVERRIDE -strlcpy (boot_command_line, builtin_cmdline,COMMAND_LINE_SIZE ); -#else -if (builtin_cmdline[0 ]) { -/* append boot loader cmdline to builtin */ -strlcat (builtin_cmdline," " ,COMMAND_LINE_SIZE ); -strlcat (builtin_cmdline, boot_command_line,COMMAND_LINE_SIZE ); -strlcpy (boot_command_line, builtin_cmdline,COMMAND_LINE_SIZE ); - } -#endif -#endif - -strlcpy (command_line, boot_command_line,COMMAND_LINE_SIZE ); - -parse_early_param (); - -return command_line; -} -/* * Determine if we were loaded by an EFI loader. If so, then we have also been * passed the efi memmap, systab, etc., so we should use these data structures
@@ -853,23 +831,6 @@ void __init setup_arch(char **cmdline_p) x86_init.oem.arch_setup ();/* -* x86_configure_nx() is called before parse_early_param() (called by -* prepare_command_line()) to detect whether hardware doesn't support -* NX (so that the early EHCI debug console setup can safely call -* set_fixmap()). It may then be called again from within noexec_setup() -* during parsing early parameters to honor the respective command line -* option. -*/ -x86_configure_nx (); - -/* -* This parses early params and it needs to run before -* early_reserve_memory() because latter relies on such settings -* supplied as early params. -*/ - *cmdline_p =prepare_command_line (); - -/* * Do some memory reservations *before* memory is added to memblock, so * memblock allocations won't overwrite it. *
@@ -902,6 +863,33 @@ void __init setup_arch(char **cmdline_p) bss_resource.start =__pa_symbol (__bss_start); bss_resource.end =__pa_symbol (__bss_stop)-1 ; +#ifdef CONFIG_CMDLINE_BOOL +#ifdef CONFIG_CMDLINE_OVERRIDE +strlcpy (boot_command_line, builtin_cmdline,COMMAND_LINE_SIZE ); +#else +if (builtin_cmdline[0 ]) { +/* append boot loader cmdline to builtin */ +strlcat (builtin_cmdline," " ,COMMAND_LINE_SIZE ); +strlcat (builtin_cmdline, boot_command_line,COMMAND_LINE_SIZE ); +strlcpy (boot_command_line, builtin_cmdline,COMMAND_LINE_SIZE ); + } +#endif +#endif + +strlcpy (command_line, boot_command_line,COMMAND_LINE_SIZE ); + *cmdline_p = command_line; + +/* +* x86_configure_nx() is called before parse_early_param() to detect +* whether hardware doesn't support NX (so that the early EHCI debug +* console setup can safely call set_fixmap()). It may then be called +* again from within noexec_setup() during parsing early parameters +* to honor the respective command line option. +*/ +x86_configure_nx (); + +parse_early_param (); +#ifdef CONFIG_MEMORY_HOTPLUG /* * Memory used by the kernel cannot be hot-removed because Linux
Greg Kroah-Hartman
maintainerPATCH 64/128 x86/boot: Move EFI range reservation after cmdline parsing
In reply to Greg Kroah-HartmanFrom: Mike Rapoport <[email protected]>
commit 2f5b3514c33fecad4003ce0f22ca9691492d310b upstream.
The memory reservation in arch/x86/platform/efi/efi.c depends on at least two command line parameters. Put it back later in the boot process and move efi_memblock_x86_reserve_range() out of early_memory_reserve().
An attempt to fix this was done in
8d48bf8206f7 ("x86/boot: Pull up cmdline preparation and early param parsing")
but that caused other troubles so it got reverted.
The bug this is addressing is:
Dan reports that Anjaneya Chagam can no longer use the efi=nosoftreserve kernel command line parameter to suppress "soft reservation" behavior.
This is due to the fact that the following call-chain happens at boot:
early_reserve_memory
|-> efi_memblock_x86_reserve_range
|-> efi_fake_memmap_early
which does
if (!efi_soft_reserve_enabled())
return;and that would have set EFI_MEM_NO_SOFT_RESERVE after having parsed "nosoftreserve".
However, parse_early_param() gets called *after* it, leading to the boot cmdline not being taken into account.
See also https://lore.kernel.org/r/[email protected]
[ bp: Turn into a proper patch. ]
--- arch/x86/kernel/setup.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/setup.c +3 -3
@@ -713,9 +713,6 @@ static void __init early_reserve_memory(early_reserve_initrd (); -if (efi_enabled (EFI_BOOT )) -efi_memblock_x86_reserve_range (); -memblock_x86_reserve_range_setup_data ();reserve_ibft_region ();
@@ -890,6 +887,9 @@ void __init setup_arch(char **cmdline_p)parse_early_param (); +if (efi_enabled (EFI_BOOT )) +efi_memblock_x86_reserve_range (); +#ifdef CONFIG_MEMORY_HOTPLUG /* * Memory used by the kernel cannot be hot-removed because Linux
Greg Kroah-Hartman
maintainerPATCH 65/128 ALSA: jack: Check the return value of kstrdup()
In reply to Greg Kroah-HartmanFrom: Xiaoke Wang <[email protected]>
commit c01c1db1dc632edafb0dff32d40daf4f9c1a4e19 upstream.
kstrdup() can return NULL, it is better to check the return value of it.
--- sound/core/jack.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/core/jack.c +4 -0
@@ -509,6 +509,10 @@ int snd_jack_new(struct snd_card *card,return -ENOMEM ; jack->id =kstrdup (id,GFP_KERNEL ); +if (jack->id ==NULL ) { +kfree (jack); +return -ENOMEM ; + }/* don't creat input device for phantom jack */ if (!phantom_jack) {
Greg Kroah-Hartman
maintainerPATCH 66/128 ALSA: drivers: opl3: Fix incorrect use of vp->state
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 2dee54b289fbc810669a1b2b8a0887fa1c9a14d7 upstream.
Static analysis with scan-build has found an assignment to vp2 that is never used. It seems that the check on vp->state > 0 should be actually on vp2->state instead. Fix this.
This dates back to 2002, I found the offending commit from the git history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git,
commit 91e39521bbf6 ("[PATCH] ALSA patch for 2.5.4")
--- sound/drivers/opl3/opl3_midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/drivers/opl3/opl3_midi.c +1 -1
@@ -397,7 +397,7 @@ void snd_opl3_note_on(void *p, int note, }if (instr_4op) { vp2 = &opl3->voices[voice +3 ]; -if (vp->state >0 ) { +if (vp2->state >0 ) { opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK + voice_offset +3 ); reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT ;
Greg Kroah-Hartman
maintainerPATCH 67/128 ALSA: rawmidi - fix the uninitalized user_pversion
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit 39a8fc4971a00d22536aeb7d446ee4a97810611b upstream.
The user_pversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation.
The kernel ALSA sequencer code clears the file structure, so no additional fixes are required.
--- sound/core/rawmidi.c | 1 + 1 file changed, 1 insertion(+)
sound/core/rawmidi.c +1 -0
@@ -447,6 +447,7 @@ static int snd_rawmidi_open(struct inode err = -ENOMEM ; goto __error; } + rawmidi_file->user_pversion =0 ;init_waitqueue_entry (&wait, current);add_wait_queue (&rmidi->open_wait, &wait);while (1 ) {
Greg Kroah-Hartman
maintainerPATCH 68/128 ALSA: hda/hdmi: Disable silent stream on GLK
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit b6fd77472dea76b7a2bad3a338ade920152972b8 upstream.
The silent stream stuff recurses back into i915 audio component .get_power() from the .pin_eld_notify() hook. On GLK this will deadlock as i915 may already be holding the relevant modeset locks during .pin_eld_notify() and the GLK audio vs. CDCLK workaround will try to grab the same locks from .get_power().
Until someone comes up with a better fix just disable the silent stream support on GLK.
--- sound/pci/hda/patch_hdmi.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
sound/pci/hda/patch_hdmi.c +15 -6
@@ -2947,7 +2947,8 @@ static int parse_intel_hdmi(struct hda_c/* Intel Haswell and onwards; audio component with eld notifier */ static int intel_hsw_common_init (struct hda_codec *codec,hda_nid_t vendor_nid, -const int *port_map,int port_num,int dev_num) +const int *port_map,int port_num,int dev_num, +bool send_silent_stream) {struct hdmi_spec *spec;int err;
@@ -2980,7 +2981,7 @@ static int intel_hsw_common_init(struct* Enable silent stream feature, if it is enabled via * module param or Kconfig option */ -if (enable_silent_stream) +if (send_silent_stream) spec->send_silent_stream = true;return parse_intel_hdmi (codec);
@@ -2988,12 +2989,18 @@ static int intel_hsw_common_init(structstatic int patch_i915_hsw_hdmi (struct hda_codec *codec) { -return intel_hsw_common_init (codec,0x08 ,NULL ,0 ,3 ); +return intel_hsw_common_init (codec,0x08 ,NULL ,0 ,3 , + enable_silent_stream); }static int patch_i915_glk_hdmi (struct hda_codec *codec) { -return intel_hsw_common_init (codec,0x0b ,NULL ,0 ,3 ); +/* +* Silent stream calls audio component .get_power() from +* .pin_eld_notify(). On GLK this will deadlock in i915 due +* to the audio vs. CDCLK workaround. +*/ +return intel_hsw_common_init (codec,0x0b ,NULL ,0 ,3 , false); }static int patch_i915_icl_hdmi (struct hda_codec *codec)
@@ -3004,7 +3011,8 @@ static int patch_i915_icl_hdmi(struct hd*/ static const int map[] = {0x0 ,0x4 ,0x6 ,0x8 ,0xa ,0xb }; -return intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),3 ); +return intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),3 , + enable_silent_stream); }static int patch_i915_tgl_hdmi (struct hda_codec *codec)
@@ -3016,7 +3024,8 @@ static int patch_i915_tgl_hdmi(struct hdstatic const int map[] = {0x4 ,0x6 ,0x8 ,0xa ,0xb ,0xc ,0xd ,0xe ,0xf };int ret; - ret =intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),4 ); + ret =intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),4 , + enable_silent_stream);if (!ret) {struct hdmi_spec *spec = codec->spec;
Greg Kroah-Hartman
maintainerPATCH 69/128 ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6
In reply to Greg Kroah-HartmanFrom: Bradley Scott <[email protected]>
commit d296a74b7b59ff9116236c17edb25f26935dbf70 upstream.
HP ZBook 15 G6 (SSID 103c:860f) needs the same speaker amplifier initialization as used on several other HP laptops using ALC285.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8660,6 +8660,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x84da ,"HP OMEN dc0019-ur" ,ALC295_FIXUP_HP_OMEN ),SND_PCI_QUIRK (0x103c ,0x84e7 ,"HP Pavilion 15" ,ALC269_FIXUP_HP_MUTE_LED_MIC3 ),SND_PCI_QUIRK (0x103c ,0x8519 ,"HP Spectre x360 15-df0xxx" ,ALC285_FIXUP_HP_SPECTRE_X360 ), +SND_PCI_QUIRK (0x103c ,0x860f ,"HP ZBook 15 G6" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x861f ,"HP Elite Dragonfly G1" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x869d ,"HP" ,ALC236_FIXUP_HP_MUTE_LED ), SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO),
Greg Kroah-Hartman
maintainerPATCH 70/128 ALSA: hda/realtek: Add new alc285-hp-amp-init model
In reply to Greg Kroah-HartmanFrom: Bradley Scott <[email protected]>
commit aa72394667e5cea3547e4c41ddff7ca8c632d764 upstream.
Adds a new "alc285-hp-amp-init" model that can be used to apply the ALC285 HP speaker amplifier initialization fixup to devices that are not already known by passing "hda_model=alc285-hp-amp-init" to the snd-sof-intel-hda-common module or "model=alc285-hp-amp-init" to the snd-hda-intel module, depending on which is being used.
--- Documentation/sound/hd-audio/models.rst | 2 ++ sound/pci/hda/patch_realtek.c | 1 + 2 files changed, 3 insertions(+)
Documentation/sound/hd-audio/models.rst +2 -0
@@ -326,6 +326,8 @@ usi-headset Headset support on USI machines dual-codecs Lenovo laptops with dual codecs +alc285-hp-amp-init + HP laptops which require speaker amplifier initialization (ALC285) ALC680 ======
sound/pci/hda/patch_realtek.c +1 -0
@@ -9124,6 +9124,7 @@ static const struct hda_model_fixup alc2 {.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"}, {.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"}, {.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"}, + {.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"}, {} };#define ALC225_STANDARD_PINS \
Greg Kroah-Hartman
maintainerPATCH 71/128 ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit f7ac570d0f026cf5475d4cc4d8040bd947980b3a upstream.
There is a HP ProBook which using ALC236 codec and need the ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mute LED and micmute LED work.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8706,6 +8706,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8896 ,"HP EliteBook 855 G8 Notebook PC" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x8898 ,"HP EliteBook 845 G8 Notebook PC" ,ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x103c ,0x88d0 ,"HP Pavilion 15-eh1xxx (mainboard 88D0)" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x89ca ,"HP" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x1043 ,0x103e ,"ASUS X540SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x103f ,"ASUS TX300" ,ALC282_FIXUP_ASUS_TX300 ), SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
Greg Kroah-Hartman
maintainerPATCH 72/128 ALSA: hda/realtek: Fix quirk for Clevo NJ51CU
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
commit edca7cc4b0accfa69dc032442fe0684e59c691b8 upstream.
The Clevo NJ51CU comes either with the ALC293 or the ALC256 codec, but uses the 0x8686 subproduct id in both cases. The ALC256 codec needs a different quirk for the headset microphone working and and edditional quirk for sound working after suspend and resume.
When waking up from s3 suspend the Coef 0x10 is set to 0x0220 instead of 0x0020 on the ALC256 codec. Setting the value manually makes the sound work again. This patch does this automatically.
[ minor coding style fix by tiwai ]
--- sound/pci/hda/patch_realtek.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +25 -1
@@ -6546,6 +6546,23 @@ static void alc233_fixup_no_audio_jack(salc_process_coef_fw (codec, alc233_fixup_no_audio_jack_coefs); } +static void alc256_fixup_mic_no_presence_and_resume (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* +* The Clevo NJ51CU comes either with the ALC293 or the ALC256 codec, +* but uses the 0x8686 subproduct id in both cases. The ALC256 codec +* needs an additional quirk for sound working after suspend and resume. +*/ +if (codec->core.vendor_id ==0x10ec0256 ) { +alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 ); +snd_hda_codec_set_pincfg (codec,0x19 ,0x04a11120 ); + }else { +snd_hda_codec_set_pincfg (codec,0x1a ,0x04a1113c ); + } +} +enum {ALC269_FIXUP_GPIO2 ,ALC269_FIXUP_SONY_VAIO ,
@@ -6766,6 +6783,7 @@ enum {ALC256_FIXUP_SET_COEF_DEFAULTS ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ,ALC233_FIXUP_NO_AUDIO_JACK , + ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME, }; static const struct hda_fixup alc269_fixups[] = {
@@ -8490,6 +8508,12 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc233_fixup_no_audio_jack, }, + [ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc256_fixup_mic_no_presence_and_resume, + .chained = true, + .chain_id =ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8831,7 +8855,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1558 ,0x8562 ,"Clevo NH[57][0-9]RZ[Q]" ,ALC269_FIXUP_DMIC ),SND_PCI_QUIRK (0x1558 ,0x8668 ,"Clevo NP50B[BE]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x8680 ,"Clevo NJ50LU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0x1558 ,0x8686 ,"Clevo NH50[CZ]U" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x8686 ,"Clevo NH50[CZ]U" ,ALC256_FIXUP_MIC_NO_PRESENCE_AND_RESUME ),SND_PCI_QUIRK (0x1558 ,0x8a20 ,"Clevo NH55DCQ-Y" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x8a51 ,"Clevo NH70RCQ-Y" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 73/128 ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
commit ee907afb0c39a41ee74b862882cfe12820c74b98 upstream.
The out-of-tree vendor driver uses the following approach to set the AIU_I2S_MISC register:
1) write AIU_MEM_I2S_START_PTR and AIU_MEM_I2S_RD_PTR
2) configure AIU_I2S_MUTE_SWAP[15:0]
3) write AIU_MEM_I2S_END_PTR
4) set AIU_I2S_MISC[2] to 1 (documented as: "put I2S interface in hold mode")
5) set AIU_I2S_MISC[4] to 1 (depending on the driver revision it always stays at 1 while for older drivers this bit is unset in step 4)
6) set AIU_I2S_MISC[2] to 0
7) write AIU_MEM_I2S_MASKS
8) toggle AIU_MEM_I2S_CONTROL[0]
9) toggle AIU_MEM_I2S_BUF_CNTL[0]
Move setting the AIU_I2S_MISC[2] bit to aiu_fifo_i2s_hw_params() so it resembles the flow in the vendor kernel more closely. While here also configure AIU_I2S_MISC[4] (documented as: "force each audio data to left or right according to the bit attached with the audio data") similar to how the vendor driver does this. This fixes the infamous and long-standing "machine gun noise" issue (a buffer underrun issue).
--- sound/soc/meson/aiu-encoder-i2s.c | 33 --------------------------------- sound/soc/meson/aiu-fifo-i2s.c | 19 +++++++++++++++++++ 2 files changed, 19 insertions(+), 33 deletions(-)
sound/soc/meson/aiu-encoder-i2s.c +0 -33
@@ -18,7 +18,6 @@#define AIU_RST_SOFT_I2S_FAST BIT(0)#define AIU_I2S_DAC_CFG_MSB_FIRST BIT(2) -#define AIU_I2S_MISC_HOLD_EN BIT(2)#define AIU_CLK_CTRL_I2S_DIV_EN BIT(0)#define AIU_CLK_CTRL_I2S_DIV GENMASK(3, 2)#define AIU_CLK_CTRL_AOCLK_INVERT BIT(6)
@@ -36,37 +35,6 @@ static void aiu_encoder_i2s_divider_enab enable ? AIU_CLK_CTRL_I2S_DIV_EN : 0); } -static void aiu_encoder_i2s_hold (struct snd_soc_component *component, -bool enable) -{ -snd_soc_component_update_bits (component,AIU_I2S_MISC , -AIU_I2S_MISC_HOLD_EN , - enable ?AIU_I2S_MISC_HOLD_EN :0 ); -} - -static int aiu_encoder_i2s_trigger (struct snd_pcm_substream *substream,int cmd, -struct snd_soc_dai *dai) -{ -struct snd_soc_component *component = dai->component; - -switch (cmd) { -case SNDRV_PCM_TRIGGER_START : -case SNDRV_PCM_TRIGGER_RESUME : -case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : -aiu_encoder_i2s_hold (component, false); -return 0 ; - -case SNDRV_PCM_TRIGGER_STOP : -case SNDRV_PCM_TRIGGER_SUSPEND : -case SNDRV_PCM_TRIGGER_PAUSE_PUSH : -aiu_encoder_i2s_hold (component, true); -return 0 ; - -default : -return -EINVAL ; - } -} -static int aiu_encoder_i2s_setup_desc (struct snd_soc_component *component,struct snd_pcm_hw_params *params) {
@@ -353,7 +321,6 @@ static void aiu_encoder_i2s_shutdown(str }const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { - .trigger = aiu_encoder_i2s_trigger, .hw_params = aiu_encoder_i2s_hw_params, .hw_free = aiu_encoder_i2s_hw_free, .set_fmt = aiu_encoder_i2s_set_fmt,
sound/soc/meson/aiu-fifo-i2s.c +19 -0
@@ -20,6 +20,8 @@#define AIU_MEM_I2S_CONTROL_MODE_16BIT BIT(6)#define AIU_MEM_I2S_BUF_CNTL_INIT BIT(0)#define AIU_RST_SOFT_I2S_FAST BIT(0) +#define AIU_I2S_MISC_HOLD_EN BIT(2) +#define AIU_I2S_MISC_FORCE_LEFT_RIGHT BIT(4)#define AIU_FIFO_I2S_BLOCK 256
@@ -90,6 +92,10 @@ static int aiu_fifo_i2s_hw_params(structunsigned int val;int ret; +snd_soc_component_update_bits (component,AIU_I2S_MISC , +AIU_I2S_MISC_HOLD_EN , +AIU_I2S_MISC_HOLD_EN ); + ret =aiu_fifo_hw_params (substream, params, dai);if (ret)return ret;
@@ -117,6 +123,19 @@ static int aiu_fifo_i2s_hw_params(structsnd_soc_component_update_bits (component,AIU_MEM_I2S_MASKS ,AIU_MEM_I2S_MASKS_IRQ_BLOCK , val); +/* +* Most (all?) supported SoCs have this bit set by default. The vendor +* driver however sets it manually (depending on the version either +* while un-setting AIU_I2S_MISC_HOLD_EN or right before that). Follow +* the same approach for consistency with the vendor driver. +*/ +snd_soc_component_update_bits (component,AIU_I2S_MISC , +AIU_I2S_MISC_FORCE_LEFT_RIGHT , +AIU_I2S_MISC_FORCE_LEFT_RIGHT ); + +snd_soc_component_update_bits (component,AIU_I2S_MISC , +AIU_I2S_MISC_HOLD_EN ,0 ); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 74/128 ASoC: tegra: Add DAPM switches for headphones and mic jack
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit d341b427c3c3fd6a58263ce01e01700d16861c28 upstream.
UCM of Acer Chromebook (Nyan) uses DAPM switches of headphones and mic jack. These switches were lost by accident during unification of the machine drivers, restore them.
--- sound/soc/tegra/tegra_asoc_machine.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/tegra/tegra_asoc_machine.c +2 -0
@@ -116,6 +116,8 @@ static const struct snd_kcontrol_new tegSOC_DAPM_PIN_SWITCH ("Headset Mic" ),SOC_DAPM_PIN_SWITCH ("Internal Mic 1" ),SOC_DAPM_PIN_SWITCH ("Internal Mic 2" ), +SOC_DAPM_PIN_SWITCH ("Headphones" ), + SOC_DAPM_PIN_SWITCH("Mic Jack"), };int tegra_asoc_machine_init (struct snd_soc_pcm_runtime *rtd)
Greg Kroah-Hartman
maintainerPATCH 75/128 ASoC: tegra: Restore headphones jack name on Nyan Big
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit db635ba4fadf3ba676d07537f3b3f58166aa7b0e upstream.
UCM of Acer Chromebook (Nyan) uses a different name for the headphones jack. The name was changed during unification of the machine drivers and UCM fails now to load because of that. Restore the old jack name.
--- sound/soc/tegra/tegra_asoc_machine.c | 9 ++++++++- sound/soc/tegra/tegra_asoc_machine.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-)
sound/soc/tegra/tegra_asoc_machine.c +8 -1
@@ -124,10 +124,16 @@ int tegra_asoc_machine_init(struct snd_s {struct snd_soc_card *card = rtd->card;struct tegra_machine *machine =snd_soc_card_get_drvdata (card); +const char *jack_name;int err;if (machine->gpiod_hp_det && machine->asoc->add_hp_jack) { - err = snd_soc_card_jack_new(card, "Headphones Jack", +if (machine->asoc->hp_jack_name) + jack_name = machine->asoc->hp_jack_name; +else + jack_name ="Headphones Jack" ; + + err = snd_soc_card_jack_new(card, jack_name, SND_JACK_HEADPHONE, &tegra_machine_hp_jack, tegra_machine_hp_jack_pins,
@@ -660,6 +666,7 @@ static struct snd_soc_card snd_soc_tegrastatic const struct tegra_asoc_data tegra_max98090_data = { .mclk_rate = tegra_machine_mclk_rate_12mhz, .card = &snd_soc_tegra_max98090, + .hp_jack_name ="Headphones" , .add_common_dapm_widgets = true, .add_common_controls = true, .add_common_snd_ops = true,
sound/soc/tegra/tegra_asoc_machine.h +1 -0
@@ -14,6 +14,7 @@ struct snd_soc_pcm_runtime;struct tegra_asoc_data {unsigned int (*mclk_rate)(unsigned int srate);const char *codec_dev_name; +const char *hp_jack_name;struct snd_soc_card *card;unsigned int mclk_id;bool hp_jack_gpio_active_low;
Greg Kroah-Hartman
maintainerPATCH 76/128 Input: atmel_mxt_ts - fix double free in mxt_read_info_block
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
commit 12f247ab590a08856441efdbd351cf2cc8f60a2d upstream.
The "id_buf" buffer is stored in "data->raw_info_block" and freed by "mxt_free_object_table" in case of error.
Return instead of jumping to avoid a double free.
Addresses-Coverity-ID: 1474582 ("Double free")
--- drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/atmel_mxt_ts.c +1 -1
@@ -1882,7 +1882,7 @@ static int mxt_read_info_block(struct mxif (error) {dev_err (&client->dev,"Error %d parsing object table\n" , error);mxt_free_object_table (data); - goto err_free_mem; +return error; } data->object_table = (struct mxt_object *)(id_buf +MXT_OBJECT_START );
Greg Kroah-Hartman
maintainerPATCH 77/128 ipmi: bail out if init_srcu_struct fails
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 2b5160b12091285c5aca45980f100a9294af7b04 upstream.
In case, init_srcu_struct fails (because of memory allocation failure), we might proceed with the driver initialization despite srcu_struct not being entirely initialized.
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_msghandler.c +3 -1
@@ -5148,7 +5148,9 @@ static int ipmi_init_msghandler(void)if (initialized) goto out; -init_srcu_struct (&ipmi_interfaces_srcu); + rv =init_srcu_struct (&ipmi_interfaces_srcu); +if (rv) + goto out;timer_setup (&ipmi_timer, ipmi_timeout,0 );mod_timer (&ipmi_timer, jiffies +IPMI_TIMEOUT_JIFFIES );
Greg Kroah-Hartman
maintainerPATCH 78/128 ipmi: ssif: initialize ssif_info->client early
In reply to Greg Kroah-HartmanFrom: Mian Yousaf Kaukab <[email protected]>
commit 34f35f8f14bc406efc06ee4ff73202c6fd245d15 upstream.
During probe ssif_info->client is dereferenced in error path. However, it is set when some of the error checking has already been done. This causes following kernel crash if an error path is taken:
[ 30.645593][ T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present [ 30.657616][ T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088 ... [ 30.657723][ T674] pc : __dev_printk+0x28/0xa0 [ 30.657732][ T674] lr : _dev_err+0x7c/0xa0 ... [ 30.657772][ T674] Call trace: [ 30.657775][ T674] __dev_printk+0x28/0xa0 [ 30.657778][ T674] _dev_err+0x7c/0xa0 [ 30.657781][ T674] ssif_probe+0x548/0x900 [ipmi_ssif 62ce4b08badc1458fd896206d9ef69a3c31f3d3e] [ 30.657791][ T674] i2c_device_probe+0x37c/0x3c0
...
Initialize ssif_info->client before any error path can be taken. Clear i2c_client data in the error path to prevent the dangling pointer from leaking.
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_ssif.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/char/ipmi/ipmi_ssif.c +4 -3
@@ -1659,6 +1659,9 @@ static int ssif_probe(struct i2c_client } } + ssif_info->client = client; +i2c_set_clientdata (client, ssif_info); + rv =ssif_check_and_remove (client, ssif_info);/* If rv is 0 and addr source is not SI_ACPI, continue probing */ if (!rv && ssif_info->addr_source ==SI_ACPI ) {
@@ -1679,9 +1682,6 @@ static int ssif_probe(struct i2c_clientipmi_addr_src_to_str (ssif_info->addr_source), client->addr, client->adapter->name, slave_addr); - ssif_info->client = client; -i2c_set_clientdata (client, ssif_info); -/* Now check for system interface capabilities */ msg[0 ] =IPMI_NETFN_APP_REQUEST <<2 ; msg[1 ] =IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD ;
@@ -1881,6 +1881,7 @@ static int ssif_probe(struct i2c_clientdev_err (&ssif_info->client->dev,"Unable to start IPMI SSIF: %d\n" , rv); +i2c_set_clientdata (client,NULL );kfree (ssif_info); }kfree (resp);
Greg Kroah-Hartman
maintainerPATCH 79/128 ipmi: fix initialization when workqueue allocation fails
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 75d70d76cb7b927cace2cb34265d68ebb3306b13 upstream.
If the workqueue allocation fails, the driver is marked as not initialized, and timer and panic_notifier will be left registered.
Instead of removing those when workqueue allocation fails, do the workqueue initialization before doing it, and cleanup srcu_struct if it fails.
Message-Id: <[email protected]>
--- drivers/char/ipmi/ipmi_msghandler.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/char/ipmi/ipmi_msghandler.c +9 -6
@@ -5152,20 +5152,23 @@ static int ipmi_init_msghandler(void)if (rv) goto out; -timer_setup (&ipmi_timer, ipmi_timeout,0 ); -mod_timer (&ipmi_timer, jiffies +IPMI_TIMEOUT_JIFFIES ); - -atomic_notifier_chain_register (&panic_notifier_list, &panic_block); - remove_work_wq =create_singlethread_workqueue ("ipmi-msghandler-remove-wq" );if (!remove_work_wq) {pr_err ("unable to create ipmi-msghandler-remove-wq workqueue" ); rv = -ENOMEM ; - goto out; + goto out_wq; } +timer_setup (&ipmi_timer, ipmi_timeout,0 ); +mod_timer (&ipmi_timer, jiffies +IPMI_TIMEOUT_JIFFIES ); + +atomic_notifier_chain_register (&panic_notifier_list, &panic_block); + initialized = true; +out_wq: +if (rv) +cleanup_srcu_struct (&ipmi_interfaces_srcu); out:mutex_unlock (&ipmi_interfaces_mutex);return rv;
Greg Kroah-Hartman
maintainerPATCH 80/128 parisc: Correct completer in lws start
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit 8f66fce0f46560b9e910787ff7ad0974441c4f9c upstream.
The completer in the "or,ev %r1,%r30,%r30" instruction is reversed, so we are not clipping the LWS number when we are called from a 32-bit process (W=0). We need to nulify the following depdi instruction when the least-significant bit of %r30 is 1.
If the %r20 register is not clipped, a user process could perform a LWS call that would branch to an undefined location in the kernel and potentially crash the machine.
--- arch/parisc/kernel/syscall.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/parisc/kernel/syscall.S +1 -1
@@ -478,7 +478,7 @@ lws_start: extrd,u %r1,PSW_W_BIT,1,%r1 /* sp must be aligned on 4, so deposit the W bit setting into * the bottom of sp temporarily */ - or,ev %r1,%r30,%r30 + or,od %r1,%r30,%r30 /* Clip LWS number to a 32-bit value for 32-bit processes */ depdi 0, 31, 32, %r20
Greg Kroah-Hartman
maintainerPATCH 81/128 parisc: Fix mask used to select futex spinlock
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit d3a5a68cff47f6eead84504c3c28376b85053242 upstream.
The address bits used to select the futex spinlock need to match those used in the LWS code in syscall.S. The mask 0x3f8 only selects 7 bits. It should select 8 bits.
This change fixes the glibc nptl/tst-cond24 and nptl/tst-cond25 tests.
--- arch/parisc/include/asm/futex.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/include/asm/futex.h +2 -2
@@ -16,7 +16,7 @@ static inline void _futex_spin_lock_irqsave(u32 __user *uaddr, unsigned long int *flags) {extern u32 lws_lock_start[]; -long index = ((long )uaddr &0x3f8 ) >>1 ; +long index = ((long )uaddr &0x7f8 ) >>1 ;arch_spinlock_t *s = (arch_spinlock_t *)&lws_lock_start[index];local_irq_save (*flags);arch_spin_lock (s);
@@ -26,7 +26,7 @@ static inline void _futex_spin_unlock_irqrestore(u32 __user *uaddr, unsigned long int *flags) {extern u32 lws_lock_start[]; -long index = ((long )uaddr &0x3f8 ) >>1 ; +long index = ((long )uaddr &0x7f8 ) >>1 ;arch_spinlock_t *s = (arch_spinlock_t *)&lws_lock_start[index];arch_spin_unlock (s);local_irq_restore (*flags);
Greg Kroah-Hartman
maintainerPATCH 82/128 tee: handle lookup of shm with reference count 0
In reply to Greg Kroah-HartmanFrom: Jens Wiklander <[email protected]>
commit dfd0743f1d9ea76931510ed150334d571fbab49d upstream.
Since the tee subsystem does not keep a strong reference to its idle shared memory buffers, it races with other threads that try to destroy a shared memory through a close of its dma-buf fd or by unmapping the memory.
In tee_shm_get_from_id() when a lookup in teedev->idr has been successful, it is possible that the tee_shm is in the dma-buf teardown path, but that path is blocked by the teedev mutex. Since we don't have an API to tell if the tee_shm is in the dma-buf teardown path or not we must find another way of detecting this condition.
Fix this by doing the reference counting directly on the tee_shm using a new refcount_t refcount field. dma-buf is replaced by using anon_inode_getfd() instead, this separates the life-cycle of the underlying file from the tee_shm. tee_shm_put() is updated to hold the mutex when decreasing the refcount to 0 and then remove the tee_shm from teedev->idr before releasing the mutex. This means that the tee_shm can never be found unless it has a refcount larger than 0.
--- drivers/tee/tee_shm.c | 171 ++++++++++++++++++------------------------------ include/linux/tee_drv.h | 4 - 2 files changed, 68 insertions(+), 107 deletions(-)
drivers/tee/tee_shm.c +66 -105
@@ -1,11 +1,11 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (c) 2015-2016, Linaro Limited +* Copyright (c) 2015-2017, 2019-2021 Linaro Limited */ +#include <linux/anon_inodes.h> #include <linux/device.h> -#include <linux/dma-buf.h> -#include <linux/fdtable.h> #include <linux/idr.h> +#include <linux/mm.h> #include <linux/sched.h> #include <linux/slab.h> #include <linux/tee_drv.h>
@@ -28,16 +28,8 @@ static void release_registered_pages(str } } -static void tee_shm_release (struct tee_shm *shm) +static void tee_shm_release (struct tee_device *teedev,struct tee_shm *shm) { -struct tee_device *teedev = shm->ctx->teedev; - -if (shm->flags &TEE_SHM_DMA_BUF ) { -mutex_lock (&teedev->mutex); -idr_remove (&teedev->idr, shm->id); -mutex_unlock (&teedev->mutex); - } -if (shm->flags &TEE_SHM_POOL ) {struct tee_shm_pool_mgr *poolm;
@@ -64,45 +56,6 @@ static void tee_shm_release(struct tee_stee_device_put (teedev); } -static struct sg_table *tee_shm_op_map_dma_buf (struct dma_buf_attachment - *attach,enum dma_data_direction dir) -{ -return NULL ; -} - -static void tee_shm_op_unmap_dma_buf (struct dma_buf_attachment *attach, -struct sg_table *table, -enum dma_data_direction dir) -{ -} - -static void tee_shm_op_release (struct dma_buf *dmabuf) -{ -struct tee_shm *shm = dmabuf->priv; - -tee_shm_release (shm); -} - -static int tee_shm_op_mmap (struct dma_buf *dmabuf,struct vm_area_struct *vma) -{ -struct tee_shm *shm = dmabuf->priv; -size_t size = vma->vm_end - vma->vm_start; - -/* Refuse sharing shared memory provided by application */ -if (shm->flags &TEE_SHM_USER_MAPPED ) -return -EINVAL ; - -return remap_pfn_range (vma, vma->vm_start, shm->paddr >>PAGE_SHIFT , - size, vma->vm_page_prot); -} - -static const struct dma_buf_ops tee_shm_dma_buf_ops = { - .map_dma_buf = tee_shm_op_map_dma_buf, - .unmap_dma_buf = tee_shm_op_unmap_dma_buf, - .release = tee_shm_op_release, - .mmap = tee_shm_op_mmap, -}; -struct tee_shm *tee_shm_alloc (struct tee_context *ctx,size_t size,u32 flags) {struct tee_device *teedev = ctx->teedev;
@@ -137,6 +90,7 @@ struct tee_shm *tee_shm_alloc(struct tee goto err_dev_put; } +refcount_set (&shm->refcount,1 ); shm->flags = flags |TEE_SHM_POOL ; shm->ctx = ctx;if (flags &TEE_SHM_DMA_BUF )
@@ -150,10 +104,7 @@ struct tee_shm *tee_shm_alloc(struct tee goto err_kfree; } -if (flags &TEE_SHM_DMA_BUF ) { -DEFINE_DMA_BUF_EXPORT_INFO (exp_info); -mutex_lock (&teedev->mutex); shm->id =idr_alloc (&teedev->idr, shm,1 ,0 ,GFP_KERNEL );mutex_unlock (&teedev->mutex);
@@ -161,28 +112,11 @@ struct tee_shm *tee_shm_alloc(struct tee ret =ERR_PTR (shm->id); goto err_pool_free; } - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags =O_RDWR ; - exp_info.priv = shm; - - shm->dmabuf =dma_buf_export (&exp_info); -if (IS_ERR (shm->dmabuf)) { - ret =ERR_CAST (shm->dmabuf); - goto err_rem; - } }teedev_ctx_get (ctx);return shm; -err_rem: -if (flags &TEE_SHM_DMA_BUF ) { -mutex_lock (&teedev->mutex); -idr_remove (&teedev->idr, shm->id); -mutex_unlock (&teedev->mutex); - } err_pool_free: poolm->ops->free (poolm, shm); err_kfree:
@@ -243,6 +177,7 @@ struct tee_shm *tee_shm_register(struct goto err; } +refcount_set (&shm->refcount,1 ); shm->flags = flags |TEE_SHM_REGISTER ; shm->ctx = ctx; shm->id =-1 ;
@@ -303,22 +238,6 @@ struct tee_shm *tee_shm_register(struct goto err; } -if (flags &TEE_SHM_DMA_BUF ) { -DEFINE_DMA_BUF_EXPORT_INFO (exp_info); - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags =O_RDWR ; - exp_info.priv = shm; - - shm->dmabuf =dma_buf_export (&exp_info); -if (IS_ERR (shm->dmabuf)) { - ret =ERR_CAST (shm->dmabuf); - teedev->desc->ops->shm_unregister (ctx, shm); - goto err; - } - } -return shm; err:if (shm) {
@@ -336,6 +255,35 @@ err: }EXPORT_SYMBOL_GPL (tee_shm_register); +static int tee_shm_fop_release (struct inode *inode,struct file *filp) +{ +tee_shm_put (filp->private_data); +return 0 ; +} + +static int tee_shm_fop_mmap (struct file *filp,struct vm_area_struct *vma) +{ +struct tee_shm *shm = filp->private_data; +size_t size = vma->vm_end - vma->vm_start; + +/* Refuse sharing shared memory provided by application */ +if (shm->flags &TEE_SHM_USER_MAPPED ) +return -EINVAL ; + +/* check for overflowing the buffer's size */ +if (vma->vm_pgoff +vma_pages (vma) > shm->size >>PAGE_SHIFT ) +return -EINVAL ; + +return remap_pfn_range (vma, vma->vm_start, shm->paddr >>PAGE_SHIFT , + size, vma->vm_page_prot); +} + +static const struct file_operations tee_shm_fops = { + .owner =THIS_MODULE , + .release = tee_shm_fop_release, + .mmap = tee_shm_fop_mmap, +}; +/** * tee_shm_get_fd() - Increase reference count and return file descriptor * @shm: Shared memory handle
@@ -348,10 +296,11 @@ int tee_shm_get_fd(struct tee_shm *shm)if (!(shm->flags &TEE_SHM_DMA_BUF ))return -EINVAL ; -get_dma_buf (shm->dmabuf); - fd =dma_buf_fd (shm->dmabuf,O_CLOEXEC ); +/* matched by tee_shm_put() in tee_shm_op_release() */ +refcount_inc (&shm->refcount); + fd =anon_inode_getfd ("tee_shm" , &tee_shm_fops, shm,O_RDWR );if (fd <0 ) -dma_buf_put (shm->dmabuf); +tee_shm_put (shm);return fd; }
@@ -361,17 +310,7 @@ int tee_shm_get_fd(struct tee_shm *shm)*/ void tee_shm_free (struct tee_shm *shm) { -/* -* dma_buf_put() decreases the dmabuf reference counter and will -* call tee_shm_release() when the last reference is gone. -* -* In the case of driver private memory we call tee_shm_release -* directly instead as it doesn't have a reference counter. -*/ -if (shm->flags &TEE_SHM_DMA_BUF ) -dma_buf_put (shm->dmabuf); -else -tee_shm_release (shm); +tee_shm_put (shm); }EXPORT_SYMBOL_GPL (tee_shm_free);
@@ -478,10 +417,15 @@ struct tee_shm *tee_shm_get_from_id(stru teedev = ctx->teedev;mutex_lock (&teedev->mutex); shm =idr_find (&teedev->idr, id); +/* +* If the tee_shm was found in the IDR it must have a refcount +* larger than 0 due to the guarantee in tee_shm_put() below. So +* it's safe to use refcount_inc(). +*/ if (!shm || shm->ctx != ctx) shm =ERR_PTR (-EINVAL ); -else if (shm->flags &TEE_SHM_DMA_BUF ) -get_dma_buf (shm->dmabuf); +else +refcount_inc (&shm->refcount);mutex_unlock (&teedev->mutex);return shm; }
@@ -493,7 +437,24 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);*/ void tee_shm_put (struct tee_shm *shm) { -if (shm->flags &TEE_SHM_DMA_BUF ) -dma_buf_put (shm->dmabuf); +struct tee_device *teedev = shm->ctx->teedev; +bool do_release = false; + +mutex_lock (&teedev->mutex); +if (refcount_dec_and_test (&shm->refcount)) { +/* +* refcount has reached 0, we must now remove it from the +* IDR before releasing the mutex. This will guarantee that +* the refcount_inc() in tee_shm_get_from_id() never starts +* from 0. +*/ +if (shm->flags &TEE_SHM_DMA_BUF ) +idr_remove (&teedev->idr, shm->id); + do_release = true; + } +mutex_unlock (&teedev->mutex); + +if (do_release) +tee_shm_release (teedev, shm); }EXPORT_SYMBOL_GPL (tee_shm_put);
include/linux/tee_drv.h +2 -2
@@ -195,7 +195,7 @@ int tee_session_calc_client_uuid(uuid_t* @offset: offset of buffer in user space * @pages: locked pages from userspace * @num_pages: number of locked pages -* @dmabuf: dmabuf used to for exporting to user space +* @refcount: reference counter * @flags: defined by TEE_SHM_* in tee_drv.h * @id: unique id of a shared memory object on this device *
@@ -210,7 +210,7 @@ struct tee_shm {unsigned int offset;struct page **pages;size_t num_pages; -struct dma_buf *dmabuf; +refcount_t refcount;u32 flags;int id; };
Greg Kroah-Hartman
maintainerPATCH 83/128 x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
In reply to Greg Kroah-HartmanFrom: Andrew Cooper <[email protected]>
commit 57690554abe135fee81d6ac33cc94d75a7e224bb upstream.
Both __pkru_allows_write() and arch_set_user_pkey_access() shift PKRU_WD_BIT (a signed constant) by up to 30 bits, hitting the sign bit.
Use unsigned constants instead.
Clearly pkey 15 has not been used in combination with UBSAN yet.
Noticed by code inspection only. I can't actually provoke the compiler into generating incorrect logic as far as this shift is concerned.
[
dhansen: add stable@ tag, plus minor changelog massaging,
For anyone doing backports, these #defines were in arch/x86/include/asm/pgtable.h before 784a46618f6.
]
--- arch/x86/include/asm/pkru.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/pkru.h +2 -2
@@ -4,8 +4,8 @@#include <asm/fpu/xstate.h> -#define PKRU_AD_BIT 0x1 -#define PKRU_WD_BIT 0x2 +#define PKRU_AD_BIT 0x1u +#define PKRU_WD_BIT 0x2u#define PKRU_BITS_PER_PKEY 2#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
Greg Kroah-Hartman
maintainerPATCH 84/128 platform/x86: amd-pmc: only use callbacks for suspend
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 09fc14061f3ed28899c23b8714c066946fdbd43e upstream.
This driver is intended to be used exclusively for suspend to idle so callbacks to send OS_HINT during hibernate and S5 will set OS_HINT at the wrong time leading to an undefined behavior.
--- drivers/platform/x86/amd-pmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/platform/x86/amd-pmc.c +2 -1
@@ -375,7 +375,8 @@ static int __maybe_unused amd_pmc_resume }static const struct dev_pm_ops amd_pmc_pm_ops = { -SET_NOIRQ_SYSTEM_SLEEP_PM_OPS (amd_pmc_suspend, amd_pmc_resume) + .suspend_noirq = amd_pmc_suspend, + .resume_noirq = amd_pmc_resume, };static const struct pci_device_id pmc_pci_ids[] = {
Greg Kroah-Hartman
maintainerPATCH 85/128 platform/x86: intel_pmc_core: fix memleak on registration failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 26a8b09437804fabfb1db080d676b96c0de68e7c upstream.
In case device registration fails during module initialisation, the platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name).
--- drivers/platform/x86/intel/pmc/pltdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/pmc/pltdrv.c +1 -1
@@ -65,7 +65,7 @@ static int __init pmc_core_platform_init retval =platform_device_register (pmc_core_device);if (retval) -kfree (pmc_core_device); +platform_device_put (pmc_core_device);return retval; }
Greg Kroah-Hartman
maintainerPATCH 86/128 KVM: x86: Always set kvm_run->if_flag
In reply to Greg Kroah-HartmanFrom: Marc Orr <[email protected]>
commit c5063551bfcae4e48fec890b7bf369598b77526b upstream.
The kvm_run struct's if_flag is a part of the userspace/kernel API. The SEV-ES patches failed to set this flag because it's no longer needed by QEMU (according to the comment in the source code). However, other hypervisors may make use of this flag. Therefore, set the flag for guests with encrypted registers (i.e., with guest_state_protected set).
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvm-x86-ops.h | 1 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/svm/svm.c | 21 ++++++++++++--------- arch/x86/kvm/vmx/vmx.c | 6 ++++++ arch/x86/kvm/x86.c | 9 +-------- 5 files changed, 21 insertions(+), 17 deletions(-)
arch/x86/include/asm/kvm-x86-ops.h +1 -0
@@ -47,6 +47,7 @@ KVM_X86_OP(set_dr7) KVM_X86_OP(cache_reg) KVM_X86_OP(get_rflags) KVM_X86_OP(set_rflags) +KVM_X86_OP(get_if_flag) KVM_X86_OP(tlb_flush_all) KVM_X86_OP(tlb_flush_current) KVM_X86_OP_NULL(tlb_remote_flush)
arch/x86/include/asm/kvm_host.h +1 -0
@@ -1341,6 +1341,7 @@ struct kvm_x86_ops {void (*cache_reg)(struct kvm_vcpu *vcpu,enum kvm_reg reg);unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);void (*set_rflags)(struct kvm_vcpu *vcpu,unsigned long rflags); +bool (*get_if_flag)(struct kvm_vcpu *vcpu);void (*tlb_flush_all)(struct kvm_vcpu *vcpu);void (*tlb_flush_current)(struct kvm_vcpu *vcpu);
arch/x86/kvm/svm/svm.c +12 -9
@@ -1517,6 +1517,15 @@ static void svm_set_rflags(struct kvm_vcto_svm (vcpu)->vmcb->save.rflags = rflags; } +static bool svm_get_if_flag (struct kvm_vcpu *vcpu) +{ +struct vmcb *vmcb =to_svm (vcpu)->vmcb; + +return sev_es_guest (vcpu->kvm) + ? vmcb->control.int_state &SVM_GUEST_INTERRUPT_MASK + :kvm_get_rflags (vcpu) &X86_EFLAGS_IF ; +} +static void svm_cache_reg (struct kvm_vcpu *vcpu,enum kvm_reg reg) {switch (reg) {
@@ -3485,14 +3494,7 @@ bool svm_interrupt_blocked(struct kvm_vcif (!gif_set (svm))return true; -if (sev_es_guest (vcpu->kvm)) { -/* -* SEV-ES guests to not expose RFLAGS. Use the VMCB interrupt mask -* bit to determine the state of the IF flag. -*/ -if (!(vmcb->control.int_state &SVM_GUEST_INTERRUPT_MASK )) -return true; - }else if (is_guest_mode (vcpu)) { +if (is_guest_mode (vcpu)) {/* As long as interrupts are being delivered... */ if ((svm->nested.ctl.int_ctl & V_INTR_MASKING_MASK) ? !(svm->vmcb01.ptr->save.rflags & X86_EFLAGS_IF)
@@ -3503,7 +3505,7 @@ bool svm_interrupt_blocked(struct kvm_vcif (nested_exit_on_intr (svm))return false; }else { -if (!(kvm_get_rflags (vcpu) &X86_EFLAGS_IF )) +if (!svm_get_if_flag (vcpu))return true; }
@@ -4562,6 +4564,7 @@ static struct kvm_x86_ops svm_x86_ops __ .cache_reg = svm_cache_reg, .get_rflags = svm_get_rflags, .set_rflags = svm_set_rflags, + .get_if_flag = svm_get_if_flag, .tlb_flush_all = svm_flush_tlb, .tlb_flush_current = svm_flush_tlb,
arch/x86/kvm/vmx/vmx.c +6 -0
@@ -1359,6 +1359,11 @@ void vmx_set_rflags(struct kvm_vcpu *vcp vmx->emulation_required =vmx_emulation_required (vcpu); } +static bool vmx_get_if_flag (struct kvm_vcpu *vcpu) +{ +return vmx_get_rflags (vcpu) &X86_EFLAGS_IF ; +} +u32 vmx_get_interrupt_shadow (struct kvm_vcpu *vcpu) {u32 interruptibility =vmcs_read32 (GUEST_INTERRUPTIBILITY_INFO );
@@ -7573,6 +7578,7 @@ static struct kvm_x86_ops vmx_x86_ops __ .cache_reg = vmx_cache_reg, .get_rflags = vmx_get_rflags, .set_rflags = vmx_set_rflags, + .get_if_flag = vmx_get_if_flag, .tlb_flush_all = vmx_flush_tlb_all, .tlb_flush_current = vmx_flush_tlb_current,
arch/x86/kvm/x86.c +1 -8
@@ -8880,14 +8880,7 @@ static void post_kvm_run_save(struct kvm {struct kvm_run *kvm_run = vcpu->run; -/* -* if_flag is obsolete and useless, so do not bother -* setting it for SEV-ES guests. Userspace can just -* use kvm_run->ready_for_interrupt_injection. -*/ - kvm_run->if_flag = !vcpu->arch.guest_state_protected - && (kvm_get_rflags (vcpu) &X86_EFLAGS_IF ) !=0 ; - + kvm_run->if_flag =static_call (kvm_x86_get_if_flag)(vcpu); kvm_run->cr8 =kvm_get_cr8 (vcpu); kvm_run->apic_base =kvm_get_apic_base (vcpu);
Greg Kroah-Hartman
maintainerPATCH 87/128 KVM: x86/mmu: Dont advance iterator after restart due to yielding
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 3a0f64de479cae75effb630a2e0a237ca0d0623c upstream.
After dropping mmu_lock in the TDP MMU, restart the iterator during tdp_iter_next() and do not advance the iterator. Advancing the iterator results in skipping the top-level SPTE and all its children, which is fatal if any of the skipped SPTEs were not visited before yielding.
When zapping all SPTEs, i.e. when min_level == root_level, restarting the iter and then invoking tdp_iter_next() is always fatal if the current gfn has as a valid SPTE, as advancing the iterator results in try_step_side() skipping the current gfn, which wasn't visited before yielding.
Sprinkle WARNs on iter->yielded being true in various helpers that are often used in conjunction with yielding, and tag the helper with __must_check to reduce the probabily of improper usage.
Failing to zap a top-level SPTE manifests in one of two ways. If a valid SPTE is skipped by both kvm_tdp_mmu_zap_all() and kvm_tdp_mmu_put_root(), the shadow page will be leaked and KVM will WARN accordingly.
WARNING: CPU: 1 PID: 3509 at arch/x86/kvm/mmu/tdp_mmu.c:46 [kvm] RIP: 0010:kvm_mmu_uninit_tdp_mmu+0x3e/0x50 [kvm] Call Trace: <TASK> kvm_arch_destroy_vm+0x130/0x1b0 [kvm] kvm_destroy_vm+0x162/0x2a0 [kvm] kvm_vcpu_release+0x34/0x60 [kvm] __fput+0x82/0x240 task_work_run+0x5c/0x90 do_exit+0x364/0xa10 ? futex_unqueue+0x38/0x60 do_group_exit+0x33/0xa0 get_signal+0x155/0x850 arch_do_signal_or_restart+0xed/0x750 exit_to_user_mode_prepare+0xc5/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae
If kvm_tdp_mmu_zap_all() skips a gfn/SPTE but that SPTE is then zapped by kvm_tdp_mmu_put_root(), KVM triggers a use-after-free in the form of marking a struct page as dirty/accessed after it has been put back on the free list. This directly triggers a WARN due to encountering a page with page_count() == 0, but it can also lead to data corruption and additional errors in the kernel.
WARNING: CPU: 7 PID: 1995658 at arch/x86/kvm/../../../virt/kvm/kvm_main.c:171 RIP: 0010:kvm_is_zone_device_pfn.part.0+0x9e/0xd0 [kvm] Call Trace: <TASK> kvm_set_pfn_dirty+0x120/0x1d0 [kvm] __handle_changed_spte+0x92e/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] __handle_changed_spte+0x63c/0xca0 [kvm] zap_gfn_range+0x549/0x620 [kvm] kvm_tdp_mmu_put_root+0x1b6/0x270 [kvm] mmu_free_root_page+0x219/0x2c0 [kvm] kvm_mmu_free_roots+0x1b4/0x4e0 [kvm] kvm_mmu_unload+0x1c/0xa0 [kvm] kvm_arch_destroy_vm+0x1f2/0x5c0 [kvm] kvm_put_kvm+0x3b1/0x8b0 [kvm] kvm_vcpu_release+0x4e/0x70 [kvm] __fput+0x1f7/0x8c0 task_work_run+0xf8/0x1a0 do_exit+0x97b/0x2230 do_group_exit+0xda/0x2a0 get_signal+0x3be/0x1e50 arch_do_signal_or_restart+0x244/0x17f0 exit_to_user_mode_prepare+0xcb/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x4d/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Note, the underlying bug existed even before commit 1af4a96025b3 ("KVM:
x86/mmu: Yield in TDU MMU iter even if no SPTES changed") moved calls to tdp_mmu_iter_cond_resched() to the beginning of loops, as KVM could still incorrectly advance past a top-level entry when yielding on a lower-level entry. But with respect to leaking shadow pages, the bug was introduced by yielding before processing the current gfn.
Alternatively, tdp_mmu_iter_cond_resched() could simply fall through, or callers could jump to their "retry" label. The downside of that approach is that tdp_mmu_iter_cond_resched() _must_ be called before anything else in the loop, and there's no easy way to enfornce that requirement.
Ideally, KVM would handling the cond_resched() fully within the iterator macro (the code is actually quite clean) and avoid this entire class of bugs, but that is extremely difficult do while also supporting yielding after tdp_mmu_set_spte_atomic() fails. Yielding after failing to set a SPTE is very desirable as the "owner" of the REMOVED_SPTE isn't strictly bounded, e.g. if it's zapping a high-level shadow page, the REMOVED_SPTE may block operations on the SPTE for a significant amount of time.
Message-Id: <[email protected]>
--- arch/x86/kvm/mmu/tdp_iter.c | 6 ++++++ arch/x86/kvm/mmu/tdp_iter.h | 6 ++++++ arch/x86/kvm/mmu/tdp_mmu.c | 29 ++++++++++++++++------------- 3 files changed, 28 insertions(+), 13 deletions(-)
arch/x86/kvm/mmu/tdp_iter.c +6 -0
@@ -26,6 +26,7 @@ static gfn_t round_gfn_for_level(gfn_t g*/ void tdp_iter_restart (struct tdp_iter *iter) { + iter->yielded = false; iter->yielded_gfn = iter->next_last_level_gfn; iter->level = iter->root_level;
@@ -160,6 +161,11 @@ static bool try_step_up(struct tdp_iter*/ void tdp_iter_next (struct tdp_iter *iter) { +if (iter->yielded) { +tdp_iter_restart (iter); +return ; + } +if (try_step_down (iter))return ;
arch/x86/kvm/mmu/tdp_iter.h +6 -0
@@ -45,6 +45,12 @@ struct tdp_iter {* iterator walks off the end of the paging structure. */ bool valid; +/* +* True if KVM dropped mmu_lock and yielded in the middle of a walk, in +* which case tdp_iter_next() needs to restart the walk at the root +* level instead of advancing to the next entry. +*/ +bool yielded; };/*
arch/x86/kvm/mmu/tdp_mmu.c +16 -13
@@ -501,6 +501,8 @@ static inline bool tdp_mmu_set_spte_atomstruct tdp_iter *iter, u64 new_spte) { + WARN_ON_ONCE(iter->yielded); +lockdep_assert_held_read (&kvm->mmu_lock);/*
@@ -611,6 +613,8 @@ static inline void __tdp_mmu_set_spte(st u64 new_spte, bool record_acc_track, bool record_dirty_log) { + WARN_ON_ONCE(iter->yielded); +lockdep_assert_held_write (&kvm->mmu_lock);/*
@@ -676,18 +680,19 @@ static inline void tdp_mmu_set_spte_no_d* If this function should yield and flush is set, it will perform a remote * TLB flush before yielding. * -* If this function yields, it will also reset the tdp_iter's walk over the -* paging structure and the calling function should skip to the next -* iteration to allow the iterator to continue its traversal from the -* paging structure root. +* If this function yields, iter->yielded is set and the caller must skip to +* the next iteration, where tdp_iter_next() will reset the tdp_iter's walk +* over the paging structures to allow the iterator to continue its traversal +* from the paging structure root. * -* Return true if this function yielded and the iterator's traversal was reset. -* Return false if a yield was not needed. +* Returns true if this function yielded. */ -static inline bool tdp_mmu_iter_cond_resched (struct kvm *kvm, -struct tdp_iter *iter,bool flush, -bool shared) +static inline bool __must_check tdp_mmu_iter_cond_resched (struct kvm *kvm, +struct tdp_iter *iter, +bool flush,bool shared) { +WARN_ON (iter->yielded); +/* Ensure forward progress has been made before yielding. */ if (iter->next_last_level_gfn == iter->yielded_gfn)return false;
@@ -707,12 +712,10 @@ static inline bool tdp_mmu_iter_cond_resWARN_ON (iter->gfn > iter->next_last_level_gfn); -tdp_iter_restart (iter); - -return true; + iter->yielded = true; } -return false; +return iter->yielded; }/*
Greg Kroah-Hartman
maintainerPATCH 88/128 KVM: nVMX: Synthesize TRIPLE_FAULT for L2 if emulation is required
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit cd0e615c49e5e5d69885af9ac3b4fa7bb3387f58 upstream.
Synthesize a triple fault if L2 guest state is invalid at the time of VM-Enter, which can happen if L1 modifies SMRAM or if userspace stuffs guest state via ioctls(), e.g. KVM_SET_SREGS. KVM should never emulate invalid guest state, since from L1's perspective, it's architecturally impossible for L2 to have invalid state while L2 is running in hardware. E.g. attempts to set CR0 or CR4 to unsupported values will either VM-Exit or #GP.
Modifying vCPU state via RSM+SMRAM and ioctl() are the only paths that can trigger this scenario, as nested VM-Enter correctly rejects any attempt to enter L2 with invalid state.
RSM is a straightforward case as (a) KVM follows AMD's SMRAM layout and behavior, and (b) Intel's SDM states that loading reserved CR0/CR4 bits via RSM results in shutdown, i.e. there is precedent for KVM's behavior. Following AMD's SMRAM layout is important as AMD's layout saves/restores the descriptor cache information, including CS.RPL and SS.RPL, and also defines all the fields relevant to invalid guest state as read-only, i.e. so long as the vCPU had valid state before the SMI, which is guaranteed for L2, RSM will generate valid state unless SMRAM was modified. Intel's layout saves/restores only the selector, which means that scenarios where the selector and cached RPL don't match, e.g. conforming code segments, would yield invalid guest state. Intel CPUs fudge around this issued by stuffing SS.RPL and CS.RPL on RSM. Per Intel's SDM on the "Default Treatment of RSM", paraphrasing for brevity:
IF internal storage indicates that the [CPU was post-VMXON] THEN
enter VMX operation (root or non-root);
restore VMX-critical state as defined in Section 34.14.1;
set to their fixed values any bits in CR0 and CR4 whose values must
be fixed in VMX operation [unless coming from an unrestricted guest];
IF RFLAGS.VM = 0 AND (in VMX root operation OR the
“unrestricted guest” VM-execution control is 0)
THEN
CS.RPL := SS.DPL;
SS.RPL := SS.DPL;
FI;
restore current VMCS pointer;FI;
Note that Intel CPUs also overwrite the fixed CR0/CR4 bits, whereas KVM will sythesize TRIPLE_FAULT in this scenario. KVM's behavior is allowed as both Intel and AMD define CR0/CR4 SMRAM fields as read-only, i.e. the only way for CR0 and/or CR4 to have illegal values is if they were modified by the L1 SMM handler, and Intel's SDM "SMRAM State Save Map" section states "modifying these registers will result in unpredictable behavior".
KVM's ioctl() behavior is less straightforward. Because KVM allows ioctls() to be executed in any order, rejecting an ioctl() if it would result in invalid L2 guest state is not an option as KVM cannot know if a future ioctl() would resolve the invalid state, e.g. KVM_SET_SREGS, or drop the vCPU out of L2, e.g. KVM_SET_NESTED_STATE. Ideally, KVM would reject KVM_RUN if L2 contained invalid guest state, but that carries the risk of a false positive, e.g. if RSM loaded invalid guest state and KVM exited to userspace. Setting a flag/request to detect such a scenario is undesirable because (a) it's extremely unlikely to add value to KVM as a whole, and (b) KVM would need to consider ioctl() interactions with such a flag, e.g. if userspace migrated the vCPU while the flag were set.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
arch/x86/kvm/vmx/vmx.c +24 -8
@@ -5866,18 +5866,14 @@ static int __vmx_handle_exit(struct kvm_vmx_flush_pml_buffer (vcpu);/* -* We should never reach this point with a pending nested VM-Enter, and -* more specifically emulation of L2 due to invalid guest state (see -* below) should never happen as that means we incorrectly allowed a -* nested VM-Enter with an invalid vmcs12. +* KVM should never reach this point with a pending nested VM-Enter. +* More specifically, short-circuiting VM-Entry to emulate L2 due to +* invalid guest state should never happen as that means KVM knowingly +* allowed a nested VM-Enter with an invalid vmcs12. More below. */ if (KVM_BUG_ON (vmx->nested.nested_run_pending, vcpu->kvm))return -EIO ; -/* If guest state is invalid, start emulating */ -if (vmx->emulation_required) -return handle_invalid_guest_state (vcpu); -if (is_guest_mode (vcpu)) {/* * PML is never enabled when running L2, bail immediately if a
@@ -5899,10 +5895,30 @@ static int __vmx_handle_exit(struct kvm_*/ nested_mark_vmcs12_pages_dirty (vcpu); +/* +* Synthesize a triple fault if L2 state is invalid. In normal +* operation, nested VM-Enter rejects any attempt to enter L2 +* with invalid state. However, those checks are skipped if +* state is being stuffed via RSM or KVM_SET_NESTED_STATE. If +* L2 state is invalid, it means either L1 modified SMRAM state +* or userspace provided bad state. Synthesize TRIPLE_FAULT as +* doing so is architecturally allowed in the RSM case, and is +* the least awful solution for the userspace case without +* risking false positives. +*/ +if (vmx->emulation_required) { +nested_vmx_vmexit (vcpu,EXIT_REASON_TRIPLE_FAULT ,0 ,0 ); +return 1 ; + } +if (nested_vmx_reflect_vmexit (vcpu))return 1 ; } +/* If guest state is invalid, start emulating. L2 is handled above. */ +if (vmx->emulation_required) +return handle_invalid_guest_state (vcpu); +if (exit_reason.failed_vmentry) {dump_vmcs (vcpu); vcpu->run->exit_reason =KVM_EXIT_FAIL_ENTRY ;
Greg Kroah-Hartman
maintainerPATCH 89/128 KVM: VMX: Always clear vmx->fail on emulation_required
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit a80dfc025924024d2c61a4c1b8ef62b2fce76a04 upstream.
Revert a relatively recent change that set vmx->fail if the vCPU is in L2 and emulation_required is true, as that behavior is completely bogus. Setting vmx->fail and synthesizing a VM-Exit is contradictory and wrong:
(a) it's impossible to have both a VM-Fail and VM-Exit
(b) vmcs.EXIT_REASON is not modified on VM-Fail
(c) emulation_required refers to guest state and guest state checks are always VM-Exits, not VM-Fails.
For KVM specifically, emulation_required is handled before nested exits in __vmx_handle_exit(), thus setting vmx->fail has no immediate effect, i.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored. Setting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit() firing when tearing down the VM as KVM never expects vmx->fail to be set when L2 is active, KVM always reflects those errors into L1.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 21158 at arch/x86/kvm/vmx/nested.c:4548
nested_vmx_vmexit+0x16bd/0x17e0
arch/x86/kvm/vmx/nested.c:4547
Modules linked in:
CPU: 0 PID: 21158 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547
Code: <0f> 0b e9 2e f8 ff ff e8 57 b3 5d 00 0f 0b e9 00 f1 ff ff 89 e9 80
Call Trace:
vmx_leave_nested arch/x86/kvm/vmx/nested.c:6220 [inline]
nested_vmx_free_vcpu+0x83/0xc0 arch/x86/kvm/vmx/nested.c:330
vmx_free_vcpu+0x11f/0x2a0 arch/x86/kvm/vmx/vmx.c:6799
kvm_arch_vcpu_destroy+0x6b/0x240 arch/x86/kvm/x86.c:10989
kvm_vcpu_destroy+0x29/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441
kvm_free_vcpus arch/x86/kvm/x86.c:11426 [inline]
kvm_arch_destroy_vm+0x3ef/0x6b0 arch/x86/kvm/x86.c:11545
kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1189 [inline]
kvm_put_kvm+0x751/0xe40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1220
kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3489
__fput+0x3fc/0x870 fs/file_table.c:280
task_work_run+0x146/0x1c0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0x705/0x24f0 kernel/exit.c:832
do_group_exit+0x168/0x2d0 kernel/exit.c:929
get_signal+0x1740/0x2120 kernel/signal.c:2852
arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300
do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xaeMessage-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
arch/x86/kvm/vmx/vmx.c +1 -3
@@ -6612,9 +6612,7 @@ static fastpath_t vmx_vcpu_run(struct kv* consistency check VM-Exit due to invalid guest state and bail. */ if (unlikely (vmx->emulation_required)) { - -/* We don't emulate invalid state of a nested guest */ - vmx->fail =is_guest_mode (vcpu); + vmx->fail =0 ; vmx->exit_reason.full =EXIT_REASON_INVALID_STATE ; vmx->exit_reason.failed_vmentry =1 ;
Greg Kroah-Hartman
maintainerPATCH 90/128 KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit fdba608f15e2427419997b0898750a49a735afcb upstream.
Drop a check that guards triggering a posted interrupt on the currently running vCPU, and more importantly guards waking the target vCPU if triggering a posted interrupt fails because the vCPU isn't IN_GUEST_MODE. If a vIRQ is delivered from asynchronous context, the target vCPU can be the currently running vCPU and can also be blocking, in which case skipping kvm_vcpu_wake_up() is effectively dropping what is supposed to be a wake event for the vCPU.
The "do nothing" logic when "vcpu == running_vcpu" mostly works only because the majority of calls to ->deliver_posted_interrupt(), especially when using posted interrupts, come from synchronous KVM context. But if a device is exposed to the guest using vfio-pci passthrough, the VFIO IRQ and vCPU are bound to the same pCPU, and the IRQ is _not_ configured to use posted interrupts, wake events from the device will be delivered to KVM from IRQ context, e.g.
vfio_msihandler()
|
|-> eventfd_signal()
|
|-> ...
|
|-> irqfd_wakeup()
|
|->kvm_arch_set_irq_inatomic()
|
|-> kvm_irq_delivery_to_apic_fast()
|
|-> kvm_apic_set_irq()This also aligns the non-nested and nested usage of triggering posted interrupts, and will allow for additional cleanups.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/kvm/vmx/vmx.c +1 -2
@@ -3971,8 +3971,7 @@ static int vmx_deliver_posted_interrupt(if (pi_test_and_set_on (&vmx->pi_desc))return 0 ; -if (vcpu !=kvm_get_running_vcpu () && - !kvm_vcpu_trigger_posted_interrupt (vcpu, false)) +if (!kvm_vcpu_trigger_posted_interrupt (vcpu, false))kvm_vcpu_kick (vcpu);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 91/128 pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
In reply to Greg Kroah-HartmanFrom: Fabien Dessenne <[email protected]>
commit b67210cc217f9ca1c576909454d846970c13dfd4 upstream.
Consider the GPIO controller offset (from "gpio-ranges") to compute the maximum GPIO line number.
This fixes an issue where gpio-ranges uses a non-null offset.
e.g.: gpio-ranges = <&pinctrl 6 86 10>
In that case the last valid GPIO line is not 9 but 15 (6 + 10 - 1)
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/stm32/pinctrl-stm32.c +4 -4
@@ -1251,10 +1251,10 @@ static int stm32_gpiolib_register_bank(s bank_nr = args.args[1 ] /STM32_GPIO_PINS_PER_BANK ; bank->gpio_chip.base = args.args[1 ]; - npins = args.args[2 ]; -while (!of_parse_phandle_with_fixed_args (np,"gpio-ranges" ,3 , - ++i, &args)) - npins += args.args[2 ]; +/* get the last defined gpio line (offset + nb of pins) */ + npins = args.args[0 ] + args.args[2 ]; +while (!of_parse_phandle_with_fixed_args (np,"gpio-ranges" ,3 , ++i, &args)) + npins =max (npins, (int )(args.args[0 ] + args.args[2 ])); }else { bank_nr = pctl->nbanks; bank->gpio_chip.base = bank_nr *STM32_GPIO_PINS_PER_BANK ;
Greg Kroah-Hartman
maintainerPATCH 92/128 gpio: dln2: Fix interrupts when replugging the device
In reply to Greg Kroah-HartmanFrom: Noralf Trønnes <[email protected]>
commit 9a5875f14b0e3a13ae314883f1bb72b7f31fac07 upstream.
When replugging the device the following message shows up:
gpio gpiochip2: (dln2): detected irqchip that is shared with multiple gpiochips: please fix the driver.
This also has the effect that interrupts won't work.
The same problem would also show up if multiple devices where plugged in.
Fix this by allocating the irq_chip data structure per instance like other drivers do.
I don't know when this problem appeared, but it is present in 5.10.
--- drivers/gpio/gpio-dln2.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/gpio/gpio-dln2.c +9 -10
@@ -46,6 +46,7 @@struct dln2_gpio {struct platform_device *pdev;struct gpio_chip gpio; +struct irq_chip irqchip;/* * Cache pin direction to save us one transfer, since the hardware has
@@ -383,15 +384,6 @@ static void dln2_irq_bus_unlock(struct imutex_unlock (&dln2->irq_lock); } -static struct irq_chip dln2_gpio_irqchip = { - .name ="dln2-irq" , - .irq_mask = dln2_irq_mask, - .irq_unmask = dln2_irq_unmask, - .irq_set_type = dln2_irq_set_type, - .irq_bus_lock = dln2_irq_bus_lock, - .irq_bus_sync_unlock = dln2_irq_bus_unlock, -}; -static void dln2_gpio_event (struct platform_device *pdev,u16 echo,const void *data,int len) {
@@ -473,8 +465,15 @@ static int dln2_gpio_probe(struct platfo dln2->gpio.direction_output = dln2_gpio_direction_output; dln2->gpio.set_config = dln2_gpio_set_config; + dln2->irqchip.name ="dln2-irq" , + dln2->irqchip.irq_mask = dln2_irq_mask, + dln2->irqchip.irq_unmask = dln2_irq_unmask, + dln2->irqchip.irq_set_type = dln2_irq_set_type, + dln2->irqchip.irq_bus_lock = dln2_irq_bus_lock, + dln2->irqchip.irq_bus_sync_unlock = dln2_irq_bus_unlock, + girq = &dln2->gpio.irq; - girq->chip = &dln2_gpio_irqchip; + girq->chip = &dln2->irqchip;/* The event comes from the outside so no parent handler */ girq->parent_handler =NULL ; girq->num_parents =0 ;
Greg Kroah-Hartman
maintainerPATCH 93/128 mmc: sdhci-tegra: Fix switch to HS400ES mode
In reply to Greg Kroah-HartmanFrom: Prathamesh Shete <[email protected]>
commit 4fc7261dbab139d3c64c3b618262504e16cfe7ee upstream.
When CMD13 is sent after switching to HS400ES mode, the bus is operating at either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR. To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host controller CAR clock and the interface clock are rate matched.
--- drivers/mmc/host/sdhci-tegra.c | 43 ++++++++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 17 deletions(-)
drivers/mmc/host/sdhci-tegra.c +26 -17
@@ -356,23 +356,6 @@ static void tegra_sdhci_set_tap(struct s } } -static void tegra_sdhci_hs400_enhanced_strobe (struct mmc_host *mmc, -struct mmc_ios *ios) -{ -struct sdhci_host *host =mmc_priv (mmc); -u32 val; - - val =sdhci_readl (host,SDHCI_TEGRA_VENDOR_SYS_SW_CTRL ); - -if (ios->enhanced_strobe) - val |=SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE ; -else - val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE ; - -sdhci_writel (host, val,SDHCI_TEGRA_VENDOR_SYS_SW_CTRL ); - -} -static void tegra_sdhci_reset (struct sdhci_host *host,u8 mask) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);
@@ -793,6 +776,32 @@ static void tegra_sdhci_set_clock(struct } } +static void tegra_sdhci_hs400_enhanced_strobe (struct mmc_host *mmc, +struct mmc_ios *ios) +{ +struct sdhci_host *host =mmc_priv (mmc); +u32 val; + + val =sdhci_readl (host,SDHCI_TEGRA_VENDOR_SYS_SW_CTRL ); + +if (ios->enhanced_strobe) { + val |=SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE ; +/* +* When CMD13 is sent from mmc_select_hs400es() after +* switching to HS400ES mode, the bus is operating at +* either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR. +* To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI +* interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host +* controller CAR clock and the interface clock are rate matched. +*/ +tegra_sdhci_set_clock (host,MMC_HS200_MAX_DTR ); + }else { + val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE ; + } + +sdhci_writel (host, val,SDHCI_TEGRA_VENDOR_SYS_SW_CTRL ); +} +static unsigned int tegra_sdhci_get_max_clock (struct sdhci_host *host) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);
Greg Kroah-Hartman
maintainerPATCH 94/128 mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
commit f89b548ca66be7500dcd92ee8e61590f7d08ac91 upstream.
The vendor driver implements special handling for multi-block SD_IO_RW_EXTENDED (and SD_IO_RW_DIRECT) commands which have data attached to them. It sets the MANUAL_STOP bit in the MESON_SDHC_MISC register for these commands. In all other cases this bit is cleared. Here we omit SD_IO_RW_DIRECT since that command never has any data attached to it.
This fixes SDIO wifi using the brcmfmac driver which reported the following error without this change on a Netxeon S82 board using a Meson8 (S802) SoC:
brcmf_fw_alloc_request: using brcm/brcmfmac43362-sdio for chip
BCM43362/1
brcmf_sdiod_ramrw: membytes transfer failed
brcmf_sdio_download_code_file: error -110 on writing 219557 membytes
at 0x00000000 brcmf_sdio_download_firmware: dongle image file download failed
And with this change:
brcmf_fw_alloc_request: using brcm/brcmfmac43362-sdio for chip
BCM43362/1
brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may
have limited channels available
brcmf_c_preinit_dcmds: Firmware: BCM43362/1 wl0: Apr 22 2013 14:50:00
version 5.90.195.89.6 FWID 01-b30a427d--- drivers/mmc/host/meson-mx-sdhc-mmc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mmc/host/meson-mx-sdhc-mmc.c +16 -0
@@ -135,6 +135,7 @@ static void meson_mx_sdhc_start_cmd(stru struct mmc_command *cmd) {struct meson_mx_sdhc_host *host =mmc_priv (mmc); +bool manual_stop = false;u32 ictl, send;int pack_len;
@@ -172,12 +173,27 @@ static void meson_mx_sdhc_start_cmd(struelse /* software flush: */ ictl |=MESON_SDHC_ICTL_DATA_XFER_OK ; + +/* +* Mimic the logic from the vendor driver where (only) +* SD_IO_RW_EXTENDED commands with more than one block set the +* MESON_SDHC_MISC_MANUAL_STOP bit. This fixes the firmware +* download in the brcmfmac driver for a BCM43362/1 card. +* Without this sdio_memcpy_toio() (with a size of 219557 +* bytes) times out if MESON_SDHC_MISC_MANUAL_STOP is not set. +*/ + manual_stop = cmd->data->blocks >1 && + cmd->opcode ==SD_IO_RW_EXTENDED ; }else { pack_len =0 ; ictl |=MESON_SDHC_ICTL_RESP_OK ; } +regmap_update_bits (host->regmap,MESON_SDHC_MISC , +MESON_SDHC_MISC_MANUAL_STOP , + manual_stop ?MESON_SDHC_MISC_MANUAL_STOP :0 ); +if (cmd->opcode ==MMC_STOP_TRANSMISSION ) send |=MESON_SDHC_SEND_DATA_STOP ;
Greg Kroah-Hartman
maintainerPATCH 95/128 mmc: core: Disable card detect during shutdown
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
commit 66c915d09b942fb3b2b0cb2f56562180901fba17 upstream.
It's seems prone to problems by allowing card detect and its corresponding mmc_rescan() work to run, during platform shutdown. For example, we may end up turning off the power while initializing a card, which potentially could damage it.
To avoid this scenario, let's add ->shutdown_pre() callback for the mmc host class device and then turn of the card detect from there.
--- drivers/mmc/core/core.c | 7 ++++++- drivers/mmc/core/core.h | 1 + drivers/mmc/core/host.c | 9 +++++++++ 3 files changed, 16 insertions(+), 1 deletion(-)
drivers/mmc/core/core.c +6 -1
@@ -2264,7 +2264,7 @@ void mmc_start_host(struct mmc_host *hos_mmc_detect_change (host,0 , false); } -void mmc_stop_host (struct mmc_host *host) +void __mmc_stop_host (struct mmc_host *host) {if (host->slot.cd_irq >=0 ) {mmc_gpio_set_cd_wake (host, false);
@@ -2273,6 +2273,11 @@ void mmc_stop_host(struct mmc_host *host host->rescan_disable =1 ;cancel_delayed_work_sync (&host->detect); +} + +void mmc_stop_host (struct mmc_host *host) +{ +__mmc_stop_host (host);/* clear pm flags now and let card drivers set them as needed */ host->pm_flags =0 ;
drivers/mmc/core/core.h +1 -0
@@ -70,6 +70,7 @@ static inline void mmc_delay(unsigned invoid mmc_rescan (struct work_struct *work);void mmc_start_host (struct mmc_host *host); +void __mmc_stop_host (struct mmc_host *host);void mmc_stop_host (struct mmc_host *host); void _mmc_detect_change(struct mmc_host *host, unsigned long delay,
drivers/mmc/core/host.c +9 -0
@@ -80,9 +80,18 @@ static void mmc_host_classdev_release(stkfree (host); } +static int mmc_host_classdev_shutdown (struct device *dev) +{ +struct mmc_host *host =cls_dev_to_mmc_host (dev); + +__mmc_stop_host (host); +return 0 ; +} +static struct class mmc_host_class = { .name ="mmc_host" , .dev_release = mmc_host_classdev_release, + .shutdown_pre = mmc_host_classdev_shutdown, .pm =MMC_HOST_CLASS_DEV_PM_OPS , };
Greg Kroah-Hartman
maintainerPATCH 96/128 mmc: mmci: stm32: clear DLYB_CR after sending tuning command
In reply to Greg Kroah-HartmanFrom: Yann Gautier <[email protected]>
commit ff31ee0a0f471776f67be5e5275c18d17736fc6b upstream.
During test campaign, and especially after several unbind/bind sequences, it has been seen that the SD-card on SDMMC1 thread could freeze. The freeze always appear on a CMD23 following a CMD19. Checking SDMMC internal registers shows that the tuning command (CMD19) has failed.
The freeze is then due to the delay block involved in the tuning sequence. To correct this, clear the delay block register DLYB_CR register after the tuning commands.
--- drivers/mmc/host/mmci_stm32_sdmmc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/mmci_stm32_sdmmc.c +2 -0
@@ -441,6 +441,8 @@ static int sdmmc_dlyb_phase_tuning(strucreturn -EINVAL ; } +writel_relaxed (0 , dlyb->base +DLYB_CR ); + phase = end_of_len - max_len /2 ;sdmmc_dlyb_set_cfgr (dlyb, dlyb->unit, phase, false);
Greg Kroah-Hartman
maintainerPATCH 97/128 ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit 8536a5ef886005bc443c2da9b842d69fd3d7647f upstream.
The Thumb2 version of the FP exception handling entry code treats the register holding the CP number (R8) differently, resulting in the iWMMXT CP number check to be incorrect.
Fix this by unifying the ARM and Thumb2 code paths, and switch the order of the additions of the TI_USED_CP offset and the shifted CP index.
--- arch/arm/kernel/entry-armv.S | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
arch/arm/kernel/entry-armv.S +3 -5
@@ -597,11 +597,9 @@ call_fpe: tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2 reteq lr and r8, r0, #0x00000f00 @ mask out CP number - THUMB( lsr r8, r8, #8 ) mov r7, #1 - add r6, r10, #TI_USED_CP - ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[] - THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[] + add r6, r10, r8, lsr #8 @ add used_cp[] array offset first + strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[] #ifdef CONFIG_IWMMXT @ Test if we need to give access to iWMMXt coprocessors ldr r5, [r10, #TI_FLAGS]
@@ -610,7 +608,7 @@ call_fpe: bcs iwmmxt_task_enable #endif ARM( add pc, pc, r8, lsr #6 ) - THUMB( lsl r8, r8, #2 ) + THUMB( lsr r8, r8, #6 ) THUMB( add pc, r8 ) nop
Greg Kroah-Hartman
maintainerPATCH 98/128 ksmbd: fix error code in ndr_read_int32()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit ef399469d9ceb9f2171cdd79863f9434b9fa3edc upstream.
This is a failure path and it should return -EINVAL instead of success. Otherwise it could result in the caller using uninitialized memory.
--- fs/ksmbd/ndr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ksmbd/ndr.c +1 -1
@@ -148,7 +148,7 @@ static int ndr_read_int16(struct ndr *n,static int ndr_read_int32 (struct ndr *n,__u32 *value) {if (n->offset +sizeof (__u32) > n->length) -return 0 ; +return -EINVAL ;if (value) *value =le32_to_cpu (*(__le32 *)ndr_get_field (n));
Greg Kroah-Hartman
maintainerPATCH 99/128 ksmbd: fix uninitialized symbol pntsd_size
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit f2e78affc48dee29b989c1d9b0d89b503dcd1204 upstream.
No check for if "rc" is an error code for build_sec_desc(). This can cause problems with using uninitialized pntsd_size.
--- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ksmbd/smb2pdu.c +4 -0
@@ -2964,6 +2964,10 @@ int smb2_open(struct ksmbd_work *work) &pntsd_size, &fattr);posix_acl_release (fattr.cf_acls);posix_acl_release (fattr.cf_dacls); +if (rc) { +kfree (pntsd); + goto err_out; + } rc = ksmbd_vfs_set_sd_xattr(conn, user_ns,
Greg Kroah-Hartman
maintainerPATCH 100/128 ksmbd: disable SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1
In reply to Greg Kroah-HartmanFrom: Marcos Del Sol Vives <[email protected]>
commit 83912d6d55be10d65b5268d1871168b9ebe1ec4b upstream.
According to the official Microsoft MS-SMB2 document section 3.3.5.4, this flag should be used only for 3.0 and 3.0.2 dialects. Setting it for 3.1.1 is a violation of the specification.
This causes my Windows 10 client to detect an anomaly in the negotiation, and disable encryption entirely despite being explicitly enabled in ksmbd, causing all data transfers to go in plain text.
--- fs/ksmbd/smb2ops.c | 3 --- fs/ksmbd/smb2pdu.c | 25 +++++++++++++++++++++---- 2 files changed, 21 insertions(+), 7 deletions(-)
fs/ksmbd/smb2ops.c +0 -3
@@ -272,9 +272,6 @@ int init_smb3_11_server(struct ksmbd_conif (server_conf.flags &KSMBD_GLOBAL_FLAG_SMB2_LEASES ) conn->vals->capabilities |=SMB2_GLOBAL_CAP_LEASING ; -if (conn->cipher_type) - conn->vals->capabilities |=SMB2_GLOBAL_CAP_ENCRYPTION ; -if (server_conf.flags &KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL ) conn->vals->capabilities |=SMB2_GLOBAL_CAP_MULTI_CHANNEL ;
fs/ksmbd/smb2pdu.c +21 -4
@@ -917,6 +917,25 @@ static void decode_encrypt_ctxt(struct k } } +/** +* smb3_encryption_negotiated() - checks if server and client agreed on enabling encryption +* @conn: smb connection +* +* Return: true if connection should be encrypted, else false +*/ +static bool smb3_encryption_negotiated (struct ksmbd_conn *conn) +{ +if (!conn->ops->generate_encryptionkey) +return false; + +/* +* SMB 3.0 and 3.0.2 dialects use the SMB2_GLOBAL_CAP_ENCRYPTION flag. +* SMB 3.1.1 uses the cipher_type field. +*/ +return (conn->vals->capabilities &SMB2_GLOBAL_CAP_ENCRYPTION ) || + conn->cipher_type; +} +static void decode_compress_ctxt (struct ksmbd_conn *conn,struct smb2_compression_ctx *pneg_ctxt) {
@@ -1471,8 +1490,7 @@ static int ntlm_authenticate(struct ksmb (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) sess->sign = true; -if (conn->vals->capabilities &SMB2_GLOBAL_CAP_ENCRYPTION && - conn->ops->generate_encryptionkey && +if (smb3_encryption_negotiated (conn) && !(req->Flags &SMB2_SESSION_REQ_FLAG_BINDING )) { rc = conn->ops->generate_encryptionkey (sess);if (rc) {
@@ -1562,8 +1580,7 @@ static int krb5_authenticate(struct ksmb (req->SecurityMode & SMB2_NEGOTIATE_SIGNING_REQUIRED)) sess->sign = true; -if ((conn->vals->capabilities &SMB2_GLOBAL_CAP_ENCRYPTION ) && - conn->ops->generate_encryptionkey) { +if (smb3_encryption_negotiated (conn)) { retval = conn->ops->generate_encryptionkey (sess);if (retval) { ksmbd_debug(SMB,
Greg Kroah-Hartman
maintainerPATCH 101/128 mac80211: fix locking in ieee80211_start_ap error path
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 87a270625a89fc841f1a7e21aae6176543d8385c upstream.
We need to hold the local->mtx to release the channel context, as even encoded by the lockdep_assert_held() there. Fix it.
--- net/mac80211/cfg.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/cfg.c +3 -0
@@ -1226,7 +1226,10 @@ static int ieee80211_start_ap(struct wipreturn 0 ; error: +mutex_lock (&local->mtx);ieee80211_vif_release_channel (sdata); +mutex_unlock (&local->mtx); +return err; }
Greg Kroah-Hartman
maintainerPATCH 102/128 mm: mempolicy: fix THP allocations escaping mempolicy restrictions
In reply to Greg Kroah-HartmanFrom: Andrey Ryabinin <[email protected]>
commit 338635340669d5b317c7e8dcf4fff4a0f3651d87 upstream.
alloc_pages_vma() may try to allocate THP page on the local NUMA node first:
page = __alloc_pages_node(hpage_node, gfp | __GFP_THISNODE | __GFP_NORETRY, order);
And if the allocation fails it retries allowing remote memory:
if (!page && (gfp & __GFP_DIRECT_RECLAIM))
page = __alloc_pages_node(hpage_node,
gfp, order);However, this retry allocation completely ignores memory policy nodemask allowing allocation to escape restrictions.
The first appearance of this bug seems to be the commit ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings").
The bug disappeared later in the commit 89c83fb539f9 ("mm, thp:
consolidate THP gfp handling into alloc_hugepage_direct_gfpmask") and reappeared again in slightly different form in the commit 76e654cc91bb ("mm, page_alloc: allow hugepage fallback to remote nodes when madvised")
Fix this by passing correct nodemask to the __alloc_pages() call.
The demonstration/reproducer of the problem:
$ mount -oremount,size=4G,huge=always /dev/shm/
$ echo always > /sys/kernel/mm/transparent_hugepage/defrag
$ cat mbind_thp.c
#include <unistd.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <numaif.h> #define SIZE 2ULL << 30
int main(int argc, char **argv)
{
int fd;
unsigned long long i;
char *addr;
pid_t pid;
char buf[100];
unsigned long nodemask = 1;
fd = open("/dev/shm/test", O_RDWR|O_CREAT);
assert(fd > 0);
assert(ftruncate(fd, SIZE) == 0);
addr = mmap(NULL, SIZE, PROT_READ|PROT_WRITE,
MAP_SHARED, fd, 0);
assert(mbind(addr, SIZE, MPOL_BIND, &nodemask, 2, MPOL_MF_STRICT|MPOL_MF_MOVE)==0);
for (i = 0; i < SIZE; i+=4096) {
addr[i] = 1;
}
pid = getpid();
snprintf(buf, sizeof(buf), "grep shm /proc/%d/numa_maps", pid);
system(buf);
sleep(10000);
return 0;
}
$ gcc mbind_thp.c -o mbind_thp -lnuma
$ numactl -H
available: 2 nodes (0-1)
node 0 cpus: 0 2
node 0 size: 1918 MB
node 0 free: 1595 MB
node 1 cpus: 1 3
node 1 size: 2014 MB
node 1 free: 1731 MB
node distances:
node 0 1
0: 10 20
1: 20 10
$ rm -f /dev/shm/test; taskset -c 0 ./mbind_thp
7fd970a00000 bind:0 file=/dev/shm/test dirty=524288 active=0 N0=396800 N1=127488 kernelpagesize_kB=4--- mm/mempolicy.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
mm/mempolicy.c +1 -2
@@ -2140,8 +2140,7 @@ struct page *alloc_pages_vma(gfp_t gfp,* memory with both reclaim and compact as well. */ if (!page && (gfp & __GFP_DIRECT_RECLAIM)) - page =__alloc_pages_node (hpage_node, - gfp, order); + page =__alloc_pages (gfp, order, hpage_node, nmask); goto out; }
Greg Kroah-Hartman
maintainerPATCH 103/128 mm, hwpoison: fix condition in free hugetlb page path
In reply to Greg Kroah-HartmanFrom: Naoya Horiguchi <[email protected]>
commit e37e7b0b3bd52ec4f8ab71b027bcec08f57f1b3b upstream.
When a memory error hits a tail page of a free hugepage, __page_handle_poison() is expected to be called to isolate the error in 4kB unit, but it's not called due to the outdated if-condition in memory_failure_hugetlb(). This loses the chance to isolate the error in the finer unit, so it's not optimal. Drop the condition.
This "(p != head && TestSetPageHWPoison(head)" condition is based on the old semantics of PageHWPoison on hugepage (where PG_hwpoison flag was set on the subpage), so it's not necessray any more. By getting to set PG_hwpoison on head page for hugepages, concurrent error events on different subpages in a single hugepage can be prevented by TestSetPageHWPoison(head) at the beginning of memory_failure_hugetlb(). So dropping the condition should not reopen the race window originally mentioned in commit b985194c8c0a ("hwpoison, hugetlb:
lock_page/unlock_page does not match for handling a free hugepage")
--- mm/memory-failure.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
mm/memory-failure.c +4 -9
@@ -1437,17 +1437,12 @@ static int memory_failure_hugetlb(unsignif (!(flags &MF_COUNT_INCREASED )) { res =get_hwpoison_page (p, flags);if (!res) { -/* -* Check "filter hit" and "race with other subpage." -*/ lock_page (head); -if (PageHWPoison (head)) { -if ((hwpoison_filter (p) &&TestClearPageHWPoison (p)) - || (p != head &&TestSetPageHWPoison (head))) { +if (hwpoison_filter (p)) { +if (TestClearPageHWPoison (head))num_poisoned_pages_dec (); -unlock_page (head); -return 0 ; - } +unlock_page (head); +return 0 ; }unlock_page (head); res =MF_FAILED ;
Greg Kroah-Hartman
maintainerPATCH 104/128 mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
commit 2a57d83c78f889bf3f54eede908d0643c40d5418 upstream.
Hulk Robot reported a panic in put_page_testzero() when testing madvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page(). This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt is not increased.
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:737!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: release_pages+0x53f/0x840
Call Trace:
free_pages_and_swap_cache+0x64/0x80
tlb_flush_mmu+0x6f/0x220
unmap_page_range+0xe6c/0x12c0
unmap_single_vma+0x90/0x170
unmap_vmas+0xc4/0x180
exit_mmap+0xde/0x3a0
mmput+0xa3/0x250
do_exit+0x564/0x1470
do_group_exit+0x3b/0x100
__do_sys_exit_group+0x13/0x20
__x64_sys_exit_group+0x16/0x20
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Modules linked in:
---[ end trace e99579b570fe0649 ]---
RIP: 0010:release_pages+0x53f/0x840--- mm/memory-failure.c | 1 + 1 file changed, 1 insertion(+)
mm/memory-failure.c +1 -0
@@ -2201,6 +2201,7 @@ retry: }else if (ret ==0 ) {if (soft_offline_free_page (page) && try_again) { try_again = false; + flags &= ~MF_COUNT_INCREASED ; goto retry; } }
Greg Kroah-Hartman
maintainerPATCH 105/128 mm/damon/dbgfs: protect targets destructions with kdamond_lock
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 34796417964b8d0aef45a99cf6c2d20cebe33733 upstream.
DAMON debugfs interface iterates current monitoring targets in 'dbgfs_target_ids_read()' while holding the corresponding 'kdamond_lock'. However, it also destructs the monitoring targets in 'dbgfs_before_terminate()' without holding the lock. This can result in a use_after_free bug. This commit avoids the race by protecting the destruction with the corresponding 'kdamond_lock'.
--- mm/damon/dbgfs.c | 2 ++ 1 file changed, 2 insertions(+)
mm/damon/dbgfs.c +2 -0
@@ -309,10 +309,12 @@ static int dbgfs_before_terminate(structif (!targetid_is_pid (ctx))return 0 ; +mutex_lock (&ctx->kdamond_lock);damon_for_each_target_safe (t, next, ctx) {put_pid ((struct pid *)t->id);damon_destroy_target (t); } +mutex_unlock (&ctx->kdamond_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 106/128 tee: optee: Fix incorrect page free bug
In reply to Greg Kroah-HartmanFrom: Sumit Garg <[email protected]>
commit 18549bf4b21c739a9def39f27dcac53e27286ab5 upstream.
Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this pointer as we would free any arbitrary pages. Fix this by stop modifying the page pointer.
--- drivers/tee/optee/shm_pool.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/tee/optee/shm_pool.c +2 -4
@@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_ goto err; } -for (i =0 ; i < nr_pages; i++) { - pages[i] = page; - page++; - } +for (i =0 ; i < nr_pages; i++) + pages[i] = page + i; shm->flags |=TEE_SHM_REGISTER ; rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
Greg Kroah-Hartman
maintainerPATCH 107/128 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 5598b24efaf4892741c798b425d543e4bed357a1 upstream.
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=215235
- Overview
page fault in f2fs_setxattr() when mount and operate on corrupted image
- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root
1. unzip tmp7.zip
2. ./single.sh f2fs 7
Sometimes need to run the script several times
- Kernel dump
loop0: detected capacity change from 0 to 131072 F2FS-fs (loop0): Found nat_bits in checkpoint F2FS-fs (loop0): Mounted with checkpoint version = 7548c2ee
BUG: unable to handle page fault for address: ffffe47bc7123f48 RIP: 0010:kfree+0x66/0x320 Call Trace: __f2fs_setxattr+0x2aa/0xc00 [f2fs] f2fs_setxattr+0xfa/0x480 [f2fs] __f2fs_set_acl+0x19b/0x330 [f2fs] __vfs_removexattr+0x52/0x70 __vfs_removexattr_locked+0xb1/0x140 vfs_removexattr+0x56/0x100 removexattr+0x57/0x80 path_removexattr+0xa3/0xc0 __x64_sys_removexattr+0x17/0x20 do_syscall_64+0x37/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is in __f2fs_setxattr(), we missed to do sanity check on last xattr entry, result in out-of-bound memory access during updating inconsistent xattr data of target inode.
After the fix, it can detect such xattr inconsistency as below:
F2FS-fs (loop11): inode (7) has invalid last xattr entry, entry_size: 60676 F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has invalid last xattr entry, entry_size: 47736
--- fs/f2fs/xattr.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/f2fs/xattr.c +10 -1
@@ -684,8 +684,17 @@ static int __f2fs_setxattr(struct inode } last = here; -while (!IS_XATTR_LAST_ENTRY (last)) +while (!IS_XATTR_LAST_ENTRY (last)) { +if ((void *)(last) +sizeof (__u32) > last_base_addr || + (void *)XATTR_NEXT_ENTRY (last) > last_base_addr) { +f2fs_err (F2FS_I_SB (inode),"inode (%lu) has invalid last xattr entry, entry_size: %zu" , + inode->i_ino,ENTRY_SIZE (last)); +set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK ); + error = -EFSCORRUPTED ; + goto exit; + } last =XATTR_NEXT_ENTRY (last); + } newsize =XATTR_ALIGN (sizeof (struct f2fs_xattr_entry ) + len + size);
Greg Kroah-Hartman
maintainerPATCH 108/128 netfs: fix parameter of cleanup()
In reply to Greg Kroah-HartmanFrom: Jeffle Xu <[email protected]>
commit 3cfef1b612e15a0c2f5b1c9d3f3f31ad72d56fcd upstream.
The order of these two parameters is just reversed. gcc didn't warn on that, probably because 'void *' can be converted from or to other pointer types without warning.
--- fs/netfs/read_helper.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/netfs/read_helper.c +3 -3
@@ -958,7 +958,7 @@ int netfs_readpage(struct file *file, rreq =netfs_alloc_read_request (ops, netfs_priv, file);if (!rreq) {if (netfs_priv) - ops->cleanup (netfs_priv,page_file_mapping (page)); + ops->cleanup (page_file_mapping (page), netfs_priv);unlock_page (page);return -ENOMEM ; }
@@ -1185,7 +1185,7 @@ have_page: goto error; have_page_no_wait:if (netfs_priv) - ops->cleanup (netfs_priv, mapping); + ops->cleanup (mapping, netfs_priv); *_page = page;_leave (" = 0" );return 0 ;
@@ -1196,7 +1196,7 @@ error:unlock_page (page);put_page (page);if (netfs_priv) - ops->cleanup (netfs_priv, mapping); + ops->cleanup (mapping, netfs_priv);_leave (" = %d" , ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 109/128 KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 0ff29701ffad9a5d5a24344d8b09f3af7b96ffda upstream.
Update the documentation for kvm-intel's emulate_invalid_guest_state to rectify the description of KVM's default behavior, and to document that the behavior and thus parameter only applies to L1.
Message-Id: <[email protected]>
--- Documentation/admin-guide/kernel-parameters.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
Documentation/admin-guide/kernel-parameters.txt +6 -2
@@ -2403,8 +2403,12 @@ Default is 1 (enabled) kvm-intel.emulate_invalid_guest_state= - [KVM,Intel] Enable emulation of invalid guest states - Default is 0 (disabled) + [KVM,Intel] Disable emulation of invalid guest state. + Ignored if kvm-intel.enable_unrestricted_guest=1, as + guest state is never invalid for unrestricted guests. + This param doesn't apply to nested guests (L2), as KVM + never emulates invalid L2 guest state. + Default is 1 (enabled) kvm-intel.flexpriority= [KVM,Intel] Disable FlexPriority feature (TPR shadow).
Greg Kroah-Hartman
maintainerPATCH 110/128 arm64: dts: lx2160a: fix scl-gpios property name
In reply to Greg Kroah-HartmanFrom: Zhang Ying-22455 <[email protected]>
commit 849e087ba68ac6956c11016ce34f9f10a09a4186 upstream.
Fix the typo in the property name.
--- arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +2 -2
@@ -719,7 +719,7 @@ clock-names = "i2c"; clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; - scl-gpio = <&gpio2 15 GPIO_ACTIVE_HIGH>; + scl-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>; status = "disabled"; };
@@ -768,7 +768,7 @@ clock-names = "i2c"; clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL QORIQ_CLK_PLL_DIV(16)>; - scl-gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>; + scl-gpios = <&gpio2 16 GPIO_ACTIVE_HIGH>; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 111/128 kfence: fix memory leak when cat kfence objects
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit 0129ab1f268b6cf88825eae819b9b84aa0a85634 upstream.
Hulk robot reported a kmemleak problem:
unreferenced object 0xffff93d1d8cc02e8 (size 248):
comm "cat", pid 23327, jiffies 4624670141 (age 495992.217s)
hex dump (first 32 bytes):
00 40 85 19 d4 93 ff ff 00 10 00 00 00 00 00 00 .@..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
seq_open+0x2a/0x80
full_proxy_open+0x167/0x1e0
do_dentry_open+0x1e1/0x3a0
path_openat+0x961/0xa20
do_filp_open+0xae/0x120
do_sys_openat2+0x216/0x2f0
do_sys_open+0x57/0x80
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff93d419854000 (size 4096):
comm "cat", pid 23327, jiffies 4624670141 (age 495992.217s)
hex dump (first 32 bytes):
6b 66 65 6e 63 65 2d 23 32 35 30 3a 20 30 78 30 kfence-#250: 0x0
30 30 30 30 30 30 30 37 35 34 62 64 61 31 32 2d 0000000754bda12-
backtrace:
seq_read_iter+0x313/0x440
seq_read+0x14b/0x1a0
full_proxy_read+0x56/0x80
vfs_read+0xa5/0x1b0
ksys_read+0xa0/0xf0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9I find that we can easily reproduce this problem with the following commands:
cat /sys/kernel/debug/kfence/objects
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
The leaked memory is allocated in the stack below:
do_syscall_64
do_sys_open
do_dentry_open
full_proxy_open
seq_open ---> alloc seq_file
vfs_read
full_proxy_read
seq_read
seq_read_iter
traverse ---> alloc seq_bufAnd it should have been released in the following process:
do_syscall_64
syscall_exit_to_user_mode
exit_to_user_mode_prepare
task_work_run
____fput
__fput
full_proxy_release ---> free hereHowever, the release function corresponding to file_operations is not implemented in kfence. As a result, a memory leak occurs. Therefore, the solution to this problem is to implement the corresponding release function.
--- mm/kfence/core.c | 1 + 1 file changed, 1 insertion(+)
mm/kfence/core.c +1 -0
@@ -578,6 +578,7 @@ static const struct file_operations obje .open = open_objects, .read = seq_read, .llseek = seq_lseek, + .release = seq_release, };static int __init kfence_debugfs_init (void )
Greg Kroah-Hartman
maintainerPATCH 112/128 Input: iqs626a - prohibit inlining of channel parsing functions
In reply to Greg Kroah-HartmanFrom: Jeff LaBundy <[email protected]>
commit e1f5e848209a1b51ccae50721b27684c6f9d978f upstream.
Some automated builds report a stack frame size in excess of 2 kB for iqs626_probe(); the culprit appears to be the call to iqs626_parse_prop().
To solve this problem, specify noinline_for_stack for all of the iqs626_parse_*() helper functions which are called inside a for loop within iqs626_parse_prop().
As a result, a build with '-Wframe-larger-than' as low as 512 is free of any such warnings.
--- drivers/input/misc/iqs626a.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/input/misc/iqs626a.c +12 -9
@@ -456,9 +456,10 @@ struct iqs626_private {unsigned int suspend_mode; }; -static int iqs626_parse_events (struct iqs626_private *iqs626, -const struct fwnode_handle *ch_node, -enum iqs626_ch_id ch_id) +static noinline_for_stack int +iqs626_parse_events (struct iqs626_private *iqs626, +const struct fwnode_handle *ch_node, +enum iqs626_ch_id ch_id) {struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;struct i2c_client *client = iqs626->client;
@@ -604,9 +605,10 @@ static int iqs626_parse_events(struct iqreturn 0 ; } -static int iqs626_parse_ati_target (struct iqs626_private *iqs626, -const struct fwnode_handle *ch_node, -enum iqs626_ch_id ch_id) +static noinline_for_stack int +iqs626_parse_ati_target (struct iqs626_private *iqs626, +const struct fwnode_handle *ch_node, +enum iqs626_ch_id ch_id) {struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;struct i2c_client *client = iqs626->client;
@@ -885,9 +887,10 @@ static int iqs626_parse_trackpad(structreturn 0 ; } -static int iqs626_parse_channel (struct iqs626_private *iqs626, -const struct fwnode_handle *ch_node, -enum iqs626_ch_id ch_id) +static noinline_for_stack int +iqs626_parse_channel (struct iqs626_private *iqs626, +const struct fwnode_handle *ch_node, +enum iqs626_ch_id ch_id) {struct iqs626_sys_reg *sys_reg = &iqs626->sys_reg;struct i2c_client *client = iqs626->client;
Greg Kroah-Hartman
maintainerPATCH 113/128 Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
In reply to Greg Kroah-HartmanFrom: Johnny Chuang <[email protected]>
commit 4ebfee2bbc1a9c343dd50565ba5ae249fac32267 upstream.
The eKTH3900/eKTH5312 series do not support the firmware update rules of Remark ID. Exclude these two series from checking it when updating the firmware in touch controllers.
--- drivers/input/touchscreen/elants_i2c.c | 46 ++++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-)
drivers/input/touchscreen/elants_i2c.c +45 -1
@@ -117,6 +117,19 @@#define ELAN_POWERON_DELAY_USEC 500#define ELAN_RESET_DELAY_MSEC 20 +/* FW boot code version */ +#define BC_VER_H_BYTE_FOR_EKTH3900x1_I2C 0x72 +#define BC_VER_H_BYTE_FOR_EKTH3900x2_I2C 0x82 +#define BC_VER_H_BYTE_FOR_EKTH3900x3_I2C 0x92 +#define BC_VER_H_BYTE_FOR_EKTH5312x1_I2C 0x6D +#define BC_VER_H_BYTE_FOR_EKTH5312x2_I2C 0x6E +#define BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C 0x77 +#define BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C 0x78 +#define BC_VER_H_BYTE_FOR_EKTH5312x1_I2C_USB 0x67 +#define BC_VER_H_BYTE_FOR_EKTH5312x2_I2C_USB 0x68 +#define BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C_USB 0x74 +#define BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C_USB 0x75 +enum elants_chip_id {EKTH3500 ,EKTF3624 ,
@@ -736,6 +749,37 @@ static int elants_i2c_validate_remark_idreturn 0 ; } +static bool elants_i2c_should_check_remark_id (struct elants_data *ts) +{ +struct i2c_client *client = ts->client; +const u8 bootcode_version = ts->iap_version; +bool check; + +/* I2C eKTH3900 and eKTH5312 are NOT support Remark ID */ +if ((bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x1_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x2_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH3900x3_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x1_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x2_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x1_I2C_USB) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312x2_I2C_USB) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx1_I2C_USB) || + (bootcode_version == BC_VER_H_BYTE_FOR_EKTH5312cx2_I2C_USB)) { +dev_dbg (&client->dev, +"eKTH3900/eKTH5312(0x%02x) are not support remark id\n" , + bootcode_version); + check = false; + }else if (bootcode_version >=0x60 ) { + check = true; + }else { + check = false; + } + +return check; +} +static int elants_i2c_do_update_firmware (struct i2c_client *client,const struct firmware *fw,bool force)
@@ -749,7 +793,7 @@ static int elants_i2c_do_update_firmwareu16 send_id;int page, n_fw_pages;int error; -bool check_remark_id = ts->iap_version >=0x60 ; +bool check_remark_id =elants_i2c_should_check_remark_id (ts);/* Recovery mode detection! */ if (force) {
Greg Kroah-Hartman
maintainerPATCH 114/128 Input: i8042 - enable deferred probe quirk for ASUS UM325UA
In reply to Greg Kroah-HartmanFrom: Samuel Čavoj <[email protected]>
commit 44ee250aeeabb28b52a10397ac17ffb8bfe94839 upstream.
The ASUS UM325UA suffers from the same issue as the ASUS UX425UA, which is a very similar laptop. The i8042 device is not usable immediately after boot and fails to initialize, requiring a deferred retry.
Enable the deferred probe quirk for the UM325UA.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -992,6 +992,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "C504"), }, }, + { + /* ASUS ZenBook UM325UA */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + }, + }, { } };
Re: [PATCH 5.15 114/128] Input: i8042 - enable deferred probe quirk for ASUS UM325UA
Hi Greg,
it seems this patch is misapplied -- please see the context in the original diff. The quirk in question itself was only added in a recent patch which is not present in stable:
commit 9222ba68c3f406 -- https://lore.kernel.org/all/[email protected]/
This seems to be the case for all stable branches.
Thanks
Quoted 22 lines · Greg Kroah-Hartman
From: Samuel Čavoj <[email protected]>
commit
44ee250aeeabb28b52a10397ac17ffb8bfe94839upstream.The ASUS UM325UA suffers from the same issue as the ASUS UX425UA, which is a very similar laptop. The i8042 device is not usable immediately after boot and fails to initialize, requiring a deferred retry.
Enable the deferred probe quirk for the UM325UA.
Signed-off-by Samuel Čavoj <[email protected]>Signed-off-by Dmitry Torokhov <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h static const struct dmi_system_id __init · line 992
Quoted 1 line
drivers/input/serio/i8042-x86ia64io.h +0
-0@@ -992,6 +992,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
It doesn't match here.
drivers/input/serio/i8042-x86ia64io.h static const struct dmi_system_id __init · line 1003
Quoted 11 lines
drivers/input/serio/i8042-x86ia64io.h +7
-0}, }, + { + /* ASUS ZenBook UM325UA */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + }, + }, { } };
Regards,
Samuel
Greg Kroah-Hartman
maintainerRe: [PATCH 5.15 114/128] Input: i8042 - enable deferred probe quirk for ASUS UM325UA
Quoted 9 lines · Samuel Čavoj
Hi Greg,
it seems this patch is misapplied -- please see the context in the original diff. The quirk in question itself was only added in a recent patch which is not present in stable:
commit9222ba68c3f406--
https://lore.kernel.org/all/[email protected]/This seems to be the case for all stable branches.
Ah, good catch, now dropped from all stable branches, thanks!
greg k-h
Greg Kroah-Hartman
maintainerPATCH 115/128 Input: goodix - add id->model mapping for the "9111" model
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 81e818869be522bc8fa6f7df1b92d7e76537926c upstream.
Add d->model mapping for the "9111" model, this fixes uses using a wrong config_len of 240 bytes while the "9111" model uses only 186 bytes of config.
--- drivers/input/touchscreen/goodix.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/touchscreen/goodix.c +1 -0
@@ -162,6 +162,7 @@ static const struct goodix_chip_id goodi { .id = "911", .data = >911_chip_data }, { .id = "9271", .data = >911_chip_data }, { .id = "9110", .data = >911_chip_data }, + { .id = "9111", .data = >911_chip_data }, { .id = "927", .data = >911_chip_data }, { .id = "928", .data = >911_chip_data },
Greg Kroah-Hartman
maintainerPATCH 116/128 ASoC: tas2770: Fix setting of high sample rates
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
commit 80d5be1a057e05f01d66e986cfd34d71845e5190 upstream.
Although the codec advertises support for 176.4 and 192 ksps, without this fix setting those sample rates fails with EINVAL at hw_params time.
--- sound/soc/codecs/tas2770.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2770.c +2 -2
@@ -291,11 +291,11 @@ static int tas2770_set_samplerate(struct ramp_rate_val =TAS2770_TDM_CFG_REG0_SMP_44_1KHZ |TAS2770_TDM_CFG_REG0_31_88_2_96KHZ ;break ; -case 19200 : +case 192000 : ramp_rate_val =TAS2770_TDM_CFG_REG0_SMP_48KHZ |TAS2770_TDM_CFG_REG0_31_176_4_192KHZ ;break ; -case 17640 : +case 176400 : ramp_rate_val =TAS2770_TDM_CFG_REG0_SMP_44_1KHZ |TAS2770_TDM_CFG_REG0_31_176_4_192KHZ ;break ;
Greg Kroah-Hartman
maintainerPATCH 117/128 ASoC: SOF: Intel: pci-tgl: add new ADL-P variant
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
commit de7dd9092cd38384f774d345cccafe81b4b866b0 upstream.
Add a PCI DID for a variant of Intel AlderLake-P.
--- sound/soc/sof/intel/pci-tgl.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sof/intel/pci-tgl.c +2 -0
@@ -117,6 +117,8 @@ static const struct pci_device_id sof_pc .driver_data = (unsigned long)&adls_desc}, { PCI_DEVICE(0x8086, 0x51c8), /* ADL-P */ .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x51cd), /* ADL-P */ + .driver_data = (unsigned long)&adl_desc}, { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ .driver_data = (unsigned long)&adl_desc}, { 0, }
Greg Kroah-Hartman
maintainerPATCH 118/128 ASoC: SOF: Intel: pci-tgl: add ADL-N support
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
commit cd57eb3c403cb864e5558874ecd57dd954a5a7f7 upstream.
Add PCI DID for Intel AlderLake-N.
--- sound/soc/sof/intel/pci-tgl.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sof/intel/pci-tgl.c +2 -0
@@ -121,6 +121,8 @@ static const struct pci_device_id sof_pc .driver_data = (unsigned long)&adl_desc}, { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x54c8), /* ADL-N */ + .driver_data = (unsigned long)&adl_desc}, { 0, } };MODULE_DEVICE_TABLE (pci, sof_pci_ids);
Greg Kroah-Hartman
maintainerPATCH 119/128 ASoC: rt5682: fix the wrong jack type detected
In reply to Greg Kroah-HartmanFrom: Derek Fang <[email protected]>
commit 8deb34a90f06374fd26f722c2a79e15160f66be7 upstream.
Some powers were changed during the jack insert detection and clk's enable/disable in CCF.
If in parallel, the influence has a chance to detect the wrong jack type, so add a lock.
--- sound/soc/codecs/rt5682.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/rt5682.c +4 -0
@@ -927,6 +927,8 @@ int rt5682_headset_detect(struct snd_socunsigned int val, count;if (jack_insert) { +snd_soc_dapm_mutex_lock (dapm); +snd_soc_component_update_bits (component,RT5682_PWR_ANLG_1 ,RT5682_PWR_VREF2 |RT5682_PWR_MB ,RT5682_PWR_VREF2 |RT5682_PWR_MB );
@@ -973,6 +975,8 @@ int rt5682_headset_detect(struct snd_socsnd_soc_component_update_bits (component,RT5682_MICBIAS_2 ,RT5682_PWR_CLK25M_MASK |RT5682_PWR_CLK1M_MASK ,RT5682_PWR_CLK25M_PU |RT5682_PWR_CLK1M_PU ); + +snd_soc_dapm_mutex_unlock (dapm); }else {rt5682_enable_push_button_irq (component, false); snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
Greg Kroah-Hartman
maintainerPATCH 120/128 pinctrl: mediatek: fix global-out-of-bounds issue
In reply to Greg Kroah-HartmanFrom: Guodong Liu <[email protected]>
commit 2d5446da5acecf9c67db1c9d55ae2c3e5de01f8d upstream.
When eint virtual eint number is greater than gpio number, it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.
--- drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +6 -2
@@ -285,8 +285,12 @@ static int mtk_xt_get_gpio_n(void *data, desc = (const struct mtk_pin_desc *)hw->soc->pins; *gpio_chip = &hw->chip; -/* Be greedy to guess first gpio_n is equal to eint_n */ -if (desc[eint_n].eint.eint_n == eint_n) +/* +* Be greedy to guess first gpio_n is equal to eint_n. +* Only eint virtual eint number is greater than gpio number. +*/ +if (hw->soc->npins > eint_n && + desc[eint_n].eint.eint_n == eint_n) *gpio_n = eint_n;else *gpio_n =mtk_xt_find_eint_num (hw, eint_n);
Greg Kroah-Hartman
maintainerPATCH 121/128 hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
commit da7dc0568491104c7acb632e9d41ddce9aaabbb1 upstream.
Tests with a real chip and a closer look into the datasheet reveals that the local and remote critical alarm status bits are swapped for MAX6680/MAX6681.
--- drivers/hwmon/lm90.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/hwmon/lm90.c +8 -2
@@ -190,6 +190,7 @@ enum chips { lm90, adm1032, lm99, lm86,#define LM90_HAVE_EXTENDED_TEMP (1 << 8)/* extended temperature support*/ #define LM90_PAUSE_FOR_CONFIG (1 << 9)/* Pause conversion for config */ #define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ +#define LM90_HAVE_CRIT_ALRM_SWP (1 << 11)/* critical alarm bits swapped */ /* LM90 status */ #define LM90_STATUS_LTHRM (1 << 0)/* local THERM limit tripped */
@@ -415,7 +416,8 @@ static const struct lm90_params lm90_par .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [max6680] = { - .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT, + .flags =LM90_HAVE_OFFSET |LM90_HAVE_CRIT + | LM90_HAVE_CRIT_ALRM_SWP, .alert_alarms = 0x7c, .max_convrate = 7, },
@@ -1201,6 +1203,7 @@ static const u8 lm90_temp_emerg_index[3]static const u8 lm90_min_alarm_bits[3 ] = {5 ,3 ,11 };static const u8 lm90_max_alarm_bits[3 ] = {6 ,4 ,12 };static const u8 lm90_crit_alarm_bits[3 ] = {0 ,1 ,9 }; +static const u8 lm90_crit_alarm_bits_swapped[3 ] = {1 ,0 ,9 };static const u8 lm90_emergency_alarm_bits[3 ] = {15 ,13 ,14 };static const u8 lm90_fault_bits[3 ] = {0 ,2 ,10 };
@@ -1226,7 +1229,10 @@ static int lm90_temp_read(struct device *val = (data->alarms >> lm90_max_alarm_bits[channel]) &1 ;break ;case hwmon_temp_crit_alarm: - *val = (data->alarms >> lm90_crit_alarm_bits[channel]) &1 ; +if (data->flags &LM90_HAVE_CRIT_ALRM_SWP ) + *val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) &1 ; +else + *val = (data->alarms >> lm90_crit_alarm_bits[channel]) &1 ;break ;case hwmon_temp_emergency_alarm: *val = (data->alarms >> lm90_emergency_alarm_bits[channel]) &1 ;
Greg Kroah-Hartman
maintainerPATCH 122/128 hwmon: (lm90) Do not report busy status bit as alarm
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
commit cdc5287acad9ede121924a9c9313544b80d15842 upstream.
Bit 7 of the status register indicates that the chip is busy doing a conversion. It does not indicate an alarm status. Stop reporting it as alarm status bit.
--- drivers/hwmon/lm90.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hwmon/lm90.c +2 -1
@@ -200,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86,#define LM90_STATUS_RHIGH (1 << 4)/* remote high temp limit tripped */ #define LM90_STATUS_LLOW (1 << 5)/* local low temp limit tripped */ #define LM90_STATUS_LHIGH (1 << 6)/* local high temp limit tripped */ +#define LM90_STATUS_BUSY (1 << 7)/* conversion is ongoing */ #define MAX6696_STATUS2_R2THRM (1 << 1)/* remote2 THERM limit tripped */ #define MAX6696_STATUS2_R2OPEN (1 << 2)/* remote2 is an open circuit */
@@ -820,7 +821,7 @@ static int lm90_update_device(struct dev val =lm90_read_reg (client,LM90_REG_R_STATUS );if (val <0 )return val; - data->alarms = val;/* lower 8 bit of alarms */ + data->alarms = val & ~LM90_STATUS_BUSY ;if (data->kind == max6696) { val =lm90_select_remote_channel (data,1 );
Greg Kroah-Hartman
maintainerPATCH 123/128 r8152: sync ocp base
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
commit b24edca309535c2d9af86aab95d64065f6ef1d26 upstream.
There are some chances that the actual base of hardware is different from the value recorded by driver, so we have to reset the variable of ocp_base to sync it.
Set ocp_base to -1. Then, it would be updated and the new base would be set to the hardware next time.
--- drivers/net/usb/r8152.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
drivers/net/usb/r8152.c +22 -4
@@ -32,7 +32,7 @@#define NETNEXT_VERSION "12"/* Information for net */ -#define NET_VERSION "11" +#define NET_VERSION "12"#define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION#define DRIVER_AUTHOR "Realtek linux nic maintainers <[email protected]>"
@@ -4016,6 +4016,11 @@ static void rtl_clear_bp(struct r8152 *tocp_write_word (tp, type,PLA_BP_BA ,0 ); } +static inline void rtl_reset_ocp_base (struct r8152 *tp) +{ + tp->ocp_base =-1 ; +} +static int rtl_phy_patch_request (struct r8152 *tp,bool request,bool wait) {u16 data, check;
@@ -4087,8 +4092,6 @@ static int rtl_post_ram_code(struct r815rtl_phy_patch_request (tp, false, wait); -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_OCP_GPHY_BASE , tp->ocp_base); -return 0 ; }
@@ -4800,6 +4803,8 @@ static void rtl_ram_code_speed_up(structu32 len;u8 *data; +rtl_reset_ocp_base (tp); +if (sram_read (tp,SRAM_GPHY_FW_VER ) >=__le16_to_cpu (phy->version)) {dev_dbg (&tp->intf->dev,"PHY firmware has been the newest\n" );return ;
@@ -4845,7 +4850,8 @@ static void rtl_ram_code_speed_up(struct } } -ocp_write_word (tp,MCU_TYPE_PLA ,PLA_OCP_GPHY_BASE , tp->ocp_base); +rtl_reset_ocp_base (tp); +rtl_phy_patch_request (tp, false, wait);if (sram_read (tp,SRAM_GPHY_FW_VER ) ==__le16_to_cpu (phy->version))
@@ -4861,6 +4867,8 @@ static int rtl8152_fw_phy_ver(struct r81 ver_addr =__le16_to_cpu (phy_ver->ver.addr); ver =__le16_to_cpu (phy_ver->ver.data); +rtl_reset_ocp_base (tp); +if (sram_read (tp, ver_addr) >= ver) {dev_dbg (&tp->intf->dev,"PHY firmware has been the newest\n" );return 0 ;
@@ -4877,6 +4885,8 @@ static void rtl8152_fw_phy_fixup(struct {u16 addr, data; +rtl_reset_ocp_base (tp); + addr =__le16_to_cpu (fix->setting.addr); data =ocp_reg_read (tp, addr);
@@ -4908,6 +4918,8 @@ static void rtl8152_fw_phy_union_apply(su32 length;int i, num; +rtl_reset_ocp_base (tp); + num = phy->pre_num;for (i =0 ; i < num; i++) sram_write(tp, __le16_to_cpu(phy->pre_set[i].addr),
@@ -4938,6 +4950,8 @@ static void rtl8152_fw_phy_nc_apply(struu32 length, i, num;__le16 *data; +rtl_reset_ocp_base (tp); + mode_reg =__le16_to_cpu (phy->mode_reg);sram_write (tp, mode_reg,__le16_to_cpu (phy->mode_pre)); sram_write(tp, __le16_to_cpu(phy->ba_reg),
@@ -5107,6 +5121,7 @@ post_fw:if (rtl_fw->post_fw) rtl_fw->post_fw (tp); +rtl_reset_ocp_base (tp);strscpy (rtl_fw->version, fw_hdr->version,RTL_VER_SIZE );dev_info (&tp->intf->dev,"load %s successfully\n" , rtl_fw->version); }
@@ -8484,6 +8499,8 @@ static int rtl8152_resume(struct usb_intmutex_lock (&tp->control); +rtl_reset_ocp_base (tp); +if (test_bit (SELECTIVE_SUSPEND , &tp->flags)) ret =rtl8152_runtime_resume (tp);else
@@ -8499,6 +8516,7 @@ static int rtl8152_reset_resume(struct ustruct r8152 *tp =usb_get_intfdata (intf);clear_bit (SELECTIVE_SUSPEND , &tp->flags); +rtl_reset_ocp_base (tp); tp->rtl_ops.init (tp);queue_delayed_work (system_long_wq, &tp->hw_phy_work,0 );set_ethernet_addr (tp, true);
Greg Kroah-Hartman
maintainerPATCH 124/128 ax25: NPD bug when detaching AX25 device
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 1ade48d0c27d5da1ccf4b583d8c5fc8b534a3ac8 upstream.
The existing cleanup routine implementation is not well synchronized with the syscall routine. When a device is detaching, below race could occur.
static int ax25_sendmsg(...) {
...
lock_sock()
ax25 = sk_to_ax25(sk);
if (ax25->ax25_dev == NULL) // CHECK
...
ax25_queue_xmit(skb, ax25->ax25_dev->dev); // USE
...
}
static void ax25_kill_by_device(...) {
...
if (s->ax25_dev == ax25_dev) {
s->ax25_dev = NULL;
...
}Other syscall functions like ax25_getsockopt, ax25_getname, ax25_info_show also suffer from similar races. To fix them, this patch introduce lock_sock() into ax25_kill_by_device in order to guarantee that the nullify action in cleanup routine cannot proceed when another socket request is pending.
--- net/ax25/af_ax25.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ax25/af_ax25.c +3 -1
@@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct n again:ax25_for_each (s, &ax25_list) {if (s->ax25_dev == ax25_dev) { - s->ax25_dev =NULL ;spin_unlock_bh (&ax25_list_lock); +lock_sock (s->sk); + s->ax25_dev =NULL ; +release_sock (s->sk);ax25_disconnect (s,ENETUNREACH );spin_lock_bh (&ax25_list_lock);
Greg Kroah-Hartman
maintainerPATCH 125/128 hamradio: defer ax25 kfree after unregister_netdev
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 3e0588c291d6ce225f2b891753ca41d45ba42469 upstream.
There is a possible race condition (use-after-free) like below
(USE) | (FREE)
ax25_sendmsg |
ax25_queue_xmit |
dev_queue_xmit |
__dev_queue_xmit |
__dev_xmit_skb |
sch_direct_xmit | ...
xmit_one |
netdev_start_xmit | tty_ldisc_kill
__netdev_start_xmit | mkiss_close
ax_xmit | kfree
ax_encaps |
|Even though there are two synchronization primitives before the kfree:
1. wait_for_completion(&ax->dead). This can prevent the race with routines from mkiss_ioctl. However, it cannot stop the routine coming from upper layer, i.e., the ax25_sendmsg.
2. netif_stop_queue(ax->dev). It seems that this line of code aims to halt the transmit queue but it fails to stop the routine that already being xmit.
This patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine.
--- drivers/net/hamradio/mkiss.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/hamradio/mkiss.c +5 -4
@@ -792,13 +792,14 @@ static void mkiss_close(struct tty_struc*/ netif_stop_queue (ax->dev); -/* Free all AX25 frame buffers. */ -kfree (ax->rbuff); -kfree (ax->xbuff); - ax->tty =NULL ;unregister_netdev (ax->dev); + +/* Free all AX25 frame buffers after unreg. */ +kfree (ax->rbuff); +kfree (ax->xbuff); +free_netdev (ax->dev); }
Greg Kroah-Hartman
maintainerPATCH 126/128 hamradio: improve the incomplete fix to avoid NPD
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit b2f37aead1b82a770c48b5d583f35ec22aabb61e upstream.
The previous commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") reorder the kfree operations and unregister_netdev operation to prevent UAF.
This commit improves the previous one by also deferring the nullify of the ax->tty pointer. Otherwise, a NULL pointer dereference bug occurs. Partial of the stack trace is shown below.
BUG: kernel NULL pointer dereference, address: 0000000000000538 RIP: 0010:ax_xmit+0x1f9/0x400 ... Call Trace: dev_hard_start_xmit+0xec/0x320 sch_direct_xmit+0xea/0x240 __qdisc_run+0x166/0x5c0 __dev_queue_xmit+0x2c7/0xaf0 ax25_std_establish_data_link+0x59/0x60 ax25_connect+0x3a0/0x500 ? security_socket_connect+0x2b/0x40 __sys_connect+0x96/0xc0 ? __hrtimer_init+0xc0/0xc0 ? common_nsleep+0x2e/0x50 ? switch_fpu_return+0x139/0x1a0 __x64_sys_connect+0x11/0x20 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
The crash point is shown as below
static void ax_encaps(...) {
...
set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); // ax->tty = NULL!
...
}
By placing the nullify action after the unregister_netdev, the ax->tty pointer won't be assigned as NULL net_device framework layer is well synchronized.
--- drivers/net/hamradio/mkiss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/hamradio/mkiss.c +2 -2
@@ -792,14 +792,14 @@ static void mkiss_close(struct tty_struc*/ netif_stop_queue (ax->dev); - ax->tty =NULL ; -unregister_netdev (ax->dev);/* Free all AX25 frame buffers after unreg. */ kfree (ax->rbuff);kfree (ax->xbuff); + ax->tty =NULL ; +free_netdev (ax->dev); }
Greg Kroah-Hartman
maintainerPATCH 127/128 tun: avoid double free in tun_free_netdev
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
commit 158b515f703e75e7d68289bf4d98c664e1d632df upstream.
Avoid double free in tun_free_netdev() by moving the dev->tstats and tun->security allocs to a new ndo_init routine (tun_net_init()) that will be called by register_netdevice(). ndo_init is paired with the desctructor (tun_free_netdev()), so if there's an error in register_netdevice() the destructor will handle the frees.
BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1 Hardware name: Red Hat KVM, BIOS Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247 kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [inline] __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook mm/slub.c:1749 [inline] slab_free mm/slub.c:3513 [inline] kfree+0xac/0x2d0 mm/slub.c:4561 selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 security_tun_dev_free_security+0x4f/0x90 security/security.c:2342 tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo+0x4df/0x840 net/core/dev.c:10627 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/net/tun.c | 115 +++++++++++++++++++++++++++--------------------------- 1 file changed, 59 insertions(+), 56 deletions(-)
drivers/net/tun.c +59 -56
@@ -209,6 +209,9 @@ struct tun_struct {struct tun_prog __rcu *steering_prog;struct tun_prog __rcu *filter_prog;struct ethtool_link_ksettings link_ksettings; +/* init args */ +struct file *file; +struct ifreq *ifr; };struct veth {
@@ -216,6 +219,9 @@ struct veth {__be16 h_vlan_TCI; }; +static void tun_flow_init (struct tun_struct *tun); +static void tun_flow_uninit (struct tun_struct *tun); +static int tun_napi_receive (struct napi_struct *napi,int budget) { struct tun_file *tfile = container_of(napi, struct tun_file, napi);
@@ -953,6 +959,49 @@ static int check_filter(struct tap_filtestatic const struct ethtool_ops tun_ethtool_ops; +static int tun_net_init (struct net_device *dev) +{ +struct tun_struct *tun =netdev_priv (dev); +struct ifreq *ifr = tun->ifr; +int err; + + dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); +if (!dev->tstats) +return -ENOMEM ; + +spin_lock_init (&tun->lock); + + err =security_tun_dev_alloc_security (&tun->security); +if (err <0 ) { +free_percpu (dev->tstats); +return err; + } + +tun_flow_init (tun); + + dev->hw_features =NETIF_F_SG |NETIF_F_FRAGLIST | +TUN_USER_FEATURES |NETIF_F_HW_VLAN_CTAG_TX | +NETIF_F_HW_VLAN_STAG_TX ; + dev->features = dev->hw_features |NETIF_F_LLTX ; + dev->vlan_features = dev->features & + ~(NETIF_F_HW_VLAN_CTAG_TX | +NETIF_F_HW_VLAN_STAG_TX ); + + tun->flags = (tun->flags & ~TUN_FEATURES ) | + (ifr->ifr_flags &TUN_FEATURES ); + +INIT_LIST_HEAD (&tun->disabled); + err =tun_attach (tun, tun->file, false, ifr->ifr_flags &IFF_NAPI , + ifr->ifr_flags &IFF_NAPI_FRAGS , false); +if (err <0 ) { +tun_flow_uninit (tun); +security_tun_dev_free_security (tun->security); +free_percpu (dev->tstats); +return err; + } +return 0 ; +} +/* Net device detach from fd. */ static void tun_net_uninit (struct net_device *dev) {
@@ -1169,6 +1218,7 @@ static int tun_net_change_carrier(struct }static const struct net_device_ops tun_netdev_ops = { + .ndo_init = tun_net_init, .ndo_uninit = tun_net_uninit, .ndo_open = tun_net_open, .ndo_stop = tun_net_close,
@@ -1252,6 +1302,7 @@ static int tun_xdp_tx(struct net_device }static const struct net_device_ops tap_netdev_ops = { + .ndo_init = tun_net_init, .ndo_uninit = tun_net_uninit, .ndo_open = tun_net_open, .ndo_stop = tun_net_close,
@@ -1292,7 +1343,7 @@ static void tun_flow_uninit(struct tun_s#define MAX_MTU 65535/* Initialize net device. */ -static void tun_net_init (struct net_device *dev) +static void tun_net_initialize (struct net_device *dev) {struct tun_struct *tun =netdev_priv (dev);
@@ -2206,11 +2257,6 @@ static void tun_free_netdev(struct net_dBUG_ON (!(list_empty (&tun->disabled)));free_percpu (dev->tstats); -/* We clear tstats so that tun_set_iff() can tell if -* tun_free_netdev() has been called from register_netdevice(). -*/ - dev->tstats =NULL ; -tun_flow_uninit (tun);security_tun_dev_free_security (tun->security);__tun_set_ebpf (tun, &tun->steering_prog,NULL );
@@ -2716,41 +2762,16 @@ static int tun_set_iff(struct net *net, tun->rx_batched =0 ;RCU_INIT_POINTER (tun->steering_prog,NULL ); - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); -if (!dev->tstats) { - err = -ENOMEM ; - goto err_free_dev; - } - -spin_lock_init (&tun->lock); - - err =security_tun_dev_alloc_security (&tun->security); -if (err <0 ) - goto err_free_stat; - -tun_net_init (dev); -tun_flow_init (tun); - - dev->hw_features =NETIF_F_SG |NETIF_F_FRAGLIST | -TUN_USER_FEATURES |NETIF_F_HW_VLAN_CTAG_TX | -NETIF_F_HW_VLAN_STAG_TX ; - dev->features = dev->hw_features |NETIF_F_LLTX ; - dev->vlan_features = dev->features & - ~(NETIF_F_HW_VLAN_CTAG_TX | -NETIF_F_HW_VLAN_STAG_TX ); - - tun->flags = (tun->flags & ~TUN_FEATURES ) | - (ifr->ifr_flags &TUN_FEATURES ); + tun->ifr = ifr; + tun->file = file; -INIT_LIST_HEAD (&tun->disabled); - err =tun_attach (tun, file, false, ifr->ifr_flags &IFF_NAPI , - ifr->ifr_flags &IFF_NAPI_FRAGS , false); -if (err <0 ) - goto err_free_flow; +tun_net_initialize (dev); err =register_netdevice (tun->dev); -if (err <0 ) - goto err_detach; +if (err <0 ) { +free_netdev (dev); +return err; + }/* free_netdev() won't check refcnt, to avoid race * with dev_put() we need publish tun after registration. */
@@ -2767,24 +2788,6 @@ static int tun_set_iff(struct net *net,strcpy (ifr->ifr_name, tun->dev->name);return 0 ; - -err_detach: -tun_detach_all (dev); -/* We are here because register_netdevice() has failed. -* If register_netdevice() already called tun_free_netdev() -* while dealing with the error, dev->stats has been cleared. -*/ -if (!dev->tstats) - goto err_free_dev; - -err_free_flow: -tun_flow_uninit (tun); -security_tun_dev_free_security (tun->security); -err_free_stat: -free_percpu (dev->tstats); -err_free_dev: -free_netdev (dev); -return err; }static void tun_get_iff (struct tun_struct *tun,struct ifreq *ifr)
Greg Kroah-Hartman
maintainerPATCH 128/128 phonet/pep: refuse to enable an unbound pipe
In reply to Greg Kroah-HartmanFrom: Rémi Denis-Courmont <[email protected]>
commit 75a2f31520095600f650597c0ac41f48b5ba0068 upstream.
This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur:
1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object.
--- net/phonet/pep.c | 2 ++ 1 file changed, 2 insertions(+)
net/phonet/pep.c +2 -0
@@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, in ret = -EBUSY ; else if (sk->sk_state == TCP_ESTABLISHED) ret = -EISCONN ; + else if (!pn->pn_sk.sobject) + ret = -EADDRNOTAVAIL ; else ret =pep_sock_enable (sk,NULL ,0 );release_sock (sk);
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.15.12-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.15.y
* git commit: 47b0c287880218282c014bf268884d9aad05e3d3
* git describe: v5.15.11-129-g47b0c2878802
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.11-129-g47b0c2878802
## No Test Regressions (compared to v5.15.11)
## No Test Fixes (compared to v5.15.11)
## Test result summary
total: 103326, pass: 88452, fail: 826, skip: 13195, xfail: 853
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 263 total, 257 passed, 6 failed
* arm64: 42 total, 40 passed, 2 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 40 total, 37 passed, 3 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 37 total, 31 passed, 6 failed
* parisc: 14 total, 14 passed, 0 failed
* powerpc: 56 total, 50 passed, 6 failed
* riscv: 28 total, 19 passed, 9 failed
* s390: 22 total, 20 passed, 2 failed
* sh: 26 total, 24 passed, 2 failed
* sparc: 14 total, 14 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 42 total, 40 passed, 2 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-secco[
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Hi Greg,
Looking good.
Run tested on:
- Intel Tiger Lake x86_64 (nuc11 i7-1165G7)
In addition: build tested on:
- Allwinner A64
- Allwinner H3
- Allwinner H5
- Allwinner H6
- NXP iMX6
- NXP iMX8
- Qualcomm Dragonboard
- Rockchip RK3288
- Rockchip RK3328
- Rockchip RK3399pro
- Samsung Exynos
--
Rudi
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
Boot test:x86_64: Booted on my test laptop. No regression.
mips: Booted on ci20 board. No regression.
--
Regards
Sudip
Quoted 18 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-
stable-rc.git linux-5.15.y
and the diffstat can be found below.
Quoted 4 lines
thanks,
greg k-h
hello ,
Compiled and booted 5.15.12-rc1. No errors from dmesg -l err
Tested by: Jeffrin Jose T <[email protected]>
Signature · 2 lines
software engineer rajagiri school of engineering and technology - autonomous
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
Build results:
total: 154 pass: 154 fail: 0 Qemu test results: total: 480 pass: 480 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.12 release. There are 128 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 29 Dec 2021 15:13:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah