5.4.29-rc1 review
Greg Kroah-Hartman
maintainercover 5.4.29-rc1 review
This is the start of the stable review cycle for the 5.4.29 release. There are 155 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 02 Apr 2020 08:50:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.29-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.29-rc1
Dafna Hirschfeld <[email protected]>
media: v4l2-core: fix a use-after-free bug of sd->devnode
Johan Hovold <[email protected]>
media: xirlink_cit: add missing descriptor sanity checks
Johan Hovold <[email protected]>
media: stv06xx: add missing descriptor sanity checks
Johan Hovold <[email protected]>
media: dib0700: fix rc endpoint lookup
Johan Hovold <[email protected]>
media: ov519: add missing endpoint sanity checks
Eric Biggers <[email protected]>
libfs: fix infoleak in simple_attr_read()
Kai-Heng Feng <[email protected]>
ahci: Add Intel Comet Lake H RAID PCI ID
Qiujun Huang <[email protected]>
staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
Qiujun Huang <[email protected]>
staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
Larry Finger <[email protected]>
staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
Dan Carpenter <[email protected]>
staging: kpc2000: prevent underflow in cpld_reconfigure()
Johan Hovold <[email protected]>
media: usbtv: fix control-message timeouts
Johan Hovold <[email protected]>
media: flexcop-usb: fix endpoint sanity check
Mans Rullgard <[email protected]>
usb: musb: fix crash with highmen PIO and usbmon
Qiujun Huang <[email protected]>
USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
Matthias Reichl <[email protected]>
USB: cdc-acm: restore capability check order
Pawel Dembicki <[email protected]>
USB: serial: option: add Wistron Neweb D19Q1
Pawel Dembicki <[email protected]>
USB: serial: option: add BroadMobi BM806U
Pawel Dembicki <[email protected]>
USB: serial: option: add support for ASKEY WWHC050
Daniel Borkmann <[email protected]>
bpf: Undo incorrect __reg_bound_offset32 handling
Yubo Xie <[email protected]>
clocksource/drivers/hyper-v: Untangle stimers and timesync from clocksources
Heiner Kallweit <[email protected]>
r8169: fix PHY driver check on platforms w/o module softdeps
Torsten Hilbrich <[email protected]>
vti6: Fix memory leak of skb if input policy check fails
Ondrej Jirman <[email protected]>
ARM: dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection
John Fastabend <[email protected]>
bpf, sockmap: Remove bucket->lock from sock_{hash|map}_freeYoshiki Komachi <[email protected]>
bpf/btf: Fix BTF verification of enum members in struct/union
Andrii Nakryiko <[email protected]>
bpf: Initialize storage pointers to NULL to prevent freeing garbage pointer
Luke Nelson <[email protected]>
bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits
Kai-Heng Feng <[email protected]>
i2c: nvidia-gpu: Handle timeout correctly in gpu_i2c_check_status()
Pablo Neira Ayuso <[email protected]>
netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
Pablo Neira Ayuso <[email protected]>
netfilter: nft_fwd_netdev: validate family and chain type
Haishuang Yan <[email protected]>
netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}Johannes Berg <[email protected]>
mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
Johannes Berg <[email protected]>
ieee80211: fix HE SPR size calculation
David Howells <[email protected]>
afs: Fix unpinned address list during probing
David Howells <[email protected]>
afs: Fix some tracing details
David Howells <[email protected]>
afs: Fix client call Rx-phase signal handling
YueHaibing <[email protected]>
xfrm: policy: Fix doulbe free in xfrm_policy_timer
Xin Long <[email protected]>
xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
Xin Long <[email protected]>
xfrm: fix uctx len check in verify_sec_ctx_len
Maor Gottlieb <[email protected]>
RDMA/mlx5: Block delay drop to unprivileged users
Leon Romanovsky <[email protected]>
RDMA/mlx5: Fix access to wrong pointer while performing flush due to error
Mark Zhang <[email protected]>
RDMA/mlx5: Fix the number of hwcounters of a dynamic counter
Nicolas Dichtel <[email protected]>
vti[6]: fix packet tx through bpf_redirect() in XinY cases
Raed Salem <[email protected]>
xfrm: handle NETDEV_UNREGISTER for xfrm device
Edward Cree <[email protected]>
genirq: Fix reference leaks on irq affinity notifiers
David Howells <[email protected]>
afs: Fix handling of an abort from a service handler
Mike Marciniszyn <[email protected]>
RDMA/core: Ensure security pkey modify is not lost
Andrii Nakryiko <[email protected]>
bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory
Hans de Goede <[email protected]>
gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model
Hans de Goede <[email protected]>
gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
Hans de Goede <[email protected]>
gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
Roman Gushchin <[email protected]>
mm: fork: fix kernel_stack memcg stats for various stack implementations
Aneesh Kumar K.V <[email protected]>
mm/sparse: fix kernel crash with pfn_section_valid check
David Hildenbrand <[email protected]>
drivers/base/memory.c: indicate all memory blocks as removable
Naohiro Aota <[email protected]>
mm/swapfile.c: move inode_lock out of claim_swapfile
Johannes Berg <[email protected]>
mac80211: mark station unauthorized before key removal
Johannes Berg <[email protected]>
mac80211: drop data frames without key on encrypted links
Johannes Berg <[email protected]>
nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
Martin K. Petersen <[email protected]>
scsi: sd: Fix optimal I/O size for devices that change reported values
Dirk Mueller <[email protected]>
scripts/dtc: Remove redundant YYLOC global declaration
Masami Hiramatsu <[email protected]>
tools: Let O= makes handle a relative path with -C option
Larry Finger <[email protected]>
rtlwifi: rtl8188ee: Fix regression due to commit d1d1a96bdb44
Masami Hiramatsu <[email protected]>
perf probe: Do not depend on dwfl_module_addrsym()
Masami Hiramatsu <[email protected]>
perf probe: Fix to delete multiple probe event
Borislav Petkov <[email protected]>
x86/ioremap: Fix CONFIG_EFI=n build
Roger Quadros <[email protected]>
ARM: dts: omap5: Add bus_dma_limit for L3 bus
Roger Quadros <[email protected]>
ARM: dts: dra7: Add bus_dma_limit for L3 bus
Luis Henriques <[email protected]>
ceph: fix memory leak in ceph_cleanup_snapid_map()
Ilya Dryomov <[email protected]>
ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL
Jason Gunthorpe <[email protected]>
RDMA/mad: Do not crash if the rdma device does not have a umad interface
Jason Gunthorpe <[email protected]>
RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET
Linus Walleij <[email protected]>
gpiolib: Fix irq_disable() semantics
Jason Gunthorpe <[email protected]>
RDMA/core: Fix missing error check on dev_set_name()
Kaike Wan <[email protected]>
IB/rdmavt: Free kernel completion queue when done
Eugene Syromiatnikov <[email protected]>
Input: avoid BIT() macro usage in the serio.h UAPI header
Yussuf Khalil <[email protected]>
Input: synaptics - enable RMI on HP Envy 13-ad105ng
Dmitry Torokhov <[email protected]>
Input: fix stale timestamp on key autorepeat events
Dan Carpenter <[email protected]>
Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger()
Chuhong Yuan <[email protected]>
i2c: hix5hd2: add missed clk_disable_unprepare in remove
Johannes Berg <[email protected]>
iwlwifi: mvm: fix non-ACPI function
Megha Dey <[email protected]>
iommu/vt-d: Populate debugfs if IOMMUs are detected
Megha Dey <[email protected]>
iommu/vt-d: Fix debugfs register reads
Yonglong Liu <[email protected]>
net: hns3: fix "tc qdisc del" failed issue
Dominik Czarnota <[email protected]>
sxgbe: Fix off by one in samsung driver strncpy size arg
Nathan Chancellor <[email protected]>
dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom
Nicolas Cavallari <[email protected]>
mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
Wen Xiong <[email protected]>
scsi: ipr: Fix softlockup when rescanning devices in petitboot
Julian Wiedmann <[email protected]>
s390/qeth: handle error when backing RX buffer
Julian Wiedmann <[email protected]>
s390/qeth: don't reset default_out_queue
Qian Cai <[email protected]>
iommu/vt-d: Silence RCU-list debugging warnings
Marek Szyprowski <[email protected]>
drm/exynos: Fix cleanup of IOMMU related objects
Hawking Zhang <[email protected]>
drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20
Martin Leung <[email protected]>
drm/amd/display: update soc bb for nv14
Madalin Bucur <[email protected]>
fsl/fman: detect FMan erratum A050385
Madalin Bucur <[email protected]>
arm64: dts: ls1043a: FMan erratum A050385
Madalin Bucur <[email protected]>
dt-bindings: net: FMan erratum A050385
Tycho Andersen <[email protected]>
cgroup1: don't call release_agent when it is ""
Dajun Jin <[email protected]>
drivers/of/of_mdio.c:fix of_mdiobus_register()
Mike Gilbert <[email protected]>
cpupower: avoid multiple definition with gcc -fno-common
Scott Mayhew <[email protected]>
nfs: add minor version to nfs_server_key for fscache
Vasily Averin <[email protected]>
cgroup-v1: cgroup_pidlist_next should update position index
Aya Levin <[email protected]>
net/mlx5e: Do not recover from a non-fatal syndrome
Aya Levin <[email protected]>
net/mlx5e: Fix ICOSQ recovery flow with Striding RQ
Aya Levin <[email protected]>
net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset
Aya Levin <[email protected]>
net/mlx5e: Enhance ICOSQ WQE info fields
Hamdan Igbaria <[email protected]>
net/mlx5: DR, Fix postsend actions write length
Taehee Yoo <[email protected]>
hsr: set .netnsok flag
Taehee Yoo <[email protected]>
hsr: add restart routine into hsr_get_node_list()
Taehee Yoo <[email protected]>
hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
Petr Machata <[email protected]>
net: ip_gre: Accept IFLA_INFO_DATA-less configuration
Petr Machata <[email protected]>
net: ip_gre: Separate ERSPAN newlink / changelink callbacks
Vasundhara Volam <[email protected]>
bnxt_en: Reset rings if ring reservation fails during open()
Michael Chan <[email protected]>
bnxt_en: Free context memory after disabling PCI in probe error path.
Michael Chan <[email protected]>
bnxt_en: Return error if bnxt_alloc_ctx_mem() fails.
Edwin Peer <[email protected]>
bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
Michael Chan <[email protected]>
bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S.
Taehee Yoo <[email protected]>
vxlan: check return value of gro_cells_init()
Eric Dumazet <[email protected]>
tcp: repair: fix TCP_QUEUE_SEQ implementation
Eric Dumazet <[email protected]>
tcp: ensure skb->dev is NULL before leaving TCP stack
Florian Westphal <[email protected]>
tcp: also NULL skb->dev when copy was needed
Oliver Hartkopp <[email protected]>
slcan: not call free_netdev before rtnl_unlock in slcan_open
Heiner Kallweit <[email protected]>
r8169: re-enable MSI on RTL8168c
Dan Carpenter <[email protected]>
NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
Emil Renner Berthing <[email protected]>
net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
Cong Wang <[email protected]>
net_sched: keep alloc_hash updated after hash allocation
Cong Wang <[email protected]>
net_sched: hold rtnl lock in tcindex_partial_destroy_work()
Cong Wang <[email protected]>
net_sched: cls_route: remove the right filter from hashtable
Paul Blakey <[email protected]>
net/sched: act_ct: Fix leak of ct zone template on replace
Pawel Dembicki <[email protected]>
net: qmi_wwan: add support for ASKEY WWHC050
Rayagonda Kokatanur <[email protected]>
net: phy: mdio-mux-bcm-iproc: check clk_prepare_enable() return value
Andre Przywara <[email protected]>
net: phy: mdio-bcm-unimac: Fix clock handling
Grygorii Strashko <[email protected]>
net: phy: dp83867: w/a for fld detect threshold bootstrapping issue
Willem de Bruijn <[email protected]>
net/packet: tpacket_rcv: avoid a producer race condition
Jisheng Zhang <[email protected]>
net: mvneta: Fix the case where the last poll did not process all rx
Guilherme G. Piccoli <[email protected]>
net: ena: Add PCI shutdown handler to allow safe kexec
Vladimir Oltean <[email protected]>
net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
René van Dorst <[email protected]>
net: dsa: mt7530: Change the LINK bit to reflect the link status
Florian Fainelli <[email protected]>
net: dsa: Fix duplicate frames flooded by learning
Zh-yuan Ye <[email protected]>
net: cbs: Fix software cbs to consider packet sending time
Bruno Meneguele <[email protected]>
net/bpfilter: fix dprintf usage for /dev/kmsg
Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Fix list iteration in error path
Ido Schimmel <[email protected]>
mlxsw: pci: Only issue reset when system is ready
Willem de Bruijn <[email protected]>
macsec: restrict to ethernet devices
Qian Cai <[email protected]>
ipv4: fix a RCU-list lock in inet_dump_fib()
Taehee Yoo <[email protected]>
hsr: fix general protection fault in hsr_addr_is_self()
Florian Westphal <[email protected]>
geneve: move debug check after netdev unregister
Rahul Lakkireddy <[email protected]>
cxgb4: fix Txq restart check during backpressure
Rahul Lakkireddy <[email protected]>
cxgb4: fix throughput drop during Tx backpressure
Rafael J. Wysocki <[email protected]>
ACPI: PM: s2idle: Rework ACPI events synchronization
Ulf Hansson <[email protected]>
mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
Ulf Hansson <[email protected]>
mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
Ulf Hansson <[email protected]>
mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command
Ulf Hansson <[email protected]>
mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard
Ulf Hansson <[email protected]>
mmc: core: Allow host controllers to require R1B for CMD6
-------------
Diffstat:
Documentation/devicetree/bindings/net/fsl-fman.txt | 7 ++ Makefile | 4 +- arch/arm/boot/dts/dra7.dtsi | 1 + arch/arm/boot/dts/omap5.dtsi | 1 + arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 3 +- arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi | 2 + arch/x86/mm/ioremap.c | 3 + arch/x86/net/bpf_jit_comp32.c | 10 +- drivers/acpi/sleep.c | 26 +++-- drivers/ata/ahci.c | 1 + drivers/base/memory.c | 23 +--- drivers/clocksource/hyperv_timer.c | 6 +- drivers/gpio/gpiolib-acpi.c | 125 ++++++++++++++++----- drivers/gpio/gpiolib.c | 9 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 25 ++++- .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 114 +++++++++++++++++++ drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 5 +- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_dma.c | 28 +++-- drivers/gpu/drm/exynos/exynos_drm_drv.h | 6 +- drivers/gpu/drm/exynos/exynos_drm_fimc.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_fimd.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_rotator.c | 5 +- drivers/gpu/drm/exynos/exynos_drm_scaler.c | 6 +- drivers/gpu/drm/exynos/exynos_mixer.c | 7 +- drivers/i2c/busses/i2c-hix5hd2.c | 1 + drivers/i2c/busses/i2c-nvidia-gpu.c | 20 ++-- drivers/infiniband/core/device.c | 4 +- drivers/infiniband/core/nldev.c | 6 +- drivers/infiniband/core/security.c | 11 +- drivers/infiniband/core/user_mad.c | 33 ++++-- drivers/infiniband/hw/mlx5/cq.c | 27 ++++- drivers/infiniband/hw/mlx5/main.c | 5 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/qp.c | 5 + drivers/infiniband/sw/rdmavt/cq.c | 2 +- drivers/input/input.c | 1 + drivers/input/mouse/synaptics.c | 1 + drivers/input/touchscreen/raydium_i2c_ts.c | 8 +- drivers/iommu/dmar.c | 3 +- drivers/iommu/intel-iommu-debugfs.c | 51 ++++++--- drivers/iommu/intel-iommu.c | 4 +- drivers/media/usb/b2c2/flexcop-usb.c | 6 +- drivers/media/usb/dvb-usb/dib0700_core.c | 4 +- drivers/media/usb/gspca/ov519.c | 10 ++ drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 +++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 + drivers/media/usb/gspca/xirlink_cit.c | 18 ++- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +- drivers/media/v4l2-core/v4l2-device.c | 1 + drivers/mmc/core/core.c | 5 +- drivers/mmc/core/mmc.c | 7 +- drivers/mmc/core/mmc_ops.c | 8 +- drivers/mmc/host/sdhci-omap.c | 3 + drivers/mmc/host/sdhci-tegra.c | 3 + drivers/net/can/slcan.c | 3 + drivers/net/dsa/mt7530.c | 4 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 51 +++++++-- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 +++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 15 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 8 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 52 ++------- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 4 +- drivers/net/ethernet/freescale/fman/Kconfig | 28 +++++ drivers/net/ethernet/freescale/fman/fman.c | 18 +++ drivers/net/ethernet/freescale/fman/fman.h | 5 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- drivers/net/ethernet/marvell/mvneta.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 + .../net/ethernet/mellanox/mlx5/core/en/health.h | 3 +- .../ethernet/mellanox/mlx5/core/en/reporter_rx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 31 +++-- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 +- drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 1 + .../mellanox/mlx5/core/steering/dr_action.c | 1 - .../ethernet/mellanox/mlx5/core/steering/dr_send.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/pci.c | 50 +++++++-- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 8 +- drivers/net/ethernet/realtek/r8169_main.c | 18 ++- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 2 +- drivers/net/geneve.c | 8 +- drivers/net/macsec.c | 3 + drivers/net/phy/dp83867.c | 21 +++- drivers/net/phy/mdio-bcm-unimac.c | 6 +- drivers/net/phy/mdio-mux-bcm-iproc.c | 7 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan.c | 11 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +- .../net/wireless/realtek/rtlwifi/rtl8188ee/trx.h | 1 + drivers/nfc/fdp/fdp.c | 5 +- drivers/of/of_mdio.c | 1 + drivers/s390/net/qeth_core_main.c | 14 ++- drivers/scsi/ipr.c | 3 +- drivers/scsi/ipr.h | 1 + drivers/scsi/sd.c | 4 +- drivers/staging/kpc2000/kpc2000/core.c | 4 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + drivers/staging/wlan-ng/hfa384x_usb.c | 2 + drivers/staging/wlan-ng/prism2usb.c | 1 + drivers/usb/class/cdc-acm.c | 18 +-- drivers/usb/musb/musb_host.c | 17 +-- drivers/usb/serial/io_edgeport.c | 2 +- drivers/usb/serial/option.c | 6 + fs/afs/cmservice.c | 14 ++- fs/afs/fs_probe.c | 2 + fs/afs/internal.h | 12 +- fs/afs/rxrpc.c | 71 ++---------- fs/ceph/file.c | 14 ++- fs/ceph/snap.c | 1 + fs/libfs.c | 8 +- fs/nfs/client.c | 1 + fs/nfs/fscache.c | 2 + fs/nfs/nfs4client.c | 1 - include/linux/ceph/osdmap.h | 4 + include/linux/ceph/rados.h | 6 +- include/linux/dmar.h | 6 +- include/linux/dsa/8021q.h | 7 -- include/linux/ieee80211.h | 4 +- include/linux/intel-iommu.h | 2 + include/linux/memcontrol.h | 12 ++ include/linux/mmc/host.h | 1 + include/net/af_rxrpc.h | 4 +- include/trace/events/afs.h | 2 +- include/uapi/linux/serio.h | 10 +- kernel/bpf/btf.c | 2 +- kernel/bpf/cgroup.c | 7 +- kernel/bpf/verifier.c | 19 ---- kernel/cgroup/cgroup-v1.c | 3 +- kernel/fork.c | 4 +- kernel/irq/manage.c | 11 +- mm/memcontrol.c | 38 +++++++ mm/sparse.c | 6 + mm/swapfile.c | 39 ++++--- net/bpfilter/main.c | 14 ++- net/ceph/osdmap.c | 9 ++ net/core/sock_map.c | 12 +- net/dsa/tag_8021q.c | 43 ------- net/dsa/tag_brcm.c | 2 + net/dsa/tag_sja1105.c | 19 ++-- net/hsr/hsr_framereg.c | 9 +- net/hsr/hsr_netlink.c | 70 +++++++----- net/hsr/hsr_slave.c | 8 +- net/ipv4/Kconfig | 1 + net/ipv4/fib_frontend.c | 2 + net/ipv4/ip_gre.c | 105 ++++++++++++++--- net/ipv4/ip_vti.c | 38 +++++-- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_output.c | 12 +- net/ipv6/ip6_vti.c | 34 ++++-- net/mac80211/debugfs_sta.c | 3 +- net/mac80211/key.c | 20 ++-- net/mac80211/mesh_hwmp.c | 3 +- net/mac80211/sta_info.c | 7 +- net/mac80211/sta_info.h | 1 + net/mac80211/tx.c | 20 +++- net/netfilter/nf_flow_table_ip.c | 2 + net/netfilter/nft_fwd_netdev.c | 13 +++ net/packet/af_packet.c | 21 ++++ net/packet/internal.h | 5 +- net/rxrpc/af_rxrpc.c | 33 +----- net/rxrpc/ar-internal.h | 1 - net/rxrpc/input.c | 1 - net/sched/act_ct.c | 2 +- net/sched/cls_route.c | 4 +- net/sched/cls_tcindex.c | 3 + net/sched/sch_cbs.c | 12 +- net/wireless/nl80211.c | 2 +- net/xfrm/xfrm_device.c | 1 + net/xfrm/xfrm_policy.c | 2 + net/xfrm/xfrm_user.c | 6 +- scripts/dtc/dtc-lexer.l | 1 - tools/perf/Makefile | 2 +- tools/perf/util/probe-file.c | 3 + tools/perf/util/probe-finder.c | 11 +- .../cpupower/utils/idle_monitor/amd_fam14h_idle.c | 2 +- .../cpupower/utils/idle_monitor/cpuidle_sysfs.c | 2 +- .../cpupower/utils/idle_monitor/cpupower-monitor.c | 2 + .../cpupower/utils/idle_monitor/cpupower-monitor.h | 2 +- tools/scripts/Makefile.include | 4 +- 185 files changed, 1421 insertions(+), 687 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/155 mmc: core: Allow host controllers to require R1B for CMD6
From: Ulf Hansson <[email protected]>
[ Upstream commit 1292e3efb149ee21d8d33d725eeed4e6b1ade963 ]
It has turned out that some host controllers can't use R1B for CMD6 and other commands that have R1B associated with them. Therefore invent a new host cap, MMC_CAP_NEED_RSP_BUSY to let them specify this.
In __mmc_switch(), let's check the flag and use it to prevent R1B responses from being converted into R1. Note that, this also means that the host are on its own, when it comes to manage the busy timeout.
--- drivers/mmc/core/mmc_ops.c | 8 +++++--- include/linux/mmc/host.h | 1 + 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/mmc/core/mmc_ops.c +5 -3
@@ -538,10 +538,12 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,* If the cmd timeout and the max_busy_timeout of the host are both * specified, let's validate them. A failure means we need to prevent * the host from doing hw busy detection, which is done by converting -* to a R1 response instead of a R1B. +* to a R1 response instead of a R1B. Note, some hosts requires R1B, +* which also means they are on their own when it comes to deal with the +* busy timeout. */ -if (timeout_ms && host->max_busy_timeout && - (timeout_ms > host->max_busy_timeout)) +if (!(host->caps &MMC_CAP_NEED_RSP_BUSY ) && timeout_ms && + host->max_busy_timeout && (timeout_ms > host->max_busy_timeout)) use_r1b_resp = false; cmd.opcode =MMC_SWITCH ;
include/linux/mmc/host.h +1 -0
@@ -333,6 +333,7 @@ struct mmc_host { MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | \ MMC_CAP_UHS_DDR50)#define MMC_CAP_SYNC_RUNTIME_PM (1 << 21)/* Synced runtime PM suspends. */ +#define MMC_CAP_NEED_RSP_BUSY (1 << 22)/* Commands with R1B can't use R1. */ #define MMC_CAP_DRIVER_TYPE_A (1 << 23)/* Host supports Driver Type A */ #define MMC_CAP_DRIVER_TYPE_C (1 << 24)/* Host supports Driver Type C */ #define MMC_CAP_DRIVER_TYPE_D (1 << 25)/* Host supports Driver Type D */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/155 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 43cc64e5221cc6741252b64bc4531dd1eefb733d ]
The busy timeout that is computed for each erase/trim/discard operation, can become quite long and may thus exceed the host->max_busy_timeout. If that becomes the case, mmc_do_erase() converts from using an R1B response to an R1 response, as to prevent the host from doing HW busy detection.
However, it has turned out that some hosts requires an R1B response no matter what, so let's respect that via checking MMC_CAP_NEED_RSP_BUSY. Note that, if the R1B gets enforced, the host becomes fully responsible of managing the needed busy timeout, in one way or the other.
--- drivers/mmc/core/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mmc/core/core.c +4 -1
@@ -1732,8 +1732,11 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,* the erase operation does not exceed the max_busy_timeout, we should * use R1B response. Or we need to prevent the host from doing hw busy * detection, which is done by converting to a R1 response instead. +* Note, some hosts requires R1B, which also means they are on their own +* when it comes to deal with the busy timeout. */ -if (card->host->max_busy_timeout && +if (!(card->host->caps &MMC_CAP_NEED_RSP_BUSY ) && + card->host->max_busy_timeout && busy_timeout > card->host->max_busy_timeout) { cmd.flags =MMC_RSP_SPI_R1 |MMC_RSP_R1 |MMC_CMD_AC ; }else {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/155 mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 18d200460cd73636d4f20674085c39e32b4e0097 ]
The busy timeout for the CMD5 to put the eMMC into sleep state, is specific to the card. Potentially the timeout may exceed the host->max_busy_timeout. If that becomes the case, mmc_sleep() converts from using an R1B response to an R1 response, as to prevent the host from doing HW busy detection.
However, it has turned out that some hosts requires an R1B response no matter what, so let's respect that via checking MMC_CAP_NEED_RSP_BUSY. Note that, if the R1B gets enforced, the host becomes fully responsible of managing the needed busy timeout, in one way or the other.
--- drivers/mmc/core/mmc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/mmc/core/mmc.c +5 -2
@@ -1911,9 +1911,12 @@ static int mmc_sleep(struct mmc_host *host)* If the max_busy_timeout of the host is specified, validate it against * the sleep cmd timeout. A failure means we need to prevent the host * from doing hw busy detection, which is done by converting to a R1 -* response instead of a R1B. +* response instead of a R1B. Note, some hosts requires R1B, which also +* means they are on their own when it comes to deal with the busy +* timeout. */ -if (host->max_busy_timeout && (timeout_ms > host->max_busy_timeout)) { +if (!(host->caps &MMC_CAP_NEED_RSP_BUSY ) && host->max_busy_timeout && + (timeout_ms > host->max_busy_timeout)) { cmd.flags =MMC_RSP_R1 |MMC_CMD_AC ; }else { cmd.flags =MMC_RSP_R1B |MMC_CMD_AC ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/155 mmc: sdhci-omap: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 055e04830d4544c57f2a5192a26c9e25915c29c0 ]
It has turned out that the sdhci-omap controller requires the R1B response, for commands that has this response associated with them. So, converting from an R1B to an R1 response for a CMD6 for example, leads to problems with the HW busy detection support.
Fix this by informing the mmc core about the requirement, via setting the host cap, MMC_CAP_NEED_RSP_BUSY.
--- drivers/mmc/host/sdhci-omap.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/sdhci-omap.c +3 -0
@@ -1134,6 +1134,9 @@ static int sdhci_omap_probe(struct platform_device *pdev) host->mmc_host_ops.execute_tuning = sdhci_omap_execute_tuning; host->mmc_host_ops.enable_sdio_irq = sdhci_omap_enable_sdio_irq; +/* R1B responses is required to properly manage HW busy detection. */ + mmc->caps |=MMC_CAP_NEED_RSP_BUSY ; + ret =sdhci_setup_host (host);if (ret) goto err_put_sync;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/155 mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit d2f8bfa4bff5028bc40ed56b4497c32e05b0178f ]
It has turned out that the sdhci-tegra controller requires the R1B response, for commands that has this response associated with them. So, converting from an R1B to an R1 response for a CMD6 for example, leads to problems with the HW busy detection support.
Fix this by informing the mmc core about the requirement, via setting the host cap, MMC_CAP_NEED_RSP_BUSY.
--- drivers/mmc/host/sdhci-tegra.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/sdhci-tegra.c +3 -0
@@ -1552,6 +1552,9 @@ static int sdhci_tegra_probe(struct platif (tegra_host->soc_data->nvquirks &NVQUIRK_ENABLE_DDR50 ) host->mmc->caps |=MMC_CAP_1_8V_DDR ; +/* R1B responses is required to properly manage HW busy detection. */ + host->mmc->caps |=MMC_CAP_NEED_RSP_BUSY ; +tegra_sdhci_parse_dt (host); tegra_host->power_gpio = devm_gpiod_get_optional(&pdev->dev, "power",
Greg Kroah-Hartman
maintainerPATCH 6/155 ACPI: PM: s2idle: Rework ACPI events synchronization
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 024aa8732acb7d2503eae43c3fe3504d0a8646d0 upstream.
Note that the EC GPE processing need not be synchronized in acpi_s2idle_wake() after invoking acpi_ec_dispatch_gpe(), because that function checks the GPE status and dispatches its handler if need be and the SCI action handler is not going to run anyway at that point.
Moreover, it is better to drain all of the pending ACPI events before restoring the working-state configuration of GPEs in acpi_s2idle_restore(), because those events are likely to be related to system wakeup, in which case they will not be relevant going forward.
Rework the code to take these observations into account.
--- drivers/acpi/sleep.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
drivers/acpi/sleep.c +19 -7
@@ -977,6 +977,16 @@ static int acpi_s2idle_prepare_late(voidreturn 0 ; } +static void acpi_s2idle_sync (void ) +{ +/* +* The EC driver uses the system workqueue and an additional special +* one, so those need to be flushed too. +*/ +acpi_ec_flush_work (); +acpi_os_wait_events_complete ();/* synchronize Notify handling */ +} +static bool acpi_s2idle_wake (void ) {if (!acpi_sci_irq_valid ())
@@ -1021,13 +1031,8 @@ static bool acpi_s2idle_wake(void)* should be missed by canceling the wakeup here. */ pm_system_cancel_wakeup (); -/* -* The EC driver uses the system workqueue and an additional -* special one, so those need to be flushed too. -*/ -acpi_os_wait_events_complete ();/* synchronize EC GPE processing */ -acpi_ec_flush_work (); -acpi_os_wait_events_complete ();/* synchronize Notify handling */ + +acpi_s2idle_sync ();/* * The SCI is in the "suspended" state now and it cannot produce
@@ -1055,6 +1060,13 @@ static void acpi_s2idle_restore_early(vostatic void acpi_s2idle_restore (void ) { +/* +* Drain pending events before restoring the working-state configuration +* of GPEs. +*/ +acpi_os_wait_events_complete ();/* synchronize GPE processing */ +acpi_s2idle_sync (); + s2idle_wakeup = false;acpi_enable_all_runtime_gpes ();
Greg Kroah-Hartman
maintainerPATCH 7/155 cxgb4: fix throughput drop during Tx backpressure
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit 7affd80802afb6ca92dba47d768632fbde365241 ]
commit 7c3bebc3d868 ("cxgb4: request the TX CIDX updates to status page") reverted back to getting Tx CIDX updates via DMA, instead of interrupts, introduced by commit d429005fdf2c ("cxgb4/cxgb4vf: Add support for SGE doorbell queue timer")
However, it missed reverting back several code changes where Tx CIDX updates are not explicitly requested during backpressure when using interrupt mode. These missed changes cause slow recovery during backpressure because the corresponding interrupt no longer comes and hence results in Tx throughput drop.
So, revert back these missed code changes, as well, which will allow explicitly requesting Tx CIDX updates when backpressure happens. This enables the corresponding interrupt with Tx CIDX update message to get generated and hence speed up recovery and restore back throughput.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 42 +------------------------------ 1 file changed, 2 insertions(+), 40 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +2 -40
@@ -1469,16 +1469,7 @@ out_free: dev_kfree_skb_any(skb);* has opened up. */ eth_txq_stop (q); - -/* If we're using the SGE Doorbell Queue Timer facility, we -* don't need to ask the Firmware to send us Egress Queue CIDX -* Updates: the Hardware will do this automatically. And -* since we send the Ingress Queue CIDX Updates to the -* corresponding Ethernet Response Queue, we'll get them very -* quickly. -*/ -if (!q->dbqt) - wr_mid |=FW_WR_EQUEQ_F |FW_WR_EQUIQ_F ; + wr_mid |=FW_WR_EQUEQ_F |FW_WR_EQUIQ_F ; } wr = (void *)&q->q.desc[q->q.pidx];
@@ -1792,16 +1783,7 @@ static netdev_tx_t cxgb4_vf_eth_xmit(str* has opened up. */ eth_txq_stop (txq); - -/* If we're using the SGE Doorbell Queue Timer facility, we -* don't need to ask the Firmware to send us Egress Queue CIDX -* Updates: the Hardware will do this automatically. And -* since we send the Ingress Queue CIDX Updates to the -* corresponding Ethernet Response Queue, we'll get them very -* quickly. -*/ -if (!txq->dbqt) - wr_mid |=FW_WR_EQUEQ_F |FW_WR_EQUIQ_F ; + wr_mid |=FW_WR_EQUEQ_F |FW_WR_EQUIQ_F ; }/* Start filling in our Work Request. Note that we do _not_ handle
@@ -2924,26 +2906,6 @@ static void t4_tx_completion_handler(str } txq = &s->ethtxq[pi->first_qset + rspq->idx]; - -/* We've got the Hardware Consumer Index Update in the Egress Update -* message. If we're using the SGE Doorbell Queue Timer mechanism, -* these Egress Update messages will be our sole CIDX Updates we get -* since we don't want to chew up PCIe bandwidth for both Ingress -* Messages and Status Page writes. However, The code which manages -* reclaiming successfully DMA'ed TX Work Requests uses the CIDX value -* stored in the Status Page at the end of the TX Queue. It's easiest -* to simply copy the CIDX Update value from the Egress Update message -* to the Status Page. Also note that no Endian issues need to be -* considered here since both are Big Endian and we're just copying -* bytes consistently ... -*/ -if (txq->dbqt) { -struct cpl_sge_egr_update *egr; - - egr = (struct cpl_sge_egr_update *)rsp; -WRITE_ONCE (txq->q.stat->cidx, egr->cidx); - } -t4_sge_eth_txq_egress_update (adapter, txq,-1 ); }
Greg Kroah-Hartman
maintainerPATCH 8/155 cxgb4: fix Txq restart check during backpressure
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit f1f20a8666c55cb534b8f3fc1130eebf01a06155 ]
Driver reclaims descriptors in much smaller batches, even if hardware indicates more to reclaim, during backpressure. So, fix the check to restart the Txq during backpressure, by looking at how many descriptors hardware had indicated to reclaim, and not on how many descriptors that driver had actually reclaimed. Once the Txq is restarted, driver will reclaim even more descriptors when Tx path is entered again.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +8 -2
@@ -1324,8 +1324,9 @@ static inline void t6_fill_tnl_lso(strucint t4_sge_eth_txq_egress_update (struct adapter *adap,struct sge_eth_txq *eq,int maxreclaim) { +unsigned int reclaimed, hw_cidx;struct sge_txq *q = &eq->q; -unsigned int reclaimed; +int hw_in_use;if (!q->in_use || !__netif_tx_trylock (eq->txq))return 0 ;
@@ -1333,12 +1334,17 @@ int t4_sge_eth_txq_egress_update(struct/* Reclaim pending completed TX Descriptors. */ reclaimed =reclaim_completed_tx (adap, &eq->q, maxreclaim, true); + hw_cidx =ntohs (READ_ONCE (q->stat->cidx)); + hw_in_use = q->pidx - hw_cidx; +if (hw_in_use <0 ) + hw_in_use += q->size; +/* If the TX Queue is currently stopped and there's now more than half * the queue available, restart it. Otherwise bail out since the rest * of what we want do here is with the possibility of shipping any * currently buffered Coalesced TX Work Request. */ -if (netif_tx_queue_stopped (eq->txq) &&txq_avail (q) > (q->size /2 )) { +if (netif_tx_queue_stopped (eq->txq) && hw_in_use < (q->size /2 )) {netif_tx_wake_queue (eq->txq); eq->q.restarts++; }
Greg Kroah-Hartman
maintainerPATCH 9/155 geneve: move debug check after netdev unregister
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 0fda7600c2e174fe27e9cf02e78e345226e441fa ]
The debug check must be done after unregister_netdevice_many() call -- the list_del() for this is done inside .ndo_stop.
--- drivers/net/geneve.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/geneve.c +6 -2
@@ -1845,8 +1845,6 @@ static void geneve_destroy_tunnels(strucif (!net_eq (dev_net (geneve->dev), net))unregister_netdevice_queue (geneve->dev, head); } - -WARN_ON_ONCE (!list_empty (&gn->sock_list)); } static void __net_exit geneve_exit_batch_net(struct list_head *net_list)
@@ -1861,6 +1859,12 @@ static void __net_exit geneve_exit_batch/* unregister the devices gathered above */ unregister_netdevice_many (&list);rtnl_unlock (); + +list_for_each_entry (net, net_list, exit_list) { +const struct geneve_net *gn =net_generic (net, geneve_net_id); + +WARN_ON_ONCE (!list_empty (&gn->sock_list)); + } }static struct pernet_operations geneve_net_ops = {
Greg Kroah-Hartman
maintainerPATCH 10/155 hsr: fix general protection fault in hsr_addr_is_self()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 3a303cfdd28d5f930a307c82e8a9d996394d5ebd ]
The port->hsr is used in the hsr_handle_frame(), which is a callback of rx_handler.
hsr master and slaves are initialized in hsr_add_port().
This function initializes several pointers, which includes port->hsr after registering rx_handler.
So, in the rx_handler routine, un-initialized pointer would be used. In order to fix this, pointers should be initialized before registering rx_handler.
Test commands:
ip netns del left
ip netns del right
modprobe -rv veth
modprobe -rv hsr
killall ping
modprobe hsr
ip netns add left
ip netns add right
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth3
ip link add veth4 type veth peer name veth5
ip link set veth1 netns left
ip link set veth3 netns right
ip link set veth4 netns left
ip link set veth5 netns right
ip link set veth0 up
ip link set veth2 up
ip link set veth0 address fc:00:00:00:00:01
ip link set veth2 address fc:00:00:00:00:02
ip netns exec left ip link set veth1 up
ip netns exec left ip link set veth4 up
ip netns exec right ip link set veth3 up
ip netns exec right ip link set veth5 up
ip link add hsr0 type hsr slave1 veth0 slave2 veth2
ip a a 192.168.100.1/24 dev hsr0
ip link set hsr0 up
ip netns exec left ip link add hsr1 type hsr slave1 veth1 slave2 veth4 ip netns exec left ip a a 192.168.100.2/24 dev hsr1
ip netns exec left ip link set hsr1 up
ip netns exec left ip n a 192.168.100.1 dev hsr1 lladdr \
fc:00:00:00:00:01 nud permanent
ip netns exec left ip n r 192.168.100.1 dev hsr1 lladdr \
fc:00:00:00:00:01 nud permanent
for i in {1..100}
do
ip netns exec left ping 192.168.100.1 &
done
ip netns exec left hping3 192.168.100.1 -2 --flood &
ip netns exec right ip link add hsr2 type hsr slave1 veth3 slave2 veth5 ip netns exec right ip a a 192.168.100.3/24 dev hsr2
ip netns exec right ip link set hsr2 up
ip netns exec right ip n a 192.168.100.1 dev hsr2 lladdr \
fc:00:00:00:00:02 nud permanent
ip netns exec right ip n r 192.168.100.1 dev hsr2 lladdr \
fc:00:00:00:00:02 nud permanent
for i in {1..100}
do
ip netns exec right ping 192.168.100.1 &
done
ip netns exec right hping3 192.168.100.1 -2 --flood &
while :
do
ip link add hsr0 type hsr slave1 veth0 slave2 veth2
ip a a 192.168.100.1/24 dev hsr0
ip link set hsr0 up
ip link del hsr0
done
Splat looks like:
[ 120.954938][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1]I [ 120.957761][ C0] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 120.959064][ C0] CPU: 0 PID: 1511 Comm: hping3 Not tainted 5.6.0-rc5+ #460 [ 120.960054][ C0] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 120.962261][ C0] RIP: 0010:hsr_addr_is_self+0x65/0x2a0 [hsr] [ 120.963149][ C0] Code: 44 24 18 70 73 2f c0 48 c1 eb 03 48 8d 04 13 c7 00 f1 f1 f1 f1 c7 40 04 00 f2 f2 f2 4 [ 120.966277][ C0] RSP: 0018:ffff8880d9c09af0 EFLAGS: 00010206 [ 120.967293][ C0] RAX: 0000000000000006 RBX: 1ffff1101b38135f RCX: 0000000000000000 [ 120.968516][ C0] RDX: dffffc0000000000 RSI: ffff8880d17cb208 RDI: 0000000000000000 [ 120.969718][ C0] RBP: 0000000000000030 R08: ffffed101b3c0e3c R09: 0000000000000001 [ 120.972203][ C0] R10: 0000000000000001 R11: ffffed101b3c0e3b R12: 0000000000000000 [ 120.973379][ C0] R13: ffff8880aaf80100 R14: ffff8880aaf800f2 R15: ffff8880aaf80040 [ 120.974410][ C0] FS: 00007f58e693f740(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 [ 120.979794][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.980773][ C0] CR2: 00007ffcb8b38f29 CR3: 00000000afe8e001 CR4: 00000000000606f0 [ 120.981945][ C0] Call Trace: [ 120.982411][ C0] <IRQ> [ 120.982848][ C0] ? hsr_add_node+0x8c0/0x8c0 [hsr] [ 120.983522][ C0] ? rcu_read_lock_held+0x90/0xa0 [ 120.984159][ C0] ? rcu_read_lock_sched_held+0xc0/0xc0 [ 120.984944][ C0] hsr_handle_frame+0x1db/0x4e0 [hsr] [ 120.985597][ C0] ? hsr_nl_nodedown+0x2b0/0x2b0 [hsr] [ 120.986289][ C0] __netif_receive_skb_core+0x6bf/0x3170 [ 120.992513][ C0] ? check_chain_key+0x236/0x5d0 [ 120.993223][ C0] ? do_xdp_generic+0x1460/0x1460 [ 120.993875][ C0] ? register_lock_class+0x14d0/0x14d0 [ 120.994609][ C0] ? __netif_receive_skb_one_core+0x8d/0x160 [ 120.995377][ C0] __netif_receive_skb_one_core+0x8d/0x160 [ 120.996204][ C0] ? __netif_receive_skb_core+0x3170/0x3170
[ ... ]
--- net/hsr/hsr_slave.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/hsr/hsr_slave.c +4 -4
@@ -145,16 +145,16 @@ int hsr_add_port(struct hsr_priv *hsr, sif (!port)return -ENOMEM ; + port->hsr = hsr; + port->dev = dev; + port->type = type; +if (type !=HSR_PT_MASTER ) { res =hsr_portdev_setup (dev, port);if (res) goto fail_dev_setup; } - port->hsr = hsr; - port->dev = dev; - port->type = type; -list_add_tail_rcu (&port->port_list, &hsr->ports);synchronize_rcu ();
Greg Kroah-Hartman
maintainerPATCH 11/155 ipv4: fix a RCU-list lock in inet_dump_fib()
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit dddeb30bfc43926620f954266fd12c65a7206f07 ]
There is a place,
inet_dump_fib()
fib_table_dump
fn_trie_dump_leaf()
hlist_for_each_entry_rcu()without rcu_read_lock() will trigger a warning,
WARNING: suspicious RCU usage
-----------------------------
net/ipv4/fib_trie.c:2216 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/1923:
#0: ffffffff8ce76e40 (rtnl_mutex){+.+.}, at: netlink_dump+0xd6/0x840
Call Trace: dump_stack+0xa1/0xea lockdep_rcu_suspicious+0x103/0x10d fn_trie_dump_leaf+0x581/0x590 fib_table_dump+0x15f/0x220 inet_dump_fib+0x4ad/0x5d0 netlink_dump+0x350/0x840 __netlink_dump_start+0x315/0x3e0 rtnetlink_rcv_msg+0x4d1/0x720 netlink_rcv_skb+0xf0/0x220 rtnetlink_rcv+0x15/0x20 netlink_unicast+0x306/0x460 netlink_sendmsg+0x44b/0x770 __sys_sendto+0x259/0x270 __x64_sys_sendto+0x80/0xa0 do_syscall_64+0x69/0xf4 entry_SYSCALL_64_after_hwframe+0x49/0xb3
--- net/ipv4/fib_frontend.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/fib_frontend.c +2 -0
@@ -1007,7 +1007,9 @@ static int inet_dump_fib(struct sk_buffreturn -ENOENT ; } +rcu_read_lock (); err =fib_table_dump (tb, skb, cb, &filter); +rcu_read_unlock ();return skb->len ? : err; }
Greg Kroah-Hartman
maintainerPATCH 12/155 macsec: restrict to ethernet devices
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit b06d072ccc4b1acd0147b17914b7ad1caa1818bb ]
Only attach macsec to ethernet devices.
Syzbot was able to trigger a KMSAN warning in macsec_handle_frame by attaching to a phonet device.
Macvlan has a similar check in macvlan_port_create.
v1->v2
- fix commit message typo
--- drivers/net/macsec.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/macsec.c +3 -0
@@ -16,6 +16,7 @@#include <net/genetlink.h> #include <net/sock.h> #include <net/gro_cells.h> +#include <linux/if_arp.h> #include <uapi/linux/if_macsec.h>
@@ -3236,6 +3237,8 @@ static int macsec_newlink(struct net *ne real_dev =__dev_get_by_index (net,nla_get_u32 (tb[IFLA_LINK ]));if (!real_dev)return -ENODEV ; +if (real_dev->type !=ARPHRD_ETHER ) +return -EINVAL ; dev->priv_flags |=IFF_MACSEC ;
Greg Kroah-Hartman
maintainerPATCH 13/155 mlxsw: pci: Only issue reset when system is ready
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit 6002059d7882c3512e6ac52fa82424272ddfcd5c ]
During initialization the driver issues a software reset command and then waits for the system status to change back to "ready" state.
However, before issuing the reset command the driver does not check that the system is actually in "ready" state. On Spectrum-{1,2} systems this was always the case as the hardware initialization time is very short. On Spectrum-3 systems this is no longer the case. This results in the software reset command timing-out and the driver failing to load:
[ 6.347591] mlxsw_spectrum3 0000:06:00.0: Cmd exec timed-out (opcode=40(ACCESS_REG),opcode_mod=0,in_mod=0) [ 6.358382] mlxsw_spectrum3 0000:06:00.0: Reg cmd access failed (reg_id=9023(mrsr),type=write) [ 6.368028] mlxsw_spectrum3 0000:06:00.0: cannot register bus device [ 6.375274] mlxsw_spectrum3: probe of 0000:06:00.0 failed with error -110
Fix this by waiting for the system to become ready both before issuing the reset command and afterwards. In case of failure, print the last system status to aid in debugging.
--- drivers/net/ethernet/mellanox/mlxsw/pci.c | 50 +++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/pci.c +39 -11
@@ -1318,36 +1318,64 @@ static void mlxsw_pci_mbox_free(struct m mbox->mapaddr); } -static int mlxsw_pci_sw_reset (struct mlxsw_pci *mlxsw_pci, -const struct pci_device_id *id) +static int mlxsw_pci_sys_ready_wait (struct mlxsw_pci *mlxsw_pci, +const struct pci_device_id *id, +u32 *p_sys_status) {unsigned long end; -char mrsr_pl[MLXSW_REG_MRSR_LEN ]; -int err; +u32 val; -mlxsw_reg_mrsr_pack (mrsr_pl); - err =mlxsw_reg_write (mlxsw_pci->core,MLXSW_REG (mrsr), mrsr_pl); -if (err) -return err;if (id->device ==PCI_DEVICE_ID_MELLANOX_SWITCHX2 ) {msleep (MLXSW_PCI_SW_RESET_TIMEOUT_MSECS );return 0 ; } -/* We must wait for the HW to become responsive once again. */ +/* We must wait for the HW to become responsive. */ msleep (MLXSW_PCI_SW_RESET_WAIT_MSECS ); end = jiffies +msecs_to_jiffies (MLXSW_PCI_SW_RESET_TIMEOUT_MSECS );do { -u32 val =mlxsw_pci_read32 (mlxsw_pci,FW_READY ); - + val =mlxsw_pci_read32 (mlxsw_pci,FW_READY );if ((val &MLXSW_PCI_FW_READY_MASK ) ==MLXSW_PCI_FW_READY_MAGIC )return 0 ;cond_resched (); }while (time_before (jiffies, end)); + + *p_sys_status = val &MLXSW_PCI_FW_READY_MASK ; +return -EBUSY ; } +static int mlxsw_pci_sw_reset (struct mlxsw_pci *mlxsw_pci, +const struct pci_device_id *id) +{ +struct pci_dev *pdev = mlxsw_pci->pdev; +char mrsr_pl[MLXSW_REG_MRSR_LEN ]; +u32 sys_status; +int err; + + err =mlxsw_pci_sys_ready_wait (mlxsw_pci, id, &sys_status); +if (err) { +dev_err (&pdev->dev,"Failed to reach system ready status before reset. Status is 0x%x\n" , + sys_status); +return err; + } + +mlxsw_reg_mrsr_pack (mrsr_pl); + err =mlxsw_reg_write (mlxsw_pci->core,MLXSW_REG (mrsr), mrsr_pl); +if (err) +return err; + + err =mlxsw_pci_sys_ready_wait (mlxsw_pci, id, &sys_status); +if (err) { +dev_err (&pdev->dev,"Failed to reach system ready status after reset. Status is 0x%x\n" , + sys_status); +return err; + } + +return 0 ; +} +static int mlxsw_pci_alloc_irq_vectors (struct mlxsw_pci *mlxsw_pci) {int err;
Greg Kroah-Hartman
maintainerPATCH 14/155 mlxsw: spectrum_mr: Fix list iteration in error path
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit f6bf1bafdc2152bb22aff3a4e947f2441a1d49e2 ]
list_for_each_entry_from_reverse() iterates backwards over the list from the current position, but in the error path we should start from the previous position.
Fix this by using list_for_each_entry_continue_reverse() instead.
This suppresses the following error from coccinelle:
drivers/net/ethernet/mellanox/mlxsw//spectrum_mr.c:655:34-38: ERROR:
invalid reference to the index variable of the iterator on line 636
--- drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c +4 -4
@@ -637,12 +637,12 @@ static int mlxsw_sp_mr_vif_resolve(strucreturn 0 ; err_erif_unresolve: -list_for_each_entry_from_reverse (erve, &mr_vif->route_evif_list, - vif_node) +list_for_each_entry_continue_reverse (erve, &mr_vif->route_evif_list, + vif_node)mlxsw_sp_mr_route_evif_unresolve (mr_table, erve); err_irif_unresolve: -list_for_each_entry_from_reverse (irve, &mr_vif->route_ivif_list, - vif_node) +list_for_each_entry_continue_reverse (irve, &mr_vif->route_ivif_list, + vif_node)mlxsw_sp_mr_route_ivif_unresolve (mr_table, irve); mr_vif->rif =NULL ;return err;
Greg Kroah-Hartman
maintainerPATCH 15/155 net/bpfilter: fix dprintf usage for /dev/kmsg
In reply to Greg Kroah-HartmanFrom: Bruno Meneguele <[email protected]>
[ Upstream commit 13d0f7b814d9b4c67e60d8c2820c86ea181e7d99 ]
The bpfilter UMH code was recently changed to log its informative messages to /dev/kmsg, however this interface doesn't support SEEK_CUR yet, used by dprintf(). As result dprintf() returns -EINVAL and doesn't log anything.
However there already had some discussions about supporting SEEK_CUR into /dev/kmsg interface in the past it wasn't concluded. Since the only user of that from userspace perspective inside the kernel is the bpfilter UMH (userspace) module it's better to correct it here instead waiting a conclusion on the interface.
--- net/bpfilter/main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/bpfilter/main.c +8 -6
@@ -10,7 +10,7 @@#include <asm/unistd.h> #include "msgfmt.h" -int debug_fd; +FILE *debug_f;static int handle_get_cmd (struct mbox_request *cmd) {
@@ -35,9 +35,10 @@ static void loop(void)struct mbox_reply reply;int n; +fprintf (debug_f,"testing the buffer\n" ); n =read (0 , &req,sizeof (req));if (n !=sizeof (req)) { -dprintf (debug_fd,"invalid request %d\n" , n); +fprintf (debug_f,"invalid request %d\n" , n);return ; }
@@ -47,7 +48,7 @@ static void loop(void) n =write (1 , &reply,sizeof (reply));if (n !=sizeof (reply)) { -dprintf (debug_fd,"reply failed %d\n" , n); +fprintf (debug_f,"reply failed %d\n" , n);return ; } }
@@ -55,9 +56,10 @@ static void loop(void)int main (void ) { - debug_fd =open ("/dev/kmsg" ,00000002 ); -dprintf (debug_fd,"Started bpfilter\n" ); + debug_f =fopen ("/dev/kmsg" ,"w" ); +setvbuf (debug_f,0 , _IOLBF,0 ); +fprintf (debug_f,"Started bpfilter\n" );loop (); -close (debug_fd); +fclose (debug_f);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 16/155 net: cbs: Fix software cbs to consider packet sending time
In reply to Greg Kroah-HartmanFrom: Zh-yuan Ye <[email protected]>
[ Upstream commit 961d0e5b32946703125964f9f5b6321d60f4d706 ]
Currently the software CBS does not consider the packet sending time when depleting the credits. It caused the throughput to be Idleslope[kbps] * (Port transmit rate[kbps] / |Sendslope[kbps]|) where Idleslope * (Port transmit rate / (Idleslope + |Sendslope|)) = Idleslope is expected. In order to fix the issue above, this patch takes the time when the packet sending completes into account by moving the anchor time variable "last" ahead to the send completion time upon transmission and adding wait when the next dequeue request comes before the send completion time of the previous packet.
changelog:V2->V3:
- remove unnecessary whitespace cleanup
- add the checks if port_rate is 0 before division
V1->V2:
- combine variable "send_completed" into "last"
- add the comment for estimate of the packet sending
--- net/sched/sch_cbs.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/sched/sch_cbs.c +11 -1
@@ -181,6 +181,11 @@ static struct sk_buff *cbs_dequeue_soft(s64 credits;int len; +/* The previous packet is still being sent */ +if (now < q->last) { +qdisc_watchdog_schedule_ns (&q->watchdog, q->last); +return NULL ; + }if (q->credits <0 ) { credits =timediff_to_credits (now - q->last, q->idleslope);
@@ -212,7 +217,12 @@ static struct sk_buff *cbs_dequeue_soft( credits += q->credits; q->credits =max_t (s64, credits, q->locredit); - q->last = now; +/* Estimate of the transmission of the last byte of the packet in ns */ +if (unlikely (atomic64_read (&q->port_rate) ==0 )) + q->last = now; +else + q->last = now +div64_s64 (len *NSEC_PER_SEC , +atomic64_read (&q->port_rate));return skb; }
Greg Kroah-Hartman
maintainerPATCH 17/155 net: dsa: Fix duplicate frames flooded by learning
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 0e62f543bed03a64495bd2651d4fe1aa4bcb7fe5 ]
When both the switch and the bridge are learning about new addresses, switch ports attached to the bridge would see duplicate ARP frames because both entities would attempt to send them.
--- net/dsa/tag_brcm.c | 2 ++ 1 file changed, 2 insertions(+)
net/dsa/tag_brcm.c +2 -0
@@ -140,6 +140,8 @@ static struct sk_buff *brcm_tag_rcv_ll(s/* Remove Broadcom tag and update checksum */ skb_pull_rcsum (skb,BRCM_TAG_LEN ); + skb->offload_fwd_mark =1 ; + return skb; }#endif
Greg Kroah-Hartman
maintainerPATCH 18/155 net: dsa: mt7530: Change the LINK bit to reflect the link status
In reply to Greg Kroah-HartmanFrom: "Ren� van Dorst" <[email protected]>
[ Upstream commit 22259471b51925353bd7b16f864c79fdd76e425e ]
Andrew reported:
After a number of network port link up/down changes, sometimes the switch port gets stuck in a state where it thinks it is still transmitting packets but the cpu port is not actually transmitting anymore. In this state you will see a message on the console
"mtk_soc_eth 1e100000.ethernet eth0: transmit timed out" and the Tx counter in ifconfig will be incrementing on virtual port, but not incrementing on cpu port.
The issue is that MAC TX/RX status has no impact on the link status or queue manager of the switch. So the queue manager just queues up packets of a disabled port and sends out pause frames when the queue is full.
Change the LINK bit to reflect the link status.
--- drivers/net/dsa/mt7530.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mt7530.c +2 -2
@@ -566,7 +566,7 @@ mt7530_mib_reset(struct dsa_switch *ds)static void mt7530_port_set_status (struct mt7530_priv *priv,int port,int enable) { -u32 mask =PMCR_TX_EN |PMCR_RX_EN ; +u32 mask =PMCR_TX_EN |PMCR_RX_EN |PMCR_FORCE_LNK ;if (enable)mt7530_set (priv,MT7530_PMCR_P (port), mask);
@@ -1439,7 +1439,7 @@ static void mt7530_phylink_mac_config(st mcr_new &= ~(PMCR_FORCE_SPEED_1000 |PMCR_FORCE_SPEED_100 |PMCR_FORCE_FDX |PMCR_TX_FC_EN |PMCR_RX_FC_EN ); mcr_new |=PMCR_IFG_XMIT (1 ) |PMCR_MAC_MODE |PMCR_BACKOFF_EN | -PMCR_BACKPR_EN |PMCR_FORCE_MODE |PMCR_FORCE_LNK ; +PMCR_BACKPR_EN |PMCR_FORCE_MODE ;/* Are we connected to external phy */ if (port ==5 &&dsa_is_user_port (ds,5 ))
Greg Kroah-Hartman
maintainerPATCH 19/155 net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit e80f40cbe4dd51371818e967d40da8fe305db5e4 ]
Not only did this wheel did not need reinventing, but there is also an issue with it: It doesn't remove the VLAN header in a way that preserves the L2 payload checksum when that is being provided by the DSA master hw. It should recalculate checksum both for the push, before removing the header, and for the pull afterwards. But the current implementation is quite dizzying, with pulls followed immediately afterwards by pushes, the memmove is done before the push, etc. This makes a DSA master with RX checksumming offload to print stack traces with the infamous 'hw csum failure' message.
So remove the dsa_8021q_remove_header function and replace it with something that actually works with inet checksumming.
--- include/linux/dsa/8021q.h | 7 ------- net/dsa/tag_8021q.c | 43 ------------------------------------------- net/dsa/tag_sja1105.c | 19 +++++++++---------- 3 files changed, 9 insertions(+), 60 deletions(-)
include/linux/dsa/8021q.h +0 -7
@@ -28,8 +28,6 @@ int dsa_8021q_rx_switch_id(u16 vid);int dsa_8021q_rx_source_port (u16 vid); -struct sk_buff *dsa_8021q_remove_header (struct sk_buff *skb); -#else int dsa_port_setup_8021q_tagging(struct dsa_switch *ds, int index,
@@ -64,11 +62,6 @@ int dsa_8021q_rx_source_port(u16 vid)return 0 ; } -struct sk_buff *dsa_8021q_remove_header (struct sk_buff *skb) -{ -return NULL ; -} -#endif /* IS_ENABLED(CONFIG_NET_DSA_TAG_8021Q) */ #endif /* _NET_DSA_8021Q_H */
net/dsa/tag_8021q.c +0 -43
49 lines not on this page · raw message
net/dsa/tag_sja1105.c +9 -10
@@ -238,14 +238,14 @@ static struct sk_buff *sja1105_rcv(struc {struct sja1105_meta meta = {0 };int source_port, switch_id; -struct vlan_ethhdr *hdr; +struct ethhdr *hdr;u16 tpid, vid, tci;bool is_link_local;bool is_tagged;bool is_meta; - hdr =vlan_eth_hdr (skb); - tpid =ntohs (hdr->h_vlan_proto); + hdr =eth_hdr (skb); + tpid =ntohs (hdr->h_proto); is_tagged = (tpid ==ETH_P_SJA1105 ); is_link_local =sja1105_is_link_local (skb); is_meta =sja1105_is_meta_frame (skb);
@@ -254,7 +254,12 @@ static struct sk_buff *sja1105_rcv(strucif (is_tagged) {/* Normal traffic path. */ - tci =ntohs (hdr->h_vlan_TCI); +skb_push_rcsum (skb,ETH_HLEN ); +__skb_vlan_pop (skb, &tci); +skb_pull_rcsum (skb,ETH_HLEN ); +skb_reset_network_header (skb); +skb_reset_transport_header (skb); + vid = tci &VLAN_VID_MASK ; source_port =dsa_8021q_rx_source_port (vid); switch_id =dsa_8021q_rx_switch_id (vid);
@@ -283,12 +288,6 @@ static struct sk_buff *sja1105_rcv(strucreturn NULL ; } -/* Delete/overwrite fake VLAN header, DSA expects to not find -* it there, see dsa_switch_rcv: skb_push(skb, ETH_HLEN). -*/ -if (is_tagged) - skb =dsa_8021q_remove_header (skb); -return sja1105_rcv_meta_state_machine (skb, &meta, is_link_local, is_meta); }
Greg Kroah-Hartman
maintainerPATCH 20/155 net: ena: Add PCI shutdown handler to allow safe kexec
In reply to Greg Kroah-HartmanFrom: "Guilherme G. Piccoli" <[email protected]>
[ Upstream commit 428c491332bca498c8eb2127669af51506c346c7 ]
Currently ENA only provides the PCI remove() handler, used during rmmod for example. This is not called on shutdown/kexec path; we are potentially creating a failure scenario on kexec:
(a) Kexec is triggered, no shutdown() / remove() handler is called for ENA; instead pci_device_shutdown() clears the master bit of the PCI device, stopping all DMA transactions;
(b) Kexec reboot happens and the device gets enabled again, likely having its FW with that DMA transaction buffered; then it may trigger the (now invalid) memory operation in the new kernel, corrupting kernel memory area.
This patch aims to prevent this, by implementing a shutdown() handler quite similar to the remove() one - the difference being the handling of the netdev, which is unregistered on remove(), but following the convention observed in other drivers, it's only detached on shutdown().
This prevents an odd issue in AWS Nitro instances, in which after the 2nd kexec the next one will fail with an initrd corruption, caused by a wild DMA write to invalid kernel memory. The lspci output for the adapter present in my instance is:
00:05.0 Ethernet controller [0200]: Amazon.com, Inc. Elastic Network Adapter (ENA) [1d0f:ec20]
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 51 +++++++++++++++++++++------ 1 file changed, 41 insertions(+), 10 deletions(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +41 -10
@@ -3652,13 +3652,15 @@ err_disable_device:/*****************************************************************************/ -/* ena_remove - Device Removal Routine +/* __ena_shutoff - Helper used in both PCI remove/shutdown routines * @pdev: PCI device information struct +* @shutdown: Is it a shutdown operation? If false, means it is a removal * -* ena_remove is called by the PCI subsystem to alert the driver -* that it should release a PCI device. +* __ena_shutoff is a helper routine that does the real work on shutdown and +* removal paths; the difference between those paths is with regards to whether +* dettach or unregister the netdevice. */ -static void ena_remove (struct pci_dev *pdev) +static void __ena_shutoff (struct pci_dev *pdev,bool shutdown) {struct ena_adapter *adapter =pci_get_drvdata (pdev);struct ena_com_dev *ena_dev;
@@ -3677,13 +3679,17 @@ static void ena_remove(struct pci_dev *pcancel_work_sync (&adapter->reset_task); -rtnl_lock (); +rtnl_lock ();/* lock released inside the below if-else block */ ena_destroy_device (adapter, true); -rtnl_unlock (); - -unregister_netdev (netdev); - -free_netdev (netdev); +if (shutdown) { +netif_device_detach (netdev); +dev_close (netdev); +rtnl_unlock (); + }else { +rtnl_unlock (); +unregister_netdev (netdev); +free_netdev (netdev); + }ena_com_rss_destroy (ena_dev);
@@ -3698,6 +3704,30 @@ static void ena_remove(struct pci_dev *pvfree (ena_dev); } +/* ena_remove - Device Removal Routine +* @pdev: PCI device information struct +* +* ena_remove is called by the PCI subsystem to alert the driver +* that it should release a PCI device. +*/ + +static void ena_remove (struct pci_dev *pdev) +{ +__ena_shutoff (pdev, false); +} + +/* ena_shutdown - Device Shutdown Routine +* @pdev: PCI device information struct +* +* ena_shutdown is called by the PCI subsystem to alert the driver that +* a shutdown/reboot (or kexec) is happening and device must be disabled. +*/ + +static void ena_shutdown (struct pci_dev *pdev) +{ +__ena_shutoff (pdev, true); +} +#ifdef CONFIG_PM /* ena_suspend - PM suspend callback * @pdev: PCI device information struct
@@ -3747,6 +3777,7 @@ static struct pci_driver ena_pci_driver .id_table = ena_pci_tbl, .probe = ena_probe, .remove = ena_remove, + .shutdown = ena_shutdown, #ifdef CONFIG_PM .suspend = ena_suspend, .resume = ena_resume,
Greg Kroah-Hartman
maintainerPATCH 21/155 net: mvneta: Fix the case where the last poll did not process all rx
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
[ Upstream commit 065fd83e1be2e1ba0d446a257fd86a3cc7bddb51 ]
For the case where the last mvneta_poll did not process all RX packets, we need to xor the pp->cause_rx_tx or port->cause_rx_tx before claculating the rx_queue.
--- drivers/net/ethernet/marvell/mvneta.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/marvell/mvneta.c +1 -2
@@ -2804,11 +2804,10 @@ static int mvneta_poll(struct napi_struc/* For the case where the last mvneta_poll did not process all * RX packets */ - rx_queue =fls (((cause_rx_tx >>8 ) &0xff )); - cause_rx_tx |= pp->neta_armada3700 ? pp->cause_rx_tx : port->cause_rx_tx; + rx_queue =fls (((cause_rx_tx >>8 ) &0xff ));if (rx_queue) { rx_queue = rx_queue -1 ;if (pp->bm_priv)
Greg Kroah-Hartman
maintainerPATCH 22/155 net/packet: tpacket_rcv: avoid a producer race condition
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 ]
PACKET_RX_RING can cause multiple writers to access the same slot if a fast writer wraps the ring while a slow writer is still copying. This is particularly likely with few, large, slots (e.g., GSO packets).
Synchronize kernel thread ownership of rx ring slots with a bitmap.
Writers acquire a slot race-free by testing tp_status TP_STATUS_KERNEL while holding the sk receive queue lock. They release this lock before copying and set tp_status to TP_STATUS_USER to release to userspace when done. During copying, another writer may take the lock, also see TP_STATUS_KERNEL, and start writing to the same slot.
Introduce a new rx_owner_map bitmap with a bit per slot. To acquire a slot, test and set with the lock held. To release race-free, update tp_status and owner bit as a transaction, so take the lock again.
This is the one of a variety of discussed options (see Link below):
* instead of a shadow ring, embed the data in the slot itself, such as in tp_padding. But any test for this field may match a value left by userspace, causing deadlock.
* avoid the lock on release. This leaves a small race if releasing the shadow slot before setting TP_STATUS_USER. The below reproducer showed that this race is not academic. If releasing the slot after tp_status, the race is more subtle. See the first link for details.
* add a new tp_status TP_KERNEL_OWNED to avoid the transactional store of two fields. But, legacy applications may interpret all non-zero tp_status as owned by the user. As libpcap does. So this is possible only opt-in by newer processes. It can be added as an optional mode.
* embed the struct at the tail of pg_vec to avoid extra allocation. The implementation proved no less complex than a separate field.
The additional locking cost on release adds contention, no different than scaling on multicore or multiqueue h/w. In practice, below reproducer nor small packet tcpdump showed a noticeable change in perf report in cycles spent in spinlock. Where contention is problematic, packet sockets support mitigation through PACKET_FANOUT. And we can consider adding opt-in state TP_KERNEL_OWNED.
Easy to reproduce by running multiple netperf or similar TCP_STREAM flows concurrently with tcpdump -B 129 -n greater 60000.
Based on an earlier patchset by Jon Rosen. See links below.
I believe this issue goes back to the introduction of tpacket_rcv, which predates git history.
--- net/packet/af_packet.c | 21 +++++++++++++++++++++ net/packet/internal.h | 5 ++++- 2 files changed, 25 insertions(+), 1 deletion(-)
net/packet/af_packet.c +21 -0
@@ -2172,6 +2172,7 @@ static int tpacket_rcv(struct sk_buff *sstruct timespec ts;__u32 ts_status;bool is_drop_n_account = false; +unsigned int slot_id =0 ;bool do_vnet = false;/* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
@@ -2274,6 +2275,13 @@ static int tpacket_rcv(struct sk_buff *sif (!h.raw) goto drop_n_account; +if (po->tp_version <=TPACKET_V2 ) { + slot_id = po->rx_ring.head; +if (test_bit (slot_id, po->rx_ring.rx_owner_map)) + goto drop_n_account; +__set_bit (slot_id, po->rx_ring.rx_owner_map); + } +if (do_vnet && virtio_net_hdr_from_skb(skb, h.raw + macoff - sizeof(struct virtio_net_hdr),
@@ -2379,7 +2387,10 @@ static int tpacket_rcv(struct sk_buff *s#endif if (po->tp_version <=TPACKET_V2 ) { +spin_lock (&sk->sk_receive_queue.lock);__packet_set_status (po, h.raw, status); +__clear_bit (slot_id, po->rx_ring.rx_owner_map); +spin_unlock (&sk->sk_receive_queue.lock); sk->sk_data_ready (sk); }else {prb_clear_blk_fill_status (&po->rx_ring);
@@ -4276,6 +4287,7 @@ static int packet_set_ring(struct sock * {struct pgv *pg_vec =NULL ;struct packet_sock *po =pkt_sk (sk); +unsigned long *rx_owner_map =NULL ;int was_running, order =0 ;struct packet_ring_buffer *rb;struct sk_buff_head *rb_queue;
@@ -4361,6 +4373,12 @@ static int packet_set_ring(struct sock * }break ;default : +if (!tx_ring) { + rx_owner_map =bitmap_alloc (req->tp_frame_nr, +GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO); +if (!rx_owner_map) + goto out_free_pg_vec; + }break ; } }
@@ -4390,6 +4408,8 @@ static int packet_set_ring(struct sock * err =0 ;spin_lock_bh (&rb_queue->lock);swap (rb->pg_vec, pg_vec); +if (po->tp_version <=TPACKET_V2 ) +swap (rb->rx_owner_map, rx_owner_map); rb->frame_max = (req->tp_frame_nr -1 ); rb->head =0 ; rb->frame_size = req->tp_frame_size;
@@ -4421,6 +4441,7 @@ static int packet_set_ring(struct sock * } out_free_pg_vec: +bitmap_free (rx_owner_map);if (pg_vec)free_pg_vec (pg_vec, order, req->tp_block_nr); out:
net/packet/internal.h +4 -1
@@ -70,7 +70,10 @@ struct packet_ring_buffer {unsigned int __percpu *pending_refcnt; -struct tpacket_kbdq_core prb_bdqc; +union { +unsigned long *rx_owner_map; +struct tpacket_kbdq_core prb_bdqc; + }; };extern struct mutex fanout_mutex;
Greg Kroah-Hartman
maintainerPATCH 23/155 net: phy: dp83867: w/a for fld detect threshold bootstrapping issue
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 749f6f6843115b424680f1aada3c0dd613ad807c ]
When the DP83867 PHY is strapped to enable Fast Link Drop (FLD) feature STRAP_STS2.STRAP_ FLD (reg 0x006F bit 10), the Energy Lost Threshold for FLD Energy Lost Mode FLD_THR_CFG.ENERGY_LOST_FLD_THR (reg 0x002e bits 2:0) will be defaulted to 0x2. This may cause the phy link to be unstable. The new DP83867 DM recommends to always restore ENERGY_LOST_FLD_THR to 0x1.
Hence, restore default value of FLD_THR_CFG.ENERGY_LOST_FLD_THR to 0x1 when FLD is enabled by bootstrapping as recommended by DM.
--- drivers/net/phy/dp83867.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/net/phy/dp83867.c +20 -1
@@ -25,7 +25,8 @@#define DP83867_CFG3 0x1e/* Extended Registers */ -#define DP83867_CFG4 0x0031 +#define DP83867_FLD_THR_CFG 0x002e +#define DP83867_CFG4 0x0031#define DP83867_CFG4_SGMII_ANEG_MASK (BIT(5) | BIT(6))#define DP83867_CFG4_SGMII_ANEG_TIMER_11MS (3 << 5)#define DP83867_CFG4_SGMII_ANEG_TIMER_800US (2 << 5)
@@ -74,6 +75,7 @@#define DP83867_STRAP_STS2_CLK_SKEW_RX_MASK GENMASK(2, 0)#define DP83867_STRAP_STS2_CLK_SKEW_RX_SHIFT 0#define DP83867_STRAP_STS2_CLK_SKEW_NONE BIT(2) +#define DP83867_STRAP_STS2_STRAP_FLD BIT(10)/* PHY CTRL bits */ #define DP83867_PHYCR_FIFO_DEPTH_SHIFT 14
@@ -103,6 +105,9 @@/* CFG4 bits */ #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) +/* FLD_THR_CFG */ +#define DP83867_FLD_THR_CFG_ENERGY_LOST_THR_MASK 0x7 +enum {DP83867_PORT_MIRROING_KEEP ,DP83867_PORT_MIRROING_EN ,
@@ -318,6 +323,20 @@ static int dp83867_config_init(struct phphy_clear_bits_mmd (phydev,DP83867_DEVADDR ,DP83867_CFG4 ,BIT (7 )); + bs =phy_read_mmd (phydev,DP83867_DEVADDR ,DP83867_STRAP_STS2 ); +if (bs &DP83867_STRAP_STS2_STRAP_FLD ) { +/* When using strap to enable FLD, the ENERGY_LOST_FLD_THR will +* be set to 0x2. This may causes the PHY link to be unstable - +* the default value 0x1 need to be restored. +*/ + ret =phy_modify_mmd (phydev,DP83867_DEVADDR , +DP83867_FLD_THR_CFG , +DP83867_FLD_THR_CFG_ENERGY_LOST_THR_MASK , +0x1 ); +if (ret) +return ret; + } +if (phy_interface_is_rgmii (phydev)) { val =phy_read (phydev,MII_DP83867_PHYCTRL );if (val <0 )
Greg Kroah-Hartman
maintainerPATCH 24/155 net: phy: mdio-bcm-unimac: Fix clock handling
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit c312c7818b86b663d32ec5d4b512abf06b23899a ]
The DT binding for this PHY describes an *optional* clock property. Due to a bug in the error handling logic, we are actually ignoring this clock *all* of the time so far.
Fix this by using devm_clk_get_optional() to handle this clock properly.
--- drivers/net/phy/mdio-bcm-unimac.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/phy/mdio-bcm-unimac.c +2 -4
@@ -242,11 +242,9 @@ static int unimac_mdio_probe(struct platreturn -ENOMEM ; } - priv->clk =devm_clk_get (&pdev->dev,NULL ); -if (PTR_ERR (priv->clk) == -EPROBE_DEFER ) + priv->clk =devm_clk_get_optional (&pdev->dev,NULL ); +if (IS_ERR (priv->clk))return PTR_ERR (priv->clk); -else - priv->clk =NULL ; ret =clk_prepare_enable (priv->clk);if (ret)
Greg Kroah-Hartman
maintainerPATCH 25/155 net: phy: mdio-mux-bcm-iproc: check clk_prepare_enable() return value
In reply to Greg Kroah-HartmanFrom: Rayagonda Kokatanur <[email protected]>
[ Upstream commit 872307abbd0d9afd72171929806c2fa33dc34179 ]
Check clk_prepare_enable() return value.
--- drivers/net/phy/mdio-mux-bcm-iproc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/phy/mdio-mux-bcm-iproc.c +6 -1
@@ -288,8 +288,13 @@ static int mdio_mux_iproc_suspend(structstatic int mdio_mux_iproc_resume (struct device *dev) {struct iproc_mdiomux_desc *md =dev_get_drvdata (dev); +int rc; -clk_prepare_enable (md->core_clk); + rc =clk_prepare_enable (md->core_clk); +if (rc) { +dev_err (md->dev,"failed to enable core clk\n" ); +return rc; + }mdio_mux_iproc_config (md);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 26/155 net: qmi_wwan: add support for ASKEY WWHC050
In reply to Greg Kroah-HartmanFrom: Pawel Dembicki <[email protected]>
[ Upstream commit 12a5ba5a1994568d4ceaff9e78c6b0329d953386 ]
ASKEY WWHC050 is a mcie LTE modem.
The oem configuration states:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
Tested on openwrt distribution.
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1210,6 +1210,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x1435, 0xd182, 5)}, /* Wistron NeWeb D18 */ {QMI_FIXED_INTF(0x1435, 0xd191, 4)}, /* Wistron NeWeb D19Q1 */ {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */ + {QMI_FIXED_INTF(0x1690, 0x7588, 4)}, /* ASKEY WWHC050 */ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
Greg Kroah-Hartman
maintainerPATCH 27/155 net/sched: act_ct: Fix leak of ct zone template on replace
In reply to Greg Kroah-HartmanFrom: Paul Blakey <[email protected]>
[ Upstream commit dd2af10402684cb5840a127caec9e7cdcff6d167 ]
Currently, on replace, the previous action instance params is swapped with a newly allocated params. The old params is only freed (via kfree_rcu), without releasing the allocated ct zone template related to it.
Call tcf_ct_params_free (via call_rcu) for the old params, so it will release it.
--- net/sched/act_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/act_ct.c +1 -1
@@ -739,7 +739,7 @@ static int tcf_ct_init(struct net *net,if (goto_ch)tcf_chain_put_by_act (goto_ch);if (params) -kfree_rcu (params, rcu); +call_rcu (¶ms->rcu, tcf_ct_params_free);if (res ==ACT_P_CREATED )tcf_idr_insert (tn, *a);
Greg Kroah-Hartman
maintainerPATCH 28/155 net_sched: cls_route: remove the right filter from hashtable
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit ef299cc3fa1a9e1288665a9fdc8bff55629fd359 ]
route4_change() allocates a new filter and copies values from the old one. After the new filter is inserted into the hash table, the old filter should be removed and freed, as the final step of the update.
However, the current code mistakenly removes the new one. This looks apparently wrong to me, and it causes double "free" and use-after-free too, as reported by syzbot.
--- net/sched/cls_route.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/sched/cls_route.c +2 -2
@@ -534,8 +534,8 @@ static int route4_change(struct net *net fp = &b->ht[h];for (pfp =rtnl_dereference (*fp); pfp; fp = &pfp->next, pfp =rtnl_dereference (*fp)) { -if (pfp == f) { - *fp = f->next; +if (pfp == fold) { +rcu_assign_pointer (*fp, fold->next);break ; } }
Greg Kroah-Hartman
maintainerPATCH 29/155 net_sched: hold rtnl lock in tcindex_partial_destroy_work()
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit b1be2e8cd290f620777bfdb8aa00890cd2fa02b5 ]
syzbot reported a use-after-free in tcindex_dump(). This is due to the lack of RTNL in the deferred rcu work. We queue this work with RTNL in tcindex_change(), later, tcindex_dump() is called:
fh = tp->ops->get(tp, t->tcm_handle);
...
err = tp->ops->change(..., &fh, ...);
tfilter_notify(..., fh, ...);but there is nothing to serialize the pending tcindex_partial_destroy_work() with tcindex_dump().
Fix this by simply holding RTNL in tcindex_partial_destroy_work(), so that it won't be called until RTNL is released after tc_new_tfilter() is completed.
--- net/sched/cls_tcindex.c | 2 ++ 1 file changed, 2 insertions(+)
net/sched/cls_tcindex.c +2 -0
@@ -261,8 +261,10 @@ static void tcindex_partial_destroy_work struct tcindex_data, rwork); +rtnl_lock ();kfree (p->perfect);kfree (p); +rtnl_unlock (); }static void tcindex_free_perfect_hash (struct tcindex_data *cp)
Greg Kroah-Hartman
maintainerPATCH 30/155 net_sched: keep alloc_hash updated after hash allocation
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit 0d1c3530e1bd38382edef72591b78e877e0edcd3 ]
In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access.
cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash().
--- net/sched/cls_tcindex.c | 1 + 1 file changed, 1 insertion(+)
net/sched/cls_tcindex.c +1 -0
@@ -359,6 +359,7 @@ tcindex_set_parms(struct net *net, strucif (tcindex_alloc_perfect_hash (net, cp) <0 ) goto errout; + cp->alloc_hash = cp->hash;for (i =0 ; i <min (cp->hash, p->hash); i++) cp->perfect[i].res = p->perfect[i].res; balloc =1 ;
Greg Kroah-Hartman
maintainerPATCH 31/155 net: stmmac: dwmac-rk: fix error path in rk_gmac_probe
In reply to Greg Kroah-HartmanFrom: Emil Renner Berthing <[email protected]>
[ Upstream commit 9de9aa487daff7a5c73434c24269b44ed6a428e6 ]
Make sure we clean up devicetree related configuration also when clock init fails.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +1 -1
@@ -1411,7 +1411,7 @@ static int rk_gmac_probe(struct platform ret =rk_gmac_clk_init (plat_dat);if (ret) -return ret; + goto err_remove_config_dt; ret =rk_gmac_powerup (plat_dat->bsp_priv);if (ret)
Greg Kroah-Hartman
maintainerPATCH 32/155 NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 0dcdf9f64028ec3b75db6b691560f8286f3898bf ]
The nci_conn_max_data_pkt_payload_size() function sometimes returns -EPROTO so "max_size" needs to be signed for the error handling to work. We can make "payload_size" an int as well.
--- drivers/nfc/fdp/fdp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/nfc/fdp/fdp.c +2 -3
@@ -184,7 +184,7 @@ static int fdp_nci_send_patch(struct nciconst struct firmware *fw;struct sk_buff *skb;unsigned long len; -u8 max_size, payload_size; +int max_size, payload_size;int rc =0 ; if ((type == NCI_PATCH_TYPE_OTP && !info->otp_patch) ||
@@ -207,8 +207,7 @@ static int fdp_nci_send_patch(struct nciwhile (len) { - payload_size = min_t(unsigned long, (unsigned long) max_size, - len); + payload_size = min_t(unsigned long, max_size, len); skb =nci_skb_alloc (ndev, (NCI_CTRL_HDR_SIZE + payload_size),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 33/155 r8169: re-enable MSI on RTL8168c
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit f13bc68131b0c0d67a77fb43444e109828a983bf ]
The original change fixed an issue on RTL8168b by mimicking the vendor driver behavior to disable MSI on chip versions before RTL8168d. This however now caused an issue on a system with RTL8168c, see [0]. Therefore leave MSI disabled on RTL8168b, but re-enable it on RTL8168c.
[0] https://bugzilla.redhat.com/show_bug.cgi?id=1792839
--- drivers/net/ethernet/realtek/r8169_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +1 -1
@@ -6812,7 +6812,7 @@ static int rtl_alloc_irq(struct rtl8169_RTL_W8 (tp, Config2,RTL_R8 (tp, Config2) & ~MSIEnable);rtl_lock_config_regs (tp);/* fall through */ - case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24: + case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_17: flags =PCI_IRQ_LEGACY ;break ;default :
Greg Kroah-Hartman
maintainerPATCH 34/155 slcan: not call free_netdev before rtnl_unlock in slcan_open
In reply to Greg Kroah-HartmanFrom: Oliver Hartkopp <[email protected]>
[ Upstream commit 2091a3d42b4f339eaeed11228e0cbe9d4f92f558 ]
As the description before netdev_run_todo, we cannot call free_netdev before rtnl_unlock, fix it by reorder the code.
This patch is a 1:1 copy of upstream slip.c commit f596c87005f7 ("slip: not call free_netdev before rtnl_unlock in slip_open").
--- drivers/net/can/slcan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/can/slcan.c +3 -0
@@ -625,7 +625,10 @@ err_free_chan: tty->disc_data =NULL ;clear_bit (SLF_INUSE , &sl->flags);slc_free_netdev (sl->dev); +/* do not call free_netdev before rtnl_unlock */ +rtnl_unlock ();free_netdev (sl->dev); +return err; err_exit:rtnl_unlock ();
Greg Kroah-Hartman
maintainerPATCH 35/155 tcp: also NULL skb->dev when copy was needed
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 07f8e4d0fddbf2f87e4cefb551278abc38db8cdd ]
In rare cases retransmit logic will make a full skb copy, which will not trigger the zeroing added in recent changeb738a185beaa ("tcp: ensure skb->dev is NULL before leaving TCP stack").
--- net/ipv4/tcp_output.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/ipv4/tcp_output.c +6 -2
@@ -2976,8 +2976,12 @@ int __tcp_retransmit_skb(struct sock *sktcp_skb_tsorted_save (skb) { nskb =__pskb_copy (skb,MAX_TCP_HEADER ,GFP_ATOMIC ); - err = nskb ?tcp_transmit_skb (sk, nskb,0 ,GFP_ATOMIC ) : - -ENOBUFS ; +if (nskb) { + nskb->dev =NULL ; + err =tcp_transmit_skb (sk, nskb,0 ,GFP_ATOMIC ); + }else { + err = -ENOBUFS ; + } }tcp_skb_tsorted_restore (skb);if (!err) {
Greg Kroah-Hartman
maintainerPATCH 36/155 tcp: ensure skb->dev is NULL before leaving TCP stack
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit b738a185beaab8728943acdb3e67371b8a88185e ]
skb->rbnode is sharing three skb fields : next, prev, dev
When a packet is sent, TCP keeps the original skb (master) in a rtx queue, which was converted to rbtree a while back.
__tcp_transmit_skb() is responsible to clone the master skb, and add the TCP header to the clone before sending it to network layer.
skb_clone() already clears skb->next and skb->prev, but copies the master oskb->dev into the clone.
We need to clear skb->dev, otherwise lower layers could interpret the value as a pointer to a netdev.
This old bug surfaced recently when commit 28f8bfd1ac94 ("netfilter: Support iif matches in POSTROUTING") was merged.
Before this netfilter commit, skb->dev value was ignored and changed before reaching dev_queue_xmit()
--- net/ipv4/tcp_output.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/tcp_output.c +4 -0
@@ -1048,6 +1048,10 @@ static int __tcp_transmit_skb(struct socif (unlikely (!skb))return -ENOBUFS ; +/* retransmit skbs might have a non zero value in skb->dev +* because skb->dev is aliased with skb->rbnode.rb_left +*/ + skb->dev =NULL ; } inet =inet_sk (sk);
Greg Kroah-Hartman
maintainerPATCH 37/155 tcp: repair: fix TCP_QUEUE_SEQ implementation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 6cd6cbf593bfa3ae6fc3ed34ac21da4d35045425 ]
When application uses TCP_QUEUE_SEQ socket option to change tp->rcv_next, we must also update tp->copied_seq.
Otherwise, stuff relying on tcp_inq() being precise can eventually be confused.
For example, tcp_zerocopy_receive() might crash because it does not expect tcp_recv_skb() to return NULL.
We could add tests in various places to fix the issue, or simply make sure tcp_inq() wont return a random value, and leave fast path as it is.
Note that this fixes ioctl(fd, SIOCINQ, &val) at the same time.
--- net/ipv4/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +3 -1
@@ -2943,8 +2943,10 @@ static int do_tcp_setsockopt(struct sock err = -EPERM ; else if (tp->repair_queue == TCP_SEND_QUEUE) WRITE_ONCE(tp->write_seq, val); - else if (tp->repair_queue == TCP_RECV_QUEUE) + else if (tp->repair_queue == TCP_RECV_QUEUE) {WRITE_ONCE (tp->rcv_nxt, val); +WRITE_ONCE (tp->copied_seq, val); + } else err = -EINVAL ;break ;
Greg Kroah-Hartman
maintainerPATCH 38/155 vxlan: check return value of gro_cells_init()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 384d91c267e621e0926062cfb3f20cb72dc16928 ]
gro_cells_init() returns error if memory allocation is failed. But the vxlan module doesn't check the return value of gro_cells_init().
--- drivers/net/vxlan.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/vxlan.c +9 -2
@@ -2779,10 +2779,19 @@ static void vxlan_vs_add_dev(struct vxla/* Setup stats when device is created */ static int vxlan_init (struct net_device *dev) { +struct vxlan_dev *vxlan =netdev_priv (dev); +int err; + dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);if (!dev->tstats)return -ENOMEM ; + err =gro_cells_init (&vxlan->gro_cells, dev); +if (err) { +free_percpu (dev->tstats); +return err; + } +return 0 ; }
@@ -3043,8 +3052,6 @@ static void vxlan_setup(struct net_devic vxlan->dev = dev; -gro_cells_init (&vxlan->gro_cells, dev); -for (h =0 ; h <FDB_HASH_SIZE ; ++h) {spin_lock_init (&vxlan->hash_lock[h]);INIT_HLIST_HEAD (&vxlan->fdb_head[h]);
Greg Kroah-Hartman
maintainerPATCH 39/155 bnxt_en: Fix Priority Bytes and Packets counters in ethtool -S.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit a24ec3220f369aa0b94c863b6b310685a727151c ]
There is an indexing bug in determining these ethtool priority counters. Instead of using the queue ID to index, we need to normalize by modulo 10 to get the index. This index is then used to obtain the proper CoS queue counter. Rename bp->pri2cos to bp->pri2cos_idx to make this more clear.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 8 ++++---- 3 files changed, 14 insertions(+), 6 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +9 -1
@@ -7387,14 +7387,22 @@ static int bnxt_hwrm_port_qstats_ext(str pri2cos = &resp2->pri0_cos_queue_id;for (i =0 ; i <8 ; i++) {u8 queue_id = pri2cos[i]; +u8 queue_idx; +/* Per port queue IDs start from 0, 10, 20, etc */ + queue_idx = queue_id %10 ; +if (queue_idx >BNXT_MAX_QUEUE ) { + bp->pri2cos_valid = false; + goto qstats_done; + }for (j =0 ; j < bp->max_q; j++) {if (bp->q_ids[j] == queue_id) - bp->pri2cos[i] = j; + bp->pri2cos_idx[i] = queue_idx; } } bp->pri2cos_valid =1 ; } +qstats_done:mutex_unlock (&bp->hwrm_cmd_lock);return rc; }
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -1
@@ -1688,7 +1688,7 @@ struct bnxt {u16 fw_rx_stats_ext_size;u16 fw_tx_stats_ext_size;u16 hw_ring_stats_size; -u8 pri2cos[8 ]; +u8 pri2cos_idx[8 ];u8 pri2cos_valid;u16 hwrm_max_req_len;
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +4 -4
@@ -589,25 +589,25 @@ skip_ring_stats:if (bp->pri2cos_valid) {for (i =0 ; i <8 ; i++, j++) {long n = bnxt_rx_bytes_pri_arr[i].base_off + - bp->pri2cos[i]; + bp->pri2cos_idx[i]; buf[j] =le64_to_cpu (*(rx_port_stats_ext + n)); }for (i =0 ; i <8 ; i++, j++) {long n = bnxt_rx_pkts_pri_arr[i].base_off + - bp->pri2cos[i]; + bp->pri2cos_idx[i]; buf[j] =le64_to_cpu (*(rx_port_stats_ext + n)); }for (i =0 ; i <8 ; i++, j++) {long n = bnxt_tx_bytes_pri_arr[i].base_off + - bp->pri2cos[i]; + bp->pri2cos_idx[i]; buf[j] =le64_to_cpu (*(tx_port_stats_ext + n)); }for (i =0 ; i <8 ; i++, j++) {long n = bnxt_tx_pkts_pri_arr[i].base_off + - bp->pri2cos[i]; + bp->pri2cos_idx[i]; buf[j] =le64_to_cpu (*(tx_port_stats_ext + n)); }
Greg Kroah-Hartman
maintainerPATCH 40/155 bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets()
In reply to Greg Kroah-HartmanFrom: Edwin Peer <[email protected]>
[ Upstream commit 62d4073e86e62e316bea2c53e77db10418fd5dd7 ]
The allocated ieee_ets structure goes out of scope without being freed, leaking memory. Appropriate result codes should be returned so that callers do not rely on invalid data passed by reference.
Also cache the ETS config retrieved from the device so that it doesn't need to be freed. The balance of the code was clearly written with the intent of having the results of querying the hardware cached in the device structure. The commensurate store was evidently missed though.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c +10 -5
@@ -479,24 +479,26 @@ static int bnxt_dcbnl_ieee_getets(struct {struct bnxt *bp =netdev_priv (dev);struct ieee_ets *my_ets = bp->ieee_ets; +int rc; ets->ets_cap = bp->max_tc;if (!my_ets) { -int rc; -if (bp->dcbx_cap &DCB_CAP_DCBX_HOST )return 0 ; my_ets =kzalloc (sizeof (*my_ets),GFP_KERNEL );if (!my_ets) -return 0 ; +return -ENOMEM ; rc =bnxt_hwrm_queue_cos2bw_qcfg (bp, my_ets);if (rc) -return 0 ; + goto error; rc =bnxt_hwrm_queue_pri2cos_qcfg (bp, my_ets);if (rc) -return 0 ; + goto error; + +/* cache result */ + bp->ieee_ets = my_ets; } ets->cbs = my_ets->cbs;
@@ -505,6 +507,9 @@ static int bnxt_dcbnl_ieee_getets(structmemcpy (ets->tc_tsa, my_ets->tc_tsa,sizeof (ets->tc_tsa));memcpy (ets->prio_tc, my_ets->prio_tc,sizeof (ets->prio_tc));return 0 ; +error: +kfree (my_ets); +return rc; }static int bnxt_dcbnl_ieee_setets (struct net_device *dev,struct ieee_ets *ets)
Greg Kroah-Hartman
maintainerPATCH 41/155 bnxt_en: Return error if bnxt_alloc_ctx_mem() fails.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 0b5b561cea32d5bb1e0a82d65b755a3cb5212141 ]
The current code ignores the return value from bnxt_hwrm_func_backing_store_cfg(), causing the driver to proceed in the init path even when this vital firmware call has failed. Fix it by propagating the error code to the caller.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -4
@@ -6863,12 +6863,12 @@ skip_rdma: } ena |=FUNC_BACKING_STORE_CFG_REQ_DFLT_ENABLES ; rc =bnxt_hwrm_func_backing_store_cfg (bp, ena); -if (rc) +if (rc) {netdev_err (bp->dev,"Failed configuring context mem, rc = %d.\n" , rc); -else - ctx->flags |=BNXT_CTX_FLAG_INITED ; - +return rc; + } + ctx->flags |=BNXT_CTX_FLAG_INITED ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/155 bnxt_en: Free context memory after disabling PCI in probe error path.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 62bfb932a51f6d08eb409248e69f8d6428c2cabd ]
Other shutdown code paths will always disable PCI first to shutdown DMA before freeing context memory. Do the same sequence in the error path of probe to be safe and consistent.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -3
@@ -11895,12 +11895,12 @@ init_err_cleanup: init_err_pci_clean:bnxt_free_hwrm_short_cmd_req (bp);bnxt_free_hwrm_resources (bp); -bnxt_free_ctx_mem (bp); -kfree (bp->ctx); - bp->ctx =NULL ;kfree (bp->fw_health); bp->fw_health =NULL ;bnxt_cleanup_pci (bp); +bnxt_free_ctx_mem (bp); +kfree (bp->ctx); + bp->ctx =NULL ; init_err_free:free_netdev (dev);
Greg Kroah-Hartman
maintainerPATCH 43/155 bnxt_en: Reset rings if ring reservation fails during open()
In reply to Greg Kroah-HartmanFrom: Vasundhara Volam <[email protected]>
[ Upstream commit 5d765a5e4bd7c368e564e11402bba74cf7f03ac1 ]
If ring counts are not reset when ring reservation fails, bnxt_init_dflt_ring_mode() will not be called again to reinitialise IRQs when open() is called and results in system crash as napi will also be not initialised. This patch fixes it by resetting the ring counts.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -0
@@ -11603,6 +11603,10 @@ static int bnxt_set_dflt_rings(struct bn bp->rx_nr_rings++; bp->cp_nr_rings++; } +if (rc) { + bp->tx_nr_rings =0 ; + bp->rx_nr_rings =0 ; + }return rc; }
Greg Kroah-Hartman
maintainerPATCH 44/155 net: ip_gre: Separate ERSPAN newlink / changelink callbacks
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit e1f8f78ffe9854308b9e12a73ebe4e909074fc33 ]
ERSPAN shares most of the code path with GRE and gretap code. While that helps keep the code compact, it is also error prone. Currently a broken userspace can turn a gretap tunnel into a de facto ERSPAN one by passing IFLA_GRE_ERSPAN_VER. There has been a similar issue in ip6gretap in the past.
To prevent these problems in future, split the newlink and changelink code paths. Split the ERSPAN code out of ipgre_netlink_parms() into a new function erspan_netlink_parms(). Extract a piece of common logic from ipgre_newlink() and ipgre_changelink() into ipgre_newlink_encap_setup(). Add erspan_newlink() and erspan_changelink().
--- net/ipv4/ip_gre.c | 103 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 85 insertions(+), 18 deletions(-)
net/ipv4/ip_gre.c +85 -18
@@ -1149,6 +1149,22 @@ static int ipgre_netlink_parms(struct neif (data[IFLA_GRE_FWMARK ]) *fwmark =nla_get_u32 (data[IFLA_GRE_FWMARK ]); +return 0 ; +} + +static int erspan_netlink_parms (struct net_device *dev, +struct nlattr *data[], +struct nlattr *tb[], +struct ip_tunnel_parm *parms, +__u32 *fwmark) +{ +struct ip_tunnel *t =netdev_priv (dev); +int err; + + err =ipgre_netlink_parms (dev, data, tb, parms, fwmark); +if (err) +return err; +if (data[IFLA_GRE_ERSPAN_VER ]) { t->erspan_ver =nla_get_u8 (data[IFLA_GRE_ERSPAN_VER ]);
@@ -1272,45 +1288,70 @@ static void ipgre_tap_setup(struct net_dip_tunnel_setup (dev, gre_tap_net_id); } -static int ipgre_newlink (struct net *src_net,struct net_device *dev, -struct nlattr *tb[],struct nlattr *data[], -struct netlink_ext_ack *extack) +static int +ipgre_newlink_encap_setup (struct net_device *dev,struct nlattr *data[]) { -struct ip_tunnel_parm p;struct ip_tunnel_encap ipencap; -__u32 fwmark =0 ; -int err;if (ipgre_netlink_encap_parms (data, &ipencap)) {struct ip_tunnel *t =netdev_priv (dev); - err =ip_tunnel_encap_setup (t, &ipencap); +int err =ip_tunnel_encap_setup (t, &ipencap);if (err <0 )return err; } +return 0 ; +} + +static int ipgre_newlink (struct net *src_net,struct net_device *dev, +struct nlattr *tb[],struct nlattr *data[], +struct netlink_ext_ack *extack) +{ +struct ip_tunnel_parm p; +__u32 fwmark =0 ; +int err; + + err =ipgre_newlink_encap_setup (dev, data); +if (err) +return err; + err =ipgre_netlink_parms (dev, data, tb, &p, &fwmark);if (err <0 )return err;return ip_tunnel_newlink (dev, tb, &p, fwmark); } +static int erspan_newlink (struct net *src_net,struct net_device *dev, +struct nlattr *tb[],struct nlattr *data[], +struct netlink_ext_ack *extack) +{ +struct ip_tunnel_parm p; +__u32 fwmark =0 ; +int err; + + err =ipgre_newlink_encap_setup (dev, data); +if (err) +return err; + + err =erspan_netlink_parms (dev, data, tb, &p, &fwmark); +if (err) +return err; +return ip_tunnel_newlink (dev, tb, &p, fwmark); +} +static int ipgre_changelink (struct net_device *dev,struct nlattr *tb[],struct nlattr *data[],struct netlink_ext_ack *extack) {struct ip_tunnel *t =netdev_priv (dev); -struct ip_tunnel_encap ipencap;__u32 fwmark = t->fwmark;struct ip_tunnel_parm p;int err; -if (ipgre_netlink_encap_parms (data, &ipencap)) { - err =ip_tunnel_encap_setup (t, &ipencap); - -if (err <0 ) -return err; - } + err =ipgre_newlink_encap_setup (dev, data); +if (err) +return err; err =ipgre_netlink_parms (dev, data, tb, &p, &fwmark);if (err <0 )
@@ -1323,8 +1364,34 @@ static int ipgre_changelink(struct net_d t->parms.i_flags = p.i_flags; t->parms.o_flags = p.o_flags; -if (strcmp (dev->rtnl_link_ops->kind,"erspan" )) -ipgre_link_update (dev, !tb[IFLA_MTU ]); +ipgre_link_update (dev, !tb[IFLA_MTU ]); + +return 0 ; +} + +static int erspan_changelink (struct net_device *dev,struct nlattr *tb[], +struct nlattr *data[], +struct netlink_ext_ack *extack) +{ +struct ip_tunnel *t =netdev_priv (dev); +__u32 fwmark = t->fwmark; +struct ip_tunnel_parm p; +int err; + + err =ipgre_newlink_encap_setup (dev, data); +if (err) +return err; + + err =erspan_netlink_parms (dev, data, tb, &p, &fwmark); +if (err <0 ) +return err; + + err =ip_tunnel_changelink (dev, tb, &p, fwmark); +if (err <0 ) +return err; + + t->parms.i_flags = p.i_flags; + t->parms.o_flags = p.o_flags;return 0 ; }
@@ -1515,8 +1582,8 @@ static struct rtnl_link_ops erspan_link_ .priv_size = sizeof(struct ip_tunnel), .setup = erspan_setup, .validate = erspan_validate, - .newlink = ipgre_newlink, - .changelink = ipgre_changelink, + .newlink = erspan_newlink, + .changelink = erspan_changelink, .dellink = ip_tunnel_dellink, .get_size = ipgre_get_size, .fill_info = ipgre_fill_info,
Greg Kroah-Hartman
maintainerPATCH 45/155 net: ip_gre: Accept IFLA_INFO_DATA-less configuration
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit 32ca98feab8c9076c89c0697c5a85e46fece809d ]
The fix referenced below causes a crash when an ERSPAN tunnel is created without passing IFLA_INFO_DATA. Fix by validating passed-in data in the same way as ipgre does.
--- net/ipv4/ip_gre.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/ip_gre.c +2 -0
@@ -1164,6 +1164,8 @@ static int erspan_netlink_parms(struct n err =ipgre_netlink_parms (dev, data, tb, parms, fwmark);if (err)return err; +if (!data) +return 0 ;if (data[IFLA_GRE_ERSPAN_VER ]) { t->erspan_ver =nla_get_u8 (data[IFLA_GRE_ERSPAN_VER ]);
Greg Kroah-Hartman
maintainerPATCH 46/155 hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 173756b86803655d70af7732079b3aa935e6ab68 ]
hsr_get_node_{list/status}() are not under rtnl_lock() because they are callback functions of generic netlink.
But they use __dev_get_by_index() without rtnl_lock(). So, it would use unsafe data.
In order to fix it, rcu_read_lock() and dev_get_by_index_rcu() are used instead of __dev_get_by_index().
--- net/hsr/hsr_framereg.c | 9 ++------- net/hsr/hsr_netlink.c | 39 +++++++++++++++++++++------------------ 2 files changed, 23 insertions(+), 25 deletions(-)
net/hsr/hsr_framereg.c +2 -7
@@ -482,12 +482,9 @@ int hsr_get_node_data(struct hsr_priv *hstruct hsr_port *port;unsigned long tdiff; -rcu_read_lock (); node =find_node_by_addr_A (&hsr->node_db, addr); -if (!node) { -rcu_read_unlock (); -return -ENOENT ;/* No such entry */ - } +if (!node) +return -ENOENT ;ether_addr_copy (addr_b, node->macaddress_B);
@@ -522,7 +519,5 @@ int hsr_get_node_data(struct hsr_priv *h *addr_b_ifindex =-1 ; } -rcu_read_unlock (); -return 0 ; }
net/hsr/hsr_netlink.c +21 -18
@@ -251,15 +251,16 @@ static int hsr_get_node_status(struct skif (!na) goto invalid; - hsr_dev =__dev_get_by_index (genl_info_net (info), -nla_get_u32 (info->attrs[HSR_A_IFINDEX ])); +rcu_read_lock (); + hsr_dev =dev_get_by_index_rcu (genl_info_net (info), +nla_get_u32 (info->attrs[HSR_A_IFINDEX ]));if (!hsr_dev) - goto invalid; + goto rcu_unlock;if (!is_hsr_master (hsr_dev)) - goto invalid; + goto rcu_unlock;/* Send reply */ - skb_out =genlmsg_new (NLMSG_GOODSIZE ,GFP_KERNEL ); + skb_out =genlmsg_new (NLMSG_GOODSIZE ,GFP_ATOMIC );if (!skb_out) { res = -ENOMEM ; goto fail;
@@ -313,12 +314,10 @@ static int hsr_get_node_status(struct sk res =nla_put_u16 (skb_out,HSR_A_IF1_SEQ , hsr_node_if1_seq);if (res <0 ) goto nla_put_failure; -rcu_read_lock (); port =hsr_port_get_hsr (hsr,HSR_PT_SLAVE_A );if (port) res =nla_put_u32 (skb_out,HSR_A_IF1_IFINDEX , port->dev->ifindex); -rcu_read_unlock ();if (res <0 ) goto nla_put_failure;
@@ -328,20 +327,22 @@ static int hsr_get_node_status(struct sk res =nla_put_u16 (skb_out,HSR_A_IF2_SEQ , hsr_node_if2_seq);if (res <0 ) goto nla_put_failure; -rcu_read_lock (); port =hsr_port_get_hsr (hsr,HSR_PT_SLAVE_B );if (port) res =nla_put_u32 (skb_out,HSR_A_IF2_IFINDEX , port->dev->ifindex); -rcu_read_unlock ();if (res <0 ) goto nla_put_failure; +rcu_read_unlock (); +genlmsg_end (skb_out, msg_head);genlmsg_unicast (genl_info_net (info), skb_out, info->snd_portid);return 0 ; +rcu_unlock: +rcu_read_unlock (); invalid:netlink_ack (skb_in,nlmsg_hdr (skb_in), -EINVAL ,NULL );return 0 ;
@@ -351,6 +352,7 @@ nla_put_failure:/* Fall through */ fail: +rcu_read_unlock ();return res; }
@@ -377,15 +379,16 @@ static int hsr_get_node_list(struct sk_bif (!na) goto invalid; - hsr_dev =__dev_get_by_index (genl_info_net (info), -nla_get_u32 (info->attrs[HSR_A_IFINDEX ])); +rcu_read_lock (); + hsr_dev =dev_get_by_index_rcu (genl_info_net (info), +nla_get_u32 (info->attrs[HSR_A_IFINDEX ]));if (!hsr_dev) - goto invalid; + goto rcu_unlock;if (!is_hsr_master (hsr_dev)) - goto invalid; + goto rcu_unlock;/* Send reply */ - skb_out =genlmsg_new (NLMSG_GOODSIZE ,GFP_KERNEL ); + skb_out =genlmsg_new (NLMSG_GOODSIZE ,GFP_ATOMIC );if (!skb_out) { res = -ENOMEM ; goto fail;
@@ -405,14 +408,11 @@ static int hsr_get_node_list(struct sk_b hsr =netdev_priv (hsr_dev); -rcu_read_lock (); pos =hsr_get_next_node (hsr,NULL , addr);while (pos) { res =nla_put (skb_out,HSR_A_NODE_ADDR ,ETH_ALEN , addr); -if (res <0 ) { -rcu_read_unlock (); +if (res <0 ) goto nla_put_failure; - } pos =hsr_get_next_node (hsr, pos, addr); }rcu_read_unlock ();
@@ -422,6 +422,8 @@ static int hsr_get_node_list(struct sk_breturn 0 ; +rcu_unlock: +rcu_read_unlock (); invalid:netlink_ack (skb_in,nlmsg_hdr (skb_in), -EINVAL ,NULL );return 0 ;
@@ -431,6 +433,7 @@ nla_put_failure:/* Fall through */ fail: +rcu_read_unlock ();return res; }
Greg Kroah-Hartman
maintainerPATCH 47/155 hsr: add restart routine into hsr_get_node_list()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit ca19c70f5225771c05bcdcb832b4eb84d7271c5e ]
The hsr_get_node_list() is to send node addresses to the userspace. If there are so many nodes, it could fail because of buffer size. In order to avoid this failure, the restart routine is added.
--- net/hsr/hsr_netlink.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-)
net/hsr/hsr_netlink.c +24 -14
@@ -360,16 +360,14 @@ fail:*/ static int hsr_get_node_list (struct sk_buff *skb_in,struct genl_info *info) { -/* For receiving */ -struct nlattr *na; +unsigned char addr[ETH_ALEN ];struct net_device *hsr_dev; - -/* For sending */ struct sk_buff *skb_out; -void *msg_head;struct hsr_priv *hsr; -void *pos; -unsigned char addr[ETH_ALEN ]; +bool restart = false; +struct nlattr *na; +void *pos =NULL ; +void *msg_head;int res;if (!info)
@@ -387,8 +385,9 @@ static int hsr_get_node_list(struct sk_bif (!is_hsr_master (hsr_dev)) goto rcu_unlock; +restart:/* Send reply */ - skb_out =genlmsg_new (NLMSG_GOODSIZE ,GFP_ATOMIC ); + skb_out =genlmsg_new (GENLMSG_DEFAULT_SIZE ,GFP_ATOMIC );if (!skb_out) { res = -ENOMEM ; goto fail;
@@ -402,17 +401,28 @@ static int hsr_get_node_list(struct sk_b goto nla_put_failure; } - res =nla_put_u32 (skb_out,HSR_A_IFINDEX , hsr_dev->ifindex); -if (res <0 ) - goto nla_put_failure; +if (!restart) { + res =nla_put_u32 (skb_out,HSR_A_IFINDEX , hsr_dev->ifindex); +if (res <0 ) + goto nla_put_failure; + } hsr =netdev_priv (hsr_dev); - pos =hsr_get_next_node (hsr,NULL , addr); +if (!pos) + pos =hsr_get_next_node (hsr,NULL , addr);while (pos) { res =nla_put (skb_out,HSR_A_NODE_ADDR ,ETH_ALEN , addr); -if (res <0 ) +if (res <0 ) { +if (res == -EMSGSIZE ) { +genlmsg_end (skb_out, msg_head); +genlmsg_unicast (genl_info_net (info), skb_out, + info->snd_portid); + restart = true; + goto restart; + } goto nla_put_failure; + } pos =hsr_get_next_node (hsr, pos, addr); }rcu_read_unlock ();
@@ -429,7 +439,7 @@ invalid:return 0 ; nla_put_failure: -kfree_skb (skb_out); +nlmsg_free (skb_out);/* Fall through */ fail:
Greg Kroah-Hartman
maintainerPATCH 48/155 hsr: set .netnsok flag
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 09e91dbea0aa32be02d8877bd50490813de56b9a ]
The hsr module has been supporting the list and status command. (HSR_C_GET_NODE_LIST and HSR_C_GET_NODE_STATUS)
These commands send node information to the user-space via generic netlink. But, in the non-init_net namespace, these commands are not allowed because .netnsok flag is false.
So, there is no way to get node information in the non-init_net namespace.
--- net/hsr/hsr_netlink.c | 1 + 1 file changed, 1 insertion(+)
net/hsr/hsr_netlink.c +1 -0
@@ -470,6 +470,7 @@ static struct genl_family hsr_genl_famil .version = 1, .maxattr = HSR_A_MAX, .policy = hsr_genl_policy, + .netnsok = true, .module = THIS_MODULE, .ops = hsr_ops, .n_ops = ARRAY_SIZE(hsr_ops),
Greg Kroah-Hartman
maintainerPATCH 49/155 net/mlx5: DR, Fix postsend actions write length
In reply to Greg Kroah-HartmanFrom: Hamdan Igbaria <[email protected]>
[ Upstream commit 692b0399a22530b2de8490bea75a7d20d59391d0 ]
Fix the send info write length to be (actions x action) size in bytes.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +0 -1
@@ -930,7 +930,6 @@ static int dr_actions_l2_rewrite(struct action->rewrite.data = (void *)ops; action->rewrite.num_of_actions = i; - action->rewrite.chunk->byte_size = i *sizeof (*ops); ret =mlx5dr_send_postsend_action (dmn, action);if (ret) {
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c +2 -1
@@ -558,7 +558,8 @@ int mlx5dr_send_postsend_action(struct mint ret; send_info.write.addr = (uintptr_t )action->rewrite.data; - send_info.write.length = action->rewrite.chunk->byte_size; + send_info.write.length = action->rewrite.num_of_actions * +DR_MODIFY_ACTION_SIZE ; send_info.write.lkey =0 ; send_info.remote_addr = action->rewrite.chunk->mr_addr; send_info.rkey = action->rewrite.chunk->rkey;
Greg Kroah-Hartman
maintainerPATCH 50/155 net/mlx5e: Enhance ICOSQ WQE info fields
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 1de0306c3a05d305e45b1f1fabe2f4e94222eb6b ]
Add number of WQEBBs (WQE's Basic Block) to WQE info struct. Set the number of WQEBBs on WQE post, and increment the consumer counter (cc) on completion.
In case of error completions, the cc was mistakenly not incremented, keeping a gap between cc and pc (producer counter). This failed the recovery flow on the ICOSQ from a CQE error which timed-out waiting for the cc and pc to meet.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 +++++------ drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 1 + 3 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -371,6 +371,7 @@ enum {struct mlx5e_sq_wqe_info {u8 opcode; +u8 num_wqebbs;/* Auxiliary data for different opcodes. */ union {
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 -6
@@ -477,6 +477,7 @@ static inline void mlx5e_fill_icosq_frag/* fill sq frag edge with nops to avoid wqe wrapping two pages */ for (; wi < edge_wi; wi++) { wi->opcode =MLX5_OPCODE_NOP ; + wi->num_wqebbs =1 ;mlx5e_post_nop (wq, sq->sqn, &sq->pc); } }
@@ -525,6 +526,7 @@ static int mlx5e_alloc_rx_mpwqe(struct m umr_wqe->uctrl.xlt_offset =cpu_to_be16 (xlt_offset); sq->db.ico_wqe[pi].opcode =MLX5_OPCODE_UMR ; + sq->db.ico_wqe[pi].num_wqebbs =MLX5E_UMR_WQEBBS ; sq->db.ico_wqe[pi].umr.rq = rq; sq->pc +=MLX5E_UMR_WQEBBS ;
@@ -628,17 +630,14 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq * ci =mlx5_wq_cyc_ctr2ix (&sq->wq, sqcc); wi = &sq->db.ico_wqe[ci]; + sqcc += wi->num_wqebbs; -if (likely (wi->opcode ==MLX5_OPCODE_UMR )) { - sqcc +=MLX5E_UMR_WQEBBS ; +if (likely (wi->opcode ==MLX5_OPCODE_UMR )) wi->umr.rq->mpwqe.umr_completed++; - }else if (likely (wi->opcode ==MLX5_OPCODE_NOP )) { - sqcc++; - }else { +else if (unlikely (wi->opcode !=MLX5_OPCODE_NOP ))netdev_WARN_ONCE (cq->channel->netdev,"Bad OPCODE in ICOSQ WQE info: 0x%x\n" , wi->opcode); - } }while (!last_wqe);
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c +1 -0
@@ -78,6 +78,7 @@ void mlx5e_trigger_irq(struct mlx5e_icosu16 pi =mlx5_wq_cyc_ctr2ix (wq, sq->pc); sq->db.ico_wqe[pi].opcode =MLX5_OPCODE_NOP ; + sq->db.ico_wqe[pi].num_wqebbs =1 ; nopwqe =mlx5e_post_nop (wq, sq->sqn, &sq->pc);mlx5e_notify_hw (wq, sq->pc, sq->uar_map, &nopwqe->ctrl); }
Greg Kroah-Hartman
maintainerPATCH 51/155 net/mlx5e: Fix missing reset of SW metadata in Striding RQ reset
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 39369fd536d485a99a59d8e357c0d4d3ce19a3b8 ]
When resetting the RQ (moving RQ state from RST to RDY), the driver resets the WQ's SW metadata.
In striding RQ mode, we maintain a field that reflects the actual expected WQ head (including in progress WQEs posted to the ICOSQ). It was mistakenly not reset together with the WQ. Fix this here.
--- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +4 -2
@@ -181,10 +181,12 @@ mlx5e_tx_dma_unmap(struct device *pdev,static inline void mlx5e_rqwq_reset (struct mlx5e_rq *rq) { -if (rq->wq_type ==MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ ) +if (rq->wq_type ==MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ ) {mlx5_wq_ll_reset (&rq->mpwqe.wq); -else + rq->mpwqe.actual_wq_head =0 ; + }else {mlx5_wq_cyc_reset (&rq->wqe.wq); + } }/* SW parser related functions */
Greg Kroah-Hartman
maintainerPATCH 52/155 net/mlx5e: Fix ICOSQ recovery flow with Striding RQ
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit e239c6d686e1c37fb2ab143162dfb57471a8643f ]
In striding RQ mode, the buffers of an RX WQE are first prepared and posted to the HW using a UMR WQEs via the ICOSQ. We maintain the state of these in-progress WQEs in the RQ SW struct.
In the flow of ICOSQ recovery, the corresponding RQ is not in error state, hence:
- The buffers of the in-progress WQEs must be released and the RQ metadata should reflect it.
- Existing RX WQEs in the RQ should not be affected.
For this, wrap the dealloc of the in-progress WQEs in a function, and use it in the ICOSQ recovery flow instead of mlx5e_free_rx_descs().
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c | 2 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 31 +++++++++++---- 3 files changed, 26 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -1059,6 +1059,7 @@ int mlx5e_modify_rq_state(struct mlx5e_rvoid mlx5e_activate_rq (struct mlx5e_rq *rq);void mlx5e_deactivate_rq (struct mlx5e_rq *rq);void mlx5e_free_rx_descs (struct mlx5e_rq *rq); +void mlx5e_free_rx_in_progress_descs (struct mlx5e_rq *rq);void mlx5e_activate_icosq (struct mlx5e_icosq *icosq);void mlx5e_deactivate_icosq (struct mlx5e_icosq *icosq);
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +1 -1
@@ -90,7 +90,7 @@ static int mlx5e_rx_reporter_err_icosq_c goto out;mlx5e_reset_icosq_cc_pc (icosq); -mlx5e_free_rx_descs (rq); +mlx5e_free_rx_in_progress_descs (rq);clear_bit (MLX5E_SQ_STATE_RECOVERING , &icosq->state);mlx5e_activate_icosq (icosq);mlx5e_activate_rq (rq);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +24 -7
@@ -824,6 +824,29 @@ int mlx5e_wait_for_min_rx_wqes(struct mlreturn -ETIMEDOUT ; } +void mlx5e_free_rx_in_progress_descs (struct mlx5e_rq *rq) +{ +struct mlx5_wq_ll *wq; +u16 head; +int i; + +if (rq->wq_type !=MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ ) +return ; + + wq = &rq->mpwqe.wq; + head = wq->head; + +/* Outstanding UMR WQEs (in progress) start at wq->head */ +for (i =0 ; i < rq->mpwqe.umr_in_progress; i++) { + rq->dealloc_wqe (rq, head); + head =mlx5_wq_ll_get_wqe_next_ix (wq, head); + } + + rq->mpwqe.actual_wq_head = wq->head; + rq->mpwqe.umr_in_progress =0 ; + rq->mpwqe.umr_completed =0 ; +} +void mlx5e_free_rx_descs (struct mlx5e_rq *rq) {__be16 wqe_ix_be;
@@ -831,14 +854,8 @@ void mlx5e_free_rx_descs(struct mlx5e_rqif (rq->wq_type ==MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ ) {struct mlx5_wq_ll *wq = &rq->mpwqe.wq; -u16 head = wq->head; -int i; -/* Outstanding UMR WQEs (in progress) start at wq->head */ -for (i =0 ; i < rq->mpwqe.umr_in_progress; i++) { - rq->dealloc_wqe (rq, head); - head =mlx5_wq_ll_get_wqe_next_ix (wq, head); - } +mlx5e_free_rx_in_progress_descs (rq);while (!mlx5_wq_ll_is_empty (wq)) {struct mlx5e_rx_wqe_ll *wqe;
Greg Kroah-Hartman
maintainerPATCH 53/155 net/mlx5e: Do not recover from a non-fatal syndrome
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit 187a9830c921d92c4a9a8e2921ecc4b35a97532c ]
For non-fatal syndromes like LOCAL_LENGTH_ERR, recovery shouldn't be triggered. In these scenarios, the RQ is not actually in ERR state. This misleads the recovery flow which assumes that the RQ is really in error state and no more completions arrive, causing crashes on bad page state.
--- drivers/net/ethernet/mellanox/mlx5/core/en/health.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/health.h +1 -2
@@ -10,8 +10,7 @@static inline bool cqe_syndrome_needs_recover (u8 syndrome) { -return syndrome ==MLX5_CQE_SYNDROME_LOCAL_LENGTH_ERR || - syndrome ==MLX5_CQE_SYNDROME_LOCAL_QP_OP_ERR || +return syndrome ==MLX5_CQE_SYNDROME_LOCAL_QP_OP_ERR || syndrome ==MLX5_CQE_SYNDROME_LOCAL_PROT_ERR || syndrome ==MLX5_CQE_SYNDROME_WR_FLUSH_ERR ; }
Greg Kroah-Hartman
maintainerPATCH 54/155 cgroup-v1: cgroup_pidlist_next should update position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit db8dd9697238be70a6b4f9d0284cd89f59c0e070 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
# mount | grep cgroup # dd if=/mnt/cgroup.procs bs=1 # normal output ... 1294 1295 1296 1304 1382 584+0 records in 584+0 records out 584 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset 83 <<< generates end of last line
1383 <<< ... and whole last line once again 0+1 records in
0+1 records out
8 bytes copied
dd: /mnt/cgroup.procs: cannot skip to specified offset 1386 <<< generates last line anyway
0+1 records in
0+1 records out
5 bytes copied
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- kernel/cgroup/cgroup-v1.c | 1 + 1 file changed, 1 insertion(+)
kernel/cgroup/cgroup-v1.c +1 -0
@@ -473,6 +473,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)*/ p++;if (p >= end) { + (*pos)++;return NULL ; }else { *pos = *p;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/155 nfs: add minor version to nfs_server_key for fscache
In reply to Greg Kroah-HartmanFrom: Scott Mayhew <[email protected]>
[ Upstream commit 55dee1bc0d72877b99805e42e0205087e98b9edd ]
An NFS client that mounts multiple exports from the same NFS server with higher NFSv4 versions disabled (i.e. 4.2) and without forcing a specific NFS version results in fscache index cookie collisions and the following messages:
[ 570.004348] FS-Cache: Duplicate cookie detected
Each nfs_client structure should have its own fscache index cookie, so add the minorversion to nfs_server_key.
--- fs/nfs/client.c | 1 + fs/nfs/fscache.c | 2 ++ fs/nfs/nfs4client.c | 1 - 3 files changed, 3 insertions(+), 1 deletion(-)
fs/nfs/client.c +1 -0
@@ -153,6 +153,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)if ((clp =kzalloc (sizeof (*clp),GFP_KERNEL )) ==NULL ) goto error_0; + clp->cl_minorversion = cl_init->minorversion; clp->cl_nfs_mod = cl_init->nfs_mod;if (!try_module_get (clp->cl_nfs_mod->owner)) goto error_dealloc;
fs/nfs/fscache.c +2 -0
@@ -31,6 +31,7 @@ static DEFINE_SPINLOCK(nfs_fscache_keys_lock);struct nfs_server_key {struct {uint16_t nfsversion;/* NFS protocol version */ +uint32_t minorversion;/* NFSv4 minor version */ uint16_t family;/* address family */ __be16 port;/* IP port */ } hdr;
@@ -55,6 +56,7 @@ void nfs_fscache_get_client_cookie(struct nfs_client *clp)memset (&key,0 ,sizeof (key)); key.hdr.nfsversion = clp->rpc_ops->version; + key.hdr.minorversion = clp->cl_minorversion; key.hdr.family = clp->cl_addr.ss_family;switch (clp->cl_addr.ss_family) {
fs/nfs/nfs4client.c +0 -1
@@ -216,7 +216,6 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)INIT_LIST_HEAD (&clp->cl_ds_clients);rpc_init_wait_queue (&clp->cl_rpcwaitq,"NFS client" ); clp->cl_state =1 <<NFS4CLNT_LEASE_EXPIRED ; - clp->cl_minorversion = cl_init->minorversion; clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; clp->cl_mig_gen =1 ;#if IS_ENABLED (CONFIG_NFS_V4_1 )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/155 cpupower: avoid multiple definition with gcc -fno-common
In reply to Greg Kroah-HartmanFrom: Mike Gilbert <[email protected]>
[ Upstream commit 2de7fb60a4740135e03cf55c1982e393ccb87b6b ]
Building cpupower with -fno-common in CFLAGS results in errors due to multiple definitions of the 'cpu_count' and 'start_time' variables.
./utils/idle_monitor/snb_idle.o:./utils/idle_monitor/cpupower-monitor.h:28:
multiple definition of `cpu_count'; ./utils/idle_monitor/nhm_idle.o:./utils/idle_monitor/cpupower-monitor.h:28:
first defined here
...
./utils/idle_monitor/cpuidle_sysfs.o:./utils/idle_monitor/cpuidle_sysfs.c:22:
multiple definition of `start_time'; ./utils/idle_monitor/amd_fam14h_idle.o:./utils/idle_monitor/amd_fam14h_idle.c:85:
first defined here
The -fno-common option will be enabled by default in GCC 10.
--- tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c | 2 +- tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c | 2 +- tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c | 2 ++ tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-)
tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c +1 -1
@@ -82,7 +82,7 @@ static struct pci_access *pci_acc;static struct pci_dev *amd_fam14h_pci_dev;static int nbp1_entered; -struct timespec start_time; +static struct timespec start_time;static unsigned long long timediff;#ifdef DEBUG
tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c +1 -1
@@ -19,7 +19,7 @@ struct cpuidle_monitor cpuidle_sysfs_monitor;static unsigned long long **previous_count;static unsigned long long **current_count; -struct timespec start_time; +static struct timespec start_time;static unsigned long long timediff; static int cpuidle_get_count_percent(unsigned int id, double *percent,
tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c +2 -0
@@ -27,6 +27,8 @@ struct cpuidle_monitor *all_monitors[] = { 0 }; +int cpu_count; +static struct cpuidle_monitor *monitors[MONITORS_MAX ];static unsigned int avail_monitors;
tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h +1 -1
@@ -25,7 +25,7 @@#endif #define CSTATE_DESC_LEN 60 -int cpu_count; +extern int cpu_count;/* Hard to define the right names ...: */ enum power_range_e {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/155 drivers/of/of_mdio.c:fix of_mdiobus_register()
In reply to Greg Kroah-HartmanFrom: Dajun Jin <[email protected]>
[ Upstream commit 209c65b61d94344522c41a83cd6ce51aac5fd0a4 ]
When registers a phy_device successful, should terminate the loop or the phy_device would be registered in other addr. If there are multiple PHYs without reg properties, it will go wrong.
--- drivers/of/of_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/of_mdio.c +1 -0
@@ -268,6 +268,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) rc =of_mdiobus_register_phy (mdio, child, addr);if (rc && rc != -ENODEV ) goto unregister; +break ; } } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/155 cgroup1: dont call release_agent when it is ""
In reply to Greg Kroah-HartmanFrom: Tycho Andersen <[email protected]>
[ Upstream commit 2e5383d7904e60529136727e49629a82058a5607 ]
Older (and maybe current) versions of systemd set release_agent to "" when shutting down, but do not set notify_on_release to 0.
Since 64e90a8acb85 ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()"), we filter out such calls when the user mode helper path is "". However, when used in conjunction with an actual (i.e. non "") STATIC_USERMODEHELPER, the path is never "", so the real usermode helper will be called with argv[0] == "".
Let's avoid this by not invoking the release_agent when it is "".
--- kernel/cgroup/cgroup-v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/cgroup/cgroup-v1.c +1 -1
@@ -784,7 +784,7 @@ void cgroup1_release_agent(struct work_struct *work) pathbuf =kmalloc (PATH_MAX ,GFP_KERNEL ); agentbuf =kstrdup (cgrp->root->release_agent_path,GFP_KERNEL ); -if (!pathbuf || !agentbuf) +if (!pathbuf || !agentbuf || !strlen (agentbuf)) goto out;spin_lock_irq (&css_set_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/155 dt-bindings: net: FMan erratum A050385
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 26d5bb9e4c4b541c475751e015072eb2cbf70d15 ]
FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak; thus stopping further packet processing.
The FMAN internal queue can overflow when FMAN splits single read or write transactions into multiple smaller transactions such that more than 17 AXI transactions are in flight from FMAN to interconnect. When the FMAN internal queue overflows, it can stall further packet processing. The issue can occur with any one of the following three conditions:
1. FMAN AXI transaction crosses 4K address boundary (Errata
A010022)
2. FMAN DMA address for an AXI transaction is not 16 byte aligned, i.e. the last 4 bits of an address are non-zero
3. Scatter Gather (SG) frames have more than one SG buffer in the SG list and any one of the buffers, except the last buffer in the SG list has data size that is not a multiple of 16 bytes, i.e., other than 16, 32, 48, 64, etc.
With any one of the above three conditions present, there is likelihood of stalled FMAN packet processing, especially under stress with multiple ports injecting line-rate traffic.
To avoid situations that stall FMAN packet processing, all of the above three conditions must be avoided; therefore, configure the system with the following rules:
1. Frame buffers must not span a 4KB address boundary, unless the frame start address is 256 byte aligned
2. All FMAN DMA start addresses (for example, BMAN buffer address, FD[address] + FD[offset]) are 16B aligned
3. SG table and buffer addresses are 16B aligned and the size of SG buffers are multiple of 16 bytes, except for the last SG buffer that can be of any size.
Additional workaround notes:
- Address alignment of 64 bytes is recommended for maximally efficient system bus transactions (although 16 byte alignment is sufficient to avoid the stall condition)
- To support frame sizes that are larger than 4K bytes, there are two options:
1. Large single buffer frames that span a 4KB page boundary can be converted into SG frames to avoid transaction splits at the 4KB boundary,
2. Align the large single buffer to 256B address boundaries, ensure that the frame address plus offset is 256B aligned.
- If software generated SG frames have buffers that are unaligned and with random non-multiple of 16 byte lengths, before transmitting such frames via FMAN, frames will need to be copied into a new single buffer or multiple buffer SG frame that is compliant with the three rules listed above.
--- Documentation/devicetree/bindings/net/fsl-fman.txt | 7 +++++++ 1 file changed, 7 insertions(+)
Documentation/devicetree/bindings/net/fsl-fman.txt +7 -0
@@ -110,6 +110,13 @@ PROPERTIES Usage: required Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt +- fsl,erratum-a050385 + Usage: optional + Value type: boolean + Definition: A boolean property. Indicates the presence of the + erratum A050385 which indicates that DMA transactions that are + split can result in a FMan lock. + ============================================================================= FMan MURAM Node
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/155 arm64: dts: ls1043a: FMan erratum A050385
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit b54d3900862374e1bb2846e6b39d79c896c0b200 ]
The LS1043A SoC is affected by the A050385 erratum stating that FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak thus stopping further packet processing.
--- arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi +2 -0
@@ -20,6 +20,8 @@ }; &fman0 { + fsl,erratum-a050385; + /* these aliases provide the FMan ports mapping */ enet0: ethernet@e0000 { };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/155 fsl/fman: detect FMan erratum A050385
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit b281f7b93b258ce1419043bbd898a29254d5c9c7 ]
Detect the presence of the A050385 erratum.
--- drivers/net/ethernet/freescale/fman/Kconfig | 28 +++++++++++++++++++++ drivers/net/ethernet/freescale/fman/fman.c | 18 +++++++++++++ drivers/net/ethernet/freescale/fman/fman.h | 5 ++++ 3 files changed, 51 insertions(+)
drivers/net/ethernet/freescale/fman/Kconfig +28 -0
@@ -8,3 +8,31 @@ config FSL_FMAN help Freescale Data-Path Acceleration Architecture Frame Manager (FMan) support + +config DPAA_ERRATUM_A050385 + bool + depends on ARM64 && FSL_DPAA + default y + help + DPAA FMan erratum A050385 software workaround implementation: + align buffers, data start, SG fragment length to avoid FMan DMA + splits. + FMAN DMA read or writes under heavy traffic load may cause FMAN + internal resource leak thus stopping further packet processing. + The FMAN internal queue can overflow when FMAN splits single + read or write transactions into multiple smaller transactions + such that more than 17 AXI transactions are in flight from FMAN + to interconnect. When the FMAN internal queue overflows, it can + stall further packet processing. The issue can occur with any + one of the following three conditions: + 1. FMAN AXI transaction crosses 4K address boundary (Errata + A010022) + 2. FMAN DMA address for an AXI transaction is not 16 byte + aligned, i.e. the last 4 bits of an address are non-zero + 3. Scatter Gather (SG) frames have more than one SG buffer in + the SG list and any one of the buffers, except the last + buffer in the SG list has data size that is not a multiple + of 16 bytes, i.e., other than 16, 32, 48, 64, etc. + With any one of the above three conditions present, there is + likelihood of stalled FMAN packet processing, especially under + stress with multiple ports injecting line-rate traffic.
drivers/net/ethernet/freescale/fman/fman.c +18 -0
@@ -1,5 +1,6 @@/* * Copyright 2008-2015 Freescale Semiconductor Inc. +* Copyright 2020 NXP * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met:
@@ -566,6 +567,10 @@ struct fman_cfg {u32 qmi_def_tnums_thresh; }; +#ifdef CONFIG_DPAA_ERRATUM_A050385 +static bool fman_has_err_a050385; +#endif +static irqreturn_t fman_exceptions (struct fman *fman,enum fman_exceptions exception) {
@@ -2514,6 +2519,14 @@ struct fman *fman_bind(struct device *fm_dev) }EXPORT_SYMBOL (fman_bind); +#ifdef CONFIG_DPAA_ERRATUM_A050385 +bool fman_has_errata_a050385 (void ) +{ +return fman_has_err_a050385; +} +EXPORT_SYMBOL (fman_has_errata_a050385); +#endif +static irqreturn_t fman_err_irq (int irq,void *handle) {struct fman *fman = (struct fman *)handle;
@@ -2841,6 +2854,11 @@ static struct fman *read_dts_node(struct platform_device *of_dev) goto fman_free; } +#ifdef CONFIG_DPAA_ERRATUM_A050385 + fman_has_err_a050385 = +of_property_read_bool (fm_node,"fsl,erratum-a050385" ); +#endif +return fman; fman_node_put:
drivers/net/ethernet/freescale/fman/fman.h +5 -0
@@ -1,5 +1,6 @@/* * Copyright 2008-2015 Freescale Semiconductor Inc. +* Copyright 2020 NXP * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met:
@@ -398,6 +399,10 @@ u16 fman_get_max_frm(void);int fman_get_rx_extra_headroom (void ); +#ifdef CONFIG_DPAA_ERRATUM_A050385 +bool fman_has_errata_a050385 (void ); +#endif +struct fman *fman_bind (struct device *dev);#endif /* __FM_H */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/155 drm/amd/display: update soc bb for nv14
In reply to Greg Kroah-HartmanFrom: Martin Leung <[email protected]>
[ Upstream commit d5349775c1726ce997b8eb4982cd85a01f1c8b42 ]
[why]
nv14 previously inherited soc bb from generic dcn 2, did not match watermark values according to memory team
[how]
add nv14 specific soc bb: copy nv2 generic that it was using from before, but changed num channels to 8
--- .../drm/amd/display/dc/dcn20/dcn20_resource.c | 114 ++++++++++++++++++ 1 file changed, 114 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +114 -0
@@ -269,6 +269,117 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_0_soc = { .use_urgent_burst_bw = 0 }; +struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv14_soc = { + .clock_limits = { + { + .state =0 , + .dcfclk_mhz =560.0 , + .fabricclk_mhz =560.0 , + .dispclk_mhz =513.0 , + .dppclk_mhz =513.0 , + .phyclk_mhz =540.0 , + .socclk_mhz =560.0 , + .dscclk_mhz =171.0 , + .dram_speed_mts =8960.0 , + }, + { + .state =1 , + .dcfclk_mhz =694.0 , + .fabricclk_mhz =694.0 , + .dispclk_mhz =642.0 , + .dppclk_mhz =642.0 , + .phyclk_mhz =600.0 , + .socclk_mhz =694.0 , + .dscclk_mhz =214.0 , + .dram_speed_mts =11104.0 , + }, + { + .state =2 , + .dcfclk_mhz =875.0 , + .fabricclk_mhz =875.0 , + .dispclk_mhz =734.0 , + .dppclk_mhz =734.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =875.0 , + .dscclk_mhz =245.0 , + .dram_speed_mts =14000.0 , + }, + { + .state =3 , + .dcfclk_mhz =1000.0 , + .fabricclk_mhz =1000.0 , + .dispclk_mhz =1100.0 , + .dppclk_mhz =1100.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1000.0 , + .dscclk_mhz =367.0 , + .dram_speed_mts =16000.0 , + }, + { + .state =4 , + .dcfclk_mhz =1200.0 , + .fabricclk_mhz =1200.0 , + .dispclk_mhz =1284.0 , + .dppclk_mhz =1284.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1200.0 , + .dscclk_mhz =428.0 , + .dram_speed_mts =16000.0 , + }, +/*Extra state, no dispclk ramping*/ + { + .state =5 , + .dcfclk_mhz =1200.0 , + .fabricclk_mhz =1200.0 , + .dispclk_mhz =1284.0 , + .dppclk_mhz =1284.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1200.0 , + .dscclk_mhz =428.0 , + .dram_speed_mts =16000.0 , + }, + }, + .num_states =5 , + .sr_exit_time_us =8.6 , + .sr_enter_plus_exit_time_us =10.9 , + .urgent_latency_us =4.0 , + .urgent_latency_pixel_data_only_us =4.0 , + .urgent_latency_pixel_mixed_with_vm_data_us =4.0 , + .urgent_latency_vm_data_only_us =4.0 , + .urgent_out_of_order_return_per_channel_pixel_only_bytes =4096 , + .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes =4096 , + .urgent_out_of_order_return_per_channel_vm_only_bytes =4096 , + .pct_ideal_dram_sdp_bw_after_urgent_pixel_only =40.0 , + .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm =40.0 , + .pct_ideal_dram_sdp_bw_after_urgent_vm_only =40.0 , + .max_avg_sdp_bw_use_normal_percent =40.0 , + .max_avg_dram_bw_use_normal_percent =40.0 , + .writeback_latency_us =12.0 , + .ideal_dram_bw_after_urgent_percent =40.0 , + .max_request_size_bytes =256 , + .dram_channel_width_bytes =2 , + .fabric_datapath_to_dcn_data_return_bytes =64 , + .dcn_downspread_percent =0.5 , + .downspread_percent =0.38 , + .dram_page_open_time_ns =50.0 , + .dram_rw_turnaround_time_ns =17.5 , + .dram_return_buffer_per_channel_bytes =8192 , + .round_trip_ping_latency_dcfclk_cycles =131 , + .urgent_out_of_order_return_per_channel_bytes =256 , + .channel_interleave_bytes =256 , + .num_banks =8 , + .num_chans =8 , + .vmm_page_size_bytes =4096 , + .dram_clock_change_latency_us =404.0 , + .dummy_pstate_latency_us =5.0 , + .writeback_dram_clock_change_latency_us =23.0 , + .return_bus_width_bytes =64 , + .dispclk_dppclk_vco_speed_mhz =3850 , + .xfc_bus_transport_time_us =20 , + .xfc_xbuf_latency_tolerance_us =4 , + .use_urgent_burst_bw =0 +}; +struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = {0 };#ifndef mmDP0_DP_DPHY_INTERNAL_CTRL
@@ -3135,6 +3246,9 @@ static void patch_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_sstatic struct _vcs_dpi_soc_bounding_box_st *get_asic_rev_soc_bb (uint32_t hw_internal_rev) { +if (ASICREV_IS_NAVI14_M (hw_internal_rev)) +return &dcn2_0_nv14_soc; +if (ASICREV_IS_NAVI12_P (hw_internal_rev))return &dcn2_0_nv12_soc;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/155 drm/amdgpu: correct ROM_INDEX/DATA offset for VEGA20
In reply to Greg Kroah-HartmanFrom: Hawking Zhang <[email protected]>
[ Upstream commit f1c2cd3f8fb959123a9beba18c0e8112dcb2e137 ]
The ROMC_INDEX/DATA offset was changed to e4/e5 since from smuio_v11 (vega20/arcturus).
--- drivers/gpu/drm/amd/amdgpu/soc15.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc15.c +23 -2
@@ -84,6 +84,13 @@#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK 0x00010000L#define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK 0x00020000L#define mmHDP_MEM_POWER_CTRL_BASE_IDX 0 + +/* for Vega20/arcturus regiter offset change */ +#define mmROM_INDEX_VG20 0x00e4 +#define mmROM_INDEX_VG20_BASE_IDX 0 +#define mmROM_DATA_VG20 0x00e5 +#define mmROM_DATA_VG20_BASE_IDX 0 +/* * Indirect registers accessor */
@@ -304,6 +311,8 @@ static bool soc15_read_bios_from_rom(struct amdgpu_device *adev, {u32 *dw_ptr;u32 i, length_dw; +uint32_t rom_index_offset; +uint32_t rom_data_offset;if (bios ==NULL )return false;
@@ -316,11 +325,23 @@ static bool soc15_read_bios_from_rom(struct amdgpu_device *adev, dw_ptr = (u32 *)bios; length_dw =ALIGN (length_bytes,4 ) /4 ; +switch (adev->asic_type) { +case CHIP_VEGA20 : +case CHIP_ARCTURUS : + rom_index_offset =SOC15_REG_OFFSET (SMUIO ,0 , mmROM_INDEX_VG20); + rom_data_offset =SOC15_REG_OFFSET (SMUIO ,0 , mmROM_DATA_VG20); +break ; +default : + rom_index_offset =SOC15_REG_OFFSET (SMUIO ,0 , mmROM_INDEX); + rom_data_offset =SOC15_REG_OFFSET (SMUIO ,0 , mmROM_DATA); +break ; + } +/* set rom index to 0 */ -WREG32 (SOC15_REG_OFFSET (SMUIO ,0 , mmROM_INDEX),0 ); +WREG32 (rom_index_offset,0 );/* read out the rom data */ for (i =0 ; i < length_dw; i++) - dw_ptr[i] =RREG32 (SOC15_REG_OFFSET (SMUIO ,0 , mmROM_DATA)); + dw_ptr[i] =RREG32 (rom_data_offset);return true; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/155 drm/exynos: Fix cleanup of IOMMU related objects
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 07dc3678bacc2a75b1900febea7d996a31f178a2 ]
Store the IOMMU mapping created by the device core of each Exynos DRM sub-device and restore it when the Exynos DRM driver is unbound. This fixes IOMMU initialization failure for the second time when a deferred probe is triggered from the bind() callback of master's compound DRM driver. This also fixes the following issue found using kmemleak detector:
unreferenced object 0xc2137640 (size 64):
comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s) hex dump (first 32 bytes):
50 a3 14 c2 80 a2 14 c2 01 00 00 00 20 00 00 00 P........... ...
00 10 00 00 00 80 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<3acd268d>] arch_setup_dma_ops+0x4c/0x104
[<9f7d2cce>] of_dma_configure+0x19c/0x3a4
[<ba07704b>] really_probe+0xb0/0x47c
[<4f510e4f>] driver_probe_device+0x78/0x1c4
[<7481a0cf>] device_driver_attach+0x58/0x60
[<0ff8f5c1>] __driver_attach+0xb8/0x158
[<86006144>] bus_for_each_dev+0x74/0xb4
[<10159dca>] bus_add_driver+0x1c0/0x200
[<8a265265>] driver_register+0x74/0x108
[<e0f3451a>] exynos_drm_init+0xb0/0x134
[<db3fc7ba>] do_one_initcall+0x90/0x458
[<6da35917>] kernel_init_freeable+0x188/0x200
[<db3f74d4>] kernel_init+0x8/0x110
[<1f3cddf9>] ret_from_fork+0x14/0x20
[<8cd12507>] 0x0
unreferenced object 0xc214a280 (size 128):
comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s)
hex dump (first 32 bytes):
00 a0 ec ed 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<3acd268d>] arch_setup_dma_ops+0x4c/0x104
[<9f7d2cce>] of_dma_configure+0x19c/0x3a4
[<ba07704b>] really_probe+0xb0/0x47c
[<4f510e4f>] driver_probe_device+0x78/0x1c4
[<7481a0cf>] device_driver_attach+0x58/0x60
[<0ff8f5c1>] __driver_attach+0xb8/0x158
[<86006144>] bus_for_each_dev+0x74/0xb4
[<10159dca>] bus_add_driver+0x1c0/0x200
[<8a265265>] driver_register+0x74/0x108
[<e0f3451a>] exynos_drm_init+0xb0/0x134
[<db3fc7ba>] do_one_initcall+0x90/0x458
[<6da35917>] kernel_init_freeable+0x188/0x200
[<db3f74d4>] kernel_init+0x8/0x110
[<1f3cddf9>] ret_from_fork+0x14/0x20
[<8cd12507>] 0x0
unreferenced object 0xedeca000 (size 4096):
comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<3acd268d>] arch_setup_dma_ops+0x4c/0x104
[<9f7d2cce>] of_dma_configure+0x19c/0x3a4
[<ba07704b>] really_probe+0xb0/0x47c
[<4f510e4f>] driver_probe_device+0x78/0x1c4
[<7481a0cf>] device_driver_attach+0x58/0x60
[<0ff8f5c1>] __driver_attach+0xb8/0x158
[<86006144>] bus_for_each_dev+0x74/0xb4
[<10159dca>] bus_add_driver+0x1c0/0x200
[<8a265265>] driver_register+0x74/0x108
[<e0f3451a>] exynos_drm_init+0xb0/0x134
[<db3fc7ba>] do_one_initcall+0x90/0x458
[<6da35917>] kernel_init_freeable+0x188/0x200
[<db3f74d4>] kernel_init+0x8/0x110
[<1f3cddf9>] ret_from_fork+0x14/0x20
[<8cd12507>] 0x0
unreferenced object 0xc214a300 (size 128):
comm "swapper/0", pid 1, jiffies 4294937900 (age 3127.400s)
hex dump (first 32 bytes):
00 a3 14 c2 00 a3 14 c2 00 40 18 c2 00 80 18 c2 .........@......
02 00 02 00 ad 4e ad de ff ff ff ff ff ff ff ff .....N..........
backtrace:
[<08cbd8bc>] iommu_domain_alloc+0x24/0x50
[<b835abee>] arm_iommu_create_mapping+0xe4/0x134
[<3acd268d>] arch_setup_dma_ops+0x4c/0x104
[<9f7d2cce>] of_dma_configure+0x19c/0x3a4
[<ba07704b>] really_probe+0xb0/0x47c
[<4f510e4f>] driver_probe_device+0x78/0x1c4
[<7481a0cf>] device_driver_attach+0x58/0x60
[<0ff8f5c1>] __driver_attach+0xb8/0x158
[<86006144>] bus_for_each_dev+0x74/0xb4
[<10159dca>] bus_add_driver+0x1c0/0x200
[<8a265265>] driver_register+0x74/0x108
[<e0f3451a>] exynos_drm_init+0xb0/0x134
[<db3fc7ba>] do_one_initcall+0x90/0x458
[<6da35917>] kernel_init_freeable+0x188/0x200
[<db3f74d4>] kernel_init+0x8/0x110
[<1f3cddf9>] ret_from_fork+0x14/0x20--- drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 5 ++-- drivers/gpu/drm/exynos/exynos7_drm_decon.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_dma.c | 28 +++++++++++++------ drivers/gpu/drm/exynos/exynos_drm_drv.h | 6 ++-- drivers/gpu/drm/exynos/exynos_drm_fimc.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_fimd.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_gsc.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_rotator.c | 5 ++-- drivers/gpu/drm/exynos/exynos_drm_scaler.c | 6 ++-- drivers/gpu/drm/exynos/exynos_mixer.c | 7 +++-- 11 files changed, 53 insertions(+), 29 deletions(-)
drivers/gpu/drm/exynos/exynos5433_drm_decon.c +3 -2
@@ -55,6 +55,7 @@ static const char * const decon_clks_name[] = {struct decon_context {struct device *dev;struct drm_device *drm_dev; +void *dma_priv;struct exynos_drm_crtc *crtc;struct exynos_drm_plane planes[WINDOWS_NR ];struct exynos_drm_plane_config configs[WINDOWS_NR ];
@@ -644,7 +645,7 @@ static int decon_bind(struct device *dev, struct device *master, void *data)decon_clear_channels (ctx->crtc); -return exynos_drm_register_dma (drm_dev, dev); +return exynos_drm_register_dma (drm_dev, dev, &ctx->dma_priv); }static void decon_unbind (struct device *dev,struct device *master,void *data)
@@ -654,7 +655,7 @@ static void decon_unbind(struct device *dev, struct device *master, void *data)decon_disable (ctx->crtc);/* detach this sub driver from iommu mapping if supported. */ -exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev); +exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev, &ctx->dma_priv); }static const struct component_ops decon_component_ops = {
drivers/gpu/drm/exynos/exynos7_drm_decon.c +3 -2
@@ -40,6 +40,7 @@struct decon_context {struct device *dev;struct drm_device *drm_dev; +void *dma_priv;struct exynos_drm_crtc *crtc;struct exynos_drm_plane planes[WINDOWS_NR ];struct exynos_drm_plane_config configs[WINDOWS_NR ];
@@ -127,13 +128,13 @@ static int decon_ctx_initialize(struct decon_context *ctx,decon_clear_channels (ctx->crtc); -return exynos_drm_register_dma (drm_dev, ctx->dev); +return exynos_drm_register_dma (drm_dev, ctx->dev, &ctx->dma_priv); }static void decon_ctx_remove (struct decon_context *ctx) {/* detach this sub driver from iommu mapping if supported. */ -exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev); +exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev, &ctx->dma_priv); } static u32 decon_calc_clkdiv(struct decon_context *ctx,
drivers/gpu/drm/exynos/exynos_drm_dma.c +19 -9
@@ -58,7 +58,7 @@ static inline void clear_dma_max_seg_size(struct device *dev)* mapping. */ static int drm_iommu_attach_device (struct drm_device *drm_dev, -struct device *subdrv_dev) +struct device *subdrv_dev,void **dma_priv) {struct exynos_drm_private *priv = drm_dev->dev_private;int ret;
@@ -74,7 +74,14 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,return ret;if (IS_ENABLED (CONFIG_ARM_DMA_USE_IOMMU )) { -if (to_dma_iommu_mapping (subdrv_dev)) +/* +* Keep the original DMA mapping of the sub-device and +* restore it on Exynos DRM detach, otherwise the DMA +* framework considers it as IOMMU-less during the next +* probe (in case of deferred probe or modular build) +*/ + *dma_priv =to_dma_iommu_mapping (subdrv_dev); +if (*dma_priv)arm_iommu_detach_device (subdrv_dev); ret =arm_iommu_attach_device (subdrv_dev, priv->mapping);
@@ -98,19 +105,21 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,* mapping */ static void drm_iommu_detach_device (struct drm_device *drm_dev, -struct device *subdrv_dev) +struct device *subdrv_dev,void **dma_priv) {struct exynos_drm_private *priv = drm_dev->dev_private; -if (IS_ENABLED (CONFIG_ARM_DMA_USE_IOMMU )) +if (IS_ENABLED (CONFIG_ARM_DMA_USE_IOMMU )) {arm_iommu_detach_device (subdrv_dev); -else if (IS_ENABLED (CONFIG_IOMMU_DMA )) +arm_iommu_attach_device (subdrv_dev, *dma_priv); + }else if (IS_ENABLED (CONFIG_IOMMU_DMA ))iommu_detach_device (priv->mapping, subdrv_dev);clear_dma_max_seg_size (subdrv_dev); } -int exynos_drm_register_dma (struct drm_device *drm,struct device *dev) +int exynos_drm_register_dma (struct drm_device *drm,struct device *dev, +void **dma_priv) {struct exynos_drm_private *priv = drm->dev_private;
@@ -137,13 +146,14 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev) priv->mapping = mapping; } -return drm_iommu_attach_device (drm, dev); +return drm_iommu_attach_device (drm, dev, dma_priv); } -void exynos_drm_unregister_dma (struct drm_device *drm,struct device *dev) +void exynos_drm_unregister_dma (struct drm_device *drm,struct device *dev, +void **dma_priv) {if (IS_ENABLED (CONFIG_EXYNOS_IOMMU )) -drm_iommu_detach_device (drm, dev); +drm_iommu_detach_device (drm, dev, dma_priv); }void exynos_drm_cleanup_dma (struct drm_device *drm)
drivers/gpu/drm/exynos/exynos_drm_drv.h +4 -2
@@ -223,8 +223,10 @@ static inline bool is_drm_iommu_supported(struct drm_device *drm_dev)return priv->mapping ? true : false; } -int exynos_drm_register_dma (struct drm_device *drm,struct device *dev); -void exynos_drm_unregister_dma (struct drm_device *drm,struct device *dev); +int exynos_drm_register_dma (struct drm_device *drm,struct device *dev, +void **dma_priv); +void exynos_drm_unregister_dma (struct drm_device *drm,struct device *dev, +void **dma_priv);void exynos_drm_cleanup_dma (struct drm_device *drm);#ifdef CONFIG_DRM_EXYNOS_DPI
drivers/gpu/drm/exynos/exynos_drm_fimc.c +3 -2
@@ -97,6 +97,7 @@ struct fimc_scaler {struct fimc_context {struct exynos_drm_ipp ipp;struct drm_device *drm_dev; +void *dma_priv;struct device *dev;struct exynos_drm_ipp_task *task;struct exynos_drm_ipp_formats *formats;
@@ -1133,7 +1134,7 @@ static int fimc_bind(struct device *dev, struct device *master, void *data) ctx->drm_dev = drm_dev; ipp->drm_dev = drm_dev; -exynos_drm_register_dma (drm_dev, dev); +exynos_drm_register_dma (drm_dev, dev, &ctx->dma_priv); exynos_drm_ipp_register(dev, ipp, &ipp_funcs, DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
@@ -1153,7 +1154,7 @@ static void fimc_unbind(struct device *dev, struct device *master,struct exynos_drm_ipp *ipp = &ctx->ipp;exynos_drm_ipp_unregister (dev, ipp); -exynos_drm_unregister_dma (drm_dev, dev); +exynos_drm_unregister_dma (drm_dev, dev, &ctx->dma_priv); }static const struct component_ops fimc_component_ops = {
drivers/gpu/drm/exynos/exynos_drm_fimd.c +3 -2
@@ -167,6 +167,7 @@ static struct fimd_driver_data exynos5420_fimd_driver_data = {struct fimd_context {struct device *dev;struct drm_device *drm_dev; +void *dma_priv;struct exynos_drm_crtc *crtc;struct exynos_drm_plane planes[WINDOWS_NR ];struct exynos_drm_plane_config configs[WINDOWS_NR ];
@@ -1090,7 +1091,7 @@ static int fimd_bind(struct device *dev, struct device *master, void *data)if (is_drm_iommu_supported (drm_dev))fimd_clear_channels (ctx->crtc); -return exynos_drm_register_dma (drm_dev, dev); +return exynos_drm_register_dma (drm_dev, dev, &ctx->dma_priv); } static void fimd_unbind(struct device *dev, struct device *master,
@@ -1100,7 +1101,7 @@ static void fimd_unbind(struct device *dev, struct device *master,fimd_disable (ctx->crtc); -exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev); +exynos_drm_unregister_dma (ctx->drm_dev, ctx->dev, &ctx->dma_priv);if (ctx->encoder)exynos_dpi_remove (ctx->encoder);
drivers/gpu/drm/exynos/exynos_drm_g2d.c +3 -2
@@ -232,6 +232,7 @@ struct g2d_runqueue_node {struct g2d_data {struct device *dev; +void *dma_priv;struct clk *gate_clk;void __iomem *regs;int irq;
@@ -1409,7 +1410,7 @@ static int g2d_bind(struct device *dev, struct device *master, void *data)return ret; } - ret =exynos_drm_register_dma (drm_dev, dev); + ret =exynos_drm_register_dma (drm_dev, dev, &g2d->dma_priv);if (ret <0 ) {dev_err (dev,"failed to enable iommu.\n" );g2d_fini_cmdlist (g2d);
@@ -1434,7 +1435,7 @@ static void g2d_unbind(struct device *dev, struct device *master, void *data) priv->g2d_dev =NULL ;cancel_work_sync (&g2d->runqueue_work); -exynos_drm_unregister_dma (g2d->drm_dev, dev); +exynos_drm_unregister_dma (g2d->drm_dev, dev, &g2d->dma_priv); }static const struct component_ops g2d_component_ops = {
drivers/gpu/drm/exynos/exynos_drm_gsc.c +3 -2
@@ -97,6 +97,7 @@ struct gsc_scaler {struct gsc_context {struct exynos_drm_ipp ipp;struct drm_device *drm_dev; +void *dma_priv;struct device *dev;struct exynos_drm_ipp_task *task;struct exynos_drm_ipp_formats *formats;
@@ -1169,7 +1170,7 @@ static int gsc_bind(struct device *dev, struct device *master, void *data) ctx->drm_dev = drm_dev; ctx->drm_dev = drm_dev; -exynos_drm_register_dma (drm_dev, dev); +exynos_drm_register_dma (drm_dev, dev, &ctx->dma_priv); exynos_drm_ipp_register(dev, ipp, &ipp_funcs, DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
@@ -1189,7 +1190,7 @@ static void gsc_unbind(struct device *dev, struct device *master,struct exynos_drm_ipp *ipp = &ctx->ipp;exynos_drm_ipp_unregister (dev, ipp); -exynos_drm_unregister_dma (drm_dev, dev); +exynos_drm_unregister_dma (drm_dev, dev, &ctx->dma_priv); }static const struct component_ops gsc_component_ops = {
drivers/gpu/drm/exynos/exynos_drm_rotator.c +3 -2
@@ -56,6 +56,7 @@ struct rot_variant {struct rot_context {struct exynos_drm_ipp ipp;struct drm_device *drm_dev; +void *dma_priv;struct device *dev;void __iomem *regs;struct clk *clock;
@@ -243,7 +244,7 @@ static int rotator_bind(struct device *dev, struct device *master, void *data) rot->drm_dev = drm_dev; ipp->drm_dev = drm_dev; -exynos_drm_register_dma (drm_dev, dev); +exynos_drm_register_dma (drm_dev, dev, &rot->dma_priv); exynos_drm_ipp_register(dev, ipp, &ipp_funcs, DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE,
@@ -261,7 +262,7 @@ static void rotator_unbind(struct device *dev, struct device *master,struct exynos_drm_ipp *ipp = &rot->ipp;exynos_drm_ipp_unregister (dev, ipp); -exynos_drm_unregister_dma (rot->drm_dev, rot->dev); +exynos_drm_unregister_dma (rot->drm_dev, rot->dev, &rot->dma_priv); }static const struct component_ops rotator_component_ops = {
drivers/gpu/drm/exynos/exynos_drm_scaler.c +4 -2
@@ -39,6 +39,7 @@ struct scaler_data {struct scaler_context {struct exynos_drm_ipp ipp;struct drm_device *drm_dev; +void *dma_priv;struct device *dev;void __iomem *regs;struct clk *clock[SCALER_MAX_CLK ];
@@ -450,7 +451,7 @@ static int scaler_bind(struct device *dev, struct device *master, void *data) scaler->drm_dev = drm_dev; ipp->drm_dev = drm_dev; -exynos_drm_register_dma (drm_dev, dev); +exynos_drm_register_dma (drm_dev, dev, &scaler->dma_priv); exynos_drm_ipp_register(dev, ipp, &ipp_funcs, DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
@@ -470,7 +471,8 @@ static void scaler_unbind(struct device *dev, struct device *master,struct exynos_drm_ipp *ipp = &scaler->ipp;exynos_drm_ipp_unregister (dev, ipp); -exynos_drm_unregister_dma (scaler->drm_dev, scaler->dev); +exynos_drm_unregister_dma (scaler->drm_dev, scaler->dev, + &scaler->dma_priv); }static const struct component_ops scaler_component_ops = {
drivers/gpu/drm/exynos/exynos_mixer.c +5 -2
@@ -94,6 +94,7 @@ struct mixer_context {struct platform_device *pdev;struct device *dev;struct drm_device *drm_dev; +void *dma_priv;struct exynos_drm_crtc *crtc;struct exynos_drm_plane planes[MIXER_WIN_NR ];unsigned long flags;
@@ -894,12 +895,14 @@ static int mixer_initialize(struct mixer_context *mixer_ctx, } } -return exynos_drm_register_dma (drm_dev, mixer_ctx->dev); +return exynos_drm_register_dma (drm_dev, mixer_ctx->dev, + &mixer_ctx->dma_priv); }static void mixer_ctx_remove (struct mixer_context *mixer_ctx) { -exynos_drm_unregister_dma (mixer_ctx->drm_dev, mixer_ctx->dev); +exynos_drm_unregister_dma (mixer_ctx->drm_dev, mixer_ctx->dev, + &mixer_ctx->dma_priv); }static int mixer_enable_vblank (struct exynos_drm_crtc *crtc)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/155 iommu/vt-d: Silence RCU-list debugging warnings
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit f5152416528c2295f35dd9c9bd4fb27c4032413d ]
Similar to the commit 02d715b4a818 ("iommu/vt-d: Fix RCU list debugging warnings"), there are several other places that call list_for_each_entry_rcu() outside of an RCU read side critical section but with dmar_global_lock held. Silence those false positives as well.
drivers/iommu/intel-iommu.c:4288 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1:
#0: ffffffff935892c8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x1ad/0xb97
drivers/iommu/dmar.c:366 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1:
#0: ffffffff935892c8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x125/0xb97
drivers/iommu/intel-iommu.c:5057 RCU-list traversed in non-reader section!! 1 lock held by swapper/0/1:
#0: ffffffffa71892c8 (dmar_global_lock){++++}, at: intel_iommu_init+0x61a/0xb13
--- drivers/iommu/dmar.c | 3 ++- include/linux/dmar.h | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/iommu/dmar.c +2 -1
@@ -371,7 +371,8 @@ dmar_find_dmaru(struct acpi_dmar_hardware_unit *drhd) {struct dmar_drhd_unit *dmaru; -list_for_each_entry_rcu (dmaru, &dmar_drhd_units, list) +list_for_each_entry_rcu (dmaru, &dmar_drhd_units, list, +dmar_rcu_check ())if (dmaru->segment == drhd->segment && dmaru->reg_base_addr == drhd->address)return dmaru;
include/linux/dmar.h +4 -2
@@ -74,11 +74,13 @@ extern struct list_head dmar_drhd_units; dmar_rcu_check())#define for_each_active_drhd_unit (drhd) \ - list_for_each_entry_rcu(drhd, &dmar_drhd_units, list) \ + list_for_each_entry_rcu(drhd, &dmar_drhd_units, list, \ + dmar_rcu_check()) \ if (drhd->ignored) {} else#define for_each_active_iommu (i, drhd) \ - list_for_each_entry_rcu(drhd, &dmar_drhd_units, list) \ + list_for_each_entry_rcu(drhd, &dmar_drhd_units, list, \ + dmar_rcu_check()) \ if (i=drhd->iommu, drhd->ignored) {} else#define for_each_iommu (i, drhd) \
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/155 s390/qeth: dont reset default_out_queue
In reply to Greg Kroah-HartmanFrom: Julian Wiedmann <[email protected]>
[ Upstream commit 240c1948491b81cfe40f84ea040a8f2a4966f101 ]
When an OSA device in prio-queue setup is reduced to 1 TX queue due to HW restrictions, we reset its the default_out_queue to 0.
In the old code this was needed so that qeth_get_priority_queue() gets the queue selection right. But with proper multiqueue support we already reduced dev->real_num_tx_queues to 1, and so the stack puts all traffic on txq 0 without even calling .ndo_select_queue.
Thus we can preserve the user's configuration, and apply it if the OSA device later re-gains support for multiple TX queues.
--- drivers/s390/net/qeth_core_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/s390/net/qeth_core_main.c +0 -1
@@ -1244,7 +1244,6 @@ static int qeth_osa_set_output_queues(struct qeth_card *card, bool single)if (count ==1 )dev_info (&card->gdev->dev,"Priority Queueing not supported\n" ); - card->qdio.default_out_queue = single ?0 :QETH_DEFAULT_QUEUE ; card->qdio.no_out_queues = count;return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/155 s390/qeth: handle error when backing RX buffer
In reply to Greg Kroah-HartmanFrom: Julian Wiedmann <[email protected]>
[ Upstream commit 17413852804d7e86e6f0576cca32c1541817800e ]
qeth_init_qdio_queues() fills the RX ring with an initial set of RX buffers. If qeth_init_input_buffer() fails to back one of the RX buffers with memory, we need to bail out and report the error.
--- drivers/s390/net/qeth_core_main.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/s390/net/qeth_core_main.c +9 -4
@@ -2633,12 +2633,12 @@ static int qeth_init_input_buffer(struct qeth_card *card, buf->rx_skb =netdev_alloc_skb (card->dev,QETH_RX_PULL_LEN +ETH_HLEN );if (!buf->rx_skb) -return 1 ; +return -ENOMEM ; } pool_entry =qeth_find_free_buffer_pool_entry (card);if (!pool_entry) -return 1 ; +return -ENOBUFS ;/* * since the buffer is accessed only from the input_tasklet
@@ -2670,10 +2670,15 @@ int qeth_init_qdio_queues(struct qeth_card *card)/* inbound queue */ qdio_reset_buffers (card->qdio.in_q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q );memset (&card->rx,0 ,sizeof (struct qeth_rx )); +qeth_initialize_working_pool_list (card);/*give only as many buffers to hardware as we have buffer pool entries*/ -for (i =0 ; i < card->qdio.in_buf_pool.buf_count -1 ; ++i) -qeth_init_input_buffer (card, &card->qdio.in_q->bufs[i]); +for (i =0 ; i < card->qdio.in_buf_pool.buf_count -1 ; i++) { + rc =qeth_init_input_buffer (card, &card->qdio.in_q->bufs[i]); +if (rc) +return rc; + } + card->qdio.in_q->next_buf_to_init = card->qdio.in_buf_pool.buf_count -1 ; rc = do_QDIO(CARD_DDEV(card), QDIO_FLAG_SYNC_INPUT, 0, 0,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/155 scsi: ipr: Fix softlockup when rescanning devices in petitboot
In reply to Greg Kroah-HartmanFrom: Wen Xiong <[email protected]>
[ Upstream commit 394b61711f3ce33f75bf70a3e22938464a13b3ee ]
When trying to rescan disks in petitboot shell, we hit the following softlockup stacktrace:
Kernel panic - not syncing: System is deadlocked on memory [ 241.223394] CPU: 32 PID: 693 Comm: sh Not tainted 5.4.16-openpower1 #1 [ 241.223406] Call Trace: [ 241.223415] [c0000003f07c3180] [c000000000493fc4] dump_stack+0xa4/0xd8 (unreliable) [ 241.223432] [c0000003f07c31c0] [c00000000007d4ac] panic+0x148/0x3cc [ 241.223446] [c0000003f07c3260] [c000000000114b10] out_of_memory+0x468/0x4c4 [ 241.223461] [c0000003f07c3300] [c0000000001472b0] __alloc_pages_slowpath+0x594/0x6d8 [ 241.223476] [c0000003f07c3420] [c00000000014757c] __alloc_pages_nodemask+0x188/0x1a4 [ 241.223492] [c0000003f07c34a0] [c000000000153e10] alloc_pages_current+0xcc/0xd8 [ 241.223508] [c0000003f07c34e0] [c0000000001577ac] alloc_slab_page+0x30/0x98 [ 241.223524] [c0000003f07c3520] [c0000000001597fc] new_slab+0x138/0x40c [ 241.223538] [c0000003f07c35f0] [c00000000015b204] ___slab_alloc+0x1e4/0x404 [ 241.223552] [c0000003f07c36c0] [c00000000015b450] __slab_alloc+0x2c/0x48 [ 241.223566] [c0000003f07c36f0] [c00000000015b754] kmem_cache_alloc_node+0x9c/0x1b4 [ 241.223582] [c0000003f07c3760] [c000000000218c48] blk_alloc_queue_node+0x34/0x270 [ 241.223599] [c0000003f07c37b0] [c000000000226574] blk_mq_init_queue+0x2c/0x78 [ 241.223615] [c0000003f07c37e0] [c0000000002ff710] scsi_mq_alloc_queue+0x28/0x70 [ 241.223631] [c0000003f07c3810] [c0000000003005b8] scsi_alloc_sdev+0x184/0x264 [ 241.223647] [c0000003f07c38a0] [c000000000300ba0] scsi_probe_and_add_lun+0x288/0xa3c [ 241.223663] [c0000003f07c3a00] [c000000000301768] __scsi_scan_target+0xcc/0x478 [ 241.223679] [c0000003f07c3b20] [c000000000301c64] scsi_scan_channel.part.9+0x74/0x7c [ 241.223696] [c0000003f07c3b70] [c000000000301df4] scsi_scan_host_selected+0xe0/0x158 [ 241.223712] [c0000003f07c3bd0] [c000000000303f04] store_scan+0x104/0x114 [ 241.223727] [c0000003f07c3cb0] [c0000000002d5ac4] dev_attr_store+0x30/0x4c [ 241.223741] [c0000003f07c3cd0] [c0000000001dbc34] sysfs_kf_write+0x64/0x78 [ 241.223756] [c0000003f07c3cf0] [c0000000001da858] kernfs_fop_write+0x170/0x1b8 [ 241.223773] [c0000003f07c3d40] [c0000000001621fc] __vfs_write+0x34/0x60 [ 241.223787] [c0000003f07c3d60] [c000000000163c2c] vfs_write+0xa8/0xcc [ 241.223802] [c0000003f07c3db0] [c000000000163df4] ksys_write+0x70/0xbc [ 241.223816] [c0000003f07c3e20] [c00000000000b40c] system_call+0x5c/0x68
As a part of the scan process Linux will allocate and configure a scsi_device for each target to be scanned. If the device is not present, then the scsi_device is torn down. As a part of scsi_device teardown a workqueue item will be scheduled and the lockups we see are because there are 250k workqueue items to be processed. Accoding to the specification of SIS-64 sas controller, max_channel should be decreased on SIS-64 adapters to 4.
The patch fixes softlockup issue.
Thanks for Oliver Halloran's help with debugging and explanation!
--- drivers/scsi/ipr.c | 3 ++- drivers/scsi/ipr.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/ipr.c +2 -1
@@ -9947,6 +9947,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, ioa_cfg->max_devs_supported = ipr_max_devs;if (ioa_cfg->sis64) { + host->max_channel =IPR_MAX_SIS64_BUSES ; host->max_id =IPR_MAX_SIS64_TARGETS_PER_BUS ; host->max_lun =IPR_MAX_SIS64_LUNS_PER_TARGET ;if (ipr_max_devs >IPR_MAX_SIS64_DEVS )
@@ -9955,6 +9956,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, + ((sizeof (struct ipr_config_table_entry64 ) * ioa_cfg->max_devs_supported))); }else { + host->max_channel =IPR_VSET_BUS ; host->max_id =IPR_MAX_NUM_TARGETS_PER_BUS ; host->max_lun =IPR_MAX_NUM_LUNS_PER_TARGET ;if (ipr_max_devs >IPR_MAX_PHYSICAL_DEVS )
@@ -9964,7 +9966,6 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg, * ioa_cfg->max_devs_supported))); } - host->max_channel =IPR_VSET_BUS ; host->unique_id = host->host_no; host->max_cmd_len =IPR_MAX_CDB_LEN ; host->can_queue = ioa_cfg->max_cmds;
drivers/scsi/ipr.h +1 -0
@@ -1300,6 +1300,7 @@ struct ipr_resource_entry {#define IPR_ARRAY_VIRTUAL_BUS 0x1#define IPR_VSET_VIRTUAL_BUS 0x2#define IPR_IOAFP_VIRTUAL_BUS 0x3 +#define IPR_MAX_SIS64_BUSES 0x4#define IPR_GET_RES_PHYS_LOC (res) \ (((res)->bus << 24) | ((res)->target << 8) | (res)->lun)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/155 mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
In reply to Greg Kroah-HartmanFrom: Nicolas Cavallari <[email protected]>
[ Upstream commit ba32679cac50c38fdf488296f96b1f3175532b8e ]
When trying to transmit to an unknown destination, the mesh code would unconditionally transmit a HWMP PREQ even if HWMP is not the current path selection algorithm.
--- net/mac80211/mesh_hwmp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/mesh_hwmp.c +2 -1
@@ -1152,7 +1152,8 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata, } } -if (!(mpath->flags &MESH_PATH_RESOLVING )) +if (!(mpath->flags &MESH_PATH_RESOLVING ) && +mesh_path_sel_is_hwmp (sdata))mesh_queue_preq (mpath,PREQ_Q_F_START );if (skb_queue_len (&mpath->frame_queue) >=MESH_FRAME_QUEUE_LEN )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/155 dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 7395f62d95aafacdb9bd4996ec2f95b4a655d7e6 ]
Clang warns:
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:2860:9: warning:
converting the result of '?:' with integer constants to a boolean always evaluates to 'true' [-Wtautological-constant-compare]
return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom,
^drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:131:34: note: expanded from macro 'DPAA_FD_DATA_ALIGNMENT'
\#define DPAA_FD_DATA_ALIGNMENT (fman_has_errata_a050385() ? 64 : 16)
^
1 warning generated.
This was exposed by commit 3c68b8fffb48 ("dpaa_eth: FMan erratum A050385 workaround") even though it appears to have been an issue since the introductory commit 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") since DPAA_FD_DATA_ALIGNMENT has never been able to be zero.
Just replace the whole boolean expression with the true branch, as it is always been true.
--- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +1 -3
@@ -2770,9 +2770,7 @@ static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl) headroom = (u16)(bl->priv_data_size +DPAA_PARSE_RESULTS_SIZE +DPAA_TIME_STAMP_SIZE +DPAA_HASH_RESULTS_SIZE ); -return DPAA_FD_DATA_ALIGNMENT ?ALIGN (headroom, -DPAA_FD_DATA_ALIGNMENT ) : - headroom; +return ALIGN (headroom,DPAA_FD_DATA_ALIGNMENT ); }static int dpaa_eth_probe (struct platform_device *pdev)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/155 sxgbe: Fix off by one in samsung driver strncpy size arg
In reply to Greg Kroah-HartmanFrom: Dominik Czarnota <[email protected]>
[ Upstream commit f3cc008bf6d59b8d93b4190e01d3e557b0040e15 ]
This patch fixes an off-by-one error in strncpy size argument in drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The issue is that in:
strncmp(opt, "eee_timer:", 6)
the passed string literal: "eee_timer:" has 10 bytes (without the NULL byte) and the passed size argument is 6. As a result, the logic will also accept other, malformed strings, e.g. "eee_tiXXX:".
This bug doesn't seem to have any security impact since its present in module's cmdline parsing code.
--- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +1 -1
@@ -2279,7 +2279,7 @@ static int __init sxgbe_cmdline_opt(char *str)if (!str || !*str)return -EINVAL ;while ((opt =strsep (&str,"," )) !=NULL ) { -if (!strncmp (opt,"eee_timer:" ,6 )) { +if (!strncmp (opt,"eee_timer:" ,10 )) {if (kstrtoint (opt +10 ,0 , &eee_timer)) goto err; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/155 net: hns3: fix "tc qdisc del" failed issue
In reply to Greg Kroah-HartmanFrom: Yonglong Liu <[email protected]>
[ Upstream commit 5eb01ddfcfb25e6ebc404a41deae946bde776731 ]
The HNS3 driver supports to configure TC numbers and TC to priority map via "tc" tool. But when delete the rule, will fail, because the HNS3 driver needs at least one TC, but the "tc" tool sets TC number to zero when delete.
This patch makes sure that the TC number is at least one.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +1 -1
@@ -1596,7 +1596,7 @@ static int hns3_setup_tc(struct net_device *netdev, void *type_data)netif_dbg (h, drv, netdev,"setup tc: num_tc=%u\n" , tc);return (kinfo->dcb_ops && kinfo->dcb_ops->setup_tc) ? - kinfo->dcb_ops->setup_tc (h, tc, prio_tc) : -EOPNOTSUPP ; + kinfo->dcb_ops->setup_tc (h, tc ? tc :1 , prio_tc) : -EOPNOTSUPP ; } static int hns3_nic_setup_tc(struct net_device *dev, enum tc_setup_type type,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/155 iommu/vt-d: Fix debugfs register reads
In reply to Greg Kroah-HartmanFrom: Megha Dey <[email protected]>
[ Upstream commit ba3b01d7a6f4ab9f8a0557044c9a7678f64ae070 ]
Commit 6825d3ea6cde ("iommu/vt-d: Add debugfs support to show register contents") dumps the register contents for all IOMMU devices.
Currently, a 64 bit read(dmar_readq) is done for all the IOMMU registers, even though some of the registers are 32 bits, which is incorrect.
Use the correct read function variant (dmar_readl/dmar_readq) while reading the contents of 32/64 bit registers respectively.
--- drivers/iommu/intel-iommu-debugfs.c | 40 ++++++++++++++++++----------- include/linux/intel-iommu.h | 2 ++ 2 files changed, 27 insertions(+), 15 deletions(-)
drivers/iommu/intel-iommu-debugfs.c +25 -15
@@ -32,38 +32,42 @@ struct iommu_regset {#define IOMMU_REGSET_ENTRY (_reg_) \ { DMAR_##_reg_##_REG, __stringify(_reg_) } -static const struct iommu_regset iommu_regs[] = { + +static const struct iommu_regset iommu_regs_32[] = {IOMMU_REGSET_ENTRY (VER ), -IOMMU_REGSET_ENTRY (CAP ), -IOMMU_REGSET_ENTRY (ECAP ),IOMMU_REGSET_ENTRY (GCMD ),IOMMU_REGSET_ENTRY (GSTS ), -IOMMU_REGSET_ENTRY (RTADDR ), -IOMMU_REGSET_ENTRY (CCMD ),IOMMU_REGSET_ENTRY (FSTS ),IOMMU_REGSET_ENTRY (FECTL ),IOMMU_REGSET_ENTRY (FEDATA ),IOMMU_REGSET_ENTRY (FEADDR ),IOMMU_REGSET_ENTRY (FEUADDR ), -IOMMU_REGSET_ENTRY (AFLOG ),IOMMU_REGSET_ENTRY (PMEN ),IOMMU_REGSET_ENTRY (PLMBASE ),IOMMU_REGSET_ENTRY (PLMLIMIT ), +IOMMU_REGSET_ENTRY (ICS ), +IOMMU_REGSET_ENTRY (PRS ), +IOMMU_REGSET_ENTRY (PECTL ), +IOMMU_REGSET_ENTRY (PEDATA ), +IOMMU_REGSET_ENTRY (PEADDR ), +IOMMU_REGSET_ENTRY (PEUADDR ), +}; + +static const struct iommu_regset iommu_regs_64[] = { +IOMMU_REGSET_ENTRY (CAP ), +IOMMU_REGSET_ENTRY (ECAP ), +IOMMU_REGSET_ENTRY (RTADDR ), +IOMMU_REGSET_ENTRY (CCMD ), +IOMMU_REGSET_ENTRY (AFLOG ),IOMMU_REGSET_ENTRY (PHMBASE ),IOMMU_REGSET_ENTRY (PHMLIMIT ),IOMMU_REGSET_ENTRY (IQH ),IOMMU_REGSET_ENTRY (IQT ),IOMMU_REGSET_ENTRY (IQA ), -IOMMU_REGSET_ENTRY (ICS ),IOMMU_REGSET_ENTRY (IRTA ),IOMMU_REGSET_ENTRY (PQH ),IOMMU_REGSET_ENTRY (PQT ),IOMMU_REGSET_ENTRY (PQA ), -IOMMU_REGSET_ENTRY (PRS ), -IOMMU_REGSET_ENTRY (PECTL ), -IOMMU_REGSET_ENTRY (PEDATA ), -IOMMU_REGSET_ENTRY (PEADDR ), -IOMMU_REGSET_ENTRY (PEUADDR ),IOMMU_REGSET_ENTRY (MTRRCAP ),IOMMU_REGSET_ENTRY (MTRRDEF ),IOMMU_REGSET_ENTRY (MTRR_FIX64K_00000 ),
@@ -126,10 +130,16 @@ static int iommu_regset_show(struct seq_file *m, void *unused)* by adding the offset to the pointer (virtual address). */ raw_spin_lock_irqsave (&iommu->register_lock, flag); -for (i =0 ; i <ARRAY_SIZE (iommu_regs); i++) { - value =dmar_readq (iommu->reg + iommu_regs[i].offset); +for (i =0 ; i <ARRAY_SIZE (iommu_regs_32); i++) { + value =dmar_readl (iommu->reg + iommu_regs_32[i].offset); +seq_printf (m,"%-16s\t0x%02x\t\t0x%016llx\n" , + iommu_regs_32[i].regs, iommu_regs_32[i].offset, + value); + } +for (i =0 ; i <ARRAY_SIZE (iommu_regs_64); i++) { + value =dmar_readq (iommu->reg + iommu_regs_64[i].offset);seq_printf (m,"%-16s\t0x%02x\t\t0x%016llx\n" , - iommu_regs[i].regs, iommu_regs[i].offset, + iommu_regs_64[i].regs, iommu_regs_64[i].offset, value); }raw_spin_unlock_irqrestore (&iommu->register_lock, flag);
include/linux/intel-iommu.h +2 -0
@@ -120,6 +120,8 @@#define dmar_readq (a) readq(a)#define dmar_writeq (a,v) writeq(v,a) +#define dmar_readl (a) readl(a) +#define dmar_writel (a, v) writel(v, a)#define DMAR_VER_MAJOR (v) (((v) & 0xf0) >> 4)#define DMAR_VER_MINOR (v) ((v) & 0x0f)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/155 iommu/vt-d: Populate debugfs if IOMMUs are detected
In reply to Greg Kroah-HartmanFrom: Megha Dey <[email protected]>
[ Upstream commit 1da8347d8505c137fb07ff06bbcd3f2bf37409bc ]
Currently, the intel iommu debugfs directory(/sys/kernel/debug/iommu/intel) gets populated only when DMA remapping is enabled (dmar_disabled = 0) irrespective of whether interrupt remapping is enabled or not.
Instead, populate the intel iommu debugfs directory if any IOMMUs are detected.
--- drivers/iommu/intel-iommu-debugfs.c | 11 ++++++++++- drivers/iommu/intel-iommu.c | 4 +++- 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/iommu/intel-iommu-debugfs.c +10 -1
@@ -281,9 +281,16 @@ static int dmar_translation_struct_show( {struct dmar_drhd_unit *drhd;struct intel_iommu *iommu; +u32 sts;rcu_read_lock ();for_each_active_iommu (iommu, drhd) { + sts =dmar_readl (iommu->reg +DMAR_GSTS_REG ); +if (!(sts &DMA_GSTS_TES )) { +seq_printf (m,"DMA Remapping is not enabled on %s\n" , + iommu->name); +continue ; + }root_tbl_walk (m, iommu);seq_putc (m,'\n' ); }
@@ -353,6 +360,7 @@ static int ir_translation_struct_show(ststruct dmar_drhd_unit *drhd;struct intel_iommu *iommu;u64 irta; +u32 sts;rcu_read_lock ();for_each_active_iommu (iommu, drhd) {
@@ -362,7 +370,8 @@ static int ir_translation_struct_show(stseq_printf (m,"Remapped Interrupt supported on IOMMU: %s\n" , iommu->name); -if (iommu->ir_table) { + sts =dmar_readl (iommu->reg +DMAR_GSTS_REG ); +if (iommu->ir_table && (sts &DMA_GSTS_IRES )) { irta =virt_to_phys (iommu->ir_table->base);seq_printf (m," IR table address:%llx\n" , irta);ir_tbl_remap_entry_show (m, iommu);
drivers/iommu/intel-iommu.c +3 -1
@@ -4961,6 +4961,9 @@ int __init intel_iommu_init(void)down_write (&dmar_global_lock); +if (!no_iommu) +intel_iommu_debugfs_init (); +if (no_iommu || dmar_disabled) {/* * We exit the function here to ensure IOMMU's remapping and
@@ -5056,7 +5059,6 @@ int __init intel_iommu_init(void)pr_info ("Intel(R) Virtualization Technology for Directed I/O\n" ); intel_iommu_enabled =1 ; -intel_iommu_debugfs_init ();return 0 ;
Greg Kroah-Hartman
maintainerPATCH 75/155 iwlwifi: mvm: fix non-ACPI function
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 7937fd3227055892e169f4b34d21157e57d919e2 upstream.
The code now compiles without ACPI, but there's a warning since iwl_mvm_get_ppag_table() isn't used, and iwl_mvm_ppag_init() must not unconditionally fail but return success instead.
[Drop hunk removing iwl_mvm_get_ppag_table() since it doesn't exist in 5.4]
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +1 -1
@@ -1181,7 +1181,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvmstatic int iwl_mvm_ppag_init (struct iwl_mvm *mvm) { -return -ENOENT ; +return 0 ; }#endif /* CONFIG_ACPI */
Greg Kroah-Hartman
maintainerPATCH 76/155 i2c: hix5hd2: add missed clk_disable_unprepare in remove
In reply to Greg Kroah-HartmanFrom: Chuhong Yuan <[email protected]>
commit e1b9f99ff8c40bba6e59de9ad4a659447b1e4112 upstream.
The driver forgets to disable and unprepare clk when remove. Add a call to clk_disable_unprepare to fix it.
--- drivers/i2c/busses/i2c-hix5hd2.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-hix5hd2.c +1 -0
@@ -477,6 +477,7 @@ static int hix5hd2_i2c_remove(struct plai2c_del_adapter (&priv->adap);pm_runtime_disable (priv->dev);pm_runtime_set_suspended (priv->dev); +clk_disable_unprepare (priv->clk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 77/155 Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 32cf3a610c35cb21e3157f4bbf29d89960e30a36 upstream.
These functions are supposed to return negative error codes but instead it returns true on failure and false on success. The error codes are eventually propagated back to user space.
--- drivers/input/touchscreen/raydium_i2c_ts.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/touchscreen/raydium_i2c_ts.c +4 -4
@@ -432,7 +432,7 @@ static int raydium_i2c_write_object(strureturn 0 ; } -static bool raydium_i2c_boot_trigger (struct i2c_client *client) +static int raydium_i2c_boot_trigger (struct i2c_client *client) {static const u8 cmd[7 ][6 ] = { {0x08 ,0x0C ,0x09 ,0x00 ,0x50 ,0xD7 },
@@ -457,10 +457,10 @@ static bool raydium_i2c_boot_trigger(str } } -return false; +return 0 ; } -static bool raydium_i2c_fw_trigger (struct i2c_client *client) +static int raydium_i2c_fw_trigger (struct i2c_client *client) {static const u8 cmd[5 ][11 ] = { {0 ,0x09 ,0x71 ,0x0C ,0x09 ,0x00 ,0x50 ,0xD7 ,0 ,0 ,0 },
@@ -483,7 +483,7 @@ static bool raydium_i2c_fw_trigger(struc } } -return false; +return 0 ; }static int raydium_i2c_check_path (struct i2c_client *client)
Greg Kroah-Hartman
maintainerPATCH 78/155 Input: fix stale timestamp on key autorepeat events
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 4134252ab7e2c339a54302b88496cb5a89cdbaec upstream.
We need to refresh timestamp when emitting key autorepeat events, otherwise they will carry timestamp of the original key press event.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206929
--- drivers/input/input.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/input.c +1 -0
@@ -190,6 +190,7 @@ static void input_repeat_key(struct time input_value_sync }; +input_set_timestamp (dev,ktime_get ());input_pass_values (dev, vals,ARRAY_SIZE (vals));if (dev->rep[REP_PERIOD ])
Greg Kroah-Hartman
maintainerPATCH 79/155 Input: synaptics - enable RMI on HP Envy 13-ad105ng
In reply to Greg Kroah-HartmanFrom: Yussuf Khalil <[email protected]>
commit 1369d0abe469fb4cdea8a5bce219d38cb857a658 upstream.
This laptop (and perhaps other variants of the same model) reports an SMBus-capable Synaptics touchpad. Everything (including suspend and resume) works fine when RMI is enabled via the kernel command line, so let's add it to the whitelist.
--- drivers/input/mouse/synaptics.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/synaptics.c +1 -0
@@ -186,6 +186,7 @@ static const char * const smbus_pnp_ids["SYN3052" ,/* HP EliteBook 840 G4 */ "SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ +"SYN3257" ,/* HP Envy 13-ad105ng */ NULL };
Greg Kroah-Hartman
maintainerPATCH 80/155 Input: avoid BIT() macro usage in the serio.h UAPI header
In reply to Greg Kroah-HartmanFrom: Eugene Syromiatnikov <[email protected]>
commit 52afa505a03d914081f40cb869a3248567a57573 upstream.
The commit 19ba1eb15a2a ("Input: psmouse - add a custom serio protocol to send extra information") introduced usage of the BIT() macro for SERIO_* flags; this macro is not provided in UAPI headers. Replace if with similarly defined _BITUL() macro defined
in <linux/const.h>.
--- include/uapi/linux/serio.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/uapi/linux/serio.h +5 -5
@@ -9,7 +9,7 @@#ifndef _UAPI_SERIO_H#define _UAPI_SERIO_H - +#include <linux/const.h> #include <linux/ioctl.h> #define SPIOCSTYPE _IOW('q', 0x01, unsigned long)
@@ -18,10 +18,10 @@/* * bit masks for use in "interrupt" flags (3rd argument) */ -#define SERIO_TIMEOUT BIT(0) -#define SERIO_PARITY BIT(1) -#define SERIO_FRAME BIT(2) -#define SERIO_OOB_DATA BIT(3) +#define SERIO_TIMEOUT _BITUL(0) +#define SERIO_PARITY _BITUL(1) +#define SERIO_FRAME _BITUL(2) +#define SERIO_OOB_DATA _BITUL(3)/* * Serio types
Greg Kroah-Hartman
maintainerPATCH 81/155 IB/rdmavt: Free kernel completion queue when done
In reply to Greg Kroah-HartmanFrom: Kaike Wan <[email protected]>
commit 941224e09483ea3428ffc6402de56a4a2e2cb6da upstream.
When a kernel ULP requests the rdmavt to create a completion queue, it allocated the queue and set cq->kqueue to point to it. However, when the completion queue is destroyed, cq->queue is freed instead, leading to a memory leak:
https://lore.kernel.org/r/[email protected]
unreferenced object 0xffffc90006639000 (size 12288):
comm "kworker/u128:0", pid 8, jiffies 4295777598 (age 589.085s)
hex dump (first 32 bytes):
4d 00 00 00 4d 00 00 00 00 c0 08 ac 8b 88 ff ff M...M...........
00 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 ................
backtrace:
[<0000000035a3d625>] __vmalloc_node_range+0x361/0x720
[<000000002942ce4f>] __vmalloc_node.constprop.30+0x63/0xb0
[<00000000f228f784>] rvt_create_cq+0x98a/0xd80 [rdmavt]
[<00000000b84aec66>] __ib_alloc_cq_user+0x281/0x1260 [ib_core]
[<00000000ef3764be>] nvme_rdma_cm_handler+0xdb7/0x1b80 [nvme_rdma]
[<00000000936b401c>] cma_cm_event_handler+0xb7/0x550 [rdma_cm]
[<00000000d9c40b7b>] addr_handler+0x195/0x310 [rdma_cm]
[<00000000c7398a03>] process_one_req+0xdd/0x600 [ib_core]
[<000000004d29675b>] process_one_work+0x920/0x1740
[<00000000efedcdb5>] worker_thread+0x87/0xb40
[<000000005688b340>] kthread+0x327/0x3f0
[<0000000043a168d6>] ret_from_fork+0x3a/0x50This patch fixes the issue by freeing cq->kqueue instead.
--- drivers/infiniband/sw/rdmavt/cq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/sw/rdmavt/cq.c +1 -1
@@ -327,7 +327,7 @@ void rvt_destroy_cq(struct ib_cq *ibcq,if (cq->ip)kref_put (&cq->ip->ref, rvt_release_mmap_info);else -vfree (cq->queue); +vfree (cq->kqueue); }/**
Greg Kroah-Hartman
maintainerPATCH 82/155 RDMA/core: Fix missing error check on dev_set_name()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit f2f2b3bbf0d9f8d090b9a019679223b2bd1c66c4 upstream.
If name memory allocation fails the name will be left empty and device_add_one() will crash:
kobject: (0000000004952746): attempted to be registered with empty name!
WARNING: CPU: 0 PID: 329 at lib/kobject.c:234 kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 329 Comm: syz-executor.5 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Code: 1a 98 ca f9 e9 f0 f8 ff ff 4c 89 f7 e8 6d 98 ca f9 e9 95 f9 ff ff e8 c3 f0 8b f9 4c 89 e6 48 c7 c7 a0 0e 1a 89 e8 e3 41 5c f9 <0f> 0b 41 bd ea ff ff ff e9 52 ff ff ff e8 a2 f0 8b f9 0f 0b e8 9b RSP: 0018:ffffc90005b27908 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815eae46 RDI: fffff52000b64f13 RBP: ffffc90005b27960 R08: ffff88805aeba480 R09: ffffed1015d06659 R10: ffffed1015d06658 R11: ffff8880ae8332c7 R12: ffff8880a37fd000 R13: 0000000000000000 R14: ffff888096691780 R15: 0000000000000001 kobject_add_varg lib/kobject.c:390 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:442 device_add+0x3be/0x1d00 drivers/base/core.c:2412 add_one_compat_dev drivers/infiniband/core/device.c:901 [inline] add_one_compat_dev+0x46a/0x7e0 drivers/infiniband/core/device.c:857 rdma_dev_init_net+0x2eb/0x490 drivers/infiniband/core/device.c:1120 ops_init+0xb3/0x420 net/core/net_namespace.c:137 setup_net+0x2d5/0x8b0 net/core/net_namespace.c:327 copy_net_ns+0x29e/0x5a0 net/core/net_namespace.c:468 create_new_namespaces+0x403/0xb50 kernel/nsproxy.c:108 unshare_nsproxy_namespaces+0xc2/0x200 kernel/nsproxy.c:229 ksys_unshare+0x444/0x980 kernel/fork.c:2955 __do_sys_unshare kernel/fork.c:3023 [inline] __se_sys_unshare kernel/fork.c:3021 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3021 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/infiniband/core/device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/core/device.c +3 -1
@@ -899,7 +899,9 @@ static int add_one_compat_dev(struct ib_ cdev->dev.parent = device->dev.parent;rdma_init_coredev (cdev, device,read_pnet (&rnet->net)); cdev->dev.release = compatdev_release; -dev_set_name (&cdev->dev,"%s" ,dev_name (&device->dev)); + ret =dev_set_name (&cdev->dev,"%s" ,dev_name (&device->dev)); +if (ret) + goto add_err; ret =device_add (&cdev->dev);if (ret)
Greg Kroah-Hartman
maintainerPATCH 83/155 gpiolib: Fix irq_disable() semantics
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 8959b304c7062889b1276092cc8590dc1ba98f65 upstream.
The implementation if .irq_disable() which kicks in between the gpiolib and the driver is not properly mimicking the expected semantics of the irqchip core: the irqchip will call .irq_disable() if that exists, else it will call mask_irq() which first checks if .irq_mask() is defined before calling it.
Since we are calling it unconditionally, we get this bug from drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c, as it only defines .irq_mask_ack and not .irq_mask:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = (ptrval) (...) PC is at 0x0 LR is at gpiochip_irq_disable+0x20/0x30
Fix this by only calling .irq_mask() if it exists.
--- drivers/gpio/gpiolib.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +8 -1
@@ -2194,9 +2194,16 @@ static void gpiochip_irq_disable(struct {struct gpio_chip *chip =irq_data_get_irq_chip_data (d); +/* +* Since we override .irq_disable() we need to mimic the +* behaviour of __irq_disable() in irq/chip.c. +* First call .irq_disable() if it exists, else mimic the +* behaviour of mask_irq() which calls .irq_mask() if +* it exists. +*/ if (chip->irq.irq_disable) chip->irq.irq_disable (d); -else +else if (chip->irq.chip->irq_mask) chip->irq.chip->irq_mask (d);gpiochip_disable_irq (chip, d->hwirq); }
Greg Kroah-Hartman
maintainerPATCH 84/155 RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit 7aefa6237cfe4a6fcf06a8656eee988b36f8fefc upstream.
Empty device names cannot be added to sysfs and crash with:
kobject: (00000000f9de3792): attempted to be registered with empty name!
WARNING: CPU: 1 PID: 10856 at lib/kobject.c:234 kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 10856 Comm: syz-executor459 Not tainted 5.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:kobject_add_internal+0x7ac/0x9a0 lib/kobject.c:234 Code: 7a ca ca f9 e9 f0 f8 ff ff 4c 89 f7 e8 cd ca ca f9 e9 95 f9 ff ff e8 13 25 8c f9 4c 89 e6 48 c7 c7 a0 08 1a 89 e8 a3 76 5c f9 <0f> 0b 41 bd ea ff ff ff e9 52 ff ff ff e8 f2 24 8c f9 0f 0b e8 eb RSP: 0018:ffffc90002006eb0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815eae46 RDI: fffff52000400dc8 RBP: ffffc90002006f08 R08: ffff8880972ac500 R09: ffffed1015d26659 R10: ffffed1015d26658 R11: ffff8880ae9332c7 R12: ffff888093034668 R13: 0000000000000000 R14: ffff8880a69d7600 R15: 0000000000000001 kobject_add_varg lib/kobject.c:390 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:442 device_add+0x3be/0x1d00 drivers/base/core.c:2412 ib_register_device drivers/infiniband/core/device.c:1371 [inline] ib_register_device+0x93e/0xe40 drivers/infiniband/core/device.c:1343 rxe_register_device+0x52e/0x655 drivers/infiniband/sw/rxe/rxe_verbs.c:1231 rxe_add+0x122b/0x1661 drivers/infiniband/sw/rxe/rxe.c:302 rxe_net_add+0x91/0xf0 drivers/infiniband/sw/rxe/rxe_net.c:539 rxe_newlink+0x39/0x90 drivers/infiniband/sw/rxe/rxe.c:318 nldev_newlink+0x28a/0x430 drivers/infiniband/core/nldev.c:1538 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Prevent empty names when checking the name provided from userspace during newlink and rename.
--- drivers/infiniband/core/nldev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/core/nldev.c +5 -1
@@ -863,6 +863,10 @@ static int nldev_set_doit(struct sk_buffnla_strlcpy (name, tb[RDMA_NLDEV_ATTR_DEV_NAME ],IB_DEVICE_NAME_MAX ); +if (strlen (name) ==0 ) { + err = -EINVAL ; + goto done; + } err =ib_device_rename (device, name); goto done; }
@@ -1468,7 +1472,7 @@ static int nldev_newlink(struct sk_buffnla_strlcpy (ibdev_name, tb[RDMA_NLDEV_ATTR_DEV_NAME ],sizeof (ibdev_name)); -if (strchr (ibdev_name,'%' )) +if (strchr (ibdev_name,'%' ) ||strlen (ibdev_name) ==0 )return -EINVAL ;nla_strlcpy (type, tb[RDMA_NLDEV_ATTR_LINK_TYPE ],sizeof (type));
Greg Kroah-Hartman
maintainerPATCH 85/155 RDMA/mad: Do not crash if the rdma device does not have a umad interface
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit 5bdfa854013ce4193de0d097931fd841382c76a7 upstream.
Non-IB devices do not have a umad interface and the client_data will be left set to NULL. In this case calling get_nl_info() will try to kref a NULL cdev causing a crash:
general protection fault, probably for non-canonical address 0xdffffc00000000ba: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000005d0-0x00000000000005d7] CPU: 0 PID: 20851 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kobject_get+0x35/0x150 lib/kobject.c:640 Code: 53 e8 3f b0 8b f9 4d 85 e4 0f 84 a2 00 00 00 e8 31 b0 8b f9 49 8d 7c 24 3c 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f b6 04 02 48 89 fa
+83 e2 07 38 d0 7f 08 84 c0 0f 85 eb 00 00 00
RSP: 0018:ffffc9000946f1a0 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: ffffffff85bdbbb0 RCX: ffffc9000bf22000
RDX: 00000000000000ba RSI: ffffffff87e9d78f RDI: 00000000000005d4
RBP: ffffc9000946f1b8 R08: ffff8880581a6440 R09: ffff8880581a6cd0
R10: fffffbfff154b838 R11: ffffffff8aa5c1c7 R12: 0000000000000598
R13: 0000000000000000 R14: ffffc9000946f278 R15: ffff88805cb0c4d0
FS: 00007faa9e8af700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30121000 CR3: 000000004515d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace: get_device+0x25/0x40 drivers/base/core.c:2574 __ib_get_client_nl_info+0x205/0x2e0 drivers/infiniband/core/device.c:1861 ib_get_client_nl_info+0x35/0x180 drivers/infiniband/core/device.c:1881 nldev_get_chardev+0x575/0xac0 drivers/infiniband/core/nldev.c:1621 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:672 ____sys_sendmsg+0x753/0x880 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 __do_sys_sendmsg net/socket.c:2439 [inline] __se_sys_sendmsg net/socket.c:2437 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/infiniband/core/user_mad.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-)
drivers/infiniband/core/user_mad.c +22 -11
@@ -1129,17 +1129,30 @@ static const struct file_operations umad .llseek = no_llseek, }; +static struct ib_umad_port *get_port (struct ib_device *ibdev, +struct ib_umad_device *umad_dev, +unsigned int port) +{ +if (!umad_dev) +return ERR_PTR (-EOPNOTSUPP ); +if (!rdma_is_port_valid (ibdev, port)) +return ERR_PTR (-EINVAL ); +if (!rdma_cap_ib_mad (ibdev, port)) +return ERR_PTR (-EOPNOTSUPP ); + +return &umad_dev->ports[port -rdma_start_port (ibdev)]; +} +static int ib_umad_get_nl_info (struct ib_device *ibdev,void *client_data,struct ib_client_nl_info *res) { -struct ib_umad_device *umad_dev = client_data; +struct ib_umad_port *port =get_port (ibdev, client_data, res->port); -if (!rdma_is_port_valid (ibdev, res->port)) -return -EINVAL ; +if (IS_ERR (port)) +return PTR_ERR (port); res->abi =IB_USER_MAD_ABI_VERSION ; - res->cdev = &umad_dev->ports[res->port -rdma_start_port (ibdev)].dev; - + res->cdev = &port->dev;return 0 ; }
@@ -1154,15 +1167,13 @@ MODULE_ALIAS_RDMA_CLIENT("umad");static int ib_issm_get_nl_info (struct ib_device *ibdev,void *client_data,struct ib_client_nl_info *res) { -struct ib_umad_device *umad_dev = -ib_get_client_data (ibdev, &umad_client); +struct ib_umad_port *port =get_port (ibdev, client_data, res->port); -if (!rdma_is_port_valid (ibdev, res->port)) -return -EINVAL ; +if (IS_ERR (port)) +return PTR_ERR (port); res->abi =IB_USER_MAD_ABI_VERSION ; - res->cdev = &umad_dev->ports[res->port -rdma_start_port (ibdev)].sm_dev; - + res->cdev = &port->sm_dev;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 86/155 ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 7614209736fbc4927584d4387faade4f31444fce upstream.
CEPH_OSDMAP_FULL/NEARFULL aren't set since mimic, so we need to consult per-pool flags as well. Unfortunately the backwards compatibility here is lacking:
- the change that deprecated OSDMAP_FULL/NEARFULL went into mimic, but was guarded by require_osd_release >= RELEASE_LUMINOUS
- it was subsequently backported to luminous in v12.2.2, but that makes no difference to clients that only check OSDMAP_FULL/NEARFULL because require_osd_release is not client-facing -- it is for OSDs
Since all kernels are affected, the best we can do here is just start checking both map flags and pool flags and send that to stable.
These checks are best effort, so take osdc->lock and look up pool flags just once. Remove the FIXME, since filesystem quotas are checked above and RADOS quotas are reflected in POOL_FLAG_FULL: when the pool reaches its quota, both POOL_FLAG_FULL and POOL_FLAG_FULL_QUOTA are set.
--- fs/ceph/file.c | 14 +++++++++++--- include/linux/ceph/osdmap.h | 4 ++++ include/linux/ceph/rados.h | 6 ++++-- net/ceph/osdmap.c | 9 +++++++++ 4 files changed, 28 insertions(+), 5 deletions(-)
fs/ceph/file.c +11 -3
@@ -1415,10 +1415,13 @@ static ssize_t ceph_write_iter(struct kistruct inode *inode =file_inode (file);struct ceph_inode_info *ci =ceph_inode (inode);struct ceph_fs_client *fsc =ceph_inode_to_client (inode); +struct ceph_osd_client *osdc = &fsc->client->osdc;struct ceph_cap_flush *prealloc_cf;ssize_t count, written =0 ;int err, want, got;bool direct_lock = false; +u32 map_flags; +u64 pool_flags;loff_t pos;loff_t limit =max (i_size_read (inode), fsc->max_file_size);
@@ -1481,8 +1484,12 @@ retry_snap: goto out; } -/* FIXME: not complete since it doesn't account for being at quota */ -if (ceph_osdmap_flag (&fsc->client->osdc,CEPH_OSDMAP_FULL )) { +down_read (&osdc->lock); + map_flags = osdc->osdmap->flags; + pool_flags =ceph_pg_pool_flags (osdc->osdmap, ci->i_layout.pool_id); +up_read (&osdc->lock); +if ((map_flags &CEPH_OSDMAP_FULL ) || + (pool_flags &CEPH_POOL_FLAG_FULL )) { err = -ENOSPC ; goto out; }
@@ -1575,7 +1582,8 @@ retry_snap: }if (written >=0 ) { -if (ceph_osdmap_flag (&fsc->client->osdc,CEPH_OSDMAP_NEARFULL )) +if ((map_flags &CEPH_OSDMAP_NEARFULL ) || + (pool_flags &CEPH_POOL_FLAG_NEARFULL )) iocb->ki_flags |=IOCB_DSYNC ; written =generic_write_sync (iocb, written); }
include/linux/ceph/osdmap.h +4 -0
@@ -37,6 +37,9 @@ int ceph_spg_compare(const struct ceph_s#define CEPH_POOL_FLAG_HASHPSPOOL (1ULL << 0)/* hash pg seed and pool id together */ #define CEPH_POOL_FLAG_FULL (1ULL << 1)/* pool is full */ +#define CEPH_POOL_FLAG_FULL_QUOTA (1ULL << 10)/* pool ran out of quota, +will set FULL too */ +#define CEPH_POOL_FLAG_NEARFULL (1ULL << 11)/* pool is nearfull */ struct ceph_pg_pool_info {struct rb_node node;
@@ -304,5 +307,6 @@ extern struct ceph_pg_pool_info *ceph_pgextern const char *ceph_pg_pool_name_by_id (struct ceph_osdmap *map,u64 id);extern int ceph_pg_poolid_by_name (struct ceph_osdmap *map,const char *name); +u64 ceph_pg_pool_flags (struct ceph_osdmap *map,u64 id);#endif
include/linux/ceph/rados.h +4 -2
@@ -143,8 +143,10 @@ extern const char *ceph_osd_state_name(i/* * osd map flag bits */ -#define CEPH_OSDMAP_NEARFULL (1<<0)/* sync writes (near ENOSPC) */ -#define CEPH_OSDMAP_FULL (1<<1)/* no data writes (ENOSPC) */ +#define CEPH_OSDMAP_NEARFULL (1<<0)/* sync writes (near ENOSPC), +not set since ~luminous */ +#define CEPH_OSDMAP_FULL (1<<1)/* no data writes (ENOSPC), +not set since ~luminous */ #define CEPH_OSDMAP_PAUSERD (1<<2)/* pause all reads */ #define CEPH_OSDMAP_PAUSEWR (1<<3)/* pause all writes */ #define CEPH_OSDMAP_PAUSEREC (1<<4)/* pause recovery */
net/ceph/osdmap.c +9 -0
@@ -710,6 +710,15 @@ int ceph_pg_poolid_by_name(struct ceph_o }EXPORT_SYMBOL (ceph_pg_poolid_by_name); +u64 ceph_pg_pool_flags (struct ceph_osdmap *map,u64 id) +{ +struct ceph_pg_pool_info *pi; + + pi =__lookup_pg_pool (&map->pg_pools, id); +return pi ? pi->flags :0 ; +} +EXPORT_SYMBOL (ceph_pg_pool_flags); +static void __remove_pg_pool (struct rb_root *root,struct ceph_pg_pool_info *pi) {rb_erase (&pi->node, root);
Greg Kroah-Hartman
maintainerPATCH 87/155 ceph: fix memory leak in ceph_cleanup_snapid_map()
In reply to Greg Kroah-HartmanFrom: Luis Henriques <[email protected]>
commit c8d6ee01449cd0d2f30410681cccb616a88f50b1 upstream.
kmemleak reports the following memory leak:
unreferenced object 0xffff88821feac8a0 (size 96):
comm "kworker/1:0", pid 17, jiffies 4294896362 (age 20.512s) hex dump (first 32 bytes):
a0 c8 ea 1f 82 88 ff ff 00 c9 ea 1f 82 88 ff ff ................
00 00 00 00 00 00 00 00 00 01 00 00 00 00 ad de ................
backtrace:
[<00000000b3ea77fb>] ceph_get_snapid_map+0x75/0x2a0
[<00000000d4060942>] fill_inode+0xb26/0x1010
[<0000000049da6206>] ceph_readdir_prepopulate+0x389/0xc40
[<00000000e2fe2549>] dispatch+0x11ab/0x1521
[<000000007700b894>] ceph_con_workfn+0xf3d/0x3240
[<0000000039138a41>] process_one_work+0x24d/0x590
[<00000000eb751f34>] worker_thread+0x4a/0x3d0
[<000000007e8f0d42>] kthread+0xfb/0x130
[<00000000d49bd1fa>] ret_from_fork+0x3a/0x50A kfree is missing while looping the 'to_free' list of ceph_snapid_map objects.
--- fs/ceph/snap.c | 1 + 1 file changed, 1 insertion(+)
fs/ceph/snap.c +1 -0
@@ -1155,5 +1155,6 @@ void ceph_cleanup_snapid_map(struct cephpr_err ("snapid map %llx -> %x still in use\n" , sm->snap, sm->dev); } +kfree (sm); } }
Greg Kroah-Hartman
maintainerPATCH 88/155 ARM: dts: dra7: Add bus_dma_limit for L3 bus
In reply to Greg Kroah-HartmanFrom: Roger Quadros <[email protected]>
commit cfb5d65f25959f724081bae8445a0241db606af6 upstream.
The L3 interconnect's memory map is from 0x0 to 0xffffffff. Out of this, System memory (SDRAM) can be accessed from 0x80000000 to 0xffffffff (2GB)
DRA7 does support 4GB of SDRAM but upper 2GB can only be accessed by the MPU subsystem.
Add the dma-ranges property to reflect the physical address limit of the L3 bus.
Issues ere observed only with SATA on DRA7-EVM with 4GB RAM and CONFIG_ARM_LPAE enabled. This is because the controller supports 64-bit DMA and its driver sets the dma_mask to 64-bit thus resulting in DMA accesses beyond L3 limit of 2G.
Setting the correct bus_dma_limit fixes the issue.
--- arch/arm/boot/dts/dra7.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/dra7.dtsi +1 -0
@@ -148,6 +148,7 @@ #address-cells = <1>; #size-cells = <1>; ranges = <0x0 0x0 0x0 0xc0000000>; + dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>; ti,hwmods = "l3_main_1", "l3_main_2"; reg = <0x0 0x44000000 0x0 0x1000000>, <0x0 0x45000000 0x0 0x1000>;
Greg Kroah-Hartman
maintainerPATCH 89/155 ARM: dts: omap5: Add bus_dma_limit for L3 bus
In reply to Greg Kroah-HartmanFrom: Roger Quadros <[email protected]>
commit dfa7ea303f56a3a8b1ed3b91ef35af2da67ca4ee upstream.
The L3 interconnect's memory map is from 0x0 to 0xffffffff. Out of this, System memory (SDRAM) can be accessed from 0x80000000 to 0xffffffff (2GB)
OMAP5 does support 4GB of SDRAM but upper 2GB can only be accessed by the MPU subsystem.
Add the dma-ranges property to reflect the physical address limit of the L3 bus.
--- arch/arm/boot/dts/omap5.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/omap5.dtsi +1 -0
@@ -143,6 +143,7 @@ #address-cells = <1>; #size-cells = <1>; ranges = <0 0 0 0xc0000000>; + dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>; ti,hwmods = "l3_main_1", "l3_main_2", "l3_main_3"; reg = <0 0x44000000 0 0x2000>, <0 0x44800000 0 0x3000>,
Greg Kroah-Hartman
maintainerPATCH 90/155 x86/ioremap: Fix CONFIG_EFI=n build
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit 870b4333a62e45b0b2000d14b301b7b8b8cad9da upstream.
In order to use efi_mem_type(), one needs CONFIG_EFI enabled. Otherwise that function is undefined. Use IS_ENABLED() to check and avoid the ifdeffery as the compiler optimizes away the following unreachable code then.
--- arch/x86/mm/ioremap.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/mm/ioremap.c +3 -0
@@ -115,6 +115,9 @@ static void __ioremap_check_other(resourif (!sev_active ())return ; +if (!IS_ENABLED (CONFIG_EFI )) +return ; +if (efi_mem_type (addr) ==EFI_RUNTIME_SERVICES_DATA ) desc->flags |=IORES_MAP_ENCRYPTED ; }
Greg Kroah-Hartman
maintainerPATCH 91/155 perf probe: Fix to delete multiple probe event
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 6b8d68f1ce9266b05a55e93c62923ff51daae4c1 upstream.
When we put an event with multiple probes, perf-probe fails to delete with filters. This comes from a failure to list up the event name because of overwrapping its name.
To fix this issue, skip to list up the event which has same name.
Without this patch:
# perf probe -l \*
probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:21@
probe_perf:map__map_ip (on perf_sample__fprintf_brstackoff:25@
probe_perf:map__map_ip (on append_inlines:12@util/machine.c in
probe_perf:map__map_ip (on unwind_entry:19@util/machine.c in /
probe_perf:map__map_ip (on map__map_ip@util/map.h in /home/mhi
probe_perf:map__map_ip (on map__map_ip@util/map.h in /home/mhi
# perf probe -d \*
"*" does not hit any event.
Error: Failed to delete events. Reason: No such file or directory (Code: -2)With it:
# perf probe -d \* Removed event: probe_perf:map__map_ip #
tools/perf/util/probe-file.c +3 -0
@@ -206,6 +206,9 @@ static struct strlist *__probe_file__get_namelist(int fd, bool include_group) }else ret =strlist__add (sl, tev.event);clear_probe_trace_event (&tev); +/* Skip if there is same name multi-probe event in the list */ +if (ret == -EEXIST ) + ret =0 ;if (ret <0 )break ; }
Greg Kroah-Hartman
maintainerPATCH 92/155 perf probe: Do not depend on dwfl_module_addrsym()
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit 1efde2754275dbd9d11c6e0132a4f09facf297ab upstream.
Do not depend on dwfl_module_addrsym() because it can fail on user-space shared libraries.
Actually, same bug was fixed by commit 664fee3dc379 ("perf probe: Do not use dwfl_module_addrsym if dwarf_diename finds symbol name"), but commit 07d369857808 ("perf probe: Fix wrong address verification) reverted to get actual symbol address from symtab.
This fixes it again by getting symbol address from DIE, and only if the DIE has only address range, it uses dwfl_module_addrsym().
--- tools/perf/util/probe-finder.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
tools/perf/util/probe-finder.c +8 -3
@@ -615,14 +615,19 @@ static int convert_to_trace_point(Dwarf_return -EINVAL ; } -/* Try to get actual symbol name from symtab */ - symbol =dwfl_module_addrsym (mod, paddr, &sym,NULL ); +if (dwarf_entrypc (sp_die, &eaddr) ==0 ) { +/* If the DIE has entrypc, use it. */ + symbol =dwarf_diename (sp_die); + }else { +/* Try to get actual symbol name and address from symtab */ + symbol =dwfl_module_addrsym (mod, paddr, &sym,NULL ); + eaddr = sym.st_value; + }if (!symbol) {pr_warning ("Failed to find symbol at 0x%lx\n" , (unsigned long )paddr);return -ENOENT ; } - eaddr = sym.st_value; tp->offset = (unsigned long )(paddr - eaddr); tp->address = (unsigned long )paddr;
Greg Kroah-Hartman
maintainerPATCH 93/155 rtlwifi: rtl8188ee: Fix regression due to commit d1d1a96bdb44
In reply to Greg Kroah-HartmanFrom: Larry Finger <[email protected]>
commit c80b18cbb04b7b101af9bd14550f13d9866c646a upstream.
For some unexplained reason, commit d1d1a96bdb44 ("rtlwifi: rtl8188ee:
Remove local configuration variable") broke at least one system. As the only net effect of the change was to remove 2 bytes from the start of struct phy_status_rpt, this patch adds 2 bytes of padding at the beginning of the struct.
--- drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h +1 -0
@@ -561,6 +561,7 @@ static inline void clear_pci_tx_desc_con rxmcs == DESC92C_RATE11M)struct phy_status_rpt { +u8 padding[2 ];u8 ch_corr[2 ];u8 cck_sig_qual_ofdm_pwdb_all;u8 cck_agc_rpt_ofdm_cfosho_a;
Greg Kroah-Hartman
maintainerPATCH 94/155 tools: Let O= makes handle a relative path with -C option
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit be40920fbf1003c38ccdc02b571e01a75d890c82 upstream.
When I tried to compile tools/perf from the top directory with the -C option, the O= option didn't work correctly if I passed a relative path:
$ make O=BUILD -C tools/perf/
make: Entering directory '/home/mhiramat/ksrc/linux/tools/perf'
BUILD: Doing 'make -j8' parallel build
../scripts/Makefile.include:4: *** O=/home/mhiramat/ksrc/linux/tools/perf/BUILD does not exist. Stop.
make: *** [Makefile:70: all] Error 2
make: Leaving directory '/home/mhiramat/ksrc/linux/tools/perf'The O= directory existence check failed because the check script ran in the build target directory instead of the directory where I ran the make command.
To fix that, once change directory to $(PWD) and check O= directory, since the PWD is set to where the make command runs.
--- tools/perf/Makefile | 2 +- tools/scripts/Makefile.include | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
tools/perf/Makefile +1 -1
@@ -35,7 +35,7 @@ endif # Only pass canonical directory names as the output directory: # ifneq ($(O),) - FULL_O := $(shell readlink -f $(O) || echo $(O)) + FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O)) endif #
tools/scripts/Makefile.include +2 -2
@@ -1,8 +1,8 @@ # SPDX-License-Identifier: GPL-2.0 ifneq ($(O),) ifeq ($(origin O), command line) - dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),) - ABSOLUTE_O := $(shell cd $(O) ; pwd) + dummy := $(if $(shell cd $(PWD); test -d $(O) || echo $(O)),$(error O=$(O) does not exist),) + ABSOLUTE_O := $(shell cd $(PWD); cd $(O) ; pwd) OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/) COMMAND_O := O=$(ABSOLUTE_O) ifeq ($(objtree),)
Greg Kroah-Hartman
maintainerPATCH 95/155 scripts/dtc: Remove redundant YYLOC global declaration
In reply to Greg Kroah-HartmanFrom: Dirk Mueller <[email protected]>
commit e33a814e772cdc36436c8c188d8c42d019fda639 upstream.
gcc 10 will default to -fno-common, which causes this error at link time:
(.text+0x0): multiple definition of `yylloc'; dtc-lexer.lex.o (symbol from plugin):(.text+0x0): first defined here
This is because both dtc-lexer as well as dtc-parser define the same global symbol yyloc. Before with -fcommon those were merged into one defintion. The proper solution would be to to mark this as "extern", however that leads to:
dtc-lexer.l:26:16: error: redundant redeclaration of 'yylloc' [-Werror=redundant-decls]
26 | extern YYLTYPE yylloc;
| ^~~~~~
In file included from dtc-lexer.l:24:
dtc-parser.tab.h:127:16: note: previous declaration of 'yylloc' was here
127 | extern YYLTYPE yylloc;
| ^~~~~~cc1: all warnings being treated as errors
which means the declaration is completely redundant and can just be dropped.
--- scripts/dtc/dtc-lexer.l | 1 - 1 file changed, 1 deletion(-)
scripts/dtc/dtc-lexer.l +0 -1
@@ -23,7 +23,6 @@ LINECOMMENT "//".*\n #include "srcpos.h" #include "dtc-parser.tab.h" -YYLTYPE yylloc; extern bool treesource_error; /* CAUTION: this will stop working if we ever use yyless() or yyunput() */
Greg Kroah-Hartman
maintainerPATCH 96/155 scsi: sd: Fix optimal I/O size for devices that change reported values
In reply to Greg Kroah-HartmanFrom: Martin K. Petersen <[email protected]>
commit ea697a8bf5a4161e59806fab14f6e4a46dc7dcb0 upstream.
Some USB bridge devices will return a default set of characteristics during initialization. And then, once an attached drive has spun up, substitute the actual parameters reported by the drive. According to the SCSI spec, the device should return a UNIT ATTENTION in case any reported parameters change. But in this case the change is made silently after a small window where default values are reported.
Commit a83da8a4509d ("scsi: sd: Optimal I/O size should be a multiple of physical block size") validated the reported optimal I/O size against the physical block size to overcome problems with devices reporting nonsensical transfer sizes. However, this validation did not account for the fact that aforementioned devices will return default values during a brief window during spin-up. The subsequent change in reported characteristics would invalidate the checking that had previously been performed.
Unset a previously configured optimal I/O size should the sanity checking fail on subsequent revalidate attempts.
--- drivers/scsi/sd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/sd.c +3 -1
@@ -3171,9 +3171,11 @@ static int sd_revalidate_disk(struct genif (sd_validate_opt_xfer_size (sdkp, dev_max)) { q->limits.io_opt =logical_to_bytes (sdp, sdkp->opt_xfer_blocks); rw_max =logical_to_sectors (sdp, sdkp->opt_xfer_blocks); - }else + }else { + q->limits.io_opt =0 ; rw_max =min_not_zero (logical_to_sectors (sdp, dev_max), (sector_t )BLK_DEF_MAX_SECTORS ); + }/* Do not exceed controller limit */ rw_max =min (rw_max,queue_max_hw_sectors (q));
Greg Kroah-Hartman
maintainerPATCH 97/155 nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 0016d3201753b59f3ae84b868fe66c86ad256f19 upstream.
The new opmode notification used this attribute with a u8, when it's documented as a u32 and indeed used in userspace as such, it just happens to work on little-endian systems since userspace isn't doing any strict size validation, and the u8 goes into the lower byte. Fix this.
--- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/nl80211.c +1 -1
@@ -16407,7 +16407,7 @@ void cfg80211_sta_opmode_change_notify(s goto nla_put_failure;if ((sta_opmode->changed &STA_OPMODE_MAX_BW_CHANGED ) && -nla_put_u8 (msg,NL80211_ATTR_CHANNEL_WIDTH , sta_opmode->bw)) +nla_put_u32 (msg,NL80211_ATTR_CHANNEL_WIDTH , sta_opmode->bw)) goto nla_put_failure; if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
Greg Kroah-Hartman
maintainerPATCH 98/155 mac80211: drop data frames without key on encrypted links
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit a0761a301746ec2d92d7fcb82af69c0a6a4339aa upstream.
If we know that we have an encrypted link (based on having had a key configured for TX in the past) then drop all data frames in the key selection handler if there's no key anymore.
This fixes an issue with mac80211 internal TXQs - there we can buffer frames for an encrypted link, but then if the key is no longer there when they're dequeued, the frames are sent without encryption. This happens if a station is disconnected while the frames are still on the TXQ.
Detecting that a link should be encrypted based on a first key having been configured for TX is fine as there are no use cases for a connection going from with encryption to no encryption. With extended key IDs, however, there is a case of having a key configured for only decryption, so we can't just trigger this behaviour on a key being configured.
--- net/mac80211/debugfs_sta.c | 3 ++- net/mac80211/key.c | 20 ++++++++++++-------- net/mac80211/sta_info.h | 1 + net/mac80211/tx.c | 12 +++++++++--- 4 files changed, 24 insertions(+), 12 deletions(-)
net/mac80211/debugfs_sta.c +2 -1
@@ -5,7 +5,7 @@* Copyright 2007 Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright(c) 2016 Intel Deutschland GmbH -* Copyright (C) 2018 - 2019 Intel Corporation +* Copyright (C) 2018 - 2020 Intel Corporation */ #include <linux/debugfs.h>
@@ -78,6 +78,7 @@ static const char * const sta_flag_namesFLAG (MPSP_OWNER ),FLAG (MPSP_RECIPIENT ),FLAG (PS_DELIVER ), +FLAG (USES_ENCRYPTION ), #undef FLAG };
net/mac80211/key.c +12 -8
@@ -6,7 +6,7 @@* Copyright 2007-2008 Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright 2015-2017 Intel Deutschland GmbH -* Copyright 2018-2019 Intel Corporation +* Copyright 2018-2020 Intel Corporation */ #include <linux/if_ether.h>
@@ -262,22 +262,29 @@ static void ieee80211_key_disable_hw_acc sta ? sta->sta.addr : bcast_addr, ret); } -int ieee80211_set_tx_key (struct ieee80211_key *key) +static int _ieee80211_set_tx_key (struct ieee80211_key *key,bool force) {struct sta_info *sta = key->sta;struct ieee80211_local *local = key->local;assert_key_lock (local); +set_sta_flag (sta,WLAN_STA_USES_ENCRYPTION ); + sta->ptk_idx = key->conf.keyidx; -if (!ieee80211_hw_check (&local->hw,AMPDU_KEYBORDER_SUPPORT )) +if (force || !ieee80211_hw_check (&local->hw,AMPDU_KEYBORDER_SUPPORT ))clear_sta_flag (sta,WLAN_STA_BLOCK_BA );ieee80211_check_fast_xmit (sta);return 0 ; } +int ieee80211_set_tx_key (struct ieee80211_key *key) +{ +return _ieee80211_set_tx_key (key, false); +} +static void ieee80211_pairwise_rekey (struct ieee80211_key *old,struct ieee80211_key *new) {
@@ -441,11 +448,8 @@ static int ieee80211_key_replace(structif (pairwise) {rcu_assign_pointer (sta->ptk[idx], new);if (new && - !(new->conf.flags &IEEE80211_KEY_FLAG_NO_AUTO_TX )) { - sta->ptk_idx = idx; -clear_sta_flag (sta,WLAN_STA_BLOCK_BA ); -ieee80211_check_fast_xmit (sta); - } + !(new->conf.flags &IEEE80211_KEY_FLAG_NO_AUTO_TX )) +_ieee80211_set_tx_key (new, true); }else {rcu_assign_pointer (sta->gtk[idx], new); }
net/mac80211/sta_info.h +1 -0
@@ -98,6 +98,7 @@ enum ieee80211_sta_info_flags {WLAN_STA_MPSP_OWNER ,WLAN_STA_MPSP_RECIPIENT ,WLAN_STA_PS_DELIVER , +WLAN_STA_USES_ENCRYPTION , NUM_WLAN_STA_FLAGS, };
net/mac80211/tx.c +9 -3
@@ -590,10 +590,13 @@ ieee80211_tx_h_select_key(struct ieee802struct ieee80211_tx_info *info =IEEE80211_SKB_CB (tx->skb);struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; -if (unlikely (info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT )) +if (unlikely (info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT )) { tx->key =NULL ; -else if (tx->sta && - (key =rcu_dereference (tx->sta->ptk[tx->sta->ptk_idx]))) +return TX_CONTINUE ; + } + +if (tx->sta && + (key =rcu_dereference (tx->sta->ptk[tx->sta->ptk_idx]))) tx->key = key;else if (ieee80211_is_group_privacy_action (tx->skb) && (key =rcu_dereference (tx->sdata->default_multicast_key)))
@@ -654,6 +657,9 @@ ieee80211_tx_h_select_key(struct ieee802if (!skip_hw && tx->key && tx->key->flags &KEY_FLAG_UPLOADED_TO_HARDWARE ) info->control.hw_key = &tx->key->conf; + }else if (!ieee80211_is_mgmt (hdr->frame_control) && tx->sta && +test_sta_flag (tx->sta,WLAN_STA_USES_ENCRYPTION )) { +return TX_DROP ; }return TX_CONTINUE ;
Greg Kroah-Hartman
maintainerPATCH 99/155 mac80211: mark station unauthorized before key removal
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit b16798f5b907733966fd1a558fca823b3c67e4a1 upstream.
If a station is still marked as authorized, mark it as no longer so before removing its keys. This allows frames transmitted to it to be rejected, providing additional protection against leaking plain text data during the disconnection flow.
--- net/mac80211/sta_info.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/mac80211/sta_info.c +6 -1
@@ -4,7 +4,7 @@* Copyright 2006-2007 Jiri Benc <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH -* Copyright (C) 2018-2019 Intel Corporation +* Copyright (C) 2018-2020 Intel Corporation */ #include <linux/module.h>
@@ -1032,6 +1032,11 @@ static void __sta_info_destroy_part2(strmight_sleep ();lockdep_assert_held (&local->sta_mtx); +while (sta->sta_state ==IEEE80211_STA_AUTHORIZED ) { + ret =sta_info_move_state (sta,IEEE80211_STA_ASSOC ); +WARN_ON_ONCE (ret); + } +/* now keys can no longer be reached */ ieee80211_free_sta_keys (local, sta);
Greg Kroah-Hartman
maintainerPATCH 100/155 mm/swapfile.c: move inode_lock out of claim_swapfile
In reply to Greg Kroah-HartmanFrom: Naohiro Aota <[email protected]>
commit d795a90e2ba024dbf2f22107ae89c210b98b08b8 upstream.
claim_swapfile() currently keeps the inode locked when it is successful, or the file is already swapfile (with -EBUSY). And, on the other error cases, it does not lock the inode.
This inconsistency of the lock state and return value is quite confusing and actually causing a bad unlock balance as below in the "bad_swap" section of __do_sys_swapon().
This commit fixes this issue by moving the inode_lock() and IS_SWAPFILE check out of claim_swapfile(). The inode is unlocked in "bad_swap_unlock_inode" section, so that the inode is ensured to be unlocked at "bad_swap". Thus, error handling codes after the locking now jumps to "bad_swap_unlock_inode" instead of "bad_swap".
=====================================
WARNING: bad unlock balance detected!
5.5.0-rc7+ #176 Not tainted
-------------------------------------
swapon/4294 is trying to release lock (&sb->s_type->i_mutex_key) at: __do_sys_swapon+0x94b/0x3550
but there are no more locks to release!
other info that might help us debug this:
no locks held by swapon/4294.
stack backtrace:
CPU: 5 PID: 4294 Comm: swapon Not tainted 5.5.0-rc7-BTRFS-ZNS+ #176
Hardware name: ASUS All Series/H87-PRO, BIOS 2102 07/29/2014
Call Trace:
dump_stack+0xa1/0xea
print_unlock_imbalance_bug.cold+0x114/0x123
lock_release+0x562/0xed0
up_write+0x2d/0x490
__do_sys_swapon+0x94b/0x3550
__x64_sys_swapon+0x54/0x80
do_syscall_64+0xa4/0x4b0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f15da0a0dc7--- mm/swapfile.c | 39 +++++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 20 deletions(-)
mm/swapfile.c +19 -20
@@ -2892,10 +2892,6 @@ static int claim_swapfile(struct swap_in p->bdev = inode->i_sb->s_bdev; } -inode_lock (inode); -if (IS_SWAPFILE (inode)) -return -EBUSY ; -return 0 ; }
@@ -3150,17 +3146,22 @@ SYSCALL_DEFINE2(swapon, const char __use mapping = swap_file->f_mapping; inode = mapping->host; -/* If S_ISREG(inode->i_mode) will do inode_lock(inode); */ error =claim_swapfile (p, inode);if (unlikely (error)) goto bad_swap; +inode_lock (inode); +if (IS_SWAPFILE (inode)) { + error = -EBUSY ; + goto bad_swap_unlock_inode; + } +/* * Read the swap header. */ if (!mapping->a_ops->readpage) { error = -EINVAL ; - goto bad_swap; + goto bad_swap_unlock_inode; } page =read_mapping_page (mapping,0 , swap_file);if (IS_ERR (page)) {
@@ -3172,14 +3173,14 @@ SYSCALL_DEFINE2(swapon, const char __use maxpages =read_swap_header (p, swap_header, inode);if (unlikely (!maxpages)) { error = -EINVAL ; - goto bad_swap; + goto bad_swap_unlock_inode; }/* OK, set up the swap map and apply the bad block list */ swap_map =vzalloc (maxpages);if (!swap_map) { error = -ENOMEM ; - goto bad_swap; + goto bad_swap_unlock_inode; }if (bdi_cap_stable_pages_required (inode_to_bdi (inode)))
@@ -3204,7 +3205,7 @@ SYSCALL_DEFINE2(swapon, const char __use GFP_KERNEL);if (!cluster_info) { error = -ENOMEM ; - goto bad_swap; + goto bad_swap_unlock_inode; }for (ci =0 ; ci < nr_cluster; ci++)
@@ -3213,7 +3214,7 @@ SYSCALL_DEFINE2(swapon, const char __use p->percpu_cluster = alloc_percpu(struct percpu_cluster);if (!p->percpu_cluster) { error = -ENOMEM ; - goto bad_swap; + goto bad_swap_unlock_inode; }for_each_possible_cpu (cpu) {struct percpu_cluster *cluster;
@@ -3227,13 +3228,13 @@ SYSCALL_DEFINE2(swapon, const char __use error =swap_cgroup_swapon (p->type, maxpages);if (error) - goto bad_swap; + goto bad_swap_unlock_inode; nr_extents =setup_swap_map_and_extents (p, swap_header, swap_map, cluster_info, maxpages, &span);if (unlikely (nr_extents <0 )) { error = nr_extents; - goto bad_swap; + goto bad_swap_unlock_inode; }/* frontswap enabled? set up bit-per-page map for frontswap */ if (IS_ENABLED (CONFIG_FRONTSWAP ))
@@ -3273,7 +3274,7 @@ SYSCALL_DEFINE2(swapon, const char __use error =init_swap_address_space (p->type, maxpages);if (error) - goto bad_swap; + goto bad_swap_unlock_inode;/* * Flush any pending IO and dirty mappings before we start using this
@@ -3283,7 +3284,7 @@ SYSCALL_DEFINE2(swapon, const char __use error =inode_drain_writes (inode);if (error) { inode->i_flags &= ~S_SWAPFILE ; - goto bad_swap; + goto bad_swap_unlock_inode; }mutex_lock (&swapon_mutex);
@@ -3308,6 +3309,8 @@ SYSCALL_DEFINE2(swapon, const char __use error =0 ; goto out; +bad_swap_unlock_inode: +inode_unlock (inode); bad_swap:free_percpu (p->percpu_cluster); p->percpu_cluster =NULL ;
@@ -3315,6 +3318,7 @@ bad_swap:set_blocksize (p->bdev, p->old_block_size);blkdev_put (p->bdev,FMODE_READ |FMODE_WRITE |FMODE_EXCL ); } + inode =NULL ;destroy_swap_extents (p);swap_cgroup_swapoff (p->type);spin_lock (&swap_lock);
@@ -3326,13 +3330,8 @@ bad_swap:kvfree (frontswap_map);if (inced_nr_rotate_swap)atomic_dec (&nr_rotate_swap); -if (swap_file) { -if (inode) { -inode_unlock (inode); - inode =NULL ; - } +if (swap_file)filp_close (swap_file,NULL ); - } out:if (page && !IS_ERR (page)) {kunmap (page);
Greg Kroah-Hartman
maintainerPATCH 101/155 drivers/base/memory.c: indicate all memory blocks as removable
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 53cdc1cb29e87ce5a61de5bb393eb08925d14ede upstream.
We see multiple issues with the implementation/interface to compute whether a memory block can be offlined (exposed via /sys/devices/system/memory/memoryX/removable) and would like to simplify it (remove the implementation).
1. It runs basically lockless. While this might be good for performance, we see possible races with memory offlining that will require at least some sort of locking to fix.
2. Nowadays, more false positives are possible. No arch-specific checks are performed that validate if memory offlining will not be denied right away (and such check will require locking). For example, arm64 won't allow to offline any memory block that was added during boot - which will imply a very high error rate. Other archs have other constraints.
3. The interface is inherently racy. E.g., if a memory block is detected to be removable (and was not a false positive at that time), there is still no guarantee that offlining will actually succeed. So any caller already has to deal with false positives.
4. It is unclear which performance benefit this interface actually provides. The introducing commit 5c755e9fd813 ("memory-hotplug: add sysfs removable attribute for hotplug memory remove") mentioned
"A user-level agent must be able to identify which sections
of memory are likely to be removable before attempting the potentially expensive operation."
However, no actual performance comparison was included.
Known users:
- lsmem: Will group memory blocks based on the "removable" property. [1]
- chmem: Indirect user. It has a RANGE mode where one can specify removable ranges identified via lsmem to be offlined. However, it also has a "SIZE" mode, which allows a sysadmin to skip the manual "identify removable blocks" step. [2]
- powerpc-utils: Uses the "removable" attribute to skip some memory blocks right away when trying to find some to offline+remove. However, with ballooning enabled, it already skips this information completely (because it once resulted in many false negatives). Therefore, the implementation can deal with false positives properly already. [3]
According to Nathan Fontenot, DLPAR on powerpc is nowadays no longer driven from userspace via the drmgr command (powerpc-utils). Nowadays it's managed in the kernel - including onlining/offlining of memory blocks - triggered by drmgr writing to /sys/kernel/dlpar. So the affected legacy userspace handling is only active on old kernels. Only very old versions of drmgr on a new kernel (unlikely) might execute slower - totally acceptable.
With CONFIG_MEMORY_HOTREMOVE, always indicating "removable" should not break any user space tool. We implement a very bad heuristic now. Without CONFIG_MEMORY_HOTREMOVE we cannot offline anything, so report "not removable" as before.
Original discussion can be found in [4] ("[PATCH RFC v1] mm:is_mem_section_removable() overhaul").
Other users of is_mem_section_removable() will be removed next, so that we can remove is_mem_section_removable() completely.
[1] http://man7.org/linux/man-pages/man1/lsmem.1.html
[2] http://man7.org/linux/man-pages/man8/chmem.8.html
[3] https://github.com/ibm-power-utilities/powerpc-utils
[4] https://lkml.kernel.org/r/[email protected]
Also, this patch probably fixes a crash reported by Steve.
http://lkml.kernel.org/r/CAPcyv4jpdaNvJ67SkjyUJLBnBnXXQv686BiVW042g03FUmWLXw@mail.gmail.com
--- drivers/base/memory.c | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-)
drivers/base/memory.c +3 -20
@@ -114,30 +114,13 @@ static ssize_t phys_index_show(struct de }/* -* Show whether the memory block is likely to be offlineable (or is already -* offline). Once offline, the memory block could be removed. The return -* value does, however, not indicate that there is a way to remove the -* memory block. +* Legacy interface that we cannot remove. Always indicate "removable" +* with CONFIG_MEMORY_HOTREMOVE - bad heuristic. */ static ssize_t removable_show (struct device *dev,struct device_attribute *attr,char *buf) { -struct memory_block *mem =to_memory_block (dev); -unsigned long pfn; -int ret =1 , i; - -if (mem->state !=MEM_ONLINE ) - goto out; - -for (i =0 ; i < sections_per_block; i++) { -if (!present_section_nr (mem->start_section_nr + i)) -continue ; - pfn =section_nr_to_pfn (mem->start_section_nr + i); - ret &=is_mem_section_removable (pfn,PAGES_PER_SECTION ); - } - -out: -return sprintf (buf,"%d\n" , ret); +return sprintf (buf,"%d\n" , (int )IS_ENABLED (CONFIG_MEMORY_HOTREMOVE )); }/*
Greg Kroah-Hartman
maintainerPATCH 102/155 mm/sparse: fix kernel crash with pfn_section_valid check
In reply to Greg Kroah-HartmanFrom: Aneesh Kumar K.V <[email protected]>
commit b943f045a9af9fd02f923e43fe8d7517e9961701 upstream.
Fix the crash like this:
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc000000000c3447c
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1
...
NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0
LR [c000000000088354] vmemmap_free+0x144/0x320
Call Trace:
section_deactivate+0x220/0x240
__remove_pages+0x118/0x170
arch_remove_memory+0x3c/0x150
memunmap_pages+0x1cc/0x2f0
devm_action_release+0x30/0x50
release_nodes+0x2f8/0x3e0
device_release_driver_internal+0x168/0x270
unbind_store+0x130/0x170
drv_attr_store+0x44/0x60
sysfs_kf_write+0x68/0x80
kernfs_fop_write+0x100/0x290
__vfs_write+0x3c/0x70
vfs_write+0xcc/0x240
ksys_write+0x7c/0x140
system_call+0x5c/0x68The crash is due to NULL dereference at
test_bit(idx, ms->usage->subsection_map);
due to ms->usage = NULL in pfn_section_valid()
With commit d41e2f3bd546 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after depopulate_section_mem(). This was done so that pfn_page() can work correctly with kernel config that disables SPARSEMEM_VMEMMAP. With that config pfn_to_page does
__section_mem_map_addr(__sec) + __pfn;
where
static inline struct page *__section_mem_map_addr(struct mem_section *section)
{
unsigned long map = section->section_mem_map;
map &= SECTION_MAP_MASK;
return (struct page *)map;}
Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is used to check the pfn validity (pfn_valid()). Since section_deactivate release mem_section->usage if a section is fully deactivated, pfn_valid() check after a subsection_deactivate cause a kernel crash.
static inline int pfn_valid(unsigned long pfn)
{
...
return early_section(ms) || pfn_section_valid(ms, pfn);
}
where
static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn)
{
int idx = subsection_map_index(pfn);
return test_bit(idx, ms->usage->subsection_map);}
Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is freed. For architectures like ppc64 where large pages are used for vmmemap mapping (16MB), a specific vmemmap mapping can cover multiple sections. Hence before a vmemmap mapping page can be freed, the kernel needs to make sure there are no valid sections within that mapping. Clearing the section valid bit before depopulate_section_memap enables this.
--- mm/sparse.c | 6 ++++++ 1 file changed, 6 insertions(+)
mm/sparse.c +6 -0
@@ -789,6 +789,12 @@ static void section_deactivate(unsigned ms->usage =NULL ; } memmap =sparse_decode_mem_map (ms->section_mem_map, section_nr); +/* +* Mark the section invalid so that valid_section() +* return false. This prevents code from dereferencing +* ms->usage array. +*/ + ms->section_mem_map &= ~SECTION_HAS_MEM_MAP ; }if (section_is_early && memmap)
Greg Kroah-Hartman
maintainerPATCH 103/155 mm: fork: fix kernel_stack memcg stats for various stack implementations
In reply to Greg Kroah-HartmanFrom: Roman Gushchin <[email protected]>
commit 8380ce479010f2f779587b462a9b4681934297c3 upstream.
Depending on CONFIG_VMAP_STACK and the THREAD_SIZE / PAGE_SIZE ratio the space for task stacks can be allocated using __vmalloc_node_range(), alloc_pages_node() and kmem_cache_alloc_node().
In the first and the second cases page->mem_cgroup pointer is set, but in the third it's not: memcg membership of a slab page should be determined using the memcg_from_slab_page() function, which looks at page->slab_cache->memcg_params.memcg . In this case, using mod_memcg_page_state() (as in account_kernel_stack()) is incorrect:page->mem_cgroup pointer is NULL even for pages charged to a non-root memory cgroup.
It can lead to kernel_stack per-memcg counters permanently showing 0 on some architectures (depending on the configuration).
In order to fix it, let's introduce a mod_memcg_obj_state() helper, which takes a pointer to a kernel object as a first argument, uses mem_cgroup_from_obj() to get a RCU-protected memcg pointer and calls mod_memcg_state(). It allows to handle all possible configurations (CONFIG_VMAP_STACK and various THREAD_SIZE/PAGE_SIZE values) without spilling any memcg/kmem specifics into fork.c .
Note: This is a special version of the patch created for stable backports. It contains code from the following two patches:
- mm: memcg/slab: introduce mem_cgroup_from_obj()
- mm: fork: fix kernel_stack memcg stats for various stack implementations
--- include/linux/memcontrol.h | 12 ++++++++++++ kernel/fork.c | 4 ++-- mm/memcontrol.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 2 deletions(-)
include/linux/memcontrol.h +12 -0
@@ -705,6 +705,7 @@ static inline unsigned long lruvec_page_void __mod_lruvec_state (struct lruvec *lruvec,enum node_stat_item idx,int val);void __mod_lruvec_slab_state (void *p,enum node_stat_item idx,int val); +void mod_memcg_obj_state (void *p,int idx,int val);static inline void mod_lruvec_state (struct lruvec *lruvec,enum node_stat_item idx,int val)
@@ -1128,6 +1129,10 @@ static inline void __mod_lruvec_slab_sta__mod_node_page_state (page_pgdat (page), idx, val); } +static inline void mod_memcg_obj_state (void *p,int idx,int val) +{ +} + static inline unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order, gfp_t gfp_mask,
@@ -1432,6 +1437,8 @@ static inline int memcg_cache_id(struct return memcg ? memcg->kmemcg_id : -1; } +struct mem_cgroup *mem_cgroup_from_obj (void *p); +#else static inline int memcg_kmem_charge (struct page *page,gfp_t gfp,int order)
@@ -1473,6 +1480,11 @@ static inline void memcg_put_cache_ids(v { } +static inline struct mem_cgroup *mem_cgroup_from_obj (void *p) +{ +return NULL ; +} +#endif /* CONFIG_MEMCG_KMEM */ #endif /* _LINUX_MEMCONTROL_H */
kernel/fork.c +2 -2
@@ -394,8 +394,8 @@ static void account_kernel_stack(structmod_zone_page_state (page_zone (first_page),NR_KERNEL_STACK_KB ,THREAD_SIZE /1024 * account); -mod_memcg_page_state (first_page,MEMCG_KERNEL_STACK_KB , - account * (THREAD_SIZE /1024 )); +mod_memcg_obj_state (stack,MEMCG_KERNEL_STACK_KB , + account * (THREAD_SIZE /1024 )); } }
mm/memcontrol.c +38 -0
@@ -786,6 +786,17 @@ void __mod_lruvec_slab_state(void *p, enrcu_read_unlock (); } +void mod_memcg_obj_state (void *p,int idx,int val) +{ +struct mem_cgroup *memcg; + +rcu_read_lock (); + memcg =mem_cgroup_from_obj (p); +if (memcg) +mod_memcg_state (memcg, idx, val); +rcu_read_unlock (); +} +/** * __count_memcg_events - account VM events in a cgroup * @memcg: the memory cgroup
@@ -2778,6 +2789,33 @@ static void commit_charge(struct page *p }#ifdef CONFIG_MEMCG_KMEM +/* +* Returns a pointer to the memory cgroup to which the kernel object is charged. +* +* The caller must ensure the memcg lifetime, e.g. by taking rcu_read_lock(), +* cgroup_mutex, etc. +*/ +struct mem_cgroup *mem_cgroup_from_obj (void *p) +{ +struct page *page; + +if (mem_cgroup_disabled ()) +return NULL ; + + page =virt_to_head_page (p); + +/* +* Slab pages don't have page->mem_cgroup set because corresponding +* kmem caches can be reparented during the lifetime. That's why +* memcg_from_slab_page() should be used instead. +*/ +if (PageSlab (page)) +return memcg_from_slab_page (page); + +/* All other pages use page->mem_cgroup */ +return page->mem_cgroup; +} +static int memcg_alloc_cache_id (void ) {int id, size;
Greg Kroah-Hartman
maintainerPATCH 104/155 gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit efaa87fa0947d525cf7c075316adde4e3ac7720b upstream.
Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") added a quirk for some models of the HP x2 10 series.
There are 2 issues with the comment describing the quirk:
1) The comment claims the DMI quirk applies to all Cherry Trail based HP x2 10 models. In the mean time I have learned that there are at least 3 models of the HP x2 10 models:
Bay Trail SoC + AXP288 PMIC
Cherry Trail SoC + AXP288 PMIC
Cherry Trail SoC + TI PMIC
And this quirk's DMI matches only match the Cherry Trail SoC + TI PMIC SoC, which is good because we want a slightly different quirk for the others. This commit updates the comment to make it clear that the quirk is only for the Cherry Trail SoC + TI PMIC models.
2) The comment says that it is ok to disable wakeup on all ACPI GPIO event handlers, because there is only the one for the embedded-controller events. This is not true, there also is a handler for the special INT0002 device which is related to USB wakeups. We need to also disable wakeups on that one because the device turns of the USB-keyboard built into the dock when closing the lid. The XHCI controller takes a while to notice this, so it only notices it when already suspended, causing a spurious wakeup because of this. So disabling wakeup on all handlers is the right thing to do, but not because there only is the one handler for the EC events. This commit updates the comment to correctly reflect this.
--- drivers/gpio/gpiolib-acpi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/gpio/gpiolib-acpi.c +8 -6
@@ -1338,12 +1338,14 @@ static const struct dmi_system_id gpioli }, {/* -* Various HP X2 10 Cherry Trail models use an external -* embedded-controller connected via I2C + an ACPI GPIO -* event handler. The embedded controller generates various -* spurious wakeup events when suspended. So disable wakeup -* for its handler (it uses the only ACPI GPIO event handler). -* This breaks wakeup when opening the lid, the user needs +* HP X2 10 models with Cherry Trail SoC + TI PMIC use an +* external embedded-controller connected via I2C + an ACPI GPIO +* event handler on INT33FF:01 pin 0, causing spurious wakeups. +* When suspending by closing the LID, the power to the USB +* keyboard is turned off, causing INT0002 ACPI events to +* trigger once the XHCI controller notices the keyboard is +* gone. So INT0002 events cause spurious wakeups too. Ignoring +* EC wakes breaks wakeup when opening the lid, the user needs * to press the power-button to wakeup the system. The * alternative is suspend simply not working, which is worse. */
Greg Kroah-Hartman
maintainerPATCH 105/155 gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 2ccb21f5516afef5e251184eeefbf36db90206d7 upstream.
Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") was added to deal with spurious wakeups on one specific model of the HP x2 10 series.
The approach taken there was to add a bool controlling wakeup support for all ACPI GPIO events. This was sufficient for the specific HP x2 10 model the commit was trying to fix, but in the mean time other models have turned up which need a similar workaround to avoid spurious wakeups from suspend, but only for one of the pins on which the ACPI tables request ACPI GPIO events.
Since the honor_wakeup option was added to be able to ignore wake events, the name was perhaps not the best, this commit renames it to ignore_wake and changes it to a string with the following format:
gpiolib_acpi.ignore_wake=controller@pin[,controller@pin[,...]]
This allows working around spurious wakeup issues on a per pin basis.
This commit also reworks the existing quirk for the HP x2 10 so that it functions as before.
Note:
-This removes the honor_wakeup parameter. This has only been upstream for
a short time and to the best of my knowledge there are no users using this module parameter.
-The controller@pin[,controller@pin[,...]] syntax is based on an existing
kernel module parameter using the same controller@pin format. That version uses ';' as separator, but in practice that is problematic because grub2 cannot handle this without taking special care to escape the ';', so here we are using a ',' as separator instead which does not have this issue.
--- drivers/gpio/gpiolib-acpi.c | 96 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 76 insertions(+), 20 deletions(-)
drivers/gpio/gpiolib-acpi.c +76 -20
@@ -21,18 +21,21 @@#include "gpiolib.h" #include "gpiolib-acpi.h" -#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l -#define QUIRK_NO_WAKEUP 0x02l -static int run_edge_events_on_boot =-1 ;module_param (run_edge_events_on_boot, int,0444 );MODULE_PARM_DESC (run_edge_events_on_boot,"Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto" ); -static int honor_wakeup =-1 ; -module_param (honor_wakeup, int,0444 ); -MODULE_PARM_DESC (honor_wakeup, -"Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto" ); +static char *ignore_wake; +module_param (ignore_wake, charp,0444 ); +MODULE_PARM_DESC (ignore_wake, +"controller@pin combos on which to ignore the ACPI wake flag " +"ignore_wake=controller@pin[,controller@pin[,...]]" ); + +struct acpi_gpiolib_dmi_quirk { +bool no_edge_events_on_boot; +char *ignore_wake; +};/** * struct acpi_gpio_event - ACPI GPIO event handler data
@@ -202,6 +205,57 @@ static void acpi_gpiochip_request_irqs(sacpi_gpiochip_request_irq (acpi_gpio, event); } +static bool acpi_gpio_in_ignore_list (const char *controller_in,int pin_in) +{ +const char *controller, *pin_str; +int len, pin; +char *endp; + + controller = ignore_wake; +while (controller) { + pin_str =strchr (controller,'@' ); +if (!pin_str) + goto err; + + len = pin_str - controller; +if (len ==strlen (controller_in) && +strncmp (controller, controller_in, len) ==0 ) { + pin =simple_strtoul (pin_str +1 , &endp,10 ); +if (*endp !=0 && *endp !=',' ) + goto err; + +if (pin == pin_in) +return true; + } + + controller =strchr (controller,',' ); +if (controller) + controller++; + } + +return false; +err: +pr_err_once ("Error invalid value for gpiolib_acpi.ignore_wake: %s\n" , + ignore_wake); +return false; +} + +static bool acpi_gpio_irq_is_wake (struct device *parent, +struct acpi_resource_gpio *agpio) +{ +int pin = agpio->pin_table[0 ]; + +if (agpio->wake_capable !=ACPI_WAKE_CAPABLE ) +return false; + +if (acpi_gpio_in_ignore_list (dev_name (parent), pin)) { +dev_info (parent,"Ignoring wakeup on pin %d\n" , pin); +return false; + } + +return true; +} +static acpi_status acpi_gpiochip_alloc_event (struct acpi_resource *ares,void *context) {
@@ -282,7 +336,7 @@ static acpi_status acpi_gpiochip_alloc_e event->handle = evt_handle; event->handler = handler; event->irq = irq; - event->irq_is_wake = honor_wakeup && agpio->wake_capable ==ACPI_WAKE_CAPABLE ; + event->irq_is_wake =acpi_gpio_irq_is_wake (chip->parent, agpio); event->pin = pin; event->desc = desc;
@@ -1321,7 +1375,9 @@ static const struct dmi_system_id gpioliDMI_MATCH (DMI_SYS_VENDOR ,"MINIX" ), DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), }, - .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + .driver_data = &(struct acpi_gpiolib_dmi_quirk ) { + .no_edge_events_on_boot = true, + }, }, {/*
@@ -1334,7 +1390,9 @@ static const struct dmi_system_id gpioliDMI_MATCH (DMI_SYS_VENDOR ,"Wortmann_AG" ), DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), }, - .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + .driver_data = &(struct acpi_gpiolib_dmi_quirk ) { + .no_edge_events_on_boot = true, + }, }, {/*
@@ -1353,33 +1411,31 @@ static const struct dmi_system_id gpioli DMI_MATCH(DMI_SYS_VENDOR, "HP"), DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), }, - .driver_data = (void *)QUIRK_NO_WAKEUP, + .driver_data = &(struct acpi_gpiolib_dmi_quirk) { + .ignore_wake = "INT33FF:01@0,INT0002:00@2", + }, }, {}/* Terminating entry */ };static int acpi_gpio_setup_params (void ) { +const struct acpi_gpiolib_dmi_quirk *quirk =NULL ;const struct dmi_system_id *id; -long quirks =0 ; id =dmi_first_match (gpiolib_acpi_quirks);if (id) - quirks = (long )id->driver_data; + quirk = id->driver_data;if (run_edge_events_on_boot <0 ) { -if (quirks &QUIRK_NO_EDGE_EVENTS_ON_BOOT ) +if (quirk && quirk->no_edge_events_on_boot) run_edge_events_on_boot =0 ;else run_edge_events_on_boot =1 ; } -if (honor_wakeup <0 ) { -if (quirks &QUIRK_NO_WAKEUP ) - honor_wakeup =0 ; -else - honor_wakeup =1 ; - } +if (ignore_wake ==NULL && quirk && quirk->ignore_wake) + ignore_wake = quirk->ignore_wake;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 106/155 gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 0e91506ba00730f088961a8d39f8693b0f8e3fea upstream.
Commit aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") was added to deal with spurious wakeups on one specific model of the HP x2 10 series. In the mean time I have learned that there are at least 3 different HP x2 10 models:
Bay Trail SoC + AXP288 PMIC
Cherry Trail SoC + AXP288 PMIC
Cherry Trail SoC + TI PMIC
And the original quirk is only correct for (and only matches the) Cherry Trail SoC + TI PMIC model.
The Bay Trail SoC + AXP288 PMIC model has different DMI strings, has the external EC interrupt on a different GPIO pin and only needs to ignore wakeups on the EC interrupt, the INT0002 device works fine on this model.
This commit adds an extra DMI based quirk for the HP x2 10 BYT + AXP288 model, ignoring wakeups for ACPI GPIO events on the EC interrupt pin on this model. This fixes spurious wakeups from suspend on this model.
--- drivers/gpio/gpiolib-acpi.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/gpio/gpiolib-acpi.c +15 -0
@@ -1415,6 +1415,21 @@ static const struct dmi_system_id gpioli .ignore_wake = "INT33FF:01@0,INT0002:00@2", }, }, + { + /* + * HP X2 10 models with Bay Trail SoC + AXP288 PMIC use an + * external embedded-controller connected via I2C + an ACPI GPIO + * event handler on INT33FC:02 pin 28, causing spurious wakeups. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), + DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), + DMI_MATCH(DMI_BOARD_NAME, "815D"), + }, + .driver_data = &(struct acpi_gpiolib_dmi_quirk) { + .ignore_wake = "INT33FC:02@28", + }, + }, {} /* Terminating entry */ };
Greg Kroah-Hartman
maintainerPATCH 107/155 bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
commit 1d8006abaab4cb90f81add86e8d1bf9411add05a upstream.
There is no compensating cgroup_bpf_put() for each ancestor cgroup in cgroup_bpf_inherit(). If compute_effective_progs returns error, those cgroups won't be freed ever. Fix it by putting them in cleanup code path.
--- kernel/bpf/cgroup.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/cgroup.c +3 -0
@@ -228,6 +228,9 @@ cleanup:for (i =0 ; i <NR ; i++)bpf_prog_array_free (arrays[i]); +for (p =cgroup_parent (cgrp); p; p =cgroup_parent (p)) +cgroup_bpf_put (p); +percpu_ref_exit (&cgrp->bpf.refcnt);return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 108/155 RDMA/core: Ensure security pkey modify is not lost
In reply to Greg Kroah-HartmanFrom: Mike Marciniszyn <[email protected]>
commit 2d47fbacf2725a67869f4d3634c2415e7dfab2f4 upstream.
The following modify sequence (loosely based on ipoib) will lose a pkey modifcation:
- Modify (pkey index, port)
- Modify (new pkey index, NO port)
After the first modify, the qp_pps list will have saved the pkey and the unit on the main list.
During the second modify, get_new_pps() will fetch the port from qp_pps and read the new pkey index from qp_attr->pkey_index. The state will still be zero, or IB_PORT_PKEY_NOT_VALID. Because of the invalid state, the new values will never replace the one in the qp pps list, losing the new pkey.
This happens because the following if statements will never correct the state because the first term will be false. If the code had been executed, it would incorrectly overwrite valid values.
if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))
new_pps->main.state = IB_PORT_PKEY_VALID;
if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) {
new_pps->main.port_num = qp_pps->main.port_num;
new_pps->main.pkey_index = qp_pps->main.pkey_index;
if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
new_pps->main.state = IB_PORT_PKEY_VALID;}
Fix by joining the two if statements with an or test to see if qp_pps is non-NULL and in the correct state.
--- drivers/infiniband/core/security.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/infiniband/core/security.c +3 -8
@@ -349,16 +349,11 @@ static struct ib_ports_pkeys *get_new_ppelse if (qp_pps) new_pps->main.pkey_index = qp_pps->main.pkey_index; -if ((qp_attr_mask &IB_QP_PKEY_INDEX ) && (qp_attr_mask &IB_QP_PORT )) +if (((qp_attr_mask &IB_QP_PKEY_INDEX ) && + (qp_attr_mask &IB_QP_PORT )) || + (qp_pps && qp_pps->main.state !=IB_PORT_PKEY_NOT_VALID )) new_pps->main.state =IB_PORT_PKEY_VALID ; -if (!(qp_attr_mask & (IB_QP_PKEY_INDEX |IB_QP_PORT )) && qp_pps) { - new_pps->main.port_num = qp_pps->main.port_num; - new_pps->main.pkey_index = qp_pps->main.pkey_index; -if (qp_pps->main.state !=IB_PORT_PKEY_NOT_VALID ) - new_pps->main.state =IB_PORT_PKEY_VALID ; - } -if (qp_attr_mask &IB_QP_ALT_PATH ) { new_pps->alt.port_num = qp_attr->alt_port_num; new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
Greg Kroah-Hartman
maintainerPATCH 109/155 afs: Fix handling of an abort from a service handler
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit dde9f095583b3f375ba23979045ee10dfcebec2f upstream.
When an AFS service handler function aborts a call, AF_RXRPC marks the call as complete - which means that it's not going to get any more packets from the receiver. This is a problem because reception of the final ACK is what triggers afs_deliver_to_call() to drop the final ref on the afs_call object.
Instead, aborted AFS service calls may then just sit around waiting for ever or until they're displaced by a new call on the same connection channel or a connection-level abort.
Fix this by calling afs_set_call_complete() to finalise the afs_call struct representing the call.
However, we then need to drop the ref that stops the call from being deallocated. We can do this in afs_set_call_complete(), as the work queue is holding a separate ref of its own, but then we shouldn't do it in afs_process_async_call() and afs_delete_async_call().
call->drop_ref is set to indicate that a ref needs dropping for a call and this is dealt with when we transition a call to AFS_CALL_COMPLETE.
But then we also need to get rid of the ref that pins an asynchronous client call. We can do this by the same mechanism, setting call->drop_ref for an async client call too.
We can also get rid of call->incoming since nothing ever sets it and only one thing ever checks it (futilely).
A trace of the rxrpc_call and afs_call struct ref counting looks like:
<idle>-0 [001] ..s5 164.764892: rxrpc_call: c=00000002 SEE u=3 sp=rxrpc_new_incoming_call+0x473/0xb34 a=00000000442095b5
<idle>-0 [001] .Ns5 164.766001: rxrpc_call: c=00000002 QUE u=4 sp=rxrpc_propose_ACK+0xbe/0x551 a=00000000442095b5
<idle>-0 [001] .Ns4 164.766005: rxrpc_call: c=00000002 PUT u=3 sp=rxrpc_new_incoming_call+0xa3f/0xb34 a=00000000442095b5
<idle>-0 [001] .Ns7 164.766433: afs_call: c=00000002 WAKE u=2 o=11 sp=rxrpc_notify_socket+0x196/0x33c
kworker/1:2-1810 [001] ...1 164.768409: rxrpc_call: c=00000002 SEE u=3 sp=rxrpc_process_call+0x25/0x7ae a=00000000442095b5
kworker/1:2-1810 [001] ...1 164.769439: rxrpc_tx_packet: c=00000002 e9f1a7a8:95786a88:00000008:09c5 00000001 00000000 02 22 ACK CallAck
kworker/1:2-1810 [001] ...1 164.769459: rxrpc_call: c=00000002 PUT u=2 sp=rxrpc_process_call+0x74f/0x7ae a=00000000442095b5
kworker/1:2-1810 [001] ...1 164.770794: afs_call: c=00000002 QUEUE u=3 o=12 sp=afs_deliver_to_call+0x449/0x72c
kworker/1:2-1810 [001] ...1 164.770829: afs_call: c=00000002 PUT u=2 o=12 sp=afs_process_async_call+0xdb/0x11e
kworker/1:2-1810 [001] ...2 164.771084: rxrpc_abort: c=00000002 95786a88:00000008 s=0 a=1 e=1 K-1
kworker/1:2-1810 [001] ...1 164.771461: rxrpc_tx_packet: c=00000002 e9f1a7a8:95786a88:00000008:09c5 00000002 00000000 04 00 ABORT CallAbort
kworker/1:2-1810 [001] ...1 164.771466: afs_call: c=00000002 PUT u=1 o=12 sp=SRXAFSCB_ProbeUuid+0xc1/0x106The abort generated in SRXAFSCB_ProbeUuid(), labelled "K-1", indicates that the local filesystem/cache manager didn't recognise the UUID as its own.
--- fs/afs/cmservice.c | 14 ++++++++++++-- fs/afs/internal.h | 12 ++++++++++-- fs/afs/rxrpc.c | 33 ++++----------------------------- 3 files changed, 26 insertions(+), 33 deletions(-)
fs/afs/cmservice.c +12 -2
@@ -244,6 +244,17 @@ static void afs_cm_destructor(struct afs }/* +* Abort a service call from within an action function. +*/ +static void afs_abort_service_call (struct afs_call *call,u32 abort_code,int error, +const char *why) +{ +rxrpc_kernel_abort_call (call->net->socket, call->rxcall, + abort_code, error, why); +afs_set_call_complete (call, error,0 ); +} + +/* * The server supplied a list of callbacks that it wanted to break. */ static void SRXAFSCB_CallBack (struct work_struct *work)
@@ -510,8 +521,7 @@ static void SRXAFSCB_ProbeUuid(struct woif (memcmp (r, &call->net->uuid,sizeof (call->net->uuid)) ==0 )afs_send_empty_reply (call);else -rxrpc_kernel_abort_call (call->net->socket, call->rxcall, -1 ,1 ,"K-1" ); +afs_abort_service_call (call,1 ,1 ,"K-1" );afs_put_call (call);_leave ("" );
fs/afs/internal.h +10 -2
@@ -154,7 +154,7 @@ struct afs_call { };unsigned char unmarshall;/* unmarshalling phase */ unsigned char addr_ix;/* Address in ->alist */ -bool incoming;/* T if incoming call */ +bool drop_ref;/* T if need to drop ref for incoming call */ bool send_pages;/* T if data from mapping should be sent */ bool need_attention;/* T if RxRPC poked us */ bool async;/* T if asynchronous */
@@ -1203,8 +1203,16 @@ static inline void afs_set_call_complete ok = true; }spin_unlock_bh (&call->state_lock); -if (ok) +if (ok) {trace_afs_call_done (call); + +/* Asynchronous calls have two refs to release - one from the alloc and +* one queued with the work item - and we can't just deallocate the +* call because the work item may be queued again. +*/ +if (call->drop_ref) +afs_put_call (call); + } }/*
fs/afs/rxrpc.c +4 -29
@@ -18,7 +18,6 @@ struct workqueue_struct *afs_async_callsstatic void afs_wake_up_call_waiter (struct sock *,struct rxrpc_call *,unsigned long );static void afs_wake_up_async_call (struct sock *,struct rxrpc_call *,unsigned long ); -static void afs_delete_async_call (struct work_struct *);static void afs_process_async_call (struct work_struct *);static void afs_rx_new_call (struct sock *,struct rxrpc_call *,unsigned long );static void afs_rx_discard_new_call (struct rxrpc_call *,unsigned long );
@@ -402,8 +401,10 @@ void afs_make_call(struct afs_addr_curso/* If the call is going to be asynchronous, we need an extra ref for * the call to hold itself so the caller need not hang on to its ref. */ -if (call->async) +if (call->async) {afs_get_call (call, afs_call_trace_get); + call->drop_ref = true; + }/* create a call */ rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
@@ -584,8 +585,6 @@ static void afs_deliver_to_call(struct a done:if (call->type->done) call->type->done (call); -if (state ==AFS_CALL_COMPLETE && call->incoming) -afs_put_call (call); out:_leave ("" );return ;
@@ -745,21 +744,6 @@ static void afs_wake_up_async_call(struc }/* -* Delete an asynchronous call. The work item carries a ref to the call struct -* that we need to release. -*/ -static void afs_delete_async_call (struct work_struct *work) -{ - struct afs_call *call = container_of(work, struct afs_call, async_work); - -_enter ("" ); - -afs_put_call (call); - -_leave ("" ); -} - -/* * Perform I/O processing on an asynchronous call. The work item carries a ref * to the call struct that we either need to release or to pass on. */
@@ -774,16 +758,6 @@ static void afs_process_async_call(strucafs_deliver_to_call (call); } -if (call->state ==AFS_CALL_COMPLETE ) { -/* We have two refs to release - one from the alloc and one -* queued with the work item - and we can't just deallocate the -* call because the work item may be queued again. -*/ - call->async_work.func = afs_delete_async_call; -if (!queue_work (afs_async_calls, &call->async_work)) -afs_put_call (call); - } -afs_put_call (call);_leave ("" ); }
@@ -810,6 +784,7 @@ void afs_charge_preallocation(struct worif (!call)break ; + call->drop_ref = true; call->async = true; call->state =AFS_CALL_SV_AWAIT_OP_ID ;init_waitqueue_head (&call->waitq);
Greg Kroah-Hartman
maintainerPATCH 110/155 genirq: Fix reference leaks on irq affinity notifiers
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
commit df81dfcfd6991d547653d46c051bac195cd182c1 upstream.
The handling of notify->work did not properly maintain notify->kref in two
cases:
1) where the work was already scheduled, another irq_set_affinity_locked() would get the ref and (no-op-ly) schedule the work. Thus when irq_affinity_notify() ran, it would drop the original ref but not the additional one.
2) when cancelling the (old) work in irq_set_affinity_notifier(), if there was outstanding work a ref had been got for it but was never put.
Fix both by checking the return values of the work handling functions
(schedule_work() for (1) and cancel_work_sync() for (2)) and put the extra ref if the return value indicates preexisting work.
--- kernel/irq/manage.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/irq/manage.c +9 -2
@@ -284,7 +284,11 @@ int irq_set_affinity_locked(struct irq_dif (desc->affinity_notify) {kref_get (&desc->affinity_notify->kref); -schedule_work (&desc->affinity_notify->work); +if (!schedule_work (&desc->affinity_notify->work)) { +/* Work was already scheduled, drop our extra ref */ +kref_put (&desc->affinity_notify->kref, + desc->affinity_notify->release); + } }irqd_set (data,IRQD_AFFINITY_SET );
@@ -384,7 +388,10 @@ irq_set_affinity_notifier(unsigned int iraw_spin_unlock_irqrestore (&desc->lock, flags);if (old_notify) { -cancel_work_sync (&old_notify->work); +if (cancel_work_sync (&old_notify->work)) { +/* Pending work had a ref, put that one too */ +kref_put (&old_notify->kref, old_notify->release); + }kref_put (&old_notify->kref, old_notify->release); }
Greg Kroah-Hartman
maintainerPATCH 111/155 xfrm: handle NETDEV_UNREGISTER for xfrm device
In reply to Greg Kroah-HartmanFrom: Raed Salem <[email protected]>
commit 03891f820c2117b19e80b370281eb924a09cf79f upstream.
This patch to handle the asynchronous unregister device event so the device IPsec offload resources could be cleanly released.
--- net/xfrm/xfrm_device.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_device.c +1 -0
@@ -390,6 +390,7 @@ static int xfrm_dev_event(struct notifiereturn xfrm_dev_feat_change (dev);case NETDEV_DOWN : +case NETDEV_UNREGISTER :return xfrm_dev_down (dev); }return NOTIFY_DONE ;
Greg Kroah-Hartman
maintainerPATCH 112/155 vti[6]: fix packet tx through bpf_redirect() in XinY cases
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
commit f1ed10264ed6b66b9cd5e8461cffce69be482356 upstream.
I forgot the 4in6/6in4 cases in my previous patch. Let's fix them.
--- net/ipv4/Kconfig | 1 + net/ipv4/ip_vti.c | 36 +++++++++++++++++++++++++++++------- net/ipv6/ip6_vti.c | 32 +++++++++++++++++++++++++------- 3 files changed, 55 insertions(+), 14 deletions(-)
net/ipv4/Kconfig +1 -0
@@ -303,6 +303,7 @@ config SYN_COOKIES config NET_IPVTI tristate "Virtual (secure) IP: tunneling" + depends on IPV6 || IPV6=n select INET_TUNNEL select NET_IP_TUNNEL select XFRM
net/ipv4/ip_vti.c +29 -7
@@ -187,17 +187,39 @@ static netdev_tx_t vti_xmit(struct sk_buint mtu;if (!dst) { -struct rtable *rt; +switch (skb->protocol) { +case htons (ETH_P_IP ): { +struct rtable *rt; - fl->u.ip4.flowi4_oif = dev->ifindex; - fl->u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; - rt =__ip_route_output_key (dev_net (dev), &fl->u.ip4); -if (IS_ERR (rt)) { + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl->u.ip4); +if (IS_ERR (rt)) { + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } + dst = &rt->dst; +skb_dst_set (skb, dst); +break ; + } +#if IS_ENABLED (CONFIG_IPV6 ) +case htons (ETH_P_IPV6 ): + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl->u.ip6); +if (dst->error) { +dst_release (dst); + dst =NULL ; + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } +skb_dst_set (skb, dst); +break ; +#endif +default : dev->stats.tx_carrier_errors++; goto tx_error_icmp; } - dst = &rt->dst; -skb_dst_set (skb, dst); }dst_hold (dst);
net/ipv6/ip6_vti.c +25 -7
@@ -450,15 +450,33 @@ vti6_xmit(struct sk_buff *skb, struct neint mtu;if (!dst) { - fl->u.ip6.flowi6_oif = dev->ifindex; - fl->u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; - dst =ip6_route_output (dev_net (dev),NULL , &fl->u.ip6); -if (dst->error) { -dst_release (dst); - dst =NULL ; +switch (skb->protocol) { +case htons (ETH_P_IP ): { +struct rtable *rt; + + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl->u.ip4); +if (IS_ERR (rt)) + goto tx_err_link_failure; + dst = &rt->dst; +skb_dst_set (skb, dst); +break ; + } +case htons (ETH_P_IPV6 ): + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl->u.ip6); +if (dst->error) { +dst_release (dst); + dst =NULL ; + goto tx_err_link_failure; + } +skb_dst_set (skb, dst); +break ; +default : goto tx_err_link_failure; } -skb_dst_set (skb, dst); }dst_hold (dst);
Greg Kroah-Hartman
maintainerPATCH 113/155 RDMA/mlx5: Fix the number of hwcounters of a dynamic counter
In reply to Greg Kroah-HartmanFrom: Mark Zhang <[email protected]>
commit ec16b6bbdab1ce2b03f46271460efc7f450658cd upstream.
When we read the global counter and there's any dynamic counter allocated, the value of a hwcounter is the sum of the default counter and all dynamic counters. So the number of hwcounters of a dynamically allocated counter must be same as of the default counter, otherwise there will be read violations.
This fixes the KASAN slab-out-of-bounds bug:
BUG: KASAN: slab-out-of-bounds in rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] Read of size 8 at addr ffff8884192a5778 by task rdma/10138 CPU: 7 PID: 10138 Comm: rdma Not tainted 5.5.0-for-upstream-dbg-2020-02-06_18-30-19-27 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0xb7/0x10b print_address_description.constprop.4+0x1e2/0x400 ? rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] __kasan_report+0x15c/0x1e0 ? mlx5_ib_query_q_counters+0x13f/0x270 [mlx5_ib] ? rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] kasan_report+0xe/0x20 rdma_counter_get_hwstat_value+0x36d/0x390 [ib_core] ? rdma_counter_query_stats+0xd0/0xd0 [ib_core] ? memcpy+0x34/0x50 ? nla_put+0xe2/0x170 nldev_stat_get_doit+0x9c7/0x14f0 [ib_core] ... do_syscall_64+0x95/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fcc457fe65a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa f1 2b 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 RSP: 002b:00007ffc0586f868 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcc457fe65a RDX: 0000000000000020 RSI: 00000000013db920 RDI: 0000000000000003 RBP: 00007ffc0586fa90 R08: 00007fcc45ac10e0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004089c0 R13: 0000000000000000 R14: 00007ffc0586fab0 R15: 00000000013dc9a0 Allocated by task 9700: save_stack+0x19/0x80 __kasan_kmalloc.constprop.7+0xa0/0xd0 mlx5_ib_counter_alloc_stats+0xd1/0x1d0 [mlx5_ib] rdma_counter_alloc+0x16d/0x3f0 [ib_core] rdma_counter_bind_qpn_alloc+0x216/0x4e0 [ib_core] nldev_stat_set_doit+0x8c2/0xb10 [ib_core] rdma_nl_rcv_msg+0x3d2/0x730 [ib_core] rdma_nl_rcv+0x2a8/0x400 [ib_core] netlink_unicast+0x448/0x620 netlink_sendmsg+0x731/0xd10 sock_sendmsg+0xb1/0xf0 __sys_sendto+0x25d/0x2c0 __x64_sys_sendto+0xdd/0x1b0 do_syscall_64+0x95/0x490 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/infiniband/hw/mlx5/main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/main.c +3 -2
@@ -5638,9 +5638,10 @@ mlx5_ib_counter_alloc_stats(struct rdma_const struct mlx5_ib_counters *cnts =get_counters (dev, counter->port -1 ); -/* Q counters are in the beginning of all counters */ return rdma_alloc_hw_stats_struct (cnts->names, - cnts->num_q_counters, + cnts->num_q_counters + + cnts->num_cong_counters + + cnts->num_ext_ppcnt_counters,RDMA_HW_STATS_DEFAULT_LIFESPAN ); }
Greg Kroah-Hartman
maintainerPATCH 114/155 RDMA/mlx5: Fix access to wrong pointer while performing flush due to error
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
commit 950bf4f17725556bbc773a5b71e88a6c14c9ff25 upstream.
The main difference between send and receive SW completions is related to separate treatment of WQ queue. For receive completions, the initial index to be flushed is stored in "tail", while for send completions, it is in deleted "last_poll".
CPU: 54 PID: 53405 Comm: kworker/u161:0 Kdump: loaded Tainted: G OE --------- -t - 4.18.0-147.el8.ppc64le #1 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] NIP: c000003c7c00a000 LR: c00800000e586af4 CTR: c000003c7c00a000 REGS: c0000036cc9db940 TRAP: 0400 Tainted: G OE --------- -t - (4.18.0-147.el8.ppc64le) MSR: 9000000010009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 24004488 XER: 20040000 CFAR: c00800000e586af0 IRQMASK: 0 GPR00: c00800000e586ab4 c0000036cc9dbbc0 c00800000e5f1a00 c0000037d8433800 GPR04: c000003895a26800 c0000037293f2000 0000000000000201 0000000000000011 GPR08: c000003895a26c80 c000003c7c00a000 0000000000000000 c00800000ed30438 GPR12: c000003c7c00a000 c000003fff684b80 c00000000017c388 c00000396ec4be40 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: c00000000151e498 0000000000000010 c000003895a26848 0000000000000010 GPR24: 0000000000000010 0000000000010000 c000003895a26800 0000000000000000 GPR28: 0000000000000010 c0000037d8433800 c000003895a26c80 c000003895a26800 NIP [c000003c7c00a000] 0xc000003c7c00a000 LR [c00800000e586af4] __ib_process_cq+0xec/0x1b0 [ib_core] Call Trace: [c0000036cc9dbbc0] [c00800000e586ab4] __ib_process_cq+0xac/0x1b0 [ib_core] (unreliable) [c0000036cc9dbc40] [c00800000e586c88] ib_cq_poll_work+0x40/0xb0 [ib_core] [c0000036cc9dbc70] [c000000000171f44] process_one_work+0x2f4/0x5c0 [c0000036cc9dbd10] [c000000000172a0c] worker_thread+0xcc/0x760 [c0000036cc9dbdc0] [c00000000017c52c] kthread+0x1ac/0x1c0 [c0000036cc9dbe30] [c00000000000b75c] ret_from_kernel_thread+0x5c/0x80
--- drivers/infiniband/hw/mlx5/cq.c | 27 +++++++++++++++++++++++++-- drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/qp.c | 1 + 3 files changed, 27 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mlx5/cq.c +25 -2
@@ -330,6 +330,22 @@ static void mlx5_handle_error_cqe(structdump_cqe (dev, cqe); } +static void handle_atomics (struct mlx5_ib_qp *qp,struct mlx5_cqe64 *cqe64, +u16 tail,u16 head) +{ +u16 idx; + +do { + idx = tail & (qp->sq.wqe_cnt -1 ); +if (idx == head) +break ; + + tail = qp->sq.w_list[idx].next; + }while (1 ); + tail = qp->sq.w_list[idx].next; + qp->sq.last_poll = tail; +} +static void free_cq_buf (struct mlx5_ib_dev *dev,struct mlx5_ib_cq_buf *buf) {mlx5_frag_buf_free (dev->mdev, &buf->frag_buf);
@@ -368,7 +384,7 @@ static void get_sig_err_item(struct mlx5 }static void sw_comp (struct mlx5_ib_qp *qp,int num_entries,struct ib_wc *wc, -int *npolled,int is_send) +int *npolled,bool is_send) {struct mlx5_ib_wq *wq;unsigned int cur;
@@ -383,10 +399,16 @@ static void sw_comp(struct mlx5_ib_qp *qreturn ;for (i =0 ; i < cur && np < num_entries; i++) { - wc->wr_id = wq->wrid[wq->tail & (wq->wqe_cnt -1 )]; +unsigned int idx; + + idx = (is_send) ? wq->last_poll : wq->tail; + idx &= (wq->wqe_cnt -1 ); + wc->wr_id = wq->wrid[idx]; wc->status =IB_WC_WR_FLUSH_ERR ; wc->vendor_err =MLX5_CQE_SYNDROME_WR_FLUSH_ERR ; wq->tail++; +if (is_send) + wq->last_poll = wq->w_list[idx].next; np++; wc->qp = &qp->ibqp; wc++;
@@ -476,6 +498,7 @@ repoll: wqe_ctr =be16_to_cpu (cqe64->wqe_counter); idx = wqe_ctr & (wq->wqe_cnt -1 );handle_good_req (wc, cqe64, wq, idx); +handle_atomics (*cur_qp, cqe64, wq->last_poll, idx); wc->wr_id = wq->wrid[idx]; wq->tail = wq->wqe_head[idx] +1 ; wc->status =IB_WC_SUCCESS ;
drivers/infiniband/hw/mlx5/mlx5_ib.h +1 -0
@@ -283,6 +283,7 @@ struct mlx5_ib_wq {unsigned head;unsigned tail;u16 cur_post; +u16 last_poll;void *cur_edge; };
drivers/infiniband/hw/mlx5/qp.c +1 -0
@@ -3725,6 +3725,7 @@ static int __mlx5_ib_modify_qp(struct ib qp->sq.cur_post =0 ;if (qp->sq.wqe_cnt) qp->sq.cur_edge =get_sq_edge (&qp->sq,0 ); + qp->sq.last_poll =0 ; qp->db.db[MLX5_RCV_DBR ] =0 ; qp->db.db[MLX5_SND_DBR ] =0 ; }
Greg Kroah-Hartman
maintainerPATCH 115/155 RDMA/mlx5: Block delay drop to unprivileged users
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
commit ba80013fba656b9830ef45cd40a6a1e44707f47a upstream.
It has been discovered that this feature can globally block the RX port, so it should be allowed for highly privileged users only.
--- drivers/infiniband/hw/mlx5/qp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/mlx5/qp.c +4 -0
@@ -6132,6 +6132,10 @@ struct ib_wq *mlx5_ib_create_wq(struct iif (udata->outlen && udata->outlen < min_resp_len)return ERR_PTR (-EINVAL ); +if (!capable (CAP_SYS_RAWIO ) && + init_attr->create_flags &IB_WQ_FLAGS_DELAY_DROP ) +return ERR_PTR (-EPERM ); + dev =to_mdev (pd->device);switch (init_attr->wq_type) {case IB_WQT_RQ :
Greg Kroah-Hartman
maintainerPATCH 116/155 xfrm: fix uctx len check in verify_sec_ctx_len
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 171d449a028573b2f0acdc7f31ecbb045391b320 upstream.
It's not sufficient to do 'uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len)' check only, as uctx->len may be greater than nla_len(rt), in which case it will cause slab-out-of-bounds when accessing uctx->ctx_str later.
This patch is to fix it by return -EINVAL when uctx->len > nla_len(rt).
--- net/xfrm/xfrm_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/xfrm/xfrm_user.c +2 -1
@@ -110,7 +110,8 @@ static inline int verify_sec_ctx_len(strreturn 0 ; uctx =nla_data (rt); -if (uctx->len != (sizeof (struct xfrm_user_sec_ctx ) + uctx->ctx_len)) +if (uctx->len >nla_len (rt) || + uctx->len != (sizeof (struct xfrm_user_sec_ctx ) + uctx->ctx_len))return -EINVAL ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 117/155 xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit a1a7e3a36e01ca6e67014f8cf673cb8e47be5550 upstream.
Without doing verify_sec_ctx_len() check in xfrm_add_acquire(), it may be out-of-bounds to access uctx->ctx_str with uctx->ctx_len, as noticed by syz:
BUG: KASAN: slab-out-of-bounds in selinux_xfrm_alloc_user+0x237/0x430 Read of size 768 at addr ffff8880123be9b4 by task syz-executor.1/11650 Call Trace: dump_stack+0xe8/0x16e print_address_description.cold.3+0x9/0x23b kasan_report.cold.4+0x64/0x95 memcpy+0x1f/0x50 selinux_xfrm_alloc_user+0x237/0x430 security_xfrm_policy_alloc+0x5c/0xb0 xfrm_policy_construct+0x2b1/0x650 xfrm_add_acquire+0x21d/0xa10 xfrm_user_rcv_msg+0x431/0x6f0 netlink_rcv_skb+0x15a/0x410 xfrm_netlink_rcv+0x6d/0x90 netlink_unicast+0x50e/0x6a0 netlink_sendmsg+0x8ae/0xd40 sock_sendmsg+0x133/0x170 ___sys_sendmsg+0x834/0x9a0 __sys_sendmsg+0x100/0x1e0 do_syscall_64+0xe5/0x660 entry_SYSCALL_64_after_hwframe+0x6a/0xdf
So fix it by adding the missing verify_sec_ctx_len check there.
--- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+)
net/xfrm/xfrm_user.c +3 -0
@@ -2276,6 +2276,9 @@ static int xfrm_add_acquire(struct sk_bu err =verify_newpolicy_info (&ua->policy);if (err) goto free_state; + err =verify_sec_ctx_len (attrs); +if (err) + goto free_state;/* build an XP */ xp =xfrm_policy_construct (net, &ua->policy, attrs, &err);
Greg Kroah-Hartman
maintainerPATCH 118/155 xfrm: policy: Fix doulbe free in xfrm_policy_timer
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit 4c59406ed00379c8663f8663d82b2537467ce9d7 upstream.
After xfrm_add_policy add a policy, its ref is 2, then
xfrm_policy_timer
read_lock
xp->walk.dead is 0
....
mod_timer()xfrm_policy_kill
policy->walk.dead = 1
....
del_timer(&policy->timer)
xfrm_pol_put //ref is 1
xfrm_pol_put //ref is 0
xfrm_policy_destroy
call_rcu
xfrm_pol_hold //ref is 1
read_unlock xfrm_pol_put //ref is 0
xfrm_policy_destroy
call_rcu
xfrm_policy_destroy is called twice, which may leads to double free.
Call Trace: RIP: 0010:refcount_warn_saturate+0x161/0x210 ... xfrm_policy_timer+0x522/0x600 call_timer_fn+0x1b3/0x5e0 ? __xfrm_decode_session+0x2990/0x2990 ? msleep+0xb0/0xb0 ? _raw_spin_unlock_irq+0x24/0x40 ? __xfrm_decode_session+0x2990/0x2990 ? __xfrm_decode_session+0x2990/0x2990 run_timer_softirq+0x5c5/0x10e0
Fix this by use write_lock_bh in xfrm_policy_kill.
--- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+)
net/xfrm/xfrm_policy.c +2 -0
@@ -431,7 +431,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy);static void xfrm_policy_kill (struct xfrm_policy *policy) { +write_lock_bh (&policy->lock); policy->walk.dead =1 ; +write_unlock_bh (&policy->lock);atomic_inc (&policy->genid);
Greg Kroah-Hartman
maintainerPATCH 119/155 afs: Fix client call Rx-phase signal handling
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit 7d7587db0d7fd1138f2afcffdc46a8e15630b944 upstream.
Fix the handling of signals in client rxrpc calls made by the afs filesystem. Ignore signals completely, leaving call abandonment or connection loss to be detected by timeouts inside AF_RXRPC.
Allowing a filesystem call to be interrupted after the entire request has been transmitted and an abort sent means that the server may or may not have done the action - and we don't know. It may even be worse than that for older servers.
--- fs/afs/rxrpc.c | 34 ++-------------------------------- include/net/af_rxrpc.h | 4 +--- net/rxrpc/af_rxrpc.c | 33 +++------------------------------ net/rxrpc/ar-internal.h | 1 - net/rxrpc/input.c | 1 - 5 files changed, 6 insertions(+), 67 deletions(-)
fs/afs/rxrpc.c +2 -32
@@ -603,11 +603,7 @@ call_complete:long afs_wait_for_call_to_complete (struct afs_call *call,struct afs_addr_cursor *ac) { -signed long rtt2, timeout;long ret; -bool stalled = false; -u64 rtt; -u32 life, last_life;bool rxrpc_complete = false;DECLARE_WAITQUEUE (myself, current);
@@ -618,14 +614,6 @@ long afs_wait_for_call_to_complete(strucif (ret <0 ) goto out; - rtt =rxrpc_kernel_get_rtt (call->net->socket, call->rxcall); - rtt2 =nsecs_to_jiffies64 (rtt) *2 ; -if (rtt2 <2 ) - rtt2 =2 ; - - timeout = rtt2; -rxrpc_kernel_check_life (call->net->socket, call->rxcall, &last_life); -add_wait_queue (&call->waitq, &myself);for (;;) {set_current_state (TASK_UNINTERRUPTIBLE );
@@ -636,37 +624,19 @@ long afs_wait_for_call_to_complete(struc call->need_attention = false;__set_current_state (TASK_RUNNING );afs_deliver_to_call (call); - timeout = rtt2;continue ; }if (afs_check_call_state (call,AFS_CALL_COMPLETE ))break ; -if (!rxrpc_kernel_check_life (call->net->socket, call->rxcall, &life)) { +if (!rxrpc_kernel_check_life (call->net->socket, call->rxcall)) {/* rxrpc terminated the call. */ rxrpc_complete = true;break ; } -if (call->intr && timeout ==0 && - life == last_life &&signal_pending (current)) { -if (stalled) -break ; -__set_current_state (TASK_RUNNING ); -rxrpc_kernel_probe_life (call->net->socket, call->rxcall); - timeout = rtt2; - stalled = true; -continue ; - } - -if (life != last_life) { - timeout = rtt2; - last_life = life; - stalled = false; - } - - timeout =schedule_timeout (timeout); +schedule (); }remove_wait_queue (&call->waitq, &myself);
include/net/af_rxrpc.h +1 -3
@@ -58,9 +58,7 @@ int rxrpc_kernel_charge_accept(struct so rxrpc_user_attach_call_t, unsigned long, gfp_t, unsigned int);void rxrpc_kernel_set_tx_length (struct socket *,struct rxrpc_call *,s64 ); -bool rxrpc_kernel_check_life (const struct socket *,const struct rxrpc_call *, -u32 *); -void rxrpc_kernel_probe_life (struct socket *,struct rxrpc_call *); +bool rxrpc_kernel_check_life (const struct socket *,const struct rxrpc_call *);u32 rxrpc_kernel_get_epoch (struct socket *,struct rxrpc_call *);bool rxrpc_kernel_get_reply_time (struct socket *,struct rxrpc_call *,ktime_t *);
net/rxrpc/af_rxrpc.c +3 -30
@@ -371,45 +371,18 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);* rxrpc_kernel_check_life - Check to see whether a call is still alive * @sock: The socket the call is on * @call: The call to check -* @_life: Where to store the life value * -* Allow a kernel service to find out whether a call is still alive - ie. we're -* getting ACKs from the server. Passes back in *_life a number representing -* the life state which can be compared to that returned by a previous call and -* return true if the call is still alive. -* -* If the life state stalls, rxrpc_kernel_probe_life() should be called and -* then 2RTT waited. +* Allow a kernel service to find out whether a call is still alive - +* ie. whether it has completed. */ bool rxrpc_kernel_check_life (const struct socket *sock, -const struct rxrpc_call *call, -u32 *_life) +const struct rxrpc_call *call) { - *_life = call->acks_latest;return call->state !=RXRPC_CALL_COMPLETE ; }EXPORT_SYMBOL (rxrpc_kernel_check_life);/** -* rxrpc_kernel_probe_life - Poke the peer to see if it's still alive -* @sock: The socket the call is on -* @call: The call to check -* -* In conjunction with rxrpc_kernel_check_life(), allow a kernel service to -* find out whether a call is still alive by pinging it. This should cause the -* life state to be bumped in about 2*RTT. -* -* The must be called in TASK_RUNNING state on pain of might_sleep() objecting. -*/ -void rxrpc_kernel_probe_life (struct socket *sock,struct rxrpc_call *call) -{ -rxrpc_propose_ACK (call,RXRPC_ACK_PING ,0 , true, false, - rxrpc_propose_ack_ping_for_check_life); -rxrpc_send_ack_packet (call, true,NULL ); -} -EXPORT_SYMBOL (rxrpc_kernel_probe_life); - -/** * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call. * @sock: The socket the call is on * @call: The call to query
net/rxrpc/ar-internal.h +0 -1
@@ -675,7 +675,6 @@ struct rxrpc_call {/* transmission-phase ACK management */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ -rxrpc_serial_t acks_latest;/* serial number of latest ACK received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +0 -1
@@ -882,7 +882,6 @@ static void rxrpc_input_ack(struct rxrpc before(prev_pkt, call->ackr_prev_seq)) goto out; call->acks_latest_ts = skb->tstamp; - call->acks_latest = sp->hdr.serial; call->ackr_first_seq = first_soft_ack; call->ackr_prev_seq = prev_pkt;
Greg Kroah-Hartman
maintainerPATCH 120/155 afs: Fix some tracing details
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit 4636cf184d6d9a92a56c2554681ea520dd4fe49a upstream.
Fix a couple of tracelines to indicate the usage count after the atomic op, not the usage count before it to be consistent with other afs and rxrpc trace lines.
Change the wording of the afs_call_trace_work trace ID label from "WORK" to "QUEUE" to reflect the fact that it's queueing work, not doing work.
--- fs/afs/rxrpc.c | 4 ++-- include/trace/events/afs.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/afs/rxrpc.c +2 -2
@@ -168,7 +168,7 @@ void afs_put_call(struct afs_call *call)int n =atomic_dec_return (&call->usage);int o =atomic_read (&net->nr_outstanding_calls); -trace_afs_call (call, afs_call_trace_put, n +1 , o, +trace_afs_call (call, afs_call_trace_put, n, o,__builtin_return_address (0 )); ASSERTCMP(n, >=, 0);
@@ -704,7 +704,7 @@ static void afs_wake_up_async_call(struc u =atomic_fetch_add_unless (&call->usage,1 ,0 );if (u !=0 ) { -trace_afs_call (call, afs_call_trace_wake, u, +trace_afs_call (call, afs_call_trace_wake, u +1 ,atomic_read (&call->net->nr_outstanding_calls),__builtin_return_address (0 ));
include/trace/events/afs.h +1 -1
@@ -233,7 +233,7 @@ enum afs_cb_break_reason { EM(afs_call_trace_get, "GET ") \ EM(afs_call_trace_put, "PUT ") \ EM(afs_call_trace_wake, "WAKE ") \ - E_(afs_call_trace_work, "WORK ") + E_(afs_call_trace_work, "QUEUE")#define afs_server_traces \ EM(afs_server_trace_alloc, "ALLOC ") \
Greg Kroah-Hartman
maintainerPATCH 121/155 afs: Fix unpinned address list during probing
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit 9efcc4a129363187c9bf15338692f107c5c9b6f0 upstream.
When it's probing all of a fileserver's interfaces to find which one is best to use, afs_do_probe_fileserver() takes a lock on the server record and notes the pointer to the address list.
It doesn't, however, pin the address list, so as soon as it drops the lock, there's nothing to stop the address list from being freed under us.
Fix this by taking a ref on the address list inside the locked section and dropping it at the end of the function.
--- fs/afs/fs_probe.c | 2 ++ 1 file changed, 2 insertions(+)
fs/afs/fs_probe.c +2 -0
@@ -145,6 +145,7 @@ static int afs_do_probe_fileserver(strucread_lock (&server->fs_lock); ac.alist =rcu_dereference_protected (server->addresses,lockdep_is_held (&server->fs_lock)); +afs_get_addrlist (ac.alist);read_unlock (&server->fs_lock);atomic_set (&server->probe_outstanding, ac.alist->nr_addrs);
@@ -163,6 +164,7 @@ static int afs_do_probe_fileserver(strucif (!in_progress)afs_fs_probe_done (server); +afs_put_addrlist (ac.alist);return in_progress; }
Greg Kroah-Hartman
maintainerPATCH 122/155 ieee80211: fix HE SPR size calculation
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 575a97acc3b7446094b0dcaf6285c7c6934c2477 upstream.
The he_sr_control field is just a u8, so le32_to_cpu() shouldn't be applied to it; this was evidently copied from ieee80211_he_oper_size(). Fix it, and also adjust the type of the local variable.
--- include/linux/ieee80211.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/ieee80211.h +2 -2
@@ -2102,14 +2102,14 @@ ieee80211_he_spr_size(const u8 *he_spr_i {struct ieee80211_he_spr *he_spr = (void *)he_spr_ie;u8 spr_len =sizeof (struct ieee80211_he_spr ); -u32 he_spr_params; +u8 he_spr_params;/* Make sure the input is not NULL */ if (!he_spr_ie)return 0 ;/* Calc required length */ - he_spr_params =le32_to_cpu (he_spr->he_sr_control); + he_spr_params = he_spr->he_sr_control;if (he_spr_params &IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT ) spr_len++;if (he_spr_params &IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT )
Greg Kroah-Hartman
maintainerPATCH 123/155 mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit b95d2ccd2ccb834394d50347d0e40dc38a954e4a upstream.
When a frame is transmitted via the nl80211 TX rather than as a normal frame, IEEE80211_TX_CTRL_PORT_CTRL_PROTO wasn't set and this will lead to wrong decisions (rate control etc.) being made about the frame; fix this.
--- net/mac80211/tx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/mac80211/tx.c +6 -2
@@ -5,7 +5,7 @@* Copyright 2006-2007 Jiri Benc <[email protected]> * Copyright 2007 Johannes Berg <[email protected]> * Copyright 2013-2014 Intel Mobile Communications GmbH -* Copyright (C) 2018 Intel Corporation +* Copyright (C) 2018, 2020 Intel Corporation * * Transmit and frame generation functions. */
@@ -5067,6 +5067,7 @@ int ieee80211_tx_control_port(struct wipstruct ieee80211_local *local = sdata->local;struct sk_buff *skb;struct ethhdr *ehdr; +u32 ctrl_flags =0 ;u32 flags;/* Only accept CONTROL_PORT_PROTOCOL configured in CONNECT/ASSOCIATE
@@ -5076,6 +5077,9 @@ int ieee80211_tx_control_port(struct wip proto != cpu_to_be16(ETH_P_PREAUTH))return -EINVAL ; +if (proto == sdata->control_port_protocol) + ctrl_flags |=IEEE80211_TX_CTRL_PORT_CTRL_PROTO ; +if (unencrypted) flags =IEEE80211_TX_INTFL_DONT_ENCRYPT ;else
@@ -5101,7 +5105,7 @@ int ieee80211_tx_control_port(struct wipskb_reset_mac_header (skb);local_bh_disable (); -__ieee80211_subif_start_xmit (skb, skb->dev, flags,0 ); +__ieee80211_subif_start_xmit (skb, skb->dev, flags, ctrl_flags);local_bh_enable ();return 0 ;
Greg Kroah-Hartman
maintainerPATCH 124/155 netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
In reply to Greg Kroah-HartmanFrom: Haishuang Yan <[email protected]>
commit 41e9ec5a54f95eee1a57c8d26ab70e0492548c1b upstream.
Since pskb_may_pull may change skb->data, so we need to reload ip{v6}h at the right place.
--- net/netfilter/nf_flow_table_ip.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_flow_table_ip.c +2 -0
@@ -189,6 +189,7 @@ static int nf_flow_tuple_ip(struct sk_buif (!pskb_may_pull (skb, thoff +sizeof (*ports)))return -1 ; + iph =ip_hdr (skb); ports = (struct flow_ports *)(skb_network_header (skb) + thoff); tuple->src_v4.s_addr = iph->saddr;
@@ -449,6 +450,7 @@ static int nf_flow_tuple_ipv6(struct sk_if (!pskb_may_pull (skb, thoff +sizeof (*ports)))return -1 ; + ip6h =ipv6_hdr (skb); ports = (struct flow_ports *)(skb_network_header (skb) + thoff); tuple->src_v6 = ip6h->saddr;
Greg Kroah-Hartman
maintainerPATCH 125/155 netfilter: nft_fwd_netdev: validate family and chain type
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 76a109fac206e158eb3c967af98c178cff738e6a upstream.
Make sure the forward action is only used from ingress.
--- net/netfilter/nft_fwd_netdev.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/netfilter/nft_fwd_netdev.c +9 -0
@@ -190,6 +190,13 @@ nla_put_failure:return -1 ; } +static int nft_fwd_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr, +const struct nft_data **data) +{ +return nft_chain_validate_hooks (ctx->chain, (1 <<NF_NETDEV_INGRESS )); +} +static struct nft_expr_type nft_fwd_netdev_type;static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = { .type = &nft_fwd_netdev_type,
@@ -197,6 +204,7 @@ static const struct nft_expr_ops nft_fwd .eval = nft_fwd_neigh_eval, .init = nft_fwd_neigh_init, .dump = nft_fwd_neigh_dump, + .validate = nft_fwd_validate, };static const struct nft_expr_ops nft_fwd_netdev_ops = {
@@ -205,6 +213,7 @@ static const struct nft_expr_ops nft_fwd .eval = nft_fwd_netdev_eval, .init = nft_fwd_netdev_init, .dump = nft_fwd_netdev_dump, + .validate = nft_fwd_validate, .offload = nft_fwd_netdev_offload, };
Greg Kroah-Hartman
maintainerPATCH 126/155 netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit bcfabee1afd99484b6ba067361b8678e28bbc065 upstream.
Set skb->tc_redirected to 1, otherwise the ifb driver drops the packet. Set skb->tc_from_ingress to 1 to reinject the packet back to the ingress path after leaving the ifb egress path.
This patch inconditionally sets on these two skb fields that are meaningful to the ifb driver. The existing forward action is guaranteed to run from ingress path.
--- net/netfilter/nft_fwd_netdev.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nft_fwd_netdev.c +4 -0
@@ -28,6 +28,10 @@ static void nft_fwd_netdev_eval(const ststruct nft_fwd_netdev *priv =nft_expr_priv (expr);int oif = regs->data[priv->sreg_dev]; +/* These are used by ifb only. */ + pkt->skb->tc_redirected =1 ; + pkt->skb->tc_from_ingress =1 ; +nf_fwd_netdev_egress (pkt, oif); regs->verdict.code =NF_STOLEN ; }
Greg Kroah-Hartman
maintainerPATCH 127/155 i2c: nvidia-gpu: Handle timeout correctly in gpu_i2c_check_status()
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit d944b27df121e2ee854a6c2fad13d6c6300792d4 upstream.
Nvidia card may come with a "phantom" UCSI device, and its driver gets stuck in probe routine, prevents any system PM operations like suspend.
There's an unaccounted case that the target time can equal to jiffies in gpu_i2c_check_status(), let's solve that by using readl_poll_timeout() instead of jiffies comparison functions.
--- drivers/i2c/busses/i2c-nvidia-gpu.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)
drivers/i2c/busses/i2c-nvidia-gpu.c +7 -11
@@ -8,6 +8,7 @@#include <linux/delay.h> #include <linux/i2c.h> #include <linux/interrupt.h> +#include <linux/iopoll.h> #include <linux/module.h> #include <linux/pci.h> #include <linux/platform_device.h>
@@ -75,20 +76,15 @@ static void gpu_enable_i2c_bus(struct gpstatic int gpu_i2c_check_status (struct gpu_i2c_dev *i2cd) { -unsigned long target = jiffies +msecs_to_jiffies (1000 );u32 val; +int ret; -do { - val =readl (i2cd->regs +I2C_MST_CNTL ); -if (!(val &I2C_MST_CNTL_CYCLE_TRIGGER )) -break ; -if ((val &I2C_MST_CNTL_STATUS ) != -I2C_MST_CNTL_STATUS_BUS_BUSY ) -break ; -usleep_range (500 ,600 ); - }while (time_is_after_jiffies (target)); + ret =readl_poll_timeout (i2cd->regs +I2C_MST_CNTL , val, + !(val &I2C_MST_CNTL_CYCLE_TRIGGER ) || + (val &I2C_MST_CNTL_STATUS ) !=I2C_MST_CNTL_STATUS_BUS_BUSY , +500 ,1000 *USEC_PER_MSEC ); -if (time_is_before_jiffies (target)) { +if (ret) {dev_err (i2cd->dev,"i2c timeout error %x\n" , val);return -ETIMEDOUT ; }
Greg Kroah-Hartman
maintainerPATCH 128/155 bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits
In reply to Greg Kroah-HartmanFrom: Luke Nelson <[email protected]>
commit 80f1f85036355e5581ec0b99913410345ad3491b upstream.
The current x32 BPF JIT is incorrect for JMP32 JSET BPF_X when the upper 32 bits of operand registers are non-zero in certain situations.
The problem is in the following code:
case BPF_JMP | BPF_JSET | BPF_X:
case BPF_JMP32 | BPF_JSET | BPF_X:
...
/* and dreg_lo,sreg_lo */ EMIT2(0x23, add_2reg(0xC0, sreg_lo, dreg_lo)); /* and dreg_hi,sreg_hi */ EMIT2(0x23, add_2reg(0xC0, sreg_hi, dreg_hi)); /* or dreg_lo,dreg_hi */ EMIT2(0x09, add_2reg(0xC0, dreg_lo, dreg_hi));
This code checks the upper bits of the operand registers regardless if the BPF instruction is BPF_JMP32 or BPF_JMP64. Registers dreg_hi and dreg_lo are not loaded from the stack for BPF_JMP32, however, they can still be polluted with values from previous instructions.
The following BPF program demonstrates the bug. The jset64 instruction loads the temporary registers and performs the jump, since ((u64)r7 & (u64)r8) is non-zero. The jset32 should _not_ be taken, as the lower 32 bits are all zero, however, the current JIT will take the branch due the pollution of temporary registers from the earlier jset64.
mov64 r0, 0 ld64 r7, 0x8000000000000000 ld64 r8, 0x8000000000000000 jset64 r7, r8, 1
exit
jset32 r7, r8, 1
mov64 r0, 2
exit
The expected return value of this program is 2; under the buggy x32 JIT it returns 0. The fix is to skip using the upper 32 bits for jset32 and compare the upper 32 bits for jset64 only.
All tests in test_bpf.ko and selftests/bpf/test_verifier continue to pass with this change.
We found this bug using our automated verification tool, Serval.
--- arch/x86/net/bpf_jit_comp32.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/x86/net/bpf_jit_comp32.c +6 -4
@@ -2039,10 +2039,12 @@ static int do_jit(struct bpf_prog *bpf_p }/* and dreg_lo,sreg_lo */ EMIT2 (0x23 ,add_2reg (0xC0 , sreg_lo, dreg_lo)); -/* and dreg_hi,sreg_hi */ -EMIT2 (0x23 ,add_2reg (0xC0 , sreg_hi, dreg_hi)); -/* or dreg_lo,dreg_hi */ -EMIT2 (0x09 ,add_2reg (0xC0 , dreg_lo, dreg_hi)); +if (is_jmp64) { +/* and dreg_hi,sreg_hi */ +EMIT2 (0x23 ,add_2reg (0xC0 , sreg_hi, dreg_hi)); +/* or dreg_lo,dreg_hi */ +EMIT2 (0x09 ,add_2reg (0xC0 , dreg_lo, dreg_hi)); + } goto emit_cond_jmp; }case BPF_JMP |BPF_JSET |BPF_K :
Greg Kroah-Hartman
maintainerPATCH 129/155 bpf: Initialize storage pointers to NULL to prevent freeing garbage pointer
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
commit 62039c30c19dcab96621e074aeeb90da7100def7 upstream.
Local storage array isn't initialized, so if cgroup storage allocation fails for BPF_CGROUP_STORAGE_SHARED, error handling code will attempt to free uninitialized pointer for BPF_CGROUP_STORAGE_PERCPU storage type. Avoid this by always initializing storage pointers to NULLs.
--- kernel/bpf/cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/bpf/cgroup.c +2 -2
@@ -303,8 +303,8 @@ int __cgroup_bpf_attach(struct cgroup *c {struct list_head *progs = &cgrp->bpf.progs[type];struct bpf_prog *old_prog =NULL ; -struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE ], - *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE ] = {NULL }; +struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE ] = {}; +struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE ] = {};enum bpf_cgroup_storage_type stype;struct bpf_prog_list *pl;bool pl_was_allocated;
Greg Kroah-Hartman
maintainerPATCH 130/155 bpf/btf: Fix BTF verification of enum members in struct/union
In reply to Greg Kroah-HartmanFrom: Yoshiki Komachi <[email protected]>
commit da6c7faeb103c493e505e87643272f70be586635 upstream.
btf_enum_check_member() was currently sure to recognize the size of "enum" type members in struct/union as the size of "int" even if its size was packed.
This patch fixes BTF enum verification to use the correct size of member in BPF programs.
--- kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/btf.c +1 -1
@@ -2309,7 +2309,7 @@ static int btf_enum_check_member(struct struct_size = struct_type->size; bytes_offset =BITS_ROUNDDOWN_BYTES (struct_bits_off); -if (struct_size - bytes_offset <sizeof (int )) { +if (struct_size - bytes_offset < member_type->size) {btf_verifier_log_member (env, struct_type, member,"Member exceeds struct_size" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 131/155 bpf, sockmap: Remove bucket->lock from sock_{hash|map}_free
In reply to Greg Kroah-HartmanFrom: John Fastabend <[email protected]>
commit 90db6d772f749e38171d04619a5e3cd8804a6d02 upstream.
The bucket->lock is not needed in the sock_hash_free and sock_map_free calls, in fact it is causing a splat due to being inside rcu block.
| BUG: sleeping function called from invalid context at net/core/sock.c:2935
| in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 62, name: kworker/0:1
| 3 locks held by kworker/0:1/62:
| #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0
| #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0
| #2: ffff8881381f6df8 (&stab->lock){+...}, at: sock_map_free+0x26/0x180
| CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04008-g7b083332376e #454
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
| Workqueue: events bpf_map_free_deferred
| Call Trace:
| dump_stack+0x71/0xa0
| ___might_sleep.cold+0xa6/0xb6
| lock_sock_nested+0x28/0x90
| sock_map_free+0x5f/0x180
| bpf_map_free_deferred+0x58/0x80
| process_one_work+0x260/0x5e0
| worker_thread+0x4d/0x3e0
| kthread+0x108/0x140
| ? process_one_work+0x5e0/0x5e0
| ? kthread_park+0x90/0x90
| ret_from_fork+0x3a/0x50The reason we have stab->lock and bucket->locks in sockmap code is to handle checking EEXIST in update/delete cases. We need to be careful during an update operation that we check for EEXIST and we need to ensure that the psock object is not in some partial state of removal/insertion while we do this. So both map_update_common and sock_map_delete need to guard from being run together potentially deleting an entry we are checking, etc. But by the time we get to the tear-down code in sock_{ma[|hash}_free we have already disconnected the map and we just did synchronize_rcu() in the line above so no updates/deletes should be in flight. Because of this we can drop the bucket locks from the map free'ing code, noting no update/deletes can be in-flight.
--- net/core/sock_map.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/core/sock_map.c +8 -4
@@ -233,8 +233,11 @@ static void sock_map_free(struct bpf_map struct bpf_stab *stab = container_of(map, struct bpf_stab, map);int i; +/* After the sync no updates or deletes will be in-flight so it +* is safe to walk map and remove entries without risking a race +* in EEXIST update case. +*/ synchronize_rcu (); -raw_spin_lock_bh (&stab->lock);for (i =0 ; i < stab->map.max_entries; i++) {struct sock **psk = &stab->sks[i];struct sock *sk;
@@ -248,7 +251,6 @@ static void sock_map_free(struct bpf_maprelease_sock (sk); } } -raw_spin_unlock_bh (&stab->lock);/* wait for psock readers accessing its map link */ synchronize_rcu ();
@@ -863,10 +865,13 @@ static void sock_hash_free(struct bpf_mastruct hlist_node *node;int i; +/* After the sync no updates or deletes will be in-flight so it +* is safe to walk map and remove entries without risking a race +* in EEXIST update case. +*/ synchronize_rcu ();for (i =0 ; i < htab->buckets_num; i++) { bucket =sock_hash_select_bucket (htab, i); -raw_spin_lock_bh (&bucket->lock);hlist_for_each_entry_safe (elem, node, &bucket->head, node) {hlist_del_rcu (&elem->node);lock_sock (elem->sk);
@@ -875,7 +880,6 @@ static void sock_hash_free(struct bpf_marcu_read_unlock ();release_sock (elem->sk); } -raw_spin_unlock_bh (&bucket->lock); }/* wait for psock readers accessing its map link */
Greg Kroah-Hartman
maintainerPATCH 132/155 ARM: dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection
In reply to Greg Kroah-HartmanFrom: Ondrej Jirman <[email protected]>
commit b642d4825441bf30c72b72deb739bd2d5f53af08 upstream.
USB-ID signal has a pullup on the schematic, but in reality it's not pulled up, so add a GPIO pullup. And we also need a usb0_vbus_power-supply for VBUS detection.
This fixes OTG mode detection and charging issues on TBS A711 tablet. The issues came from ID pin reading 0, causing host mode to be enabled, when it should not be, leading to DRVVBUS being enabled, which disabled the charger.
--- arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts +2 -1
@@ -482,7 +482,8 @@ }; &usbphy { - usb0_id_det-gpios = <&pio 7 11 GPIO_ACTIVE_HIGH>; /* PH11 */ + usb0_id_det-gpios = <&pio 7 11 (GPIO_ACTIVE_HIGH | GPIO_PULL_UP)>; /* PH11 */ + usb0_vbus_power-supply = <&usb_power_supply>; usb0_vbus-supply = <®_drivevbus>; usb1_vbus-supply = <®_vmain>; usb2_vbus-supply = <®_vmain>;
Greg Kroah-Hartman
maintainerPATCH 133/155 vti6: Fix memory leak of skb if input policy check fails
In reply to Greg Kroah-HartmanFrom: Torsten Hilbrich <[email protected]>
commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df upstream.
The vti6_rcv function performs some tests on the retrieved tunnel including checking the IP protocol, the XFRM input policy, the source and destination address.
In all but one places the skb is released in the error case. When the input policy check fails the network packet is leaked.
Using the same goto-label discard in this case to fix this problem.
--- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_vti.c +1 -1
@@ -311,7 +311,7 @@ static int vti6_rcv(struct sk_buff *skb)if (!xfrm6_policy_check (NULL ,XFRM_POLICY_IN , skb)) {rcu_read_unlock (); -return 0 ; + goto discard; } ipv6h =ipv6_hdr (skb);
Greg Kroah-Hartman
maintainerPATCH 134/155 r8169: fix PHY driver check on platforms w/o module softdeps
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit 2e8c339b4946490a922a21aa8cd869c6cfad2023 upstream.
On Android/x86 the module loading infrastructure can't deal with softdeps. Therefore the check for presence of the Realtek PHY driver module fails. mdiobus_register() will try to load the PHY driver module, therefore move the check to after this call and explicitly check that a dedicated PHY driver is bound to the PHY device.
--- drivers/net/ethernet/realtek/r8169_main.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +7 -9
@@ -6903,6 +6903,13 @@ static int r8169_mdio_register(struct rtif (!tp->phydev) {mdiobus_unregister (new_bus);return -ENODEV ; + }else if (!tp->phydev->drv) { +/* Most chip versions fail with the genphy driver. +* Therefore ensure that the dedicated PHY driver is loaded. +*/ +dev_err (&pdev->dev,"realtek.ko not loaded, maybe it needs to be added to initramfs?\n" ); +mdiobus_unregister (new_bus); +return -EUNATCH ; }/* PHY will be woken up in rtl_open() */
@@ -7064,15 +7071,6 @@ static int rtl_init_one(struct pci_dev *int chipset, region;int jumbo_max, rc; -/* Some tools for creating an initramfs don't consider softdeps, then -* r8169.ko may be in initramfs, but realtek.ko not. Then the generic -* PHY driver is used that doesn't work with most chip versions. -*/ -if (!driver_find ("RTL8201CP Ethernet" , &mdio_bus_type)) { -dev_err (&pdev->dev,"realtek.ko not loaded, maybe it needs to be added to initramfs?\n" ); -return -ENOENT ; - } - dev =devm_alloc_etherdev (&pdev->dev,sizeof (*tp));if (!dev)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 135/155 clocksource/drivers/hyper-v: Untangle stimers and timesync from clocksources
In reply to Greg Kroah-HartmanFrom: Yubo Xie <[email protected]>
[ Upstream commit 0af3e137c144377fbaf5025ba784ff5ba7ad40c9 ]
hyperv_timer.c exports hyperv_cs, which is used by stimers and the timesync mechanism. However, the clocksource dependency is not
needed: these mechanisms only depend on the partition reference counter (which can be read via a MSR or via the TSC Reference Page).
Introduce the (function) pointer hv_read_reference_counter, as an embodiment of the partition reference counter read, and export it in place of the hyperv_cs pointer. The latter can be removed.
This should clarify that there's no relationship between Hyper-V stimers & timesync and the Linux clocksource abstractions. No functional or semantic change.
--- drivers/clocksource/hyperv_timer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/clocksource/hyperv_timer.c +4 -2
@@ -233,7 +233,8 @@ static u64 notrace read_hv_clock_tsc(strstatic u64 read_hv_sched_clock_tsc (void ) { -return read_hv_clock_tsc (NULL ) - hv_sched_clock_offset; +return (read_hv_clock_tsc (NULL ) - hv_sched_clock_offset) * + (NSEC_PER_SEC /HV_CLOCK_HZ ); }static struct clocksource hyperv_cs_tsc = {
@@ -258,7 +259,8 @@ static u64 notrace read_hv_clock_msr(strstatic u64 read_hv_sched_clock_msr (void ) { -return read_hv_clock_msr (NULL ) - hv_sched_clock_offset; +return (read_hv_clock_msr (NULL ) - hv_sched_clock_offset) * + (NSEC_PER_SEC /HV_CLOCK_HZ ); }static struct clocksource hyperv_cs_msr = {
Greg Kroah-Hartman
maintainerPATCH 136/155 bpf: Undo incorrect __reg_bound_offset32 handling
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit f2d67fec0b43edce8c416101cdc52e71145b5fef upstream.
Anatoly has been fuzzing with kBdysch harness and reported a hang in one of the outcomes:
0: (b7) r0 = 808464432
1: (7f) r0 >>= r0
2: (14) w0 -= 808464432
3: (07) r0 += 808464432
4: (b7) r1 = 808464432
5: (de) if w1 s<= w0 goto pc+0
R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020;0x10000001f)) R1_w=invP808464432 R10=fp0
6: (07) r0 += -2144337872
7: (14) w0 -= -1607454672
8: (25) if r0 > 0x30303030 goto pc+0
R0_w=invP(id=0,umin_value=271581184,umax_value=271581311,var_off=(0x10300000;0x7f)) R1_w=invP808464432 R10=fp0
9: (76) if w0 s>= 0x303030 goto pc+2
12: (95) exit
from 8 to 9: safe
from 5 to 6: R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020;0x10000001f)) R1_w=invP808464432 R10=fp0 6: (07) r0 += -2144337872
7: (14) w0 -= -1607454672
8: (25) if r0 > 0x30303030 goto pc+0
R0_w=invP(id=0,umin_value=271581184,umax_value=271581311,var_off=(0x10300000;0x7f)) R1_w=invP808464432 R10=fp0
9: safe
from 8 to 9: safe
verification time 589 usec
stack depth 0
processed 17 insns (limit 1000000) [...]
The underlying program was xlated as follows:
# bpftool p d x i 9 0: (b7) r0 = 808464432 1: (7f) r0 >>= r0 2: (14) w0 -= 808464432 3: (07) r0 += 808464432 4: (b7) r1 = 808464432 5: (de) if w1 s<= w0 goto pc+0 6: (07) r0 += -2144337872 7: (14) w0 -= -1607454672 8: (25) if r0 > 0x30303030 goto pc+0 9: (76) if w0 s>= 0x303030 goto pc+2 10: (05) goto pc-1 11: (05) goto pc-1 12: (95) exit
The verifier rewrote original instructions it recognized as dead code with 'goto pc-1', but reality differs from verifier simulation in that we're actually able to trigger a hang due to hitting the 'goto pc-1' instructions.
Taking different examples to make the issue more obvious: in this example we're probing bounds on a completely unknown scalar variable in r1:
[...]
5: R0_w=inv1 R1_w=inv(id=0) R10=fp0
5: (18) r2 = 0x4000000000
7: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R10=fp0
7: (18) r3 = 0x2000000000
9: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R10=fp0
9: (18) r4 = 0x400
11: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R10=fp0
11: (18) r5 = 0x200
13: R0_w=inv1 R1_w=inv(id=0) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0
13: (2d) if r1 > r2 goto pc+4
R0_w=inv1 R1_w=inv(id=0,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0
14: R0_w=inv1 R1_w=inv(id=0,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0 14: (ad) if r1 < r3 goto pc+3
R0_w=inv1 R1_w=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2_w=inv274877906944 R3_w=inv137438953472 R4_w=inv1024 R5_w=inv512 R10=fp0
15: R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7fffffffff)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 15: (2e) if w1 > w4 goto pc+2
R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0
16: R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0 16: (ae) if w1 < w5 goto pc+1
R0=inv1 R1=inv(id=0,umin_value=137438953472,umax_value=274877906944,var_off=(0x0; 0x7f00000000)) R2=inv274877906944 R3=inv137438953472 R4=inv1024 R5=inv512 R10=fp0
[...]
We're first probing lower/upper bounds via jmp64, later we do a similar check via jmp32 and examine the resulting var_off there. After fall-through in insn 14, we get the following bounded r1 with 0x7fffffffff unknown marked bits in the variable section.
Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000:
max: 0b100000000000000000000000000000000000000 / 0x4000000000
var: 0b111111111111111111111111111111111111111 / 0x7fffffffff
min: 0b010000000000000000000000000000000000000 / 0x2000000000
Now, in insn 15 and 16, we perform a similar probe with lower/upper bounds in jmp32.
Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000 and
w1 <= 0x400 and w1 >= 0x200:
max: 0b100000000000000000000000000000000000000 / 0x4000000000
var: 0b111111100000000000000000000000000000000 / 0x7f00000000
min: 0b010000000000000000000000000000000000000 / 0x2000000000
The lower/upper bounds haven't changed since they have high bits set in u64 space and the jmp32 tests can only refine bounds in the low bits.
However, for the var part the expectation would have been 0x7f000007ff or something less precise up to 0x7fffffffff. A outcome of 0x7f00000000 is not correct since it would contradict the earlier probed bounds where we know that the result should have been in [0x200,0x400] in u32 space. Therefore, tests with such info will lead to wrong verifier assumptions later on like falsely predicting conditional jumps to be always taken, etc.
The issue here is that __reg_bound_offset32()'s implementation from commit 581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions") makes an incorrect range assumption:
static void __reg_bound_offset32(struct bpf_reg_state *reg)
{
u64 mask = 0xffffFFFF;
struct tnum range = tnum_range(reg->umin_value & mask,
reg->umax_value & mask);
struct tnum lo32 = tnum_cast(reg->var_off, 4);
struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range));
}
In the above walk-through example, __reg_bound_offset32() as-is chose a range after masking with 0xffffffff of [0x0,0x0] since umin:0x2000000000 and umax:0x4000000000 and therefore the lo32 part was clamped to 0x0 as well. However, in the umin:0x2000000000 and umax:0x4000000000 range above we'd end up with an actual possible interval of [0x0,0xffffffff] for u32 space instead.
In case of the original reproducer, the situation looked as follows at insn 5 for r0:
[...]
5: R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x0; 0x1ffffffff)) R1_w=invP808464432 R10=fp0
0x30303030 0x13030302f
5: (de) if w1 s<= w0 goto pc+0
R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x30303020; 0x10000001f)) R1_w=invP808464432 R10=fp0
0x30303030 0x13030302f[...]
After the fall-through, we similarly forced the var_off result into the wrong range [0x30303030,0x3030302f] suggesting later on that fixed bits must only be of 0x30303020 with 0x10000001f unknowns whereas such assumption can only be made when both bounds in hi32 range match.
Originally, I was thinking to fix this by moving reg into a temp reg and use proper coerce_reg_to_size() helper on the temp reg where we can then based on that define the range tnum for later intersection:
static void __reg_bound_offset32(struct bpf_reg_state *reg)
{
struct bpf_reg_state tmp = *reg;
struct tnum lo32, hi32, range; coerce_reg_to_size(&tmp, 4);
range = tnum_range(tmp.umin_value, tmp.umax_value);
lo32 = tnum_cast(reg->var_off, 4);
hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);
reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range));}
In the case of the concrete example, this gives us a more conservative unknown section. Thus, after knowing r1 <= 0x4000000000 and r1 >= 0x2000000000 and
w1 <= 0x400 and w1 >= 0x200:
max: 0b100000000000000000000000000000000000000 / 0x4000000000
var: 0b111111111111111111111111111111111111111 / 0x7fffffffff
min: 0b010000000000000000000000000000000000000 / 0x2000000000
However, above new __reg_bound_offset32() has no effect on refining the knowledge of the register contents. Meaning, if the bounds in hi32 range mismatch we'll get the identity function given the range reg spans [0x0,0xffffffff] and we cast var_off into lo32 only to later on binary or it again with the hi32.
Likewise, if the bounds in hi32 range match, then we mask both bounds with 0xffffffff, use the resulting umin/umax for the range to later intersect the lo32 with it. However, _prior_ called __reg_bound_offset() did already such intersection on the full reg and we therefore would only repeat the same operation on the lo32 part twice.
Given this has no effect and the original commit had false assumptions, this patch reverts the code entirely which is also more straight forward for stable trees: apparently 581738a681b6 got auto-selected by Sasha's ML system and misclassified as a fix, so it got sucked into v5.4 where it should never have landed. A revert is low-risk also from a user PoV since it requires a recent kernel and llc to opt-into -mcpu=v3 BPF CPU to generate jmp32 instructions. A proper bounds refinement would need a significantly more complex approach which is currently being worked, but no stable material [0]. Hence revert is best option for stable. After the revert, the original reported program gets rejected as follows:
1: (7f) r0 >>= r0
2: (14) w0 -= 808464432
3: (07) r0 += 808464432
4: (b7) r1 = 808464432
5: (de) if w1 s<= w0 goto pc+0
R0_w=invP(id=0,umin_value=808464432,umax_value=5103431727,var_off=(0x0; 0x1ffffffff)) R1_w=invP808464432 R10=fp0
6: (07) r0 += -2144337872
7: (14) w0 -= -1607454672
8: (25) if r0 > 0x30303030 goto pc+0
R0_w=invP(id=0,umax_value=808464432,var_off=(0x0; 0x3fffffff)) R1_w=invP808464432 R10=fp0
9: (76) if w0 s>= 0x303030 goto pc+2
R0=invP(id=0,umax_value=3158063,var_off=(0x0; 0x3fffff)) R1=invP808464432 R10=fp0
10: (30) r0 = *(u8 *)skb[808464432]
BPF_LD_[ABS|IND] uses reserved fields
processed 11 insns (limit 1000000) [...]
--- kernel/bpf/verifier.c | 19 ------------------- 1 file changed, 19 deletions(-)
kernel/bpf/verifier.c +0 -19
@@ -979,17 +979,6 @@ static void __reg_bound_offset(struct bp reg->umax_value)); } -static void __reg_bound_offset32 (struct bpf_reg_state *reg) -{ -u64 mask =0xffffFFFF ; -struct tnum range =tnum_range (reg->umin_value & mask, - reg->umax_value & mask); -struct tnum lo32 =tnum_cast (reg->var_off,4 ); -struct tnum hi32 =tnum_lshift (tnum_rshift (reg->var_off,32 ),32 ); - - reg->var_off =tnum_or (hi32,tnum_intersect (lo32, range)); -} -/* Reset the min/max bounds of a register */ static void __mark_reg_unbounded (struct bpf_reg_state *reg) {
@@ -5452,10 +5441,6 @@ static void reg_set_min_max(struct bpf_r/* We might have learned some bits from the bounds. */ __reg_bound_offset (false_reg);__reg_bound_offset (true_reg); -if (is_jmp32) { -__reg_bound_offset32 (false_reg); -__reg_bound_offset32 (true_reg); - }/* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), * then new var_off is (0; 0x7f...fc) which improves our umax.
@@ -5565,10 +5550,6 @@ static void reg_set_min_max_inv(struct b/* We might have learned some bits from the bounds. */ __reg_bound_offset (false_reg);__reg_bound_offset (true_reg); -if (is_jmp32) { -__reg_bound_offset32 (false_reg); -__reg_bound_offset32 (true_reg); - }/* Intersecting with the old var_off might have improved our bounds * slightly. e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc), * then new var_off is (0; 0x7f...fc) which improves our umax.
Greg Kroah-Hartman
maintainerPATCH 137/155 USB: serial: option: add support for ASKEY WWHC050
In reply to Greg Kroah-HartmanFrom: Pawel Dembicki <[email protected]>
commit 007d20dca2376a751b1dad03442f118438b7e65e upstream.
ASKEY WWHC050 is a mcie LTE modem.
The oem configuration states:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
Tested on openwrt distribution.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1992,6 +1992,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
Greg Kroah-Hartman
maintainerPATCH 138/155 USB: serial: option: add BroadMobi BM806U
In reply to Greg Kroah-HartmanFrom: Pawel Dembicki <[email protected]>
commit 6cb2669cb97fc4fdf526127159ac59caae052247 upstream.
BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem. Tested hardware BM806U is mounted on D-Link DWR-921-C3 router.
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2020 ProdID=2033 Rev= 2.28 S: Manufacturer=Mobile Connect S: Product=Mobile Connect S: SerialNumber=f842866cfd5a C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1996,6 +1996,8 @@ static const struct usb_device_id option .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
Greg Kroah-Hartman
maintainerPATCH 139/155 USB: serial: option: add Wistron Neweb D19Q1
In reply to Greg Kroah-HartmanFrom: Pawel Dembicki <[email protected]>
commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream.
This modem is embedded on dlink dwr-960 router.
The oem configuration states:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1435 ProdID=d191 Rev=ff.ff
S: Manufacturer=Android
S: Product=Android
S: SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
Tested on openwrt distribution
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1992,6 +1992,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
Greg Kroah-Hartman
maintainerPATCH 140/155 USB: cdc-acm: restore capability check order
In reply to Greg Kroah-HartmanFrom: Matthias Reichl <[email protected]>
commit 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 upstream.
commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") introduced a regression by changing the order of capability and close settings change checks. When running with CAP_SYS_ADMIN setting the close settings to the values already set resulted in -EOPNOTSUPP.
Fix this by changing the check order back to how it was before.
--- drivers/usb/class/cdc-acm.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/usb/class/cdc-acm.c +9 -9
@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_stmutex_lock (&acm->port.mutex); -if ((ss->close_delay != old_close_delay) || - (ss->closing_wait != old_closing_wait)) { -if (!capable (CAP_SYS_ADMIN )) +if (!capable (CAP_SYS_ADMIN )) { +if ((ss->close_delay != old_close_delay) || + (ss->closing_wait != old_closing_wait)) retval = -EPERM ; -else { - acm->port.close_delay = close_delay; - acm->port.closing_wait = closing_wait; - } - }else - retval = -EOPNOTSUPP ; +else + retval = -EOPNOTSUPP ; + }else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; + }mutex_unlock (&acm->port.mutex);return retval;
Greg Kroah-Hartman
maintainerPATCH 141/155 USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream.
Fix slab-out-of-bounds read in the interrupt-URB completion handler.
The boundary condition should be (length - 1) as we access data[position + 1].
--- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/io_edgeport.c +1 -1
@@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru/* grab the txcredits for the ports if available */ position =2 ; portNumber =0 ; -while ((position < length) && +while ((position < length -1 ) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1 ] <<8 );if (txCredits) {
Greg Kroah-Hartman
maintainerPATCH 142/155 usb: musb: fix crash with highmen PIO and usbmon
In reply to Greg Kroah-HartmanFrom: Mans Rullgard <[email protected]>
commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream.
When handling a PIO bulk transfer with highmem buffer, a temporary mapping is assigned to urb->transfer_buffer. After the transfer is complete, an invalid address is left behind in this pointer. This is not ordinarily a problem since nothing touches that buffer before the urb is released. However, when usbmon is active, usbmon_urb_complete() calls (indirectly) mon_bin_get_data() which does access the transfer buffer if it is set. To prevent an invalid memory access here, reset urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not set it at all (musb_host_tx()).
--- drivers/usb/musb/musb_host.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
drivers/usb/musb/musb_host.c +5 -12
@@ -1462,10 +1462,7 @@ done:* We need to map sg if the transfer_buffer is * NULL. */ -if (!urb->transfer_buffer) - qh->use_sg = true; - -if (qh->use_sg) { +if (!urb->transfer_buffer) {/* sg_miter_start is already done in musb_ep_program */ if (!sg_miter_next (&qh->sg_miter)) {dev_err (musb->controller,"error: sg list empty\n" );
@@ -1473,9 +1470,8 @@ done: status = -EINVAL ; goto done; } - urb->transfer_buffer = qh->sg_miter.addr; length =min_t (u32, length, qh->sg_miter.length); -musb_write_fifo (hw_ep, length, urb->transfer_buffer); +musb_write_fifo (hw_ep, length, qh->sg_miter.addr); qh->sg_miter.consumed = length;sg_miter_stop (&qh->sg_miter); }else {
@@ -1484,11 +1480,6 @@ done: qh->segsize = length; -if (qh->use_sg) { -if (offset + length >= urb->transfer_buffer_length) - qh->use_sg = false; - } -musb_ep_select (mbase, epnum);musb_writew (epio,MUSB_TXCSR ,MUSB_TXCSR_H_WZC_BITS |MUSB_TXCSR_TXPKTRDY );
@@ -2003,8 +1994,10 @@ finish: urb->actual_length += xfer_len; qh->offset += xfer_len;if (done) { -if (qh->use_sg) +if (qh->use_sg) { qh->use_sg = false; + urb->transfer_buffer =NULL ; + }if (urb->status == -EINPROGRESS ) urb->status = status;
Greg Kroah-Hartman
maintainerPATCH 143/155 media: flexcop-usb: fix endpoint sanity check
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bca243b1ce0e46be26f7c63b5591dfbb41f558e5 upstream.
commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added an endpoint sanity check to address a NULL-pointer dereference on probe. Unfortunately the check was done on the current altsetting which was later changed.
Fix this by moving the sanity check to after the altsetting is changed.
--- drivers/media/usb/b2c2/flexcop-usb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/usb/b2c2/flexcop-usb.c +3 -3
@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexcreturn ret; } +if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints <1 ) +return -ENODEV ; +switch (fc_usb->udev->speed) {case USB_SPEED_LOW :err ("cannot handle USB speed because it is too slow." );
@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_struct flexcop_device *fc =NULL ;int ret; -if (intf->cur_altsetting->desc.bNumEndpoints <1 ) -return -ENODEV ; -if ((fc =flexcop_device_kmalloc (sizeof (struct flexcop_usb ))) ==NULL ) {err ("out of memory\n" );return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 144/155 media: usbtv: fix control-message timeouts
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 536f561d871c5781bc33d26d415685211b94032e upstream.
The driver was issuing synchronous uninterruptible control requests without using a timeout. This could lead to the driver hanging on various user requests due to a malfunctioning (or malicious) device until the device is physically disconnected.
The USB upper limit of five seconds per request should be more than enough.
--- drivers/media/usb/usbtv/usbtv-core.c | 2 +- drivers/media/usb/usbtv/usbtv-video.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/media/usb/usbtv/usbtv-core.c +1 -1
@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, ret =usb_control_msg (usbtv->udev, pipe,USBTV_REQUEST_REG ,USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_DEVICE , - value, index,NULL ,0 ,0 ); + value, index,NULL ,0 ,USB_CTRL_GET_TIMEOUT );if (ret <0 )return ret; }
drivers/media/usb/usbtv/usbtv-video.c +3 -2
@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl ret =usb_control_msg (usbtv->udev,usb_rcvctrlpipe (usbtv->udev,0 ),USBTV_CONTROL_REG ,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , -0 ,USBTV_BASE +0x0244 , (void *)data,3 ,0 ); +0 ,USBTV_BASE +0x0244 , (void *)data,3 , +USB_CTRL_GET_TIMEOUT );if (ret <0 ) goto error; }
@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl ret =usb_control_msg (usbtv->udev,usb_sndctrlpipe (usbtv->udev,0 ),USBTV_CONTROL_REG ,USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_DEVICE , -0 , index, (void *)data, size,0 ); +0 , index, (void *)data, size,USB_CTRL_SET_TIMEOUT ); error:if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 145/155 staging: kpc2000: prevent underflow in cpld_reconfigure()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 upstream.
This function should not allow negative values of "wr_val". If negatives are allowed then capping the upper bound at 7 is meaningless. Let's make it unsigned.
--- drivers/staging/kpc2000/kpc2000/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/kpc2000/kpc2000/core.c +2 -2
@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d const char *buf, size_t count) {struct kp2000_device *pcard =dev_get_drvdata (dev); -long wr_val; +unsigned long wr_val;int rv; - rv =kstrtol (buf,0 , &wr_val); + rv =kstrtoul (buf,0 , &wr_val);if (rv <0 )return rv;if (wr_val >7 )
Greg Kroah-Hartman
maintainerPATCH 146/155 staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
In reply to Greg Kroah-HartmanFrom: Larry Finger <[email protected]>
commit 38ef48f7d4b7342f145a1b4f96023bde99aeb245 upstream.
The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device. Add it to the device tables.
--- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/rtl8188eu/os_dep/usb_intf.c +1 -0
@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us/****** 8188EUS ********/ {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */ {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */ + {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
Greg Kroah-Hartman
maintainerPATCH 147/155 staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream.
We should cancel hw->usb_work before kfree(hw).
--- drivers/staging/wlan-ng/prism2usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/wlan-ng/prism2usb.c +1 -0
@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(strcancel_work_sync (&hw->link_bh);cancel_work_sync (&hw->commsqual_bh); +cancel_work_sync (&hw->usb_work);/* Now we complete any outstanding commands * and tell everyone who is waiting for their
Greg Kroah-Hartman
maintainerPATCH 148/155 staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit 1165dd73e811a07d947aee218510571f516081f6 upstream.
We can't handle the case length > WLAN_DATA_MAXLEN.
Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't read more than that.
Thanks-to: Hillf Danton <[email protected]>
--- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/wlan-ng/hfa384x_usb.c +2 -0
@@ -3374,6 +3374,8 @@ static void hfa384x_int_rxmonitor(struct WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {pr_debug ("overlen frm: len=%zd\n" , skblen -sizeof (struct p80211_caphdr )); + +return ; } skb =dev_alloc_skb (skblen);
Greg Kroah-Hartman
maintainerPATCH 149/155 ahci: Add Intel Comet Lake H RAID PCI ID
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 32d2545462c6cede998267b86e57cda5d1dc2225 upstream.
Add the PCI ID to the driver list to support this new device.
--- drivers/ata/ahci.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/ahci.c +1 -0
@@ -393,6 +393,7 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ { PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */ + { PCI_VDEVICE(INTEL, 0x06d7), board_ahci }, /* Comet Lake-H RAID */ { PCI_VDEVICE(INTEL, 0x0f22), board_ahci_mobile }, /* Bay Trail AHCI */ { PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */ { PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
Greg Kroah-Hartman
maintainerPATCH 150/155 libfs: fix infoleak in simple_attr_read()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit a65cab7d7f05c2061a3e2490257d3086ff3202c6 upstream.
Reading from a debugfs file at a nonzero position, without first reading at position 0, leaks uninitialized memory to userspace.
It's a bit tricky to do this, since lseek() and pread() aren't allowed on these files, and write() doesn't update the position on them. But writing to them with splice() *does* update the position:
#define _GNU_SOURCE 1
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
int main()
{
int pipes[2], fd, n, i;
char buf[32];
pipe(pipes);
write(pipes[1], "0", 1);
fd = open("/sys/kernel/debug/fault_around_bytes", O_RDWR);
splice(pipes[0], NULL, fd, NULL, 1, 0);
n = read(fd, buf, sizeof(buf));
for (i = 0; i < n; i++)
printf("%02x", buf[i]);
printf("\n");
}Output:
5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a30
Fix the infoleak by making simple_attr_read() always fill simple_attr::get_buf if it hasn't been filled yet.
--- fs/libfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/libfs.c +5 -3
@@ -821,7 +821,7 @@ int simple_attr_open(struct inode *inode {struct simple_attr *attr; - attr =kmalloc (sizeof (*attr),GFP_KERNEL ); + attr =kzalloc (sizeof (*attr),GFP_KERNEL );if (!attr)return -ENOMEM ;
@@ -861,9 +861,11 @@ ssize_t simple_attr_read(struct file *fiif (ret)return ret; -if (*ppos) {/* continued read */ +if (*ppos && attr->get_buf[0 ]) { +/* continued read */ size =strlen (attr->get_buf); - }else {/* first read */ + }else { +/* first read */ u64 val; ret = attr->get (attr->data, &val);if (ret)
Greg Kroah-Hartman
maintainerPATCH 151/155 media: ov519: add missing endpoint sanity checks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 998912346c0da53a6dbb71fab3a138586b596b30 upstream.
Make sure to check that we have at least one endpoint before accessing the endpoint array to avoid dereferencing a NULL-pointer on stream start.
Note that these sanity checks are not redundant as the driver is mixing looking up altsettings by index and by number, which need not coincide.
--- drivers/media/usb/gspca/ov519.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/media/usb/gspca/ov519.c +10 -0
@@ -3477,6 +3477,11 @@ static void ov511_mode_init_regs(structreturn ; } +if (alt->desc.bNumEndpoints <1 ) { + sd->gspca_dev.usb_err = -ENODEV ; +return ; + } + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize);reg_w (sd, R51x_FIFO_PSIZE, packet_size >>5 );
@@ -3603,6 +3608,11 @@ static void ov518_mode_init_regs(structreturn ; } +if (alt->desc.bNumEndpoints <1 ) { + sd->gspca_dev.usb_err = -ENODEV ; +return ; + } + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize);ov518_reg_w32 (sd, R51x_FIFO_PSIZE, packet_size & ~7 ,2 );
Greg Kroah-Hartman
maintainerPATCH 152/155 media: dib0700: fix rc endpoint lookup
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit f52981019ad8d6718de79b425a574c6bddf81f7c upstream.
Make sure to use the current alternate setting when verifying the interface descriptors to avoid submitting an URB to an invalid endpoint.
Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on.
--- drivers/media/usb/dvb-usb/dib0700_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/dib0700_core.c +2 -2
@@ -818,7 +818,7 @@ int dib0700_rc_setup(struct dvb_usb_devi/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ -if (intf->altsetting[0 ].desc.bNumEndpoints < rc_ep +1 ) +if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep +1 )return -ENODEV ; purb =usb_alloc_urb (0 ,GFP_KERNEL );
@@ -838,7 +838,7 @@ int dib0700_rc_setup(struct dvb_usb_devi* Some devices like the Hauppauge NovaTD model 52009 use an interrupt * endpoint, while others use a bulk one. */ - e = &intf->altsetting[0 ].endpoint[rc_ep].desc; + e = &intf->cur_altsetting->endpoint[rc_ep].desc;if (usb_endpoint_dir_in (e)) {if (usb_endpoint_xfer_bulk (e)) { pipe =usb_rcvbulkpipe (d->udev, rc_ep);
Greg Kroah-Hartman
maintainerPATCH 153/155 media: stv06xx: add missing descriptor sanity checks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 485b06aadb933190f4bc44e006076bc27a23f205 upstream.
Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays.
This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors.
Note that the sanity checks in stv06xx_start() and pb0100_start() are not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide.
--- drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 ++++++++++++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 ++++ 2 files changed, 22 insertions(+), 1 deletion(-)
drivers/media/usb/gspca/stv06xx/stv06xx.c +18 -1
@@ -282,6 +282,9 @@ static int stv06xx_start(struct gspca_dereturn -EIO ; } +if (alt->desc.bNumEndpoints <1 ) +return -ENODEV ; + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize); err =stv06xx_write_bridge (sd,STV_ISO_SIZE_L , packet_size);if (err <0 )
@@ -306,11 +309,21 @@ out:static int stv06xx_isoc_init (struct gspca_dev *gspca_dev) { +struct usb_interface_cache *intfc;struct usb_host_interface *alt;struct sd *sd = (struct sd *) gspca_dev; + intfc = gspca_dev->dev->actconfig->intf_cache[0 ]; + +if (intfc->num_altsetting <2 ) +return -ENODEV ; + + alt = &intfc->altsetting[1 ]; + +if (alt->desc.bNumEndpoints <1 ) +return -ENODEV ; +/* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0 ]->altsetting[1 ]; alt->endpoint[0 ].desc.wMaxPacketSize =cpu_to_le16 (sd->sensor->max_packet_size[gspca_dev->curr_mode]);
@@ -323,6 +336,10 @@ static int stv06xx_isoc_nego(struct gspcstruct usb_host_interface *alt;struct sd *sd = (struct sd *) gspca_dev; +/* +* Existence of altsetting and endpoint was verified in +* stv06xx_isoc_init() +*/ alt = &gspca_dev->dev->actconfig->intf_cache[0 ]->altsetting[1 ]; packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize); min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];
drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c +4 -0
@@ -185,6 +185,10 @@ static int pb0100_start(struct sd *sd) alt =usb_altnum_to_altsetting (intf, sd->gspca_dev.alt);if (!alt)return -ENODEV ; + +if (alt->desc.bNumEndpoints <1 ) +return -ENODEV ; + packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize);/* If we don't have enough bandwidth use a lower framerate */
Greg Kroah-Hartman
maintainerPATCH 154/155 media: xirlink_cit: add missing descriptor sanity checks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a246b4d547708f33ff4d4b9a7a5dbac741dc89d8 upstream.
Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays.
This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors.
Note that the sanity check in cit_get_packet_size() is not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide.
--- drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/media/usb/gspca/xirlink_cit.c +17 -1
@@ -1442,6 +1442,9 @@ static int cit_get_packet_size(struct gsreturn -EIO ; } +if (alt->desc.bNumEndpoints <1 ) +return -ENODEV ; +return le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize); }
@@ -2626,6 +2629,7 @@ static int sd_start(struct gspca_dev *gsstatic int sd_isoc_init (struct gspca_dev *gspca_dev) { +struct usb_interface_cache *intfc;struct usb_host_interface *alt;int max_packet_size;
@@ -2641,8 +2645,17 @@ static int sd_isoc_init(struct gspca_devbreak ; } + intfc = gspca_dev->dev->actconfig->intf_cache[0 ]; + +if (intfc->num_altsetting <2 ) +return -ENODEV ; + + alt = &intfc->altsetting[1 ]; + +if (alt->desc.bNumEndpoints <1 ) +return -ENODEV ; +/* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0 ]->altsetting[1 ]; alt->endpoint[0 ].desc.wMaxPacketSize =cpu_to_le16 (max_packet_size);return 0 ;
@@ -2665,6 +2678,9 @@ static int sd_isoc_nego(struct gspca_devbreak ; } +/* +* Existence of altsetting and endpoint was verified in sd_isoc_init() +*/ alt = &gspca_dev->dev->actconfig->intf_cache[0 ]->altsetting[1 ]; packet_size =le16_to_cpu (alt->endpoint[0 ].desc.wMaxPacketSize);if (packet_size <= min_packet_size)
Greg Kroah-Hartman
maintainerPATCH 155/155 media: v4l2-core: fix a use-after-free bug of sd->devnode
In reply to Greg Kroah-HartmanFrom: Dafna Hirschfeld <[email protected]>
commit 6990570f7e0a6078e11b9c5dc13f4b6e3f49a398 upstream.
sd->devnode is released after callingv4l2_subdev_release. Therefore it should be set
to NULL so that the subdev won't hold a pointer
to a released object. This fixes a reference
after free bug in functionv4l2_device_unregister_subdev
--- drivers/media/v4l2-core/v4l2-device.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/v4l2-core/v4l2-device.c +1 -0
@@ -179,6 +179,7 @@ static void v4l2_subdev_release(struct vif (sd->internal_ops && sd->internal_ops->release) sd->internal_ops->release (sd); + sd->devnode =NULL ;module_put (owner); }