5.9.9-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainerPATCH 3/255 mm: memcg: link page counters to root if use_hierarchy is false
In reply to Greg Kroah-HartmanFrom: Roman Gushchin <[email protected]>
[ Upstream commit 8de15e920dc85d1705ab9c202c95d56845bc2d48 ]
Richard reported a warning which can be reproduced by running the LTP madvise6 test (cgroup v1 in the non-hierarchical mode should be used):
WARNING: CPU: 0 PID: 12 at mm/page_counter.c:57 page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156)
Modules linked in:
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.9.0-rc7-22-default #77
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812d-rebuilt.opensuse.org 04/01/2014
Workqueue: events drain_local_stock
RIP: 0010:page_counter_uncharge (mm/page_counter.c:57 mm/page_counter.c:50 mm/page_counter.c:156)
Call Trace:
__memcg_kmem_uncharge (mm/memcontrol.c:3022)
drain_obj_stock (./include/linux/rcupdate.h:689 mm/memcontrol.c:3114)
drain_local_stock (mm/memcontrol.c:2255)
process_one_work (./arch/x86/include/asm/jump_label.h:25 ./include/linux/jump_label.h:200 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2274)
worker_thread (./include/linux/list.h:282 kernel/workqueue.c:2416)
kthread (kernel/kthread.c:292)
ret_from_fork (arch/x86/entry/entry_64.S:300)The problem occurs because in the non-hierarchical mode non-root page counters are not linked to root page counters, so the charge is not propagated to the root memory cgroup.
After the removal of the original memory cgroup and reparenting of the object cgroup, the root cgroup might be uncharged by draining a objcg stock, for example. It leads to an eventual underflow of the charge and triggers a warning.
Fix it by linking all page counters to corresponding root page counters in the non-hierarchical mode.
Please note, that in the non-hierarchical mode all objcgs are always reparented to the root memory cgroup, even if the hierarchy has more than 1 level. This patch doesn't change it.
The patch also doesn't affect how the hierarchical mode is working, which is the only sane and truly supported mode now.
Thanks to Richard for reporting, debugging and providing an alternative version of the fix!
--- mm/memcontrol.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
mm/memcontrol.c +12 -6
@@ -5298,7 +5298,13 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) memcg->swappiness =mem_cgroup_swappiness (parent); memcg->oom_kill_disable = parent->oom_kill_disable; } -if (parent && parent->use_hierarchy) { +if (!parent) { +page_counter_init (&memcg->memory,NULL ); +page_counter_init (&memcg->swap,NULL ); +page_counter_init (&memcg->memsw,NULL ); +page_counter_init (&memcg->kmem,NULL ); +page_counter_init (&memcg->tcpmem,NULL ); + }else if (parent->use_hierarchy) { memcg->use_hierarchy = true;page_counter_init (&memcg->memory, &parent->memory);page_counter_init (&memcg->swap, &parent->swap);
@@ -5306,11 +5312,11 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)page_counter_init (&memcg->kmem, &parent->kmem);page_counter_init (&memcg->tcpmem, &parent->tcpmem); }else { -page_counter_init (&memcg->memory,NULL ); -page_counter_init (&memcg->swap,NULL ); -page_counter_init (&memcg->memsw,NULL ); -page_counter_init (&memcg->kmem,NULL ); -page_counter_init (&memcg->tcpmem,NULL ); +page_counter_init (&memcg->memory, &root_mem_cgroup->memory); +page_counter_init (&memcg->swap, &root_mem_cgroup->swap); +page_counter_init (&memcg->memsw, &root_mem_cgroup->memsw); +page_counter_init (&memcg->kmem, &root_mem_cgroup->kmem); +page_counter_init (&memcg->tcpmem, &root_mem_cgroup->tcpmem);/* * Deeper hierachy with use_hierarchy == false doesn't make * much sense so let cgroup subsystem know about this
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 198/255 loop: Fix occasional uevent drop
In reply to Greg Kroah-HartmanFrom: Petr Vorel <[email protected]>
commit c01a21b77722db0474bbcc4eafc8c4e0d8fed6d8 upstream.
Commit 716ad0986cbd ("loop: Switch to set_capacity_revalidate_and_notify") causes an occasional drop of loop device uevent, which are no longer triggered in loop_set_size() but in a different part of code.
Bug is reproducible with LTP test uevent01 [1]:
i=0; while true; do
i=$((i+1)); echo "== $i =="
lsmod |grep -q loop && rmmod -f loop
./uevent01 || breakdone
Put back triggering through code called in loop_set_size().
Fix required to add yet another parameter toset_capacity_revalidate_and_notify().
[1] https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/uevents/uevent01.c
[hch: rebased on a different change to the prototype of
set_capacity_revalidate_and_notify]
--- drivers/block/loop.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/loop.c +2 -1
@@ -255,7 +255,8 @@ static void loop_set_size(struct loop_debd_set_size (bdev, size <<SECTOR_SHIFT ); -set_capacity_revalidate_and_notify (lo->lo_disk, size, false); +if (!set_capacity_revalidate_and_notify (lo->lo_disk, size, false)) +kobject_uevent (&disk_to_dev (bdev->bd_disk)->kobj,KOBJ_CHANGE ); } static inline int
Greg Kroah-Hartman
maintainerPATCH 10/255 net: xfrm: fix a race condition during allocing spi
In reply to Greg Kroah-HartmanFrom: zhuoliang zhang <[email protected]>
[ Upstream commit a779d91314ca7208b7feb3ad817b62904397c56d ]
we found that the following race condition exists in xfrm_alloc_userspi flow:
user thread state_hash_work thread
---- ----xfrm_alloc_userspi()
__find_acq_core()
/*alloc new xfrm_state:x*/
xfrm_state_alloc()
/*schedule state_hash_work thread*/
xfrm_hash_grow_check() xfrm_hash_resize()
xfrm_alloc_spi /*hold lock*/
x->id.spi = htonl(spi) spin_lock_bh(&net->xfrm.xfrm_state_lock)
/*waiting lock release*/ xfrm_hash_transfer()
spin_lock_bh(&net->xfrm.xfrm_state_lock) /*add x into hlist:net->xfrm.state_byspi*/
hlist_add_head_rcu(&x->byspi)
spin_unlock_bh(&net->xfrm.xfrm_state_lock)
/*add x into hlist:net->xfrm.state_byspi 2 times*/
hlist_add_head_rcu(&x->byspi)1. a new state x is alloced in xfrm_state_alloc() and added into the bydst hlist in __find_acq_core() on the LHS;
2. on the RHS, state_hash_work thread travels the old bydst and tranfers every xfrm_state (include x) into the new bydst hlist and new byspi hlist;
3. user thread on the LHS gets the lock and adds x into the new byspi hlist again.
So the same xfrm_state (x) is added into the same list_hash (net->xfrm.state_byspi) 2 times that makes the list_hash become an inifite loop.
To fix the race, x->id.spi = htonl(spi) in the xfrm_alloc_spi() is moved to the back of spin_lock_bh, sothat state_hash_work thread no longer add x which id.spi is zero into the hash_list.
--- net/xfrm/xfrm_state.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/xfrm/xfrm_state.c +5 -3
@@ -2004,6 +2004,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)int err = -ENOENT ;__be32 minspi =htonl (low);__be32 maxspi =htonl (high); +__be32 newspi =0 ;u32 mark = x->mark.v & x->mark.m;spin_lock_bh (&x->lock);
@@ -2022,21 +2023,22 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)xfrm_state_put (x0); goto unlock; } - x->id.spi = minspi; + newspi = minspi; }else {u32 spi =0 ;for (h =0 ; h < high-low+1 ; h++) { spi = low +prandom_u32 ()%(high-low+1 ); x0 =xfrm_state_lookup (net, mark, &x->id.daddr,htonl (spi), x->id.proto, x->props.family);if (x0 ==NULL ) { - x->id.spi =htonl (spi); + newspi =htonl (spi);break ; }xfrm_state_put (x0); } } -if (x->id.spi) { +if (newspi) {spin_lock_bh (&net->xfrm.xfrm_state_lock); + x->id.spi = newspi; h =xfrm_spi_hash (net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);hlist_add_head_rcu (&x->byspi, net->xfrm.state_byspi + h);spin_unlock_bh (&net->xfrm.xfrm_state_lock);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 12/255 spi: imx: fix runtime pm support for !CONFIG_PM
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
[ Upstream commit 43b6bf406cd0319e522638f97c9086b7beebaeaa ]
525c9e5a32bd introduced pm_runtime support for the i.MX SPI driver. With this pm_runtime is used to bring up the clocks initially. When CONFIG_PM is disabled the clocks are no longer enabled and the driver doesn't work anymore. Fix this by enabling the clocks in the probe function and telling pm_runtime that the device is active using pm_runtime_set_active().
--- drivers/spi/spi-imx.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/spi/spi-imx.c +15 -8
@@ -1674,15 +1674,18 @@ static int spi_imx_probe(struct platform_device *pdev) goto out_master_put; } -pm_runtime_enable (spi_imx->dev); + ret =clk_prepare_enable (spi_imx->clk_per); +if (ret) + goto out_master_put; + + ret =clk_prepare_enable (spi_imx->clk_ipg); +if (ret) + goto out_put_per; +pm_runtime_set_autosuspend_delay (spi_imx->dev,MXC_RPM_TIMEOUT );pm_runtime_use_autosuspend (spi_imx->dev); - - ret =pm_runtime_get_sync (spi_imx->dev); -if (ret <0 ) { -dev_err (spi_imx->dev,"failed to enable clock\n" ); - goto out_runtime_pm_put; - } +pm_runtime_set_active (spi_imx->dev); +pm_runtime_enable (spi_imx->dev); spi_imx->spi_clk =clk_get_rate (spi_imx->clk_per);/*
@@ -1722,8 +1725,12 @@ out_bitbang_start:spi_imx_sdma_exit (spi_imx); out_runtime_pm_put:pm_runtime_dont_use_autosuspend (spi_imx->dev); -pm_runtime_put_sync (spi_imx->dev); +pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (spi_imx->dev); + +clk_disable_unprepare (spi_imx->clk_ipg); +out_put_per: +clk_disable_unprepare (spi_imx->clk_per); out_master_put:spi_master_put (master);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 13/255 irqchip/sifive-plic: Fix broken irq_set_affinity() callback
In reply to Greg Kroah-HartmanFrom: Greentime Hu <[email protected]>
[ Upstream commit a7480c5d725c4ecfc627e70960f249c34f5d13e8 ]
An interrupt submitted to an affinity change will always be left enabled after plic_set_affinity() has been called, while the expectation is that it should stay in whatever state it was before the call.
Preserving the configuration fixes a PWM hang issue on the Unleashed board.
[ 919.015783] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [ 919.020922] rcu: 0-...0: (0 ticks this GP) idle=7d2/1/0x4000000000000002 softirq=1424/1424 fqs=105807 [ 919.030295] (detected by 1, t=225825 jiffies, g=1561, q=3496) [ 919.036109] Task dump for CPU 0: [ 919.039321] kworker/0:1 R running task 0 30 2 0x00000008 [ 919.046359] Workqueue: events set_brightness_delayed [ 919.051302] Call Trace: [ 919.053738] [<ffffffe000930d92>] __schedule+0x194/0x4de [ 982.035783] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [ 982.040923] rcu: 0-...0: (0 ticks this GP) idle=7d2/1/0x4000000000000002 softirq=1424/1424 fqs=113325 [ 982.050294] (detected by 1, t=241580 jiffies, g=1561, q=3509) [ 982.056108] Task dump for CPU 0: [ 982.059321] kworker/0:1 R running task 0 30 2 0x00000008 [ 982.066359] Workqueue: events set_brightness_delayed [ 982.071302] Call Trace: [ 982.073739] [<ffffffe000930d92>] __schedule+0x194/0x4de
[..]
--- drivers/irqchip/irq-sifive-plic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-sifive-plic.c +1 -1
@@ -151,7 +151,7 @@ static int plic_set_affinity(struct irq_data *d,return -EINVAL ;plic_irq_toggle (&priv->lmask, d,0 ); -plic_irq_toggle (cpumask_of (cpu), d,1 ); +plic_irq_toggle (cpumask_of (cpu), d, !irqd_irq_masked (d));irq_data_update_effective_affinity (d,cpumask_of (cpu));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 1/255 drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 537457a979a02a410b555fab289dcb28b588f33b ]
Since __vma_release is run by a kworker after the fence has been signaled, it is no longer protected by the active reference on the vma, and so the alias of vw->pinned to vma->obj is also not protected by a reference on the object. Add an explicit reference for vw->pinned so it will always be safe.
Found by inspection.
--- drivers/gpu/drm/i915/i915_vma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_vma.c +4 -2
@@ -315,8 +315,10 @@ static void __vma_release(struct dma_fence_work *work) {struct i915_vma_work *vw =container_of (work,typeof (*vw), base); -if (vw->pinned) +if (vw->pinned) {__i915_gem_object_unpin_pages (vw->pinned); +i915_gem_object_put (vw->pinned); + } }static const struct dma_fence_work_ops bind_ops = {
@@ -430,7 +432,7 @@ int i915_vma_bind(struct i915_vma *vma,if (vma->obj) {__i915_gem_object_pin_pages (vma->obj); - work->pinned = vma->obj; + work->pinned =i915_gem_object_get (vma->obj); } }else { ret = vma->ops->bind_vma (vma->vm, vma, cache_level, bind_flags);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 15/255 kunit: Dont fail test suites if one of them is empty
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 3fc48259d5250f7a3ee021ad0492b604c428c564 ]
Empty test suite is okay test suite.
Don't fail the rest of the test suites if one of them is empty.
--- tools/testing/kunit/kunit_parser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/kunit/kunit_parser.py +1 -1
@@ -232,7 +232,7 @@ def parse_test_suite(lines: List[str]) -> TestSuite: return None test_suite.name = name expected_test_case_num = parse_subtest_plan(lines) - if not expected_test_case_num: + if expected_test_case_num is None: return None while expected_test_case_num > 0: test_case = parse_test_case(lines)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 18/255 ASoC: codecs: wcd934x: Set digital gain range correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit fc0522bbe02fa4beb95c0514ace66b585616f111 ]
digital gain range is -84dB min to 40dB max, however this was not correctly specified in the range.
Fix this by with correct range!
--- sound/soc/codecs/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd934x.c +1 -1
@@ -551,7 +551,7 @@ struct wcd_iir_filter_ctl {struct soc_bytes_ext bytes_ext; }; -static const DECLARE_TLV_DB_SCALE(digital_gain, 0, 1, 0); +static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1); static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1); static const DECLARE_TLV_DB_SCALE(ear_pa_gain, 0, 150, 0);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 2/255 drm/i915/gem: Flush coherency domains on first set-domain-ioctl
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 59dd13ad310793757e34afa489dd6fc8544fc3da ]
Avoid skipping what appears to be a no-op set-domain-ioctl if the cache coherency state is inconsistent with our target domain. This also has the utility of using the population of the pages to validate the backing store.
The danger in skipping the first set-domain is leaving the cache inconsistent and submitting stale data, or worse leaving the clean data in the cache and not flushing it to the GPU. The impact should be small as it requires a no-op set-domain as the very first ioctl in a particular sequence not found in typical userspace.
Testcase: igt/gem_mmap_offset/blt-coherency
--- drivers/gpu/drm/i915/gem/i915_gem_domain.c | 28 ++++++++++------------ 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/gpu/drm/i915/gem/i915_gem_domain.c +13 -15
@@ -484,21 +484,6 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,if (!obj)return -ENOENT ; -/* -* Already in the desired write domain? Nothing for us to do! -* -* We apply a little bit of cunning here to catch a broader set of -* no-ops. If obj->write_domain is set, we must be in the same -* obj->read_domains, and only that domain. Therefore, if that -* obj->write_domain matches the request read_domains, we are -* already in the same read/write domain and can skip the operation, -* without having to further check the requested write_domain. -*/ -if (READ_ONCE (obj->write_domain) == read_domains) { - err =0 ; - goto out; - } -/* * Try to flush the object off the GPU without holding the lock. * We will repeat the flush holding the lock in the normal manner
@@ -536,6 +521,19 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,if (err) goto out; +/* +* Already in the desired write domain? Nothing for us to do! +* +* We apply a little bit of cunning here to catch a broader set of +* no-ops. If obj->write_domain is set, we must be in the same +* obj->read_domains, and only that domain. Therefore, if that +* obj->write_domain matches the request read_domains, we are +* already in the same read/write domain and can skip the operation, +* without having to further check the requested write_domain. +*/ +if (READ_ONCE (obj->write_domain) == read_domains) + goto out_unpin; + err =i915_gem_object_lock_interruptible (obj);if (err) goto out_unpin;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 11/255 ASoC: codecs: wsa881x: add missing stream rates and format
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit f47d0742515748162d3fc35f04331c5b81c0ed47 ]
Add missing supported rates and formats for the stream, without which attempt to do playback will fail to find any matching rates/format.
--- sound/soc/codecs/wsa881x.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/wsa881x.c +2 -0
@@ -1026,6 +1026,8 @@ static struct snd_soc_dai_driver wsa881x_dais[] = { .id = 0, .playback = { .stream_name = "SPKR Playback", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, .rate_max = 48000, .rate_min = 48000, .channels_min = 1,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 19/255 ASoC: codecs: wcd9335: Set digital gain range correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 6d6bc54ab4f2404d46078abc04bf4dee4db01def ]
digital gain range is -84dB min to 40dB max, however this was not correctly specified in the range.
Fix this by with correct range!
--- sound/soc/codecs/wcd9335.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd9335.c +1 -1
@@ -618,7 +618,7 @@ static const char * const sb_tx8_mux_text[] = {"ZERO" ,"RX_MIX_TX8" ,"DEC8" ,"DEC8_192" }; -static const DECLARE_TLV_DB_SCALE(digital_gain, 0, 1, 0); +static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); static const DECLARE_TLV_DB_SCALE(line_gain, 0, 7, 1); static const DECLARE_TLV_DB_SCALE(analog_gain, 0, 25, 1); static const DECLARE_TLV_DB_SCALE(ear_pa_gain, 0, 150, 0);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 4/255 nbd: dont update block size after device is started
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit b40813ddcd6bf9f01d020804e4cb8febc480b9e4 ]
Mounted NBD device can be resized, one use case is rbd-nbd.
Fix the issue by setting up default block size, then not touch it in nbd_size_update() any more. This kind of usage is aligned with loop which has same use case too.
--- drivers/block/nbd.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/block/nbd.c +5 -4
@@ -296,7 +296,7 @@ static void nbd_size_clear(struct nbd_device *nbd) } } -static void nbd_size_update (struct nbd_device *nbd) +static void nbd_size_update (struct nbd_device *nbd,bool start) {struct nbd_config *config = nbd->config;struct block_device *bdev =bdget_disk (nbd->disk,0 );
@@ -312,7 +312,8 @@ static void nbd_size_update(struct nbd_device *nbd)if (bdev) {if (bdev->bd_disk) {bd_set_size (bdev, config->bytesize); -set_blocksize (bdev, config->blksize); +if (start) +set_blocksize (bdev, config->blksize); }else bdev->bd_invalidated =1 ;bdput (bdev);
@@ -327,7 +328,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, config->blksize = blocksize; config->bytesize = blocksize * nr_blocks;if (nbd->task_recv !=NULL ) -nbd_size_update (nbd); +nbd_size_update (nbd, false); }static void nbd_complete_rq (struct request *req)
@@ -1307,7 +1308,7 @@ static int nbd_start_device(struct nbd_device *nbd) args->index = i;queue_work (nbd->recv_workq, &args->work); } -nbd_size_update (nbd); +nbd_size_update (nbd, true);return error; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 16/255 usb: gadget: fsl: fix null pointer checking
In reply to Greg Kroah-HartmanFrom: Ran Wang <[email protected]>
[ Upstream commit 48e7bbbbb261b007fe78aa14ae62df01d236497e ]
fsl_ep_fifo_status() should return error if _ep->desc is null.
--- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/fsl_udc_core.c +1 -1
@@ -1051,7 +1051,7 @@ static int fsl_ep_fifo_status(struct usb_ep *_ep)u32 bitmask;struct ep_queue_head *qh; -if (!_ep || _ep->desc || !(_ep->desc->bEndpointAddress&0xF )) +if (!_ep || !_ep->desc || !(_ep->desc->bEndpointAddress&0xF ))return -ENODEV ; ep = container_of(_ep, struct fsl_ep, ep);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 6/255 xfrm: interface: fix the priorities for ipip and ipv6 tunnels
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 7fe94612dd4cfcd35fe0ec87745fb31ad2be71f8 ]
As Nicolas noticed in his case, when xfrm_interface module is installed the standard IP tunnels will break in receiving packets.
This is caused by the IP tunnel handlers with a higher priority in xfrm interface processing incoming packets by xfrm_input(), which would drop the packets and return 0 instead when anything wrong happens.
Rather than changing xfrm_input(), this patch is to adjust the priority for the IP tunnel handlers in xfrm interface, so that the packets would go to xfrmi's later than the others', as the others' would not drop the packets when the handlers couldn't process them.
Note that IPCOMP also defines its own IPIP tunnel handler and it calls xfrm_input() as well, so we must make its priority lower than xfrmi's, which means having xfrmi loaded would still break IPCOMP. We may seek another way to fix it in xfrm_input() in the future.
--- net/ipv4/xfrm4_tunnel.c | 4 ++-- net/ipv6/xfrm6_tunnel.c | 4 ++-- net/xfrm/xfrm_interface.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-)
net/ipv4/xfrm4_tunnel.c +2 -2
@@ -64,14 +64,14 @@ static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)static struct xfrm_tunnel xfrm_tunnel_handler__read_mostly = { .handler = xfrm_tunnel_rcv, .err_handler = xfrm_tunnel_err, - .priority =3 , + .priority =4 , };#if IS_ENABLED (CONFIG_IPV6 )static struct xfrm_tunnel xfrm64_tunnel_handler__read_mostly = { .handler = xfrm_tunnel_rcv, .err_handler = xfrm_tunnel_err, - .priority =2 , + .priority =3 , };#endif
net/ipv6/xfrm6_tunnel.c +2 -2
@@ -303,13 +303,13 @@ static const struct xfrm_type xfrm6_tunnel_type = {static struct xfrm6_tunnel xfrm6_tunnel_handler__read_mostly = { .handler = xfrm6_tunnel_rcv, .err_handler = xfrm6_tunnel_err, - .priority =2 , + .priority =3 , };static struct xfrm6_tunnel xfrm46_tunnel_handler__read_mostly = { .handler = xfrm6_tunnel_rcv, .err_handler = xfrm6_tunnel_err, - .priority =2 , + .priority =3 , };static int __net_init xfrm6_tunnel_net_init (struct net *net)
net/xfrm/xfrm_interface.c +4 -4
@@ -830,14 +830,14 @@ static struct xfrm6_tunnel xfrmi_ipv6_handler __read_mostly = { .handler = xfrmi6_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, - .priority = -1, + .priority = 2, };static struct xfrm6_tunnel xfrmi_ip6ip_handler__read_mostly = { .handler = xfrmi6_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, - .priority =-1 , + .priority =2 , };#endif
@@ -875,14 +875,14 @@ static struct xfrm_tunnel xfrmi_ipip_handler __read_mostly = { .handler = xfrmi4_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, - .priority = -1, + .priority = 3, };static struct xfrm_tunnel xfrmi_ipip6_handler__read_mostly = { .handler = xfrmi4_rcv_tunnel, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, - .priority =-1 , + .priority =2 , };#endif
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 8/255 genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 151a535171be6ff824a0a3875553ea38570f4c05 ]
kernel/irq/ipi.c otherwise fails to compile if nothing else selects it.
--- kernel/irq/Kconfig | 1 + 1 file changed, 1 insertion(+)
kernel/irq/Kconfig +1 -0
@@ -82,6 +82,7 @@ config IRQ_FASTEOI_HIERARCHY_HANDLERS # Generic IRQ IPI support config GENERIC_IRQ_IPI bool + select IRQ_DOMAIN_HIERARCHY # Generic MSI interrupt support config GENERIC_MSI_IRQ
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 5/255 KVM: arm64: Force PTE mapping on fault resulting in a device mapping
In reply to Greg Kroah-HartmanFrom: Santosh Shukla <[email protected]>
[ Upstream commit 91a2c34b7d6fadc9c5d9433c620ea4c32ee7cae8 ]
VFIO allows a device driver to resolve a fault by mapping a MMIO range. This can be subsequently result in user_mem_abort() to try and compute a huge mapping based on the MMIO pfn, which is a sure recipe for things to go wrong.
Instead, force a PTE mapping when the pfn faulted in has a device mapping.
--- arch/arm64/kvm/mmu.c | 1 + 1 file changed, 1 insertion(+)
arch/arm64/kvm/mmu.c +1 -0
@@ -1920,6 +1920,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,if (kvm_is_device_pfn (pfn)) { mem_type =PAGE_S2_DEVICE ; flags |=KVM_S2PTE_FLAG_IS_IOMAP ; + force_pte = true; }else if (logging_active) {/* * Faults on pages in a memslot with logging enabled
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 9/255 hv_balloon: disable warning when floor reached
In reply to Greg Kroah-HartmanFrom: Olaf Hering <[email protected]>
[ Upstream commit 2c3bd2a5c86fe744e8377733c5e511a5ca1e14f5 ]
It is not an error if the host requests to balloon down, but the VM refuses to do so. Without this change a warning is logged in dmesg every five minutes.
--- drivers/hv/hv_balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hv/hv_balloon.c +1 -1
@@ -1275,7 +1275,7 @@ static void balloon_up(struct work_struct *dummy)/* Refuse to balloon below the floor. */ if (avail_pages < num_pages || avail_pages - num_pages < floor) { -pr_warn ("Balloon request will be partially fulfilled. %s\n" , +pr_info ("Balloon request will be partially fulfilled. %s\n" , avail_pages < num_pages ?"Not enough memory." :"Balloon floor reached." );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 36/255 perf trace: Fix segfault when trying to trace events by cgroup
In reply to Greg Kroah-HartmanFrom: Stanislav Ivanichkin <[email protected]>
[ Upstream commit a6293f36ac92ab513771a98efe486477be2f981f ]
# ./perf trace -e sched:sched_switch -G test -a sleep 1 perf: Segmentation fault Obtained 11 stack frames. ./perf(sighandler_dump_stack+0x43) [0x55cfdc636db3] /lib/x86_64-linux-gnu/libc.so.6(+0x3efcf) [0x7fd23eecafcf] ./perf(parse_cgroups+0x36) [0x55cfdc673f36] ./perf(+0x3186ed) [0x55cfdc70d6ed] ./perf(parse_options_subcommand+0x629) [0x55cfdc70e999] ./perf(cmd_trace+0x9c2) [0x55cfdc5ad6d2] ./perf(+0x1e8ae0) [0x55cfdc5ddae0] ./perf(+0x1e8ded) [0x55cfdc5ddded] ./perf(main+0x370) [0x55cfdc556f00] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fd23eeadb96] ./perf(_start+0x29) [0x55cfdc557389] Segmentation fault #
It happens because "struct trace" in option->value is passed to the parse_cgroups function instead of "struct evlist".
--- tools/perf/builtin-trace.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/perf/builtin-trace.c +9 -6
@@ -4639,9 +4639,9 @@ do_concat: err =0 ;if (lists[0 ]) { -struct option o =OPT_CALLBACK ('e' ,"event" , &trace->evlist,"event" , -"event selector. use 'perf list' to list available events" , - parse_events_option); +struct option o = { + .value = &trace->evlist, + }; err =parse_events_option (&o, lists[0 ],0 ); } out:
@@ -4655,9 +4655,12 @@ static int trace__parse_cgroups(const struct option *opt, const char *str, int u {struct trace *trace = opt->value; -if (!list_empty (&trace->evlist->core.entries)) -return parse_cgroups (opt, str, unset); - +if (!list_empty (&trace->evlist->core.entries)) { +struct option o = { + .value = &trace->evlist, + }; +return parse_cgroups (&o, str, unset); + } trace->cgroup =evlist__findnew_cgroup (trace->evlist, str);return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainercover 5.9.9-rc1 review
This is the start of the stable review cycle for the 5.9.9 release. There are 255 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Nov 2020 12:20:51 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.9.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.9.9-rc1
Boris Protopopov <[email protected]>
Convert trailing spaces and periods in path components
Mike Leach <[email protected]>
coresight: Fix uninitialised pointer bug in etm_setup_aux()
Linu Cherian <[email protected]>
coresight: etm: perf: Sink selection using sysfs is deprecated
Arnaldo Carvalho de Melo <[email protected]>
perf scripting python: Avoid declaring function pointers with a visibility attribute
Damien Le Moal <[email protected]>
null_blk: Fix scheduling in atomic with zoned mode
Christophe Leroy <[email protected]>
powerpc/603: Always fault when _PAGE_ACCESSED is not set
Stefano Brivio <[email protected]>
tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies
Paolo Abeni <[email protected]>
mptcp: provide rmem[0] limit
Parav Pandit <[email protected]>
devlink: Avoid overwriting port attributes of registered port
Wang Hai <[email protected]>
tipc: fix memory leak in tipc_topsrv_start()
Martin Schiller <[email protected]>
net/x25: Fix null-ptr-deref in x25_connect
Mao Wenan <[email protected]>
net: Update window_clamp if SOCK_RCVBUF is set
Alexander Lobakin <[email protected]>
net: udp: fix UDP header access on Fast/frag0 UDP GRO
Alexander Lobakin <[email protected]>
net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO
Ursula Braun <[email protected]>
net/af_iucv: fix null pointer dereference on shutdown
Oliver Herms <[email protected]>
IPv6: Set SIT tunnel hard_header_len to zero
Alexander Lobakin <[email protected]>
ethtool: netlink: add missing netdev_features_change() call
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Take CPUFREQ_GOV_STRICT_TARGET into account
Rafael J. Wysocki <[email protected]>
cpufreq: Add strict_target to struct cpufreq_policy
Rafael J. Wysocki <[email protected]>
cpufreq: Introduce CPUFREQ_GOV_STRICT_TARGET
Rafael J. Wysocki <[email protected]>
cpufreq: Introduce governor flags
Stefano Stabellini <[email protected]>
swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
Coiby Xu <[email protected]>
pinctrl: amd: fix incorrect way to disable debounce filter
Coiby Xu <[email protected]>
pinctrl: amd: use higher precision for 512 RtcClk
J. Bruce Fields <[email protected]>
NFSv4.2: fix failure to unregister shrinker
Thomas Zimmermann <[email protected]>
drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
Venkata Sandeep Dhanalakota <[email protected]>
drm/i915: Correctly set SFC capability for video engines
Bhawanpreet Lakha <[email protected]>
drm/amd/display: Add missing pflip irq
Al Viro <[email protected]>
don't dump the threads that had been already exiting when zapped.
Yoshihiro Shimoda <[email protected]>
mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
Yangbo Lu <[email protected]>
mmc: sdhci-of-esdhc: Handle pulse width detection erratum for more SoCs
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Enable PEX8311 interrupts
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Fix IRQ Enable Register value
Arnaud de Turckheim <[email protected]>
gpio: pcie-idio-24: Fix irq mask when masking
Damien Le Moal <[email protected]>
gpio: sifive: Fix SiFive gpio probe
Jens Axboe <[email protected]>
io_uring: round-up cq size before comparing with rounded sq size
Chen Zhou <[email protected]>
selinux: Fix error return code in sel_ib_pkey_sid_slow()
Naveen Krishna Chatradhi <[email protected]>
hwmon: (amd_energy) modify the visibility of the counters
Wengang Wang <[email protected]>
ocfs2: initialize ip_next_orphan
Mike Kravetz <[email protected]>
hugetlbfs: fix anon huge page migration race
Matteo Croce <[email protected]>
reboot: fix overflow parsing reboot cpu number
Matteo Croce <[email protected]>
Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
Jason Gunthorpe <[email protected]>
mm/gup: use unpin_user_pages() in __gup_longterm_locked()
Nicholas Piggin <[email protected]>
mm/vmscan: fix NR_ISOLATED_FILE corruption on 64-bit
Laurent Dufour <[email protected]>
mm/slub: fix panic in slab_alloc_node()
Zi Yan <[email protected]>
mm/compaction: stop isolation if too many pages are isolated and we have pages to migrate
Zi Yan <[email protected]>
mm/compaction: count pages and stop correctly during page isolation
Masami Hiramatsu <[email protected]>
bootconfig: Extend the magic check range to the preceding 3 bytes
Theodore Ts'o <[email protected]>
jbd2: fix up sparse warnings in checkpoint code
Dan Carpenter <[email protected]>
futex: Don't enable IRQs unconditionally in put_pi_state()
Alexander Usyskin <[email protected]>
mei: protect mei_cl_mtu from null dereference
Alexander Lobakin <[email protected]>
virtio: virtio_console: fix DMA memory allocation for rproc serial
Zhang Qilong <[email protected]>
xhci: hisilicon: fix refercence leak in xhci_histb_probe
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Report power supply changes
Chris Brandt <[email protected]>
usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
Geert Uytterhoeven <[email protected]>
Revert "usb: musb: convert to devm_platform_ioremap_resource_byname"
Shin'ichiro Kawasaki <[email protected]>
uio: Fix use-after-free in uio_unregister_device()
Petr Vorel <[email protected]>
loop: Fix occasional uevent drop
Christoph Hellwig <[email protected]>
block: add a return value to set_capacity_revalidate_and_notify
Jing Xiangfeng <[email protected]>
thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
Mika Westerberg <[email protected]>
thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services()
Samuel Thibault <[email protected]>
speakup: Fix clearing selection in safe context
Samuel Thibault <[email protected]>
speakup ttyio: Do not schedule() in ttyio_in_nowait
Samuel Thibault <[email protected]>
speakup: Fix var_id_t values and thus keymap
Andrew Jones <[email protected]>
KVM: arm64: Don't hide ID registers from userspace
Anand Jain <[email protected]>
btrfs: dev-replace: fail mount if we don't have replace item with target device
Josef Bacik <[email protected]>
btrfs: fix min reserved size calculation in merge_reloc_root
Dinghao Liu <[email protected]>
btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
Matthew Wilcox (Oracle) <[email protected]>
btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
Joseph Qi <[email protected]>
ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
Kaixu Xia <[email protected]>
ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
Gao Xiang <[email protected]>
erofs: derive atime instead of leaving it empty
Gao Xiang <[email protected]>
erofs: fix setting up pcluster for temporary pages
Arnd Bergmann <[email protected]>
firmware: xilinx: fix out-of-bounds access
Peter Zijlstra <[email protected]>
perf: Fix event multiplexing for exclusive groups
Peter Zijlstra <[email protected]>
perf: Simplify group_sched_in()
Sagi Grimberg <[email protected]>
nvme: fix incorrect behavior when BLKROSET is called by the user
Sasha Levin <[email protected]>
nvme: freeze the queue over ->lba_shift updates
Christoph Hellwig <[email protected]>
nvme: factor out a nvme_configure_metadata helper
Peter Zijlstra <[email protected]>
perf: Fix get_recursion_context()
David Howells <[email protected]>
afs: Fix afs_write_end() when called with copied == 0 [ver #3]
Muchun Song <[email protected]>
mm: memcontrol: fix missing wakeup polling thread
Santosh Sivaraj <[email protected]>
kernel/watchdog: fix watchdog_allowed_mask not used warning
Anshuman Khandual <[email protected]>
arm64/mm: Validate hotplug range before creating linear mapping
Sven Van Asbroeck <[email protected]>
lan743x: fix use of uninitialized variable
Martin Willi <[email protected]>
vrf: Fix fast path output packet handling with async Netfilter rules
Chuck Lever <[email protected]>
NFS: Fix listxattr receive buffer size
Brad Campbell <[email protected]>
hwmon: (applesmc) Re-work SMC comms
Wang Hai <[email protected]>
cosa: Add missing kfree in error path of cosa_write
Rohit Maheshwari <[email protected]>
ch_ktls: tcb update fails sometimes
Rohit Maheshwari <[email protected]>
ch_ktls: Update cheksum information
Evan Nimmo <[email protected]>
of/address: Fix of_node memory leak in of_dma_is_coherent
Christoph Hellwig <[email protected]>
xfs: fix a missing unlock on error in xfs_fs_map_blocks
Sven Van Asbroeck <[email protected]>
lan743x: fix "BUG: invalid wait context" when setting rx mode
Darrick J. Wong <[email protected]>
xfs: fix brainos in the refcount scrubber's rmap fragment processor
Darrick J. Wong <[email protected]>
xfs: fix rmap key and record comparison functions
Darrick J. Wong <[email protected]>
xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
Darrick J. Wong <[email protected]>
xfs: fix flags argument to rmap lookup when converting shared file rmaps
Heiner Kallweit <[email protected]>
net: phy: realtek: support paged operations on RTL8201CP
Sven Van Asbroeck <[email protected]>
lan743x: correctly handle chips with internal PHY
Vinicius Costa Gomes <[email protected]>
igc: Fix returning wrong statistics
Slawomir Laba <[email protected]>
i40e: Fix MAC address setting for a VF via Host/VM
Vlad Buslov <[email protected]>
selftest: fix flower terse dump tests
Christoph Hellwig <[email protected]>
nbd: fix a block_device refcount leak in nbd_release
Bjorn Andersson <[email protected]>
pinctrl: qcom: sm8250: Specify PDC map
Maulik Shah <[email protected]>
pinctrl: qcom: Move clearing pending IRQ to .irq_request_resources callback
Heiner Kallweit <[email protected]>
r8169: disable hw csum for short packets on all chip versions
Heiner Kallweit <[email protected]>
r8169: fix potential skb double free in an error path
David Verbeiren <[email protected]>
bpf: Zero-fill re-used per-cpu map element
Lorenz Bauer <[email protected]>
tools/bpftool: Fix attaching flow dissector
Dai Ngo <[email protected]>
NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy
Dai Ngo <[email protected]>
NFSD: Fix use-after-free warning when doing inter-server copy
Chuck Lever <[email protected]>
SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
Aya Levin <[email protected]>
net/mlx5e: Fix VXLAN synchronization after function reload
Parav Pandit <[email protected]>
net/mlx5: E-switch, Avoid extack error log for disabled vport
Maor Gottlieb <[email protected]>
net/mlx5: Fix deletion of duplicate rules
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Use spin_lock_bh for async_icosq_lock
Vlad Buslov <[email protected]>
net/mlx5e: Protect encap route dev from concurrent release
Maor Dickman <[email protected]>
net/mlx5e: Fix modify header actions memory leak
Billy Tsai <[email protected]>
pinctrl: aspeed: Fix GPI only function problem.
Andy Shevchenko <[email protected]>
pinctrl: mcp23s08: Use full chunk of memory for regmap configuration
Ian Rogers <[email protected]>
libbpf, hashmap: Fix undefined behavior in hash_bits
Ard Biesheuvel <[email protected]>
bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
Andrew Jeffery <[email protected]>
ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
Billy Tsai <[email protected]>
gpio: aspeed: fix ast2600 bank properties
Andy Shevchenko <[email protected]>
pinctrl: intel: Set default bias in case no particular value given
Andy Shevchenko <[email protected]>
pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
Baolin Wang <[email protected]>
mfd: sprd: Add wakeup capability for PMIC IRQ
Martin Hundebøll <[email protected]>
spi: bcm2835: remove use of uninitialized gpio flags variable
Jerry Snitselaar <[email protected]>
tpm_tis: Disable interrupts on ThinkPad T490s
Michael Wu <[email protected]>
i2c: designware: slave should do WRITE_REQUESTED before WRITE_RECEIVED
Michael Wu <[email protected]>
i2c: designware: call i2c_dw_read_clear_intrbits_slave() once
Ulrich Hecht <[email protected]>
i2c: sh_mobile: implement atomic transfers
Sean Anderson <[email protected]>
riscv: Set text_offset correctly for M-Mode
Benjamin Gwin <[email protected]>
arm64: kexec_file: try more regions if loading segments fails
Tommi Rantala <[email protected]>
selftests: proc: fix warning: _GNU_SOURCE redefined
Brian Foster <[email protected]>
iomap: clean up writeback state logic on writepage error
Veerabadhran Gopalakrishnan <[email protected]>
amd/amdgpu: Disable VCN DPG mode for Picasso
Qii Wang <[email protected]>
i2c: mediatek: move dma reset before i2c reset
Fred Gao <[email protected]>
vfio/pci: Bypass IGD init in case of -ENODEV
Zhang Qilong <[email protected]>
vfio: platform: fix reference leak in vfio_platform_open
Qian Cai <[email protected]>
s390/smp: move rcu_cpu_starting() earlier
Suravee Suthikulpanit <[email protected]>
iommu/amd: Increase interrupt remapping table limit to 512 entries
Sagi Grimberg <[email protected]>
nvme-tcp: avoid repeated request completion
Sagi Grimberg <[email protected]>
nvme-rdma: avoid repeated request completion
Chao Leng <[email protected]>
nvme-tcp: avoid race between time out and tear down
Chao Leng <[email protected]>
nvme-rdma: avoid race between time out and tear down
Chao Leng <[email protected]>
nvme: introduce nvme_sync_io_queues
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
Hannes Reinecke <[email protected]>
scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
Vineet Gupta <[email protected]>
ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline
Keith Busch <[email protected]>
Revert "nvme-pci: remove last_sq_tail"
Qiujun Huang <[email protected]>
tracing: Fix the checking of stackidx in __ftrace_trace_stack
Jason A. Donenfeld <[email protected]>
wireguard: selftests: check that route_me_harder packets use the right sk
Ye Bin <[email protected]>
cfg80211: regulatory: Fix inconsistent format argument
Johannes Berg <[email protected]>
mac80211: always wind down STA state
Johannes Berg <[email protected]>
cfg80211: initialize wdev data earlier
Johannes Berg <[email protected]>
mac80211: fix use of skb payload instead of header
Evan Quan <[email protected]>
drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
Evan Quan <[email protected]>
drm/amd/pm: perform SMC reset on suspend/hibernation
Evan Quan <[email protected]>
drm/amd/pm: correct the baco reset sequence for CI ASICs
Evan Quan <[email protected]>
drm/amdgpu: perform srbm soft reset always on SDMA resume
Keita Suzuki <[email protected]>
scsi: hpsa: Fix memory leak in hpsa_init_one()
Bob Peterson <[email protected]>
gfs2: check for live vs. read-only file system in gfs2_fitrim
Bob Peterson <[email protected]>
gfs2: Add missing truncate_inode_pages_final for sd_aspace
Bob Peterson <[email protected]>
gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
Joerg Roedel <[email protected]>
x86/boot/compressed/64: Introduce sev_status
Kai-Heng Feng <[email protected]>
ALSA: hda: Reinstate runtime_allow() for all hda controllers
Kai-Heng Feng <[email protected]>
ALSA: hda: Separate runtime and system suspend
Tommi Rantala <[email protected]>
selftests: pidfd: fix compilation errors due to wait.h
Colin Ian King <[email protected]>
selftests/ftrace: check for do_sys_openat2 in user-memory test
Zqiang <[email protected]>
usb: raw-gadget: fix memory leak in gadget_setup
Evgeny Novikov <[email protected]>
usb: gadget: goku_udc: fix potential crashes in probe
Viresh Kumar <[email protected]>
opp: Reduce the size of critical section in _opp_table_kref_release()
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Alder Lake-S
Bard Liao <[email protected]>
ASoC: SOF: loader: handle all SOF_IPC_EXT types
Olivier Moysan <[email protected]>
ASoC: cs42l51: manage mclk shutdown delay
Srinivas Kandagatla <[email protected]>
ASoC: qcom: sdm845: set driver name correctly
Tzung-Bi Shih <[email protected]>
ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015
Pujin Shi <[email protected]>
scsi: ufs: Fix missing brace warning for old compilers
Masashi Honma <[email protected]>
ath9k_htc: Use appropriate rs_datalen type
Stephen Boyd <[email protected]>
KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return SMCCC_RET_NOT_REQUIRED
Tyler Hicks <[email protected]>
tpm: efi: Don't create binary_bios_measurements file for an empty log
Zhang Qilong <[email protected]>
USB: apple-mfi-fastcharge: fix reference leak in apple_mfi_fc_set_property
Palmer Dabbelt <[email protected]>
RISC-V: Fix the VDSO symbol generaton for binutils-2.35+
Bill Wendling <[email protected]>
kbuild: explicitly specify the build id style
Anand K Mistry <[email protected]>
x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
Tommi Rantala <[email protected]>
selftests: binderfs: use SKIP instead of XFAIL
Tommi Rantala <[email protected]>
selftests: clone3: use SKIP instead of XFAIL
Tommi Rantala <[email protected]>
selftests: core: use SKIP instead of XFAIL in close_range_test.c
Jeff Layton <[email protected]>
ceph: check session state after bumping session->s_seq
Rob Herring <[email protected]>
PCI: mvebu: Fix duplicate resource requests
Zhao Qiang <[email protected]>
spi: fsl-dspi: fix wrong pointer in suspend/resume
Jens Axboe <[email protected]>
io_uring: ensure consistent view of original task ->mm from SQPOLL
Darrick J. Wong <[email protected]>
xfs: fix scrub flagging rtinherit even if there is no rt device
Darrick J. Wong <[email protected]>
xfs: fix missing CoW blocks writeback conversion retry
Brian Foster <[email protected]>
xfs: flush new eof page on truncate to avoid post-eof corruption
Joakim Zhang <[email protected]>
can: flexcan: flexcan_remove(): disable wakeup completely
Joakim Zhang <[email protected]>
can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
Stephane Grosjean <[email protected]>
can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
Stephane Grosjean <[email protected]>
can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
Dan Carpenter <[email protected]>
can: peak_usb: add range checking in decode operations
Navid Emamdoost <[email protected]>
can: xilinx_can: handle failure cases of pm_runtime_get_sync
Zhang Changzhong <[email protected]>
can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
Zhang Changzhong <[email protected]>
can: j1939: j1939_sk_bind(): return failure if netdev is down
Yegor Yefremov <[email protected]>
can: j1939: swap addr and pgn in the send example
Oleksij Rempel <[email protected]>
can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
Oliver Hartkopp <[email protected]>
can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
Vincent Mailhol <[email protected]>
can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
Marc Kleine-Budde <[email protected]>
can: rx-offload: don't call kfree_skb() from IRQ context
Alex Williamson <[email protected]>
vfio/pci: Implement ioeventfd thread handler for contended memory lock
David Howells <[email protected]>
afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
David Howells <[email protected]>
afs: Fix warning due to unadvanced marshalling pointer
Liu, Yi L <[email protected]>
iommu/vt-d: Fix a bug for PDP check in prq_event_thread
Liu Yi L <[email protected]>
iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
Dan Carpenter <[email protected]>
ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
Namhyung Kim <[email protected]>
perf tools: Add missing swap for cgroup events
Jiri Olsa <[email protected]>
perf tools: Add missing swap for ino_generation
Stanislav Ivanichkin <[email protected]>
perf trace: Fix segfault when trying to trace events by cgroup
Steven Price <[email protected]>
drm/panfrost: Fix module unload
Clément Péron <[email protected]>
drm/panfrost: move devfreq_init()/fini() in device
Clément Péron <[email protected]>
drm/panfrost: rename error labels in device_init
zhongjiang-ali <[email protected]>
mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg
Maor Gottlieb <[email protected]>
IB/srpt: Fix memory leak in srpt_add_one
Maxime Ripard <[email protected]>
drm/vc4: bo: Add a managed action to cleanup the cache
Qian Cai <[email protected]>
powerpc/eeh_cache: Fix a possible debugfs deadlock
Greentime Hu <[email protected]>
irqchip/sifive-plic: Fix chip_data access within a hierarchy
Stefano Brivio <[email protected]>
netfilter: ipset: Update byte and packet counters regardless of whether they match
Rajat Jain <[email protected]>
PCI: Always enable ACS even if no ACS Capability
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing validation from the abort path
Jason A. Donenfeld <[email protected]>
netfilter: use actual socket sk rather than skb sk when routing harder
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: fix netlink report logic in flowtable and genid
Johannes Berg <[email protected]>
mac80211: don't require VHT elements for HE on 2.4 GHz
Darrick J. Wong <[email protected]>
xfs: set xefi_discard when creating a deferred agfl free log intent item
Bert Vermeulen <[email protected]>
mtd: spi-nor: Fix address width on flash chips > 16MB
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd9335: Set digital gain range correctly
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd934x: Set digital gain range correctly
Tommi Rantala <[email protected]>
selftests: filter kselftest headers from command in lib.mk
Ran Wang <[email protected]>
usb: gadget: fsl: fix null pointer checking
Andy Shevchenko <[email protected]>
kunit: Don't fail test suites if one of them is empty
David Gow <[email protected]>
kunit: Fix kunit.py --raw_output option
Greentime Hu <[email protected]>
irqchip/sifive-plic: Fix broken irq_set_affinity() callback
Sascha Hauer <[email protected]>
spi: imx: fix runtime pm support for !CONFIG_PM
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: add missing stream rates and format
zhuoliang zhang <[email protected]>
net: xfrm: fix a race condition during allocing spi
Olaf Hering <[email protected]>
hv_balloon: disable warning when floor reached
Marc Zyngier <[email protected]>
genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
Tomasz Figa <[email protected]>
ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
Xin Long <[email protected]>
xfrm: interface: fix the priorities for ipip and ipv6 tunnels
Santosh Shukla <[email protected]>
KVM: arm64: Force PTE mapping on fault resulting in a device mapping
Ming Lei <[email protected]>
nbd: don't update block size after device is started
Roman Gushchin <[email protected]>
mm: memcg: link page counters to root if use_hierarchy is false
Chris Wilson <[email protected]>
drm/i915/gem: Flush coherency domains on first set-domain-ioctl
Chris Wilson <[email protected]>
drm/i915: Hold onto an explicit ref to i915_vma_work.pinned
-------------
Diffstat:
Documentation/networking/j1939.rst | 4 +- Makefile | 8 +- arch/arc/kernel/head.S | 17 +- arch/arc/plat-hsdk/platform.c | 17 -- arch/arm/include/asm/kprobes.h | 22 +-- arch/arm/probes/kprobes/opt-arm.c | 18 +- arch/arm/vdso/Makefile | 2 +- arch/arm64/kernel/kexec_image.c | 41 +++- arch/arm64/kernel/machine_kexec_file.c | 9 +- arch/arm64/kernel/vdso/Makefile | 2 +- arch/arm64/kernel/vdso32/Makefile | 2 +- arch/arm64/kvm/hypercalls.c | 2 +- arch/arm64/kvm/mmu.c | 1 + arch/arm64/kvm/sys_regs.c | 18 +- arch/arm64/mm/mmu.c | 17 ++ arch/mips/vdso/Makefile | 2 +- arch/powerpc/kernel/eeh_cache.c | 5 +- arch/powerpc/kernel/head_32.S | 12 -- arch/riscv/kernel/head.S | 5 + arch/riscv/kernel/vdso/.gitignore | 1 + arch/riscv/kernel/vdso/Makefile | 18 +- arch/riscv/kernel/vdso/so2s.sh | 6 + arch/s390/kernel/smp.c | 3 +- arch/s390/kernel/vdso64/Makefile | 2 +- arch/sparc/vdso/Makefile | 2 +- arch/x86/boot/compressed/mem_encrypt.S | 16 +- arch/x86/entry/vdso/Makefile | 2 +- arch/x86/kernel/cpu/bugs.c | 51 +++-- block/genhd.c | 5 +- drivers/accessibility/speakup/main.c | 1 - drivers/accessibility/speakup/selection.c | 11 +- drivers/accessibility/speakup/speakup.h | 1 - drivers/accessibility/speakup/spk_ttyio.c | 10 +- drivers/accessibility/speakup/spk_types.h | 8 +- drivers/block/loop.c | 3 +- drivers/block/nbd.c | 10 +- drivers/block/null_blk.h | 1 + drivers/block/null_blk_zoned.c | 31 ++- drivers/char/tpm/eventlog/efi.c | 5 + drivers/char/tpm/tpm_tis.c | 29 ++- drivers/char/virtio_console.c | 8 +- drivers/cpufreq/cpufreq.c | 4 +- drivers/cpufreq/cpufreq_governor.h | 2 +- drivers/cpufreq/cpufreq_performance.c | 1 + drivers/cpufreq/cpufreq_powersave.c | 1 + drivers/cpufreq/intel_pstate.c | 16 +- drivers/crypto/chelsio/chcr_ktls.c | 27 ++- drivers/firmware/xilinx/zynqmp.c | 3 + drivers/gpio/gpio-aspeed.c | 1 + drivers/gpio/gpio-pcie-idio-24.c | 62 +++++- drivers/gpio/gpio-sifive.c | 2 +- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +- .../amd/display/dc/irq/dcn30/irq_service_dcn30.c | 4 +- drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c | 7 +- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 + drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 29 ++- drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 + drivers/gpu/drm/gma500/psb_irq.c | 34 ++-- drivers/gpu/drm/i915/gem/i915_gem_domain.c | 28 ++- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 3 +- drivers/gpu/drm/i915/i915_vma.c | 6 +- drivers/gpu/drm/panfrost/panfrost_device.c | 40 ++-- drivers/gpu/drm/panfrost/panfrost_drv.c | 20 +- drivers/gpu/drm/vc4/vc4_bo.c | 5 +- drivers/gpu/drm/vc4/vc4_drv.c | 1 - drivers/gpu/drm/vc4/vc4_drv.h | 2 +- drivers/hv/hv_balloon.c | 2 +- drivers/hwmon/amd_energy.c | 2 +- drivers/hwmon/applesmc.c | 130 ++++++++----- drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +- drivers/i2c/busses/i2c-designware-slave.c | 52 ++--- drivers/i2c/busses/i2c-mt65xx.c | 8 +- drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++-- drivers/infiniband/ulp/srpt/ib_srpt.c | 13 +- drivers/iommu/amd/amd_iommu_types.h | 6 +- drivers/iommu/intel/svm.c | 8 +- drivers/irqchip/irq-sifive-plic.c | 10 +- drivers/mfd/sprd-sc27xx-spi.c | 28 ++- drivers/misc/mei/client.h | 4 +- drivers/mmc/host/renesas_sdhi_core.c | 1 + drivers/mmc/host/sdhci-of-esdhc.c | 2 + drivers/mtd/spi-nor/core.c | 8 +- drivers/net/can/dev.c | 14 +- drivers/net/can/flexcan.c | 5 +- drivers/net/can/peak_canfd/peak_canfd.c | 11 +- drivers/net/can/rx-offload.c | 4 +- drivers/net/can/ti_hecc.c | 8 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++-- drivers/net/can/xilinx_can.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 ++- drivers/net/ethernet/intel/igc/igc_main.c | 14 +- .../net/ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +- .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 72 ++++--- .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 4 +- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 4 +- .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 14 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 2 - drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 +- .../net/ethernet/mellanox/mlx5/core/lib/vxlan.c | 23 ++- .../net/ethernet/mellanox/mlx5/core/lib/vxlan.h | 2 + drivers/net/ethernet/microchip/lan743x_main.c | 24 +-- drivers/net/ethernet/microchip/lan743x_main.h | 3 - drivers/net/ethernet/realtek/r8169_main.c | 18 +- drivers/net/phy/realtek.c | 2 + drivers/net/vrf.c | 92 ++++++--- drivers/net/wan/cosa.c | 1 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +- drivers/nvme/host/core.c | 106 ++++++---- drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 23 ++- drivers/nvme/host/rdma.c | 14 +- drivers/nvme/host/tcp.c | 16 +- drivers/of/address.c | 4 +- drivers/opp/core.c | 7 +- drivers/pci/controller/pci-mvebu.c | 23 +-- drivers/pci/pci.c | 9 +- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 +- drivers/pinctrl/intel/pinctrl-intel.c | 40 +++- drivers/pinctrl/pinctrl-amd.c | 6 +- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 +- drivers/pinctrl/qcom/pinctrl-msm.c | 32 +-- drivers/pinctrl/qcom/pinctrl-sm8250.c | 18 ++ drivers/scsi/device_handler/scsi_dh_alua.c | 9 +- drivers/scsi/hpsa.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 7 + drivers/scsi/ufs/ufshcd-crypto.c | 4 +- drivers/spi/spi-bcm2835.c | 3 +- drivers/spi/spi-fsl-dspi.c | 10 +- drivers/spi/spi-imx.c | 23 ++- drivers/thunderbolt/nhi.c | 19 +- drivers/thunderbolt/xdomain.c | 1 + drivers/uio/uio.c | 10 +- drivers/usb/class/cdc-acm.c | 9 + drivers/usb/dwc3/dwc3-pci.c | 4 + drivers/usb/gadget/legacy/raw_gadget.c | 5 +- drivers/usb/gadget/udc/fsl_udc_core.c | 2 +- drivers/usb/gadget/udc/goku_udc.c | 2 +- drivers/usb/host/xhci-histb.c | 2 +- drivers/usb/misc/apple-mfi-fastcharge.c | 4 +- drivers/usb/musb/musb_dsps.c | 4 +- drivers/usb/typec/ucsi/psy.c | 9 + drivers/usb/typec/ucsi/ucsi.c | 7 +- drivers/usb/typec/ucsi/ucsi.h | 2 + drivers/vfio/pci/vfio_pci.c | 2 +- drivers/vfio/pci/vfio_pci_rdwr.c | 43 ++++- drivers/vfio/platform/vfio_platform_common.c | 3 +- fs/afs/write.c | 5 +- fs/afs/xattr.c | 7 +- fs/afs/yfsclient.c | 1 + fs/btrfs/dev-replace.c | 26 ++- fs/btrfs/ioctl.c | 10 +- fs/btrfs/ref-verify.c | 1 + fs/btrfs/relocation.c | 4 +- fs/btrfs/volumes.c | 26 +-- fs/ceph/caps.c | 2 +- fs/ceph/mds_client.c | 50 +++-- fs/ceph/mds_client.h | 1 + fs/ceph/quota.c | 2 +- fs/ceph/snap.c | 2 +- fs/cifs/cifs_unicode.c | 8 +- fs/erofs/inode.c | 21 +- fs/erofs/zdata.c | 7 +- fs/ext4/inline.c | 1 + fs/ext4/super.c | 4 +- fs/gfs2/rgrp.c | 5 +- fs/gfs2/super.c | 1 + fs/io_uring.c | 29 ++- fs/iomap/buffered-io.c | 15 +- fs/jbd2/checkpoint.c | 2 + fs/jbd2/transaction.c | 4 +- fs/nfs/nfs42xattr.c | 2 + fs/nfs/nfs42xdr.c | 4 +- fs/nfsd/nfs4proc.c | 3 +- fs/ocfs2/super.c | 1 + fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/libxfs/xfs_rmap_btree.c | 16 +- fs/xfs/scrub/bmap.c | 2 + fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_aops.c | 6 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- include/linux/arm-smccc.h | 2 + include/linux/can/skb.h | 20 +- include/linux/compiler-gcc.h | 2 - include/linux/compiler_types.h | 4 - include/linux/cpufreq.h | 18 +- include/linux/genhd.h | 2 +- include/linux/memcontrol.h | 11 +- include/linux/netfilter/nfnetlink.h | 9 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 10 +- include/trace/events/sunrpc.h | 8 +- init/main.c | 14 +- kernel/bpf/Makefile | 6 +- kernel/bpf/core.c | 2 +- kernel/bpf/hashtab.c | 30 ++- kernel/dma/swiotlb.c | 6 +- kernel/events/core.c | 12 +- kernel/events/internal.h | 2 +- kernel/exit.c | 5 +- kernel/futex.c | 5 +- kernel/irq/Kconfig | 1 + kernel/reboot.c | 28 +-- kernel/sched/cpufreq_schedutil.c | 2 +- kernel/trace/trace.c | 4 +- kernel/watchdog.c | 4 +- mm/compaction.c | 12 +- mm/gup.c | 14 +- mm/hugetlb.c | 90 +-------- mm/memcontrol.c | 28 ++- mm/memory-failure.c | 36 ++-- mm/migrate.c | 44 +++-- mm/rmap.c | 5 +- mm/slub.c | 2 +- mm/vmscan.c | 5 +- net/can/j1939/socket.c | 6 + net/core/devlink.c | 8 +- net/ethtool/features.c | 2 +- net/ipv4/ip_tunnel_core.c | 4 +- net/ipv4/netfilter.c | 8 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/syncookies.c | 9 +- net/ipv4/udp_offload.c | 19 +- net/ipv4/xfrm4_tunnel.c | 4 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/ipv6/udp_offload.c | 17 +- net/ipv6/xfrm6_tunnel.c | 4 +- net/iucv/af_iucv.c | 3 +- net/mac80211/mlme.c | 3 +- net/mac80211/sta_info.c | 18 ++ net/mac80211/tx.c | 37 ++-- net/mptcp/protocol.c | 1 + net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/nf_nat_proto.c | 4 +- net/netfilter/nf_synproxy_core.c | 2 +- net/netfilter/nf_tables_api.c | 19 +- net/netfilter/nfnetlink.c | 22 ++- net/netfilter/nft_chain_route.c | 4 +- net/netfilter/utils.c | 4 +- net/tipc/topsrv.c | 10 +- net/wireless/core.c | 57 +++--- net/wireless/core.h | 5 +- net/wireless/nl80211.c | 3 +- net/wireless/reg.c | 2 +- net/x25/af_x25.c | 2 +- net/xfrm/xfrm_interface.c | 8 +- net/xfrm/xfrm_state.c | 8 +- security/selinux/ibpkey.c | 4 +- sound/hda/ext/hdac_ext_controller.c | 2 + sound/pci/hda/hda_controller.h | 3 +- sound/pci/hda/hda_intel.c | 63 +++--- sound/soc/codecs/cs42l51.c | 22 ++- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wsa881x.c | 2 + sound/soc/intel/boards/kbl_rt5663_max98927.c | 39 +++- sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 31 ++- sound/soc/qcom/sdm845.c | 2 + sound/soc/sof/loader.c | 5 + tools/bpf/bpftool/prog.c | 2 +- tools/lib/bpf/hashmap.h | 15 +- tools/perf/builtin-trace.c | 15 +- .../util/scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 14 ++ tools/testing/kunit/kunit_parser.py | 3 +- tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/map_init.c | 214 +++++++++++++++++++++ tools/testing/selftests/bpf/progs/test_map_init.c | 33 ++++ .../clone3/clone3_cap_checkpoint_restore.c | 2 +- tools/testing/selftests/core/close_range_test.c | 8 +- .../selftests/filesystems/binderfs/binderfs_test.c | 8 +- .../ftrace/test.d/kprobe/kprobe_args_user.tc | 4 + tools/testing/selftests/lib.mk | 2 +- tools/testing/selftests/pidfd/pidfd_open_test.c | 1 - tools/testing/selftests/pidfd/pidfd_poll_test.c | 1 - tools/testing/selftests/proc/proc-loadavg-001.c | 1 - tools/testing/selftests/proc/proc-self-syscall.c | 1 - tools/testing/selftests/proc/proc-uptime-002.c | 1 - .../tc-testing/tc-tests/filters/tests.json | 4 +- tools/testing/selftests/wireguard/netns.sh | 8 + .../testing/selftests/wireguard/qemu/kernel.config | 2 + 297 files changed, 2450 insertions(+), 1241 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 37/255 perf tools: Add missing swap for ino_generation
From: Jiri Olsa <[email protected]>
[ Upstream commit fe01adb72356a4e2f8735e4128af85921ca98fa1 ]
We are missing swap for ino_generation field.
--- tools/perf/util/session.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/session.c +1 -0
@@ -595,6 +595,7 @@ static void perf_event__mmap2_swap(union perf_event *event, event->mmap2.maj =bswap_32 (event->mmap2.maj); event->mmap2.min =bswap_32 (event->mmap2.min); event->mmap2.ino =bswap_64 (event->mmap2.ino); + event->mmap2.ino_generation =bswap_64 (event->mmap2.ino_generation);if (sample_id_all) {void *data = &event->mmap2.filename;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 39/255 ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 158e1886b6262c1d1c96a18c85fac5219b8bf804 ]
This is harmless, but the "addr" comes from the user and it could lead to a negative shift or to shift wrapping if it's too high.
--- sound/hda/ext/hdac_ext_controller.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/ext/hdac_ext_controller.c +2 -0
@@ -148,6 +148,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_bus *bus,return NULL ;if (bus->idx != bus_idx)return NULL ; +if (addr <0 || addr >31 ) +return NULL ;list_for_each_entry (hlink, &bus->hlink_list, list) {for (i =0 ; i <HDA_MAX_CODECS ; i++) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 42/255 afs: Fix warning due to unadvanced marshalling pointer
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit c80afa1d9c3603d5eddeb8d63368823b1982f3f0 ]
When using the afs.yfs.acl xattr to change an AuriStor ACL, a warning can be generated when the request is marshalled because the buffer pointer isn't increased after adding the last element, thereby triggering the check at the end if the ACL wasn't empty. This just causes something like the following warning, but doesn't stop the call from happening successfully:
kAFS: YFS.StoreOpaqueACL2: Request buffer underflow (36<108)
Fix this simply by increasing the count prior to the check.
--- fs/afs/yfsclient.c | 1 + 1 file changed, 1 insertion(+)
fs/afs/yfsclient.c +1 -0
@@ -1990,6 +1990,7 @@ void yfs_fs_store_opaque_acl2(struct afs_operation *op)memcpy (bp, acl->data, acl->size);if (acl->size != size)memset ((void *)bp + acl->size,0 , size - acl->size); + bp += size /sizeof (__be32);yfs_check_req (call, bp);trace_afs_make_fs_call (call, &vp->fid);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 38/255 perf tools: Add missing swap for cgroup events
In reply to Greg Kroah-HartmanFrom: Namhyung Kim <[email protected]>
[ Upstream commit 2c589d933e54d183ee2a052971b730e423c62031 ]
It was missed to add a swap function for PERF_RECORD_CGROUP.
--- tools/perf/util/session.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/perf/util/session.c +13 -0
@@ -711,6 +711,18 @@ static void perf_event__namespaces_swap(union perf_event *event,swap_sample_id_all (event, &event->namespaces.link_info[i]); } +static void perf_event__cgroup_swap (union perf_event *event,bool sample_id_all) +{ + event->cgroup.id =bswap_64 (event->cgroup.id); + +if (sample_id_all) { +void *data = &event->cgroup.path; + + data +=PERF_ALIGN (strlen (data) +1 ,sizeof (u64)); +swap_sample_id_all (event, data); + } +} +static u8 revbyte (u8 b) {int rev = (b >>4 ) | ((b &0xf ) <<4 );
@@ -953,6 +965,7 @@ static perf_event__swap_op perf_event__swap_ops[] = { [PERF_RECORD_SWITCH] = perf_event__switch_swap, [PERF_RECORD_SWITCH_CPU_WIDE] = perf_event__switch_swap, [PERF_RECORD_NAMESPACES] = perf_event__namespaces_swap, + [PERF_RECORD_CGROUP] = perf_event__cgroup_swap, [PERF_RECORD_TEXT_POKE] = perf_event__text_poke_swap, [PERF_RECORD_HEADER_ATTR] = perf_event__hdr_attr_swap, [PERF_RECORD_HEADER_EVENT_TYPE] = perf_event__event_type_swap,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 25/255 netfilter: nf_tables: missing validation from the abort path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c0391b6ab810381df632677a1dcbbbbd63d05b6d ]
If userspace does not include the trailing end of batch message, then nfnetlink aborts the transaction. This allows to check that ruleset updates trigger no errors.
After this patch, invoking this command from the prerouting chain:
# nft -c add rule x y fib saddr . oif type local
fails since oif is not supported there.
This patch fixes the lack of rule validation from the abort/check path to catch configuration errors such as the one above.
--- include/linux/netfilter/nfnetlink.h | 9 ++++++++- net/netfilter/nf_tables_api.c | 15 ++++++++++----- net/netfilter/nfnetlink.c | 22 ++++++++++++++++++---- 3 files changed, 36 insertions(+), 10 deletions(-)
include/linux/netfilter/nfnetlink.h +8 -1
@@ -24,6 +24,12 @@ struct nfnl_callback {const u_int16_t attr_count;/* number of nlattr's */ }; +enum nfnl_abort_action { +NFNL_ABORT_NONE =0 , +NFNL_ABORT_AUTOLOAD , +NFNL_ABORT_VALIDATE , +}; +struct nfnetlink_subsystem {const char *name;__u8 subsys_id;/* nfnetlink subsystem ID */
@@ -31,7 +37,8 @@ struct nfnetlink_subsystem {const struct nfnl_callback *cb;/* callback for individual types */ struct module *owner;int (*commit)(struct net *net,struct sk_buff *skb); -int (*abort)(struct net *net,struct sk_buff *skb,bool autoload); +int (*abort)(struct net *net,struct sk_buff *skb, +enum nfnl_abort_action action);void (*cleanup)(struct net *net);bool (*valid_genid)(struct net *net,u32 genid); };
net/netfilter/nf_tables_api.c +10 -5
@@ -7992,12 +7992,16 @@ static void nf_tables_abort_release(struct nft_trans *trans)kfree (trans); } -static int __nf_tables_abort (struct net *net,bool autoload) +static int __nf_tables_abort (struct net *net,enum nfnl_abort_action action) {struct nft_trans *trans, *next;struct nft_trans_elem *te;struct nft_hook *hook; +if (action ==NFNL_ABORT_VALIDATE && +nf_tables_validate (net) <0 ) +return -EAGAIN ; +list_for_each_entry_safe_reverse (trans, next, &net->nft.commit_list, list) {switch (trans->msg_type) {
@@ -8129,7 +8133,7 @@ static int __nf_tables_abort(struct net *net, bool autoload)nf_tables_abort_release (trans); } -if (autoload) +if (action ==NFNL_ABORT_AUTOLOAD )nf_tables_module_autoload (net);else nf_tables_module_autoload_cleanup (net);
@@ -8142,9 +8146,10 @@ static void nf_tables_cleanup(struct net *net)nft_validate_state_update (net,NFT_VALIDATE_SKIP ); } -static int nf_tables_abort (struct net *net,struct sk_buff *skb,bool autoload) +static int nf_tables_abort (struct net *net,struct sk_buff *skb, +enum nfnl_abort_action action) { -int ret =__nf_tables_abort (net, autoload); +int ret =__nf_tables_abort (net, action);mutex_unlock (&net->nft.commit_mutex);
@@ -8775,7 +8780,7 @@ static void __net_exit nf_tables_exit_net(struct net *net) {mutex_lock (&net->nft.commit_mutex);if (!list_empty (&net->nft.commit_list)) -__nf_tables_abort (net, false); +__nf_tables_abort (net,NFNL_ABORT_NONE );__nft_release_tables (net);mutex_unlock (&net->nft.commit_mutex);WARN_ON_ONCE (!list_empty (&net->nft.tables));
net/netfilter/nfnetlink.c +18 -4
@@ -316,7 +316,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,return netlink_ack (skb, nlh, -EINVAL ,NULL ); replay: status =0 ; - +replay_abort: skb =netlink_skb_clone (oskb,GFP_KERNEL );if (!skb)return netlink_ack (oskb, nlh, -ENOMEM ,NULL );
@@ -482,7 +482,7 @@ ack: } done:if (status &NFNL_BATCH_REPLAY ) { - ss->abort (net, oskb, true); + ss->abort (net, oskb,NFNL_ABORT_AUTOLOAD );nfnl_err_reset (&err_list);kfree_skb (skb);module_put (ss->owner);
@@ -493,11 +493,25 @@ done: status |=NFNL_BATCH_REPLAY ; goto done; }else if (err) { - ss->abort (net, oskb, false); + ss->abort (net, oskb,NFNL_ABORT_NONE );netlink_ack (oskb,nlmsg_hdr (oskb), err,NULL ); } }else { - ss->abort (net, oskb, false); +enum nfnl_abort_action abort_action; + +if (status &NFNL_BATCH_FAILURE ) + abort_action =NFNL_ABORT_NONE ; +else + abort_action =NFNL_ABORT_VALIDATE ; + + err = ss->abort (net, oskb, abort_action); +if (err == -EAGAIN ) { +nfnl_err_reset (&err_list); +kfree_skb (skb); +module_put (ss->owner); + status |=NFNL_BATCH_FAILURE ; + goto replay_abort; + } }if (ss->cleanup) ss->cleanup (net);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 34/255 drm/panfrost: move devfreq_init()/fini() in device
In reply to Greg Kroah-HartmanFrom: Clément Péron <[email protected]>
[ Upstream commit 25e247bbf85af3ad721dfeb2e2caf405f43b7e66 ]
Later we will introduce devfreq probing regulator if they are present. As regulator should be probe only one time we need to get this logic in the device_init().
panfrost_device is already taking care of devfreq_resume() and devfreq_suspend(), so it's not totally illogic to move the devfreq_init() and devfreq_fini() here.
--- drivers/gpu/drm/panfrost/panfrost_device.c | 12 +++++++++++- drivers/gpu/drm/panfrost/panfrost_drv.c | 15 ++------------- 2 files changed, 13 insertions(+), 14 deletions(-)
drivers/gpu/drm/panfrost/panfrost_device.c +11 -1
@@ -214,9 +214,16 @@ int panfrost_device_init(struct panfrost_device *pfdev)return err; } + err =panfrost_devfreq_init (pfdev); +if (err) { +if (err != -EPROBE_DEFER ) +dev_err (pfdev->dev,"devfreq init failed %d\n" , err); + goto out_clk; + } + err =panfrost_regulator_init (pfdev);if (err) - goto out_clk; + goto out_devfreq; err =panfrost_reset_init (pfdev);if (err) {
@@ -265,6 +272,8 @@ out_reset:panfrost_reset_fini (pfdev); out_regulator:panfrost_regulator_fini (pfdev); +out_devfreq: +panfrost_devfreq_fini (pfdev); out_clk:panfrost_clk_fini (pfdev);return err;
@@ -278,6 +287,7 @@ void panfrost_device_fini(struct panfrost_device *pfdev)panfrost_gpu_fini (pfdev);panfrost_pm_domain_fini (pfdev);panfrost_reset_fini (pfdev); +panfrost_devfreq_fini (pfdev);panfrost_regulator_fini (pfdev);panfrost_clk_fini (pfdev); }
drivers/gpu/drm/panfrost/panfrost_drv.c +2 -13
@@ -14,7 +14,6 @@#include <drm/drm_utils.h> #include "panfrost_device.h" -#include "panfrost_devfreq.h" #include "panfrost_gem.h" #include "panfrost_mmu.h" #include "panfrost_job.h"
@@ -606,13 +605,6 @@ static int panfrost_probe(struct platform_device *pdev) goto err_out0; } - err =panfrost_devfreq_init (pfdev); -if (err) { -if (err != -EPROBE_DEFER ) -dev_err (&pdev->dev,"Fatal error during devfreq init\n" ); - goto err_out1; - } -pm_runtime_set_active (pfdev->dev);pm_runtime_mark_last_busy (pfdev->dev);pm_runtime_enable (pfdev->dev);
@@ -625,16 +617,14 @@ static int panfrost_probe(struct platform_device *pdev)*/ err =drm_dev_register (ddev,0 );if (err <0 ) - goto err_out2; + goto err_out1;panfrost_gem_shrinker_init (ddev);return 0 ; -err_out2: -pm_runtime_disable (pfdev->dev); -panfrost_devfreq_fini (pfdev); err_out1: +pm_runtime_disable (pfdev->dev);panfrost_device_fini (pfdev); err_out0:drm_dev_put (ddev);
@@ -650,7 +640,6 @@ static int panfrost_remove(struct platform_device *pdev)panfrost_gem_shrinker_cleanup (ddev);pm_runtime_get_sync (pfdev->dev); -panfrost_devfreq_fini (pfdev);panfrost_device_fini (pfdev);pm_runtime_put_sync_suspend (pfdev->dev);pm_runtime_disable (pfdev->dev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 35/255 drm/panfrost: Fix module unload
In reply to Greg Kroah-HartmanFrom: Steven Price <[email protected]>
[ Upstream commit 876b15d2c88d8c005f1aebeaa23f1e448d834757 ]
When unloading the call to pm_runtime_put_sync_suspend() will attempt to turn the GPU cores off, however panfrost_device_fini() will have turned the clocks off. This leads to the hardware locking up.
Instead don't call pm_runtime_put_sync_suspend() and instead simply mark the device as suspended using pm_runtime_set_suspended(). And also include this on the error path in panfrost_probe().
--- drivers/gpu/drm/panfrost/panfrost_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/panfrost/panfrost_drv.c +3 -2
@@ -626,6 +626,7 @@ static int panfrost_probe(struct platform_device *pdev) err_out1:pm_runtime_disable (pfdev->dev);panfrost_device_fini (pfdev); +pm_runtime_set_suspended (pfdev->dev); err_out0:drm_dev_put (ddev);return err;
@@ -640,9 +641,9 @@ static int panfrost_remove(struct platform_device *pdev)panfrost_gem_shrinker_cleanup (ddev);pm_runtime_get_sync (pfdev->dev); -panfrost_device_fini (pfdev); -pm_runtime_put_sync_suspend (pfdev->dev);pm_runtime_disable (pfdev->dev); +panfrost_device_fini (pfdev); +pm_runtime_set_suspended (pfdev->dev);drm_dev_put (ddev);return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 46/255 can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 2283f79b22684d2812e5c76fc2280aae00390365 ]
If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but not always, the case), the 'WARN_ON(in_irq)' in net/core/skbuff.c#skb_release_head_state() might be triggered, under network congestion circumstances, together with the potential risk of a NULL pointer dereference.
The root cause of this issue is the call to kfree_skb() instead of dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().
This patch prevents the skb to be freed within the call to netif_rx() by incrementing its reference count with skb_get(). The skb is finally freed by one of the in-irq-context safe functions: dev_consume_skb_any() or dev_kfree_skb_any(). The "any" version is used because some drivers might call can_get_echo_skb() in a normal context.
The reason for this issue to occur is that initially, in the core network stack, loopback skb were not supposed to be received in hardware IRQ context. The CAN stack is an exeption.
This bug was previously reported back in 2017 in [1] but the proposed patch never got accepted.
While [1] directly modifies net/core/dev.c, we try to propose here a smoother modification local to CAN network stack (the assumption behind is that only CAN devices are affected by this issue).
[1] http://lore.kernel.org/r/[email protected]
--- drivers/net/can/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +5 -1
@@ -512,7 +512,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)if (!skb)return 0 ; -netif_rx (skb); +skb_get (skb); +if (netif_rx (skb) ==NET_RX_SUCCESS ) +dev_consume_skb_any (skb); +else +dev_kfree_skb_any (skb);return len; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 50/255 can: j1939: j1939_sk_bind(): return failure if netdev is down
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 08c487d8d807535f509ed80c6a10ad90e6872139 ]
When a netdev down event occurs after a successful call to j1939_sk_bind(), j1939_netdev_notify() can handle it correctly.
But if the netdev already in down state before calling j1939_sk_bind(), j1939_sk_release() will stay in wait_event_interruptible() blocked forever. Because in this case, j1939_netdev_notify() won't be called and j1939_tp_txtimer() won't call j1939_session_cancel() or other function to clear session for ENETDOWN error, this lead to mismatch of j1939_session_get/put() and jsk->skb_pending will never decrease to zero.
To reproduce it use following commands:
1. ip link add dev vcan0 type vcan
2. j1939acd -r 100,80-120 1122334455667788 vcan0
3. presses ctrl-c and thread will be blocked forever
This patch adds check for ndev->flags in j1939_sk_bind() to avoid this kind of situation and return with -ENETDOWN.
--- net/can/j1939/socket.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/can/j1939/socket.c +6 -0
@@ -475,6 +475,12 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) goto out_release_sock; } +if (!(ndev->flags &IFF_UP )) { +dev_put (ndev); + ret = -ENETDOWN ; + goto out_release_sock; + } + priv =j1939_netdev_start (ndev);dev_put (ndev);if (IS_ERR (priv)) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 51/255 can: ti_hecc: ti_hecc_probe(): add missed clk_disable_unprepare() in error path
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit e002103b36a695f7cb6048b96da73e66c86ddffb ]
The driver forgets to call clk_disable_unprepare() in error path after a success calling for clk_prepare_enable().
Fix it by adding a clk_disable_unprepare() in error path.
--- drivers/net/can/ti_hecc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/can/ti_hecc.c +5 -3
@@ -950,7 +950,7 @@ static int ti_hecc_probe(struct platform_device *pdev) err =clk_prepare_enable (priv->clk);if (err) {dev_err (&pdev->dev,"clk_prepare_enable() failed\n" ); - goto probe_exit_clk; + goto probe_exit_release_clk; } priv->offload.mailbox_read = ti_hecc_mailbox_read;
@@ -959,7 +959,7 @@ static int ti_hecc_probe(struct platform_device *pdev) err =can_rx_offload_add_timestamp (ndev, &priv->offload);if (err) {dev_err (&pdev->dev,"can_rx_offload_add_timestamp() failed\n" ); - goto probe_exit_clk; + goto probe_exit_disable_clk; } err =register_candev (ndev);
@@ -977,7 +977,9 @@ static int ti_hecc_probe(struct platform_device *pdev) probe_exit_offload:can_rx_offload_del (&priv->offload); -probe_exit_clk: +probe_exit_disable_clk: +clk_disable_unprepare (priv->clk); +probe_exit_release_clk:clk_put (priv->clk); probe_exit_candev:free_candev (ndev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 52/255 can: xilinx_can: handle failure cases of pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit 79c43333bdd5a7026a5aab606b53053b643585e7 ]
Calling pm_runtime_get_sync increments the counter even in case of failure, causing incorrect ref count. Call pm_runtime_put if pm_runtime_get_sync fails.
--- drivers/net/can/xilinx_can.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/can/xilinx_can.c +3 -3
@@ -1391,7 +1391,7 @@ static int xcan_open(struct net_device *ndev)if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); -return ret; + goto err; } ret = request_irq(ndev->irq, xcan_interrupt, priv->irq_flags,
@@ -1475,6 +1475,7 @@ static int xcan_get_berr_counter(const struct net_device *ndev,if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); +pm_runtime_put (priv->dev);return ret; }
@@ -1789,7 +1790,7 @@ static int xcan_probe(struct platform_device *pdev)if (ret <0 ) {netdev_err (ndev,"%s: pm_runtime_get failed(%d)\n" , __func__, ret); - goto err_pmdisable; + goto err_disableclks; }if (priv->read_reg (priv,XCAN_SR_OFFSET ) !=XCAN_SR_CONFIG_MASK ) {
@@ -1824,7 +1825,6 @@ static int xcan_probe(struct platform_device *pdev) err_disableclks:pm_runtime_put (priv->dev); -err_pmdisable:pm_runtime_disable (&pdev->dev); err_free:free_candev (ndev);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 26/255 PCI: Always enable ACS even if no ACS Capability
In reply to Greg Kroah-HartmanFrom: Rajat Jain <[email protected]>
[ Upstream commit 462b58fb033996e999cc213ed0b430d4f22a28fe ]
Some devices support ACS functionality even though they don't have a spec-compliant ACS Capability; pci_enable_acs() has a quirk mechanism to handle them.
We want to enable ACS whenever possible, but 52fbf5bdeeef ("PCI: Cache ACS capability offset in device") inadvertently broke this by calling pci_enable_acs() only if we find an ACS Capability.
This resulted in ACS not being enabled for these non-compliant devices, which means devices can't be separated into different IOMMU groups, which in turn means we may not be able to pass those devices through to VMs, as reported by Boris V:
https://lore.kernel.org/r/[email protected]
--- drivers/pci/pci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/pci.c +7 -2
@@ -3503,8 +3503,13 @@ void pci_acs_init(struct pci_dev *dev) { dev->acs_cap =pci_find_ext_capability (dev,PCI_EXT_CAP_ID_ACS ); -if (dev->acs_cap) -pci_enable_acs (dev); +/* +* Attempt to enable ACS regardless of capability because some Root +* Ports (e.g. those quirked with *_intel_pch_acs_*) do not have +* the standard ACS capability but still support ACS via those +* quirks. +*/ +pci_enable_acs (dev); }/**
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 43/255 afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit f4c79144edd8a49ffca8fa737a31d606be742a34 ]
The cleanup for the yfs_store_opaque_acl2_operation calls the wrong function to destroy the ACL content buffer. It's an afs_acl struct, not a yfs_acl struct - and the free function for latter may pass invalid pointers to kfree().
Fix this by using the afs_acl_put() function. The yfs_acl_put() function is then no longer used and can be removed.
general protection fault, probably for non-canonical address 0x7ebde00000000: 0000 [#1] SMP PTI ... RIP: 0010:compound_head+0x0/0x11 ... Call Trace: virt_to_cache+0x8/0x51 kfree+0x5d/0x79 yfs_free_opaque_acl+0x16/0x29 afs_put_operation+0x60/0x114 __vfs_setxattr+0x67/0x72 __vfs_setxattr_noperm+0x66/0xe9 vfs_setxattr+0x67/0xce setxattr+0x14e/0x184 __do_sys_fsetxattr+0x66/0x8f do_syscall_64+0x2d/0x3a entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- fs/afs/xattr.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
fs/afs/xattr.c +1 -6
@@ -148,11 +148,6 @@ static const struct xattr_handler afs_xattr_afs_acl_handler = { .set = afs_xattr_set_acl, }; -static void yfs_acl_put (struct afs_operation *op) -{ -yfs_free_opaque_acl (op->yacl); -} -static const struct afs_operation_ops yfs_fetch_opaque_acl_operation = { .issue_yfs_rpc = yfs_fs_fetch_opaque_acl, .success = afs_acl_success,
@@ -246,7 +241,7 @@ error:static const struct afs_operation_ops yfs_store_opaque_acl2_operation = { .issue_yfs_rpc = yfs_fs_store_opaque_acl2, .success = afs_acl_success, - .put = yfs_acl_put, + .put = afs_acl_put, };/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 55/255 can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
[ Upstream commit 93ef65e5a6357cc7381f85fcec9283fe29970045 ]
Echo management is driven by PUCAN_MSG_LOOPED_BACK bit, while loopback frames are identified with PUCAN_MSG_SELF_RECEIVE bit. Those bits are set for each outgoing frame written to the IP core so that a copy of each one will be placed into the rx path. Thus,
- when PUCAN_MSG_LOOPED_BACK is set then the rx frame is an echo of a previously sent frame,
- when PUCAN_MSG_LOOPED_BACK+PUCAN_MSG_SELF_RECEIVE are set, then the rx frame is an echo AND a loopback frame. Therefore, this frame must be put into the socket rx path too.
This patch fixes how CAN frames are handled when these are sent while the can interface is configured in "loopback on" mode.
--- drivers/net/can/peak_canfd/peak_canfd.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/can/peak_canfd/peak_canfd.c +8 -3
@@ -262,8 +262,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, cf_len =get_can_dlc (pucan_msg_get_dlc (msg));/* if this frame is an echo, */ -if ((rx_msg_flags &PUCAN_MSG_LOOPED_BACK ) && - !(rx_msg_flags &PUCAN_MSG_SELF_RECEIVE )) { +if (rx_msg_flags &PUCAN_MSG_LOOPED_BACK ) {unsigned long flags;spin_lock_irqsave (&priv->echo_lock, flags);
@@ -277,7 +276,13 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,netif_wake_queue (priv->ndev);spin_unlock_irqrestore (&priv->echo_lock, flags); -return 0 ; + +/* if this frame is only an echo, stop here. Otherwise, +* continue to push this application self-received frame into +* its own rx queue. +*/ +if (!(rx_msg_flags &PUCAN_MSG_SELF_RECEIVE )) +return 0 ; }/* otherwise, it should be pushed into rx fifo */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 27/255 netfilter: ipset: Update byte and packet counters regardless of whether they match
In reply to Greg Kroah-HartmanFrom: Stefano Brivio <[email protected]>
[ Upstream commit 7d10e62c2ff8e084c136c94d32d9a94de4d31248 ]
In ip_set_match_extensions(), for sets with counters, we take care of updating counters themselves by calling ip_set_update_counter(), and of checking if the given comparison and values match, by calling ip_set_match_counter() if needed.
However, if a given comparison on counters doesn't match the configured values, that doesn't mean the set entry itself isn't matching.
This fix restores the behaviour we had before commit 4750005a85f7 ("netfilter: ipset: Fix "don't update counters" mode when counters used at the matching"), without reintroducing the issue fixed there: back then, mtype_data_match() first updated counters in any case, and then took care of matching on counters.
Now, if the IPSET_FLAG_SKIP_COUNTER_UPDATE flag is set, ip_set_update_counter() will anyway skip counter updates if desired.
The issue observed is illustrated by this reproducer:
ipset create c hash:ip counters ipset add c 192.0.2.1 iptables -I INPUT -m set --match-set c src --bytes-gt 800 -j DROP
if we now send packets from 192.0.2.1, bytes and packets counters for the entry as shown by 'ipset list' are always zero, and, no matter how many bytes we send, the rule will never match, because counters themselves are not updated.
--- net/netfilter/ipset/ip_set_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/ipset/ip_set_core.c +2 -1
@@ -652,13 +652,14 @@ ip_set_match_extensions(struct ip_set *set, const struct ip_set_ext *ext,if (SET_WITH_COUNTER (set)) {struct ip_set_counter *counter =ext_counter (data, set); +ip_set_update_counter (counter, ext, flags); +if (flags &IPSET_FLAG_MATCH_COUNTERS && !(ip_set_match_counter (ip_set_get_packets (counter), mext->packets, mext->packets_op) &&ip_set_match_counter (ip_set_get_bytes (counter), mext->bytes, mext->bytes_op)))return false; -ip_set_update_counter (counter, ext, flags); }if (SET_WITH_SKBINFO (set)) ip_set_get_skbinfo(ext_skbinfo(data, set),
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 28/255 irqchip/sifive-plic: Fix chip_data access within a hierarchy
In reply to Greg Kroah-HartmanFrom: Greentime Hu <[email protected]>
[ Upstream commit f9ac7bbd6e4540dcc6df621b9c9b6eb2e26ded1d ]
The plic driver crashes in plic_irq_unmask() when the interrupt is within a hierarchy, as it picks the top-level chip_data instead of its local one.
Using irq_data_get_irq_chip_data() instead of irq_get_chip_data() solves the issue for good.
--- drivers/irqchip/irq-sifive-plic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/irqchip/irq-sifive-plic.c +4 -4
@@ -99,7 +99,7 @@ static inline void plic_irq_toggle(const struct cpumask *mask, struct irq_data *d, int enable) { int cpu; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);writel (enable, priv->regs +PRIORITY_BASE + d->hwirq *PRIORITY_PER_ID );for_each_cpu (cpu, mask) {
@@ -115,7 +115,7 @@ static void plic_irq_unmask(struct irq_data *d) {struct cpumask amask;unsigned int cpu; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);cpumask_and (&amask, &priv->lmask, cpu_online_mask); cpu = cpumask_any_and(irq_data_get_affinity_mask(d),
@@ -127,7 +127,7 @@ static void plic_irq_unmask(struct irq_data *d)static void plic_irq_mask (struct irq_data *d) { -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);plic_irq_toggle (&priv->lmask, d,0 ); }
@@ -138,7 +138,7 @@ static int plic_set_affinity(struct irq_data *d, {unsigned int cpu;struct cpumask amask; -struct plic_priv *priv =irq_get_chip_data (d->irq); +struct plic_priv *priv =irq_data_get_irq_chip_data (d);cpumask_and (&amask, &priv->lmask, mask_val);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 7/255 ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function
In reply to Greg Kroah-HartmanFrom: Tomasz Figa <[email protected]>
[ Upstream commit 9fe9efd6924c9a62ebb759025bb8927e398f51f7 ]
This is a copy of commit 5c5f1baee85a ("ASoC: Intel:kbl_rt5663_rt5514_max98927: Fix kabylake_ssp_fixup function") applied to the kbl_rt5663_max98927 board file.
Original explanation of the change:
kabylake_ssp_fixup function uses snd_soc_dpcm to identify the codecs DAIs. The HW parameters are changed based on the codec DAI of the stream. The earlier approach to get snd_soc_dpcm was using container_of() macro on snd_pcm_hw_params.
The structures have been modified over time and snd_soc_dpcm does not have snd_pcm_hw_params as a reference but as a copy. This causes the current driver to crash when used.
This patch changes the way snd_soc_dpcm is extracted. snd_soc_pcm_runtime holds 2 dpcm instances (one for playback and one for capture). 2 codecs on the SSP are dmic (capture) and speakers (playback). Based on the stream direction, snd_soc_dpcm is extracted from snd_soc_pcm_runtime.
Fixes a boot crash on a HP Chromebook x2:
[ 16.582225] BUG: kernel NULL pointer dereference, address: 0000000000000050 [ 16.582231] #PF: supervisor read access in kernel mode [ 16.582233] #PF: error_code(0x0000) - not-present page [ 16.582234] PGD 0 P4D 0 [ 16.582238] Oops: 0000 [#1] PREEMPT SMP PTI [ 16.582241] CPU: 0 PID: 1980 Comm: cras Tainted: G C 5.4.58 #1 [ 16.582243] Hardware name: HP Soraka/Soraka, BIOS Google_Soraka.10431.75.0 08/30/2018 [ 16.582247] RIP: 0010:kabylake_ssp_fixup+0x19/0xbb [snd_soc_kbl_rt5663_max98927] [ 16.582250] Code: c6 6f c5 80 c0 44 89 f2 31 c0 e8 3e c9 4c d6 eb de 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 f3 48 8b 46 c8 48 8b 4e d0 <48> 8b 49 10 4c 8b 78 10 4c 8b 31 4c 89 f7 48 c7 c6 4b c2 80 c0 e8 [ 16.582252] RSP: 0000:ffffaf7e81e0b958 EFLAGS: 00010282 [ 16.582254] RAX: ffffffff96f13e0d RBX: ffffaf7e81e0ba00 RCX: 0000000000000040 [ 16.582256] RDX: ffffaf7e81e0ba00 RSI: ffffaf7e81e0ba00 RDI: ffffa3b208558028 [ 16.582258] RBP: ffffaf7e81e0b970 R08: ffffa3b203b54160 R09: ffffaf7e81e0ba00 [ 16.582259] R10: 0000000000000000 R11: ffffffffc080b345 R12: ffffa3b209fb6e00 [ 16.582261] R13: ffffa3b1b1a47838 R14: ffffa3b1e6197f28 R15: ffffaf7e81e0ba00 [ 16.582263] FS: 00007eb3f25aaf80(0000) GS:ffffa3b236a00000(0000) knlGS:0000000000000000 [ 16.582265] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.582267] CR2: 0000000000000050 CR3: 0000000246bc8006 CR4: 00000000003606f0 [ 16.582269] Call Trace: [ 16.582275] snd_soc_link_be_hw_params_fixup+0x21/0x68 [ 16.582278] snd_soc_dai_hw_params+0x25/0x94 [ 16.582282] soc_pcm_hw_params+0x2d8/0x583 [ 16.582288] dpcm_be_dai_hw_params+0x172/0x29e [ 16.582291] dpcm_fe_dai_hw_params+0x9f/0x12f [ 16.582295] snd_pcm_hw_params+0x137/0x41c [ 16.582298] snd_pcm_hw_params_user+0x3c/0x71 [ 16.582301] snd_pcm_common_ioctl+0x2c6/0x565 [ 16.582304] snd_pcm_ioctl+0x32/0x36 [ 16.582307] do_vfs_ioctl+0x506/0x783 [ 16.582311] ksys_ioctl+0x58/0x83 [ 16.582313] __x64_sys_ioctl+0x1a/0x1e [ 16.582316] do_syscall_64+0x54/0x7e [ 16.582319] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 16.582322] RIP: 0033:0x7eb3f1886157 [ 16.582324] Code: 8a 66 90 48 8b 05 11 dd 2b 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 dc 2b 00 f7 d8 64 89 01 48 [ 16.582326] RSP: 002b:00007ffff7559818 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 16.582329] RAX: ffffffffffffffda RBX: 00005acc9188b140 RCX: 00007eb3f1886157 [ 16.582330] RDX: 00007ffff7559940 RSI: 00000000c2604111 RDI: 000000000000001e [ 16.582332] RBP: 00007ffff7559840 R08: 0000000000000004 R09: 0000000000000000 [ 16.582333] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000bb80 [ 16.582335] R13: 00005acc91702e80 R14: 00007ffff7559940 R15: 00005acc91702e80 [ 16.582337] Modules linked in: rfcomm cmac algif_hash algif_skcipher af_alg uinput hid_google_hammer snd_soc_kbl_rt5663_max98927 snd_soc_hdac_hdmi snd_soc_dmic snd_soc_skl_ssp_clk snd_soc_skl snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_hdac_hda snd_soc_acpi_intel_match snd_soc_acpi snd_hda_ext_core snd_intel_dspcfg snd_hda_codec snd_hwdep snd_hda_core ipu3_cio2 ipu3_imgu(C) videobuf2_v4l2 videobuf2_common videobuf2_dma_sg videobuf2_memops snd_soc_rt5663 snd_soc_max98927 snd_soc_rl6231 ov5670 ov13858 acpi_als v4l2_fwnode dw9714 fuse xt_MASQUERADE iio_trig_sysfs cros_ec_light_prox cros_ec_sensors cros_ec_sensors_core cros_ec_sensors_ring industrialio_triggered_buffer kfifo_buf industrialio cros_ec_sensorhub cdc_ether usbnet btusb btrtl btintel btbcm bluetooth ecdh_generic ecc lzo_rle lzo_compress iwlmvm zram iwl7000_mac80211 r8152 mii iwlwifi cfg80211 joydev [ 16.584243] gsmi: Log Shutdown Reason 0x03 [ 16.584246] CR2: 0000000000000050 [ 16.584248] ---[ end trace c8511d090c11edff ]---
--- sound/soc/intel/boards/kbl_rt5663_max98927.c | 39 ++++++++++++++++---- 1 file changed, 31 insertions(+), 8 deletions(-)
sound/soc/intel/boards/kbl_rt5663_max98927.c +31 -8
@@ -401,17 +401,40 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,struct snd_interval *chan =hw_param_interval (params,SNDRV_PCM_HW_PARAM_CHANNELS );struct snd_mask *fmt =hw_param_mask (params,SNDRV_PCM_HW_PARAM_FORMAT ); -struct snd_soc_dpcm *dpcm =container_of ( - params, struct snd_soc_dpcm, hw_params); -struct snd_soc_dai_link *fe_dai_link = dpcm->fe->dai_link; -struct snd_soc_dai_link *be_dai_link = dpcm->be->dai_link; +struct snd_soc_dpcm *dpcm, *rtd_dpcm =NULL ; + +/* +* The following loop will be called only for playback stream +* In this platform, there is only one playback device on every SSP +*/ +for_each_dpcm_fe (rtd,SNDRV_PCM_STREAM_PLAYBACK , dpcm) { + rtd_dpcm = dpcm; +break ; + } + +/* +* This following loop will be called only for capture stream +* In this platform, there is only one capture device on every SSP +*/ +for_each_dpcm_fe (rtd,SNDRV_PCM_STREAM_CAPTURE , dpcm) { + rtd_dpcm = dpcm; +break ; + } + +if (!rtd_dpcm) +return -EINVAL ; + +/* +* The above 2 loops are mutually exclusive based on the stream direction, +* thus rtd_dpcm variable will never be overwritten +*/ /* * The ADSP will convert the FE rate to 48k, stereo, 24 bit */ -if (!strcmp (fe_dai_link->name,"Kbl Audio Port" ) || - !strcmp (fe_dai_link->name,"Kbl Audio Headset Playback" ) || - !strcmp (fe_dai_link->name,"Kbl Audio Capture Port" )) { +if (!strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Port" ) || + !strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Headset Playback" ) || + !strcmp (rtd_dpcm->fe->dai_link->name,"Kbl Audio Capture Port" )) { rate->min = rate->max =48000 ; chan->min = chan->max =2 ;snd_mask_none (fmt);
@@ -421,7 +444,7 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,* The speaker on the SSP0 supports S16_LE and not S24_LE. * thus changing the mask here */ -if (!strcmp (be_dai_link->name,"SSP0-Codec" )) +if (!strcmp (rtd_dpcm->be->dai_link->name,"SSP0-Codec" ))snd_mask_set_format (fmt,SNDRV_PCM_FORMAT_S16_LE );return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 29/255 powerpc/eeh_cache: Fix a possible debugfs deadlock
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit fd552e0542b4532483289cce48fdbd27b692984b ]
Lockdep complains that a possible deadlock below in eeh_addr_cache_show() because it is acquiring a lock with IRQ enabled, but eeh_addr_cache_insert_dev() needs to acquire the same lock with IRQ disabled. Let's just make eeh_addr_cache_show() acquire the lock with IRQ disabled as well.
CPU0 CPU1
---- ----
lock(&pci_io_addr_cache_root.piar_lock);
local_irq_disable();
lock(&tp->lock);
lock(&pci_io_addr_cache_root.piar_lock);
<Interrupt>
lock(&tp->lock);*** DEADLOCK ***
lock_acquire+0x140/0x5f0 _raw_spin_lock_irqsave+0x64/0xb0 eeh_addr_cache_insert_dev+0x48/0x390 eeh_probe_device+0xb8/0x1a0 pnv_pcibios_bus_add_device+0x3c/0x80 pcibios_bus_add_device+0x118/0x290 pci_bus_add_device+0x28/0xe0 pci_bus_add_devices+0x54/0xb0 pcibios_init+0xc4/0x124 do_one_initcall+0xac/0x528 kernel_init_freeable+0x35c/0x3fc kernel_init+0x24/0x148 ret_from_kernel_thread+0x5c/0x80 lock_acquire+0x140/0x5f0 _raw_spin_lock+0x4c/0x70 eeh_addr_cache_show+0x38/0x110 seq_read+0x1a0/0x660 vfs_read+0xc8/0x1f0 ksys_read+0x74/0x130 system_call_exception+0xf8/0x1d0 system_call_common+0xe8/0x218
--- arch/powerpc/kernel/eeh_cache.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/powerpc/kernel/eeh_cache.c +3 -2
@@ -264,8 +264,9 @@ static int eeh_addr_cache_show(struct seq_file *s, void *v) {struct pci_io_addr_range *piar;struct rb_node *n; +unsigned long flags; -spin_lock (&pci_io_addr_cache_root.piar_lock); +spin_lock_irqsave (&pci_io_addr_cache_root.piar_lock, flags);for (n =rb_first (&pci_io_addr_cache_root.rb_root); n; n =rb_next (n)) { piar = rb_entry(n, struct pci_io_addr_range, rb_node);
@@ -273,7 +274,7 @@ static int eeh_addr_cache_show(struct seq_file *s, void *v) (piar->flags &IORESOURCE_IO ) ?"i/o" :"mem" , &piar->addr_lo, &piar->addr_hi, pci_name(piar->pcidev)); } -spin_unlock (&pci_io_addr_cache_root.piar_lock); +spin_unlock_irqrestore (&pci_io_addr_cache_root.piar_lock, flags);return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 31/255 IB/srpt: Fix memory leak in srpt_add_one
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit 372a1786283e50e7cb437ab7fdb1b95597310ad7 ]
Failure in srpt_refresh_port() for the second port will leave MAD registered for the first one, however, the srpt_add_one() will be marked as "failed" and SRPT will leak resources for that registered but not used and released first port.
Unregister the MAD agent for all ports in case of failure.
--- drivers/infiniband/ulp/srpt/ib_srpt.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/infiniband/ulp/srpt/ib_srpt.c +8 -5
@@ -622,10 +622,11 @@ static int srpt_refresh_port(struct srpt_port *sport)/** * srpt_unregister_mad_agent - unregister MAD callback functions * @sdev: SRPT HCA pointer. +* #port_cnt: number of ports with registered MAD * * Note: It is safe to call this function more than once for the same device. */ -static void srpt_unregister_mad_agent (struct srpt_device *sdev) +static void srpt_unregister_mad_agent (struct srpt_device *sdev,int port_cnt) {struct ib_port_modify port_modify = { .clr_port_cap_mask =IB_PORT_DEVICE_MGMT_SUP ,
@@ -633,7 +634,7 @@ static void srpt_unregister_mad_agent(struct srpt_device *sdev)struct srpt_port *sport;int i; -for (i =1 ; i <= sdev->device->phys_port_cnt; i++) { +for (i =1 ; i <= port_cnt; i++) { sport = &sdev->port[i -1 ];WARN_ON (sport->port != i);if (sport->mad_agent) {
@@ -3185,7 +3186,8 @@ static int srpt_add_one(struct ib_device *device)if (ret) {pr_err ("MAD registration failed for %s-%d.\n" ,dev_name (&sdev->device->dev), i); - goto err_event; + i--; + goto err_port; } }
@@ -3197,7 +3199,8 @@ static int srpt_add_one(struct ib_device *device)pr_debug ("added %s.\n" ,dev_name (&device->dev));return 0 ; -err_event: +err_port: +srpt_unregister_mad_agent (sdev, i);ib_unregister_event_handler (&sdev->event_handler); err_cm:if (sdev->cm_id)
@@ -3221,7 +3224,7 @@ static void srpt_remove_one(struct ib_device *device, void *client_data)struct srpt_device *sdev = client_data;int i; -srpt_unregister_mad_agent (sdev); +srpt_unregister_mad_agent (sdev, sdev->device->phys_port_cnt);ib_unregister_event_handler (&sdev->event_handler);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 54/255 can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
[ Upstream commit ecc7b4187dd388549544195fb13a11b4ea8e6a84 ]
Fabian Inostroza <[email protected]> has discovered a potential problem in the hardware timestamp reporting from the PCAN-USB USB CAN interface (only), related to the fact that a timestamp of an event may precede the timestamp used for synchronization when both records are part of the same USB packet. However, this case was used to detect the wrapping of the time counter.
This patch details and fixes the two identified cases where this problem can occur.
--- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++++++++++++++++-- 1 file changed, 46 insertions(+), 5 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_core.c +46 -5
@@ -130,14 +130,55 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)/* protect from getting time before setting now */ if (ktime_to_ns (time_ref->tv_host)) {u64 delta_us; +s64 delta_ts =0 ; + +/* General case: dev_ts_1 < dev_ts_2 < ts, with: +* +* - dev_ts_1 = previous sync timestamp +* - dev_ts_2 = last sync timestamp +* - ts = event timestamp +* - ts_period = known sync period (theoretical) +* ~ dev_ts2 - dev_ts1 +* *but*: +* +* - time counters wrap (see adapter->ts_used_bits) +* - sometimes, dev_ts_1 < ts < dev_ts2 +* +* "normal" case (sync time counters increase): +* must take into account case when ts wraps (tsw) +* +* < ts_period > < > +* | | | +* ---+--------+----+-------0-+--+--> +* ts_dev_1 | ts_dev_2 | +* ts tsw +*/ +if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { +/* case when event time (tsw) wraps */ +if (ts < time_ref->ts_dev_1) + delta_ts =1 << time_ref->adapter->ts_used_bits; + +/* Otherwise, sync time counter (ts_dev_2) has wrapped: +* handle case when event time (tsn) hasn't. +* +* < ts_period > < > +* | | | +* ---+--------+--0-+---------+--+--> +* ts_dev_1 | ts_dev_2 | +* tsn ts +*/ + }else if (time_ref->ts_dev_1 < ts) { + delta_ts = -(1 << time_ref->adapter->ts_used_bits); + } - delta_us = ts - time_ref->ts_dev_2; -if (ts < time_ref->ts_dev_2) - delta_us &= (1 << time_ref->adapter->ts_used_bits) -1 ; +/* add delay between last sync and event timestamps */ + delta_ts += (signed int )(ts - time_ref->ts_dev_2); - delta_us += time_ref->ts_total; +/* add time from beginning to last sync */ + delta_ts += time_ref->ts_total; - delta_us *= time_ref->adapter->us_per_ts_scale; +/* convert ticks number into microseconds */ + delta_us = delta_ts * time_ref->adapter->us_per_ts_scale; delta_us >>= time_ref->adapter->us_per_ts_shift; *time =ktime_add_us (time_ref->tv_host_0, delta_us);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 40/255 iommu/vt-d: Fix sid not set issue in intel_svm_bind_gpasid()
In reply to Greg Kroah-HartmanFrom: Liu Yi L <[email protected]>
[ Upstream commit eea4e29ab8bef254b228d6e1e3de188087b2c7d0 ]
Should get correct sid and set it into sdev. Because we execute 'sdev->sid != req->rid' in the loop of prq_event_thread().
--- drivers/iommu/intel/svm.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iommu/intel/svm.c +6 -0
@@ -278,6 +278,7 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,struct intel_iommu *iommu =device_to_iommu (dev,NULL ,NULL );struct intel_svm_dev *sdev =NULL ;struct dmar_domain *dmar_domain; +struct device_domain_info *info;struct intel_svm *svm =NULL ;int ret =0 ;
@@ -302,6 +303,10 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,if (data->hpasid <=0 || data->hpasid >=PASID_MAX )return -EINVAL ; + info =get_domain_info (dev); +if (!info) +return -EINVAL ; + dmar_domain =to_dmar_domain (domain);mutex_lock (&pasid_mutex);
@@ -349,6 +354,7 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev, goto out; } sdev->dev = dev; + sdev->sid =PCI_DEVID (info->bus, info->devfn);/* Only count users if device has aux domains */ if (iommu_dev_feature_enabled (dev,IOMMU_DEV_FEAT_AUX ))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 68/255 x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
In reply to Greg Kroah-HartmanFrom: Anand K Mistry <[email protected]>
[ Upstream commit 1978b3a53a74e3230cd46932b149c6e62e832e9a ]
On AMD CPUs which have the feature X86_FEATURE_AMD_STIBP_ALWAYS_ON, STIBP is set to on and
spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED
At the same time, IBPB can be set to conditional.
However, this leads to the case where it's impossible to turn on IBPB for a process because in the PR_SPEC_DISABLE case in ib_prctl_set() the
spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED
condition leads to a return before the task flag is set. Similarly, ib_prctl_get() will return PR_SPEC_DISABLE even though IBPB is set to conditional.
More generally, the following cases are possible:
1. STIBP = conditional && IBPB = on for spectre_v2_user=seccomp,ibpb
2. STIBP = on && IBPB = conditional for AMD CPUs with X86_FEATURE_AMD_STIBP_ALWAYS_ON
The first case functions correctly today, but only because spectre_v2_user_ibpb isn't updated to reflect the IBPB mode.
At a high level, this change does one thing. If either STIBP or IBPB is set to conditional, allow the prctl to change the task flag. Also, reflect that capability when querying the state. This isn't perfect since it doesn't take into account if only STIBP or IBPB is unconditionally on. But it allows the conditional feature to work as expected, without affecting the unconditional one.
[ bp: Massage commit message and comment; space out statements for
better readability. ]
--- arch/x86/kernel/cpu/bugs.c | 51 ++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 18 deletions(-)
arch/x86/kernel/cpu/bugs.c +33 -18
@@ -1254,6 +1254,14 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)return 0 ; } +static bool is_spec_ib_user_controlled (void ) +{ +return spectre_v2_user_ibpb ==SPECTRE_V2_USER_PRCTL || + spectre_v2_user_ibpb ==SPECTRE_V2_USER_SECCOMP || + spectre_v2_user_stibp ==SPECTRE_V2_USER_PRCTL || + spectre_v2_user_stibp ==SPECTRE_V2_USER_SECCOMP ; +} +static int ib_prctl_set (struct task_struct *task,unsigned long ctrl) {switch (ctrl) {
@@ -1261,16 +1269,26 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return 0 ; +/* -* Indirect branch speculation is always disabled in strict -* mode. It can neither be enabled if it was force-disabled -* by a previous prctl call. +* With strict mode for both IBPB and STIBP, the instruction +* code paths avoid checking this task flag and instead, +* unconditionally run the instruction. However, STIBP and IBPB +* are independent and either can be set to conditionally +* enabled regardless of the mode of the other. +* +* If either is set to conditional, allow the task flag to be +* updated, unless it was force-disabled by a previous prctl +* call. Currently, this is possible on an AMD CPU which has the +* feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the +* kernel is booted with 'spectre_v2_user=seccomp', then +* spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and +* spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED. */ -if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED || +if (!is_spec_ib_user_controlled () ||task_spec_ib_force_disable (task))return -EPERM ; +task_clear_spec_ib_disable (task);task_update_spec_tif (task);break ;
@@ -1283,10 +1301,10 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return -EPERM ; -if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) + +if (!is_spec_ib_user_controlled ())return 0 ; +task_set_spec_ib_disable (task);if (ctrl ==PR_SPEC_FORCE_DISABLE )task_set_spec_ib_force_disable (task);
@@ -1351,20 +1369,17 @@ static int ib_prctl_get(struct task_struct *task)if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_NONE && spectre_v2_user_stibp ==SPECTRE_V2_USER_NONE )return PR_SPEC_ENABLE ; -else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || - spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) -return PR_SPEC_DISABLE ; -else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_PRCTL || - spectre_v2_user_ibpb ==SPECTRE_V2_USER_SECCOMP || - spectre_v2_user_stibp ==SPECTRE_V2_USER_PRCTL || - spectre_v2_user_stibp ==SPECTRE_V2_USER_SECCOMP ) { +else if (is_spec_ib_user_controlled ()) {if (task_spec_ib_force_disable (task))return PR_SPEC_PRCTL |PR_SPEC_FORCE_DISABLE ;if (task_spec_ib_disable (task))return PR_SPEC_PRCTL |PR_SPEC_DISABLE ;return PR_SPEC_PRCTL |PR_SPEC_ENABLE ; - }else + }else if (spectre_v2_user_ibpb ==SPECTRE_V2_USER_STRICT || + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT || + spectre_v2_user_stibp ==SPECTRE_V2_USER_STRICT_PREFERRED ) +return PR_SPEC_DISABLE ; +else return PR_SPEC_NOT_AFFECTED ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 69/255 kbuild: explicitly specify the build id style
In reply to Greg Kroah-HartmanFrom: Bill Wendling <[email protected]>
[ Upstream commit a968433723310f35898b4a2f635a7991aeef66b1 ]
ld's --build-id defaults to "sha1" style, while lld defaults to "fast". The build IDs are very different between the two, which may confuse programs that reference them.
--- Makefile | 4 ++-- arch/arm/vdso/Makefile | 2 +- arch/arm64/kernel/vdso/Makefile | 2 +- arch/arm64/kernel/vdso32/Makefile | 2 +- arch/mips/vdso/Makefile | 2 +- arch/riscv/kernel/vdso/Makefile | 2 +- arch/s390/kernel/vdso64/Makefile | 2 +- arch/sparc/vdso/Makefile | 2 +- arch/x86/entry/vdso/Makefile | 2 +- tools/testing/selftests/bpf/Makefile | 2 +- 10 files changed, 11 insertions(+), 11 deletions(-)
Makefile +2 -2
@@ -973,8 +973,8 @@ KBUILD_CPPFLAGS += $(KCPPFLAGS) KBUILD_AFLAGS += $(KAFLAGS) KBUILD_CFLAGS += $(KCFLAGS) -KBUILD_LDFLAGS_MODULE += --build-id -LDFLAGS_vmlinux += --build-id +KBUILD_LDFLAGS_MODULE += --build-id=sha1 +LDFLAGS_vmlinux += --build-id=sha1 ifeq ($(CONFIG_STRIP_ASM_SYMS),y) LDFLAGS_vmlinux += $(call ld-option, -X,)
arch/arm/vdso/Makefile +1 -1
@@ -19,7 +19,7 @@ ccflags-y += -DDISABLE_BRANCH_PROFILING -DBUILD_VDSO32 ldflags-$(CONFIG_CPU_ENDIAN_BE8) := --be8 ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ -z max-page-size=4096 -nostdlib -shared $(ldflags-y) \ - --hash-style=sysv --build-id \ + --hash-style=sysv --build-id=sha1 \ -T obj-$(CONFIG_VDSO) += vdso.o
arch/arm64/kernel/vdso/Makefile +1 -1
@@ -24,7 +24,7 @@ btildflags-$(CONFIG_ARM64_BTI_KERNEL) += -z force-bti # routines, as x86 does (see 6f121e548f83 ("x86, vdso: Reimplement vdso.so # preparation in build-time C")). ldflags-y := -shared -nostdlib -soname=linux-vdso.so.1 --hash-style=sysv \ - -Bsymbolic $(call ld-option, --no-eh-frame-hdr) --build-id -n \ + -Bsymbolic $(call ld-option, --no-eh-frame-hdr) --build-id=sha1 -n \ $(btildflags-y) -T ccflags-y := -fno-common -fno-builtin -fno-stack-protector -ffixed-x18
arch/arm64/kernel/vdso32/Makefile +1 -1
@@ -128,7 +128,7 @@ VDSO_LDFLAGS += -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1 VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096 VDSO_LDFLAGS += -nostdlib -shared -mfloat-abi=soft VDSO_LDFLAGS += -Wl,--hash-style=sysv -VDSO_LDFLAGS += -Wl,--build-id +VDSO_LDFLAGS += -Wl,--build-id=sha1 VDSO_LDFLAGS += $(call cc32-ldoption,-fuse-ld=bfd)
arch/mips/vdso/Makefile +1 -1
@@ -61,7 +61,7 @@ endif # VDSO linker flags. ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \ $(filter -E%,$(KBUILD_CFLAGS)) -nostdlib -shared \ - -G 0 --eh-frame-hdr --hash-style=sysv --build-id -T + -G 0 --eh-frame-hdr --hash-style=sysv --build-id=sha1 -T CFLAGS_REMOVE_vdso.o = -pg
arch/riscv/kernel/vdso/Makefile +1 -1
@@ -49,7 +49,7 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE # refer to these symbols in the kernel code rather than hand-coded addresses. SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ - -Wl,--build-id -Wl,--hash-style=both + -Wl,--build-id=sha1 -Wl,--hash-style=both $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE $(call if_changed,vdsold)
arch/s390/kernel/vdso64/Makefile +1 -1
@@ -19,7 +19,7 @@ KBUILD_AFLAGS_64 += -m64 -s KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin ldflags-y := -fPIC -shared -nostdlib -soname=linux-vdso64.so.1 \ - --hash-style=both --build-id -T + --hash-style=both --build-id=sha1 -T $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64) $(targets:%=$(obj)/%.dbg): KBUILD_AFLAGS = $(KBUILD_AFLAGS_64)
arch/sparc/vdso/Makefile +1 -1
@@ -115,7 +115,7 @@ quiet_cmd_vdso = VDSO $@ -T $(filter %.lds,$^) $(filter %.o,$^) && \ sh $(srctree)/$(src)/checkundef.sh '$(OBJDUMP)' '$@' -VDSO_LDFLAGS = -shared --hash-style=both --build-id -Bsymbolic +VDSO_LDFLAGS = -shared --hash-style=both --build-id=sha1 -Bsymbolic GCOV_PROFILE := n #
arch/x86/entry/vdso/Makefile +1 -1
@@ -176,7 +176,7 @@ quiet_cmd_vdso = VDSO $@ -T $(filter %.lds,$^) $(filter %.o,$^) && \ sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' -VDSO_LDFLAGS = -shared --hash-style=both --build-id \ +VDSO_LDFLAGS = -shared --hash-style=both --build-id=sha1 \ $(call ld-option, --eh-frame-hdr) -Bsymbolic GCOV_PROFILE := n
tools/testing/selftests/bpf/Makefile +1 -1
@@ -133,7 +133,7 @@ $(OUTPUT)/%:%.c $(OUTPUT)/urandom_read: urandom_read.c $(call msg,BINARY,,$@) - $(Q)$(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id + $(Q)$(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id=sha1 $(OUTPUT)/test_stub.o: test_stub.c $(BPFOBJ) $(call msg,CC,,$@)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 70/255 RISC-V: Fix the VDSO symbol generaton for binutils-2.35+
In reply to Greg Kroah-HartmanFrom: Palmer Dabbelt <[email protected]>
[ Upstream commit c2c81bb2f69138f902e1a58d3bef6ad97fb8a92c ]
We were relying on GNU ld's ability to re-link executable files in order to extract our VDSO symbols. This behavior was deemed a bug as of binutils-2.35 (specifically the binutils-gdb commit a87e1817a4 ("Have the linker fail if any attempt to link in an executable is made."), but as that has been backported to at least Debian's binutils-2.34 in may manifest in other places.
The previous version of this was a bit of a mess: we were linking a static executable version of the VDSO, containing only a subset of the input symbols, which we then linked into the kernel. This worked, but certainly wasn't a supported path through the toolchain. Instead this new version parses the textual output of nm to produce a symbol table. Both rely on near-zero addresses being linkable, but as we rely on weak undefined symbols being linkable elsewhere I don't view this as a major issue.
--- arch/riscv/kernel/vdso/.gitignore | 1 + arch/riscv/kernel/vdso/Makefile | 18 +++++++++--------- arch/riscv/kernel/vdso/so2s.sh | 6 ++++++ 3 files changed, 16 insertions(+), 9 deletions(-) create mode 100755 arch/riscv/kernel/vdso/so2s.sh
arch/riscv/kernel/vdso/.gitignore +1 -0
@@ -1,3 +1,4 @@ # SPDX-License-Identifier: GPL-2.0-only vdso.lds *.tmp +vdso-syms.S
arch/riscv/kernel/vdso/Makefile +9 -9
@@ -43,19 +43,14 @@ $(obj)/vdso.o: $(obj)/vdso.so SYSCFLAGS_vdso.so.dbg = $(c_flags) $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE $(call if_changed,vdsold) +SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ + -Wl,--build-id -Wl,--hash-style=both # We also create a special relocatable object that should mirror the symbol # table and layout of the linked DSO. With ld --just-symbols we can then # refer to these symbols in the kernel code rather than hand-coded addresses. - -SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ - -Wl,--build-id=sha1 -Wl,--hash-style=both -$(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE - $(call if_changed,vdsold) - -LDFLAGS_vdso-syms.o := -r --just-symbols -$(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE - $(call if_changed,ld) +$(obj)/vdso-syms.S: $(obj)/vdso.so FORCE + $(call if_changed,so2s) # strip rule for the .so file $(obj)/%.so: OBJCOPYFLAGS := -S
@@ -73,6 +68,11 @@ quiet_cmd_vdsold = VDSOLD $@ $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ && \ rm [email protected] +# Extracts symbol offsets from the VDSO, converting them into an assembly file +# that contains the same symbols at the same offsets. +quiet_cmd_so2s = SO2S $@ + cmd_so2s = $(NM) -D $< | $(srctree)/$(src)/so2s.sh > $@ + # install commands for the unstripped file quiet_cmd_vdso_install = INSTALL $@ cmd_vdso_install = cp $(obj)/[email protected] $(MODLIB)/vdso/$@
arch/riscv/kernel/vdso/so2s.sh new file +6 -0
@@ -0,0 +1,6 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2020 Palmer Dabbelt <[email protected]> + +sed 's!\([0-9a-f]*\) T \([a-z0-9_]*\)\(@@LINUX_4.15\)*!.global \2\n.set \2,0x\1!' \ +| grep '^\.'
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 73/255 KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesnt return SMCCC_RET_NOT_REQUIRED
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
commit 1de111b51b829bcf01d2e57971f8fd07a665fa3f upstream.
According to the SMCCC spec[1](7.5.2 Discovery) the ARM_SMCCC_ARCH_WORKAROUND_1 function id only returns 0, 1, and SMCCC_RET_NOT_SUPPORTED.
0 is "workaround required and safe to call this function"
1 is "workaround not required but safe to call this function" SMCCC_RET_NOT_SUPPORTED is "might be vulnerable or might not be, who knows, I give up!"
SMCCC_RET_NOT_SUPPORTED might as well mean "workaround required, except calling this function may not work because it isn't implemented in some cases". Wonderful. We map this SMC call to
0 is SPECTRE_MITIGATED
1 is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
For KVM hypercalls (hvc), we've implemented this function id to return SMCCC_RET_NOT_SUPPORTED, 0, and SMCCC_RET_NOT_REQUIRED. One of those isn't supposed to be there. Per the code we call arm64_get_spectre_v2_state() to figure out what to return for this feature discovery call.
0 is SPECTRE_MITIGATED
SMCCC_RET_NOT_REQUIRED is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
Let's clean this up so that KVM tells the guest this mapping:
0 is SPECTRE_MITIGATED
1 is SPECTRE_UNAFFECTED
SMCCC_RET_NOT_SUPPORTED is SPECTRE_VULNERABLE
Note: SMCCC_RET_NOT_AFFECTED is 1 but isn't part of the SMCCC spec
--- arch/arm64/kvm/hypercalls.c | 2 +- include/linux/arm-smccc.h | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-)
arch/arm64/kvm/hypercalls.c +1 -1
@@ -31,7 +31,7 @@ int kvm_hvc_call_handler(struct kvm_vcpu val =SMCCC_RET_SUCCESS ;break ;case KVM_BP_HARDEN_NOT_REQUIRED : - val =SMCCC_RET_NOT_REQUIRED ; + val =SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED ;break ; }break ;
include/linux/arm-smccc.h +2 -0
@@ -86,6 +86,8 @@ ARM_SMCCC_SMC_32, \ 0, 0x7fff) +#define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1 +/* Paravirtualised time calls (defined by ARM DEN0057A) */ #define ARM_SMCCC_HV_PV_TIME_FEATURES \ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
Greg Kroah-Hartman
maintainerPATCH 72/255 tpm: efi: Dont create binary_bios_measurements file for an empty log
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit 8ffd778aff45be760292225049e0141255d4ad6e ]
Mimic the pre-existing ACPI and Device Tree event log behavior by not creating the binary_bios_measurements file when the EFI TPM event log is empty.
This fixes the following NULL pointer dereference that can occur when reading /sys/kernel/security/tpm0/binary_bios_measurements after the kernel received an empty event log from the firmware:
BUG: kernel NULL pointer dereference, address: 000000000000002c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 2 PID: 3932 Comm: fwupdtpmevlog Not tainted 5.9.0-00003-g629990edad62 #17 Hardware name: LENOVO 20LCS03L00/20LCS03L00, BIOS N27ET38W (1.24 ) 11/28/2019 RIP: 0010:tpm2_bios_measurements_start+0x3a/0x550 Code: 54 53 48 83 ec 68 48 8b 57 70 48 8b 1e 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 82 c0 06 00 00 48 8b 8a c8 06 00 00 <44> 8b 60 1c 48 89 4d a0 4c 89 e2 49 83 c4 20 48 83 fb 00 75 2a 49 RSP: 0018:ffffa9c901203db0 EFLAGS: 00010246 RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000010 RDX: ffff8ba1eb99c000 RSI: ffff8ba1e4ce8280 RDI: ffff8ba1e4ce8258 RBP: ffffa9c901203e40 R08: ffffa9c901203dd8 R09: ffff8ba1ec443300 R10: ffffa9c901203e50 R11: 0000000000000000 R12: ffff8ba1e4ce8280 R13: ffffa9c901203ef0 R14: ffffa9c901203ef0 R15: ffff8ba1e4ce8258 FS: 00007f6595460880(0000) GS:ffff8ba1ef880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002c CR3: 00000007d8d18003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __kmalloc_node+0x113/0x320 ? kvmalloc_node+0x31/0x80 seq_read+0x94/0x420 vfs_read+0xa7/0x190 ksys_read+0xa7/0xe0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x37/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9
In this situation, the bios_event_log pointer in the tpm_bios_log struct was not NULL but was equal to the ZERO_SIZE_PTR (0x10) value. This was due to the following kmemdup() in tpm_read_log_efi():
int tpm_read_log_efi(struct tpm_chip *chip)
{
...
/* malloc EventLog space */
log->bios_event_log = kmemdup(log_tbl->log, log_size, GFP_KERNEL);
if (!log->bios_event_log) {
ret = -ENOMEM;
goto out;
}...
}
When log_size is zero, due to an empty event log from firmware, ZERO_SIZE_PTR is returned from kmemdup(). Upon a read of the binary_bios_measurements file, the tpm2_bios_measurements_start() function does not perform a ZERO_OR_NULL_PTR() check on the bios_event_log pointer before dereferencing it.
Rather than add a ZERO_OR_NULL_PTR() check in functions that make use of the bios_event_log pointer, simply avoid creating the binary_bios_measurements_file as is done in other event log retrieval backends.
Explicitly ignore all of the events in the final event log when the main event log is empty. The list of events in the final event log cannot be accurately parsed without referring to the first event in the main event log (the event log header) so the final event log is useless in such a situation.
--- drivers/char/tpm/eventlog/efi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/char/tpm/eventlog/efi.c +5 -0
@@ -41,6 +41,11 @@ int tpm_read_log_efi(struct tpm_chip *chip) log_size = log_tbl->size;memunmap (log_tbl); +if (!log_size) { +pr_warn ("UEFI TPM log area empty\n" ); +return -EIO ; + } + log_tbl =memremap (efi.tpm_log,sizeof (*log_tbl) + log_size,MEMREMAP_WB );if (!log_tbl) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 77/255 ASoC: qcom: sdm845: set driver name correctly
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 3f48b6eba15ea342ef4cb420b580f5ed6605669f ]
With the current state of code, we would endup with something like below in /proc/asound/cards for 2 machines based on this driver.
Machine 1:
0 [DB845c ]: DB845c - DB845c
DB845c
Machine 2:
0 [LenovoYOGAC6301]: Lenovo-YOGA-C63 - Lenovo-YOGA-C630-13Q50
LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216This is not very UCM friendly both w.r.t to common up configs and card identification, and UCM2 became totally not usefull with just one ucm sdm845.conf for two machines which have different setups w.r.t HDMI and other dais.
Reasons for such thing is partly because Qualcomm machine drivers never cared to set driver_name.
This patch sets up driver name for the this driver to sort out the UCM integration issues!
after this patch contents of /proc/asound/cards:
Machine 1:
0 [DB845c ]: sdm845 - DB845c
DB845c
Machine 2:
0 [LenovoYOGAC6301]: sdm845 - Lenovo-YOGA-C630-13Q50
LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216with this its possible to align with what UCM2 expects and we can have sdm845/DB845.conf sdm845/LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216.conf ... for board variants. This should scale much better!
--- sound/soc/qcom/sdm845.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/qcom/sdm845.c +2 -0
@@ -17,6 +17,7 @@#include "qdsp6/q6afe.h" #include "../codecs/rt5663.h" +#define DRIVER_NAME "sdm845"#define DEFAULT_SAMPLE_RATE_48K 48000#define DEFAULT_MCLK_RATE 24576000#define TDM_BCLK_RATE 6144000
@@ -552,6 +553,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev)if (!data)return -ENOMEM ; + card->driver_name =DRIVER_NAME ; card->dapm_widgets = sdm845_snd_widgets; card->num_dapm_widgets =ARRAY_SIZE (sdm845_snd_widgets); card->dev = dev;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 76/255 ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit eb5a558705c7f63d06b4ddd072898b1ca894e053 ]
RT1015's output widget name is "SPO" instead of "Speaker". Fixes it to use the correct names.
--- .../mediatek/mt8183/mt8183-da7219-max98357.c | 31 +++++++++++++++---- 1 file changed, 25 insertions(+), 6 deletions(-)
sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +25 -6
@@ -624,15 +624,34 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { }, }; +static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { +SOC_DAPM_PIN_SWITCH ("Left Spk" ), +SOC_DAPM_PIN_SWITCH ("Right Spk" ), +}; + +static const +struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { +SND_SOC_DAPM_SPK ("Left Spk" ,NULL ), +SND_SOC_DAPM_SPK ("Right Spk" ,NULL ), +SND_SOC_DAPM_PINCTRL ("TDM_OUT_PINCTRL" , +"aud_tdm_out_on" ,"aud_tdm_out_off" ), +}; + +static const struct snd_soc_dapm_route mt8183_da7219_rt1015_dapm_routes[] = { + {"Left Spk" ,NULL ,"Left SPO" }, + {"Right Spk" ,NULL ,"Right SPO" }, + {"I2S Playback" ,NULL ,"TDM_OUT_PINCTRL" }, +}; +static struct snd_soc_card mt8183_da7219_rt1015_card = { .name ="mt8183_da7219_rt1015" , .owner =THIS_MODULE , - .controls = mt8183_da7219_max98357_snd_controls, - .num_controls =ARRAY_SIZE (mt8183_da7219_max98357_snd_controls), - .dapm_widgets = mt8183_da7219_max98357_dapm_widgets, - .num_dapm_widgets =ARRAY_SIZE (mt8183_da7219_max98357_dapm_widgets), - .dapm_routes = mt8183_da7219_max98357_dapm_routes, - .num_dapm_routes =ARRAY_SIZE (mt8183_da7219_max98357_dapm_routes), + .controls = mt8183_da7219_rt1015_snd_controls, + .num_controls =ARRAY_SIZE (mt8183_da7219_rt1015_snd_controls), + .dapm_widgets = mt8183_da7219_rt1015_dapm_widgets, + .num_dapm_widgets =ARRAY_SIZE (mt8183_da7219_rt1015_dapm_widgets), + .dapm_routes = mt8183_da7219_rt1015_dapm_routes, + .num_dapm_routes =ARRAY_SIZE (mt8183_da7219_rt1015_dapm_routes), .dai_link = mt8183_da7219_dai_links, .num_links =ARRAY_SIZE (mt8183_da7219_dai_links), .aux_dev = &mt8183_da7219_max98357_headset_dev,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 78/255 ASoC: cs42l51: manage mclk shutdown delay
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
[ Upstream commit 20afe581c9b980848ad097c4d54dde9bec7593ef ]
A delay must be introduced before the shutdown down of the mclk, as stated in CS42L51 datasheet. Otherwise the codec may produce some noise after the end of DAPM power down sequence. The delay between DAC and CLOCK_SUPPLY widgets is too short. Add a delay in mclk shutdown request to manage the shutdown delay explicitly. From experiments, at least 10ms delay is necessary. Set delay to 20ms as recommended in Documentation/timers/timers-howto.rst when using msleep().
--- sound/soc/codecs/cs42l51.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
sound/soc/codecs/cs42l51.c +21 -1
@@ -245,8 +245,28 @@ static const struct snd_soc_dapm_widget cs42l51_dapm_widgets[] = { &cs42l51_adcr_mux_controls), }; +static int mclk_event (struct snd_soc_dapm_widget *w, +struct snd_kcontrol *kcontrol,int event) +{ +struct snd_soc_component *comp =snd_soc_dapm_to_component (w->dapm); +struct cs42l51_private *cs42l51 =snd_soc_component_get_drvdata (comp); + +switch (event) { +case SND_SOC_DAPM_PRE_PMU : +return clk_prepare_enable (cs42l51->mclk_handle); +case SND_SOC_DAPM_POST_PMD : +/* Delay mclk shutdown to fulfill power-down sequence requirements */ +msleep (20 ); +clk_disable_unprepare (cs42l51->mclk_handle); +break ; + } + +return 0 ; +} +static const struct snd_soc_dapm_widget cs42l51_dapm_mclk_widgets[] = { -SND_SOC_DAPM_CLOCK_SUPPLY ("MCLK" ) +SND_SOC_DAPM_SUPPLY ("MCLK" ,SND_SOC_NOPM ,0 ,0 , mclk_event, +SND_SOC_DAPM_PRE_PMU |SND_SOC_DAPM_POST_PMD ), };static const struct snd_soc_dapm_route cs42l51_routes[] = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 79/255 ASoC: SOF: loader: handle all SOF_IPC_EXT types
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
[ Upstream commit 6e5329c6e6032cd997400b43b8299f607a61883e ]
Do not emit a warning for extended firmware header fields that are not used by kernel. This creates unnecessary noise to kernel logs like:
sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 3 size 0x1c sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 4 size 0x10
--- sound/soc/sof/loader.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/sof/loader.c +5 -0
@@ -118,6 +118,11 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset)case SOF_IPC_EXT_CC_INFO : ret =get_cc_info (sdev, ext_hdr);break ; +case SOF_IPC_EXT_UNUSED : +case SOF_IPC_EXT_PROBE_INFO : +case SOF_IPC_EXT_USER_ABI_INFO : +/* They are supported but we don't do anything here */ +break ;default :dev_warn (sdev->dev,"warning: unknown ext header type %d size 0x%x\n" , ext_hdr->type, ext_hdr->hdr.size);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 80/255 usb: dwc3: pci: add support for the Intel Alder Lake-S
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ]
This patch adds the necessary PCI ID for Intel Alder Lake-S devices.
--- drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +4 -0
@@ -40,6 +40,7 @@#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee#define PCI_DEVICE_ID_INTEL_JSP 0x4dee +#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1#define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"#define PCI_INTEL_BXT_FUNC_PMU_PWR 4
@@ -367,6 +368,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { {PCI_VDEVICE (INTEL ,PCI_DEVICE_ID_INTEL_JSP ), (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), (kernel_ulong_t) &dwc3_pci_amd_properties, }, { } /* Terminating Entry */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 83/255 usb: raw-gadget: fix memory leak in gadget_setup
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
[ Upstream commit 129aa9734559a17990ee933351c7b6956f1dba62 ]
When fetch 'event' from event queue, after copy its address space content to user space, the 'event' the memory space pointed to by the 'event' pointer need be freed.
BUG: memory leak
unreferenced object 0xffff888110622660 (size 32):
comm "softirq", pid 0, jiffies 4294941981 (age 12.480s)
hex dump (first 32 bytes):
02 00 00 00 08 00 00 00 80 06 00 01 00 00 40 00 ..............@.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000efd29abd>] kmalloc include/linux/slab.h:554 [inline]
[<00000000efd29abd>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
[<00000000efd29abd>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
[<00000000efd29abd>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343
[<00000000952c4a46>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899
[<0000000074ac2c54>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1415
[<00000000560a3a79>] expire_timers kernel/time/timer.c:1460 [inline]
[<00000000560a3a79>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1757
[<000000009d9503d0>] __run_timers kernel/time/timer.c:1738 [inline]
[<000000009d9503d0>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1770
[<000000009df27c89>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298
[<000000007a3f1a47>] asm_call_irq_on_stack+0xf/0x20
[<000000004a62cc2e>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
[<000000004a62cc2e>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
[<000000004a62cc2e>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
[<00000000b0086800>] invoke_softirq kernel/softirq.c:393 [inline]
[<00000000b0086800>] __irq_exit_rcu kernel/softirq.c:423 [inline]
[<00000000b0086800>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435
[<00000000175f9523>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091
[<00000000a348e847>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
[<0000000060661100>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
[<0000000060661100>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
[<0000000060661100>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
[<0000000060661100>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517
[<000000003f413b99>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648
[<00000000f5e5afb8>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237
[<00000000d50d51fc>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351
[<00000000d674baed>] call_cpuidle kernel/sched/idle.c:132 [inline]
[<00000000d674baed>] cpuidle_idle_call kernel/sched/idle.c:213 [inline]
[<00000000d674baed>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273--- drivers/usb/gadget/legacy/raw_gadget.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/raw_gadget.c +4 -1
@@ -564,9 +564,12 @@ static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value)return -ENODEV ; } length =min (arg.length, event->length); -if (copy_to_user ((void __user *)value, event,sizeof (*event) + length)) +if (copy_to_user ((void __user *)value, event,sizeof (*event) + length)) { +kfree (event);return -EFAULT ; + } +kfree (event);return 0 ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 82/255 usb: gadget: goku_udc: fix potential crashes in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]
goku_probe() goes to error label "err" and invokes goku_remove() in case of failures of pci_enable_device(), pci_resource_start() and ioremap(). goku_remove() gets a device from pci_get_drvdata(pdev) and works with it without any checks, in particular it dereferences a corresponding pointer. But goku_probe() did not set this device yet. So, one can expect various crashes. The patch moves setting the device just after allocation of memory for it.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/goku_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/goku_udc.c +1 -1
@@ -1760,6 +1760,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err; } +pci_set_drvdata (pdev, dev);spin_lock_init (&dev->lock); dev->pdev = pdev; dev->gadget.ops = &goku_ops;
@@ -1793,7 +1794,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) } dev->regs = (struct goku_udc_regs __iomem *) base; -pci_set_drvdata (pdev, dev);INFO (dev,"%s\n" , driver_desc);INFO (dev,"version: " DRIVER_VERSION " %s\n" ,dmastr ());INFO (dev,"irq %d, pci mem %p\n" , pdev->irq, base);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 59/255 xfs: fix missing CoW blocks writeback conversion retry
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit c2f09217a4305478c55adc9a98692488dd19cd32 ]
In commit 7588cbeec6df, we tried to fix a race stemming from the lack of coordination between higher level code that wants to allocate and remap CoW fork extents into the data fork. Christoph cites as examples the always_cow mode, and a directio write completion racing with writeback.
According to the comments before the goto retry, we want to restart the lookup to catch the extent in the data fork, but we don't actually reset whichfork or cow_fsb, which means the second try executes using stale information. Up until now I think we've gotten lucky that either there's something left in the CoW fork to cause cow_fsb to be reset, or either data/cow fork sequence numbers have advanced enough to force a fresh lookup from the data fork. However, if we reach the retry with an empty stable CoW fork and a stable data fork, neither of those things happens. The retry foolishly re-calls xfs_convert_blocks on the CoW fork which fails again. This time, we toss the write.
I've recently been working on extending reflink to the realtime device. When the realtime extent size is larger than a single block, we have to force the page cache to CoW the entire rt extent if a write (or fallocate) are not aligned with the rt extent size. The strategy I've chosen to deal with this is derived from Dave's blocksize > pagesize
series: dirtying around the write range, and ensuring that writeback always starts mapping on an rt extent boundary. This has brought this race front and center, since generic/522 blows up immediately.
However, I'm pretty sure this is a bug outright, independent of that.
--- fs/xfs/xfs_aops.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/xfs/xfs_aops.c +4 -2
@@ -346,8 +346,8 @@ xfs_map_blocks(ssize_t count =i_blocksize (inode);xfs_fileoff_t offset_fsb =XFS_B_TO_FSBT (mp, offset);xfs_fileoff_t end_fsb =XFS_B_TO_FSB (mp, offset + count); -xfs_fileoff_t cow_fsb =NULLFILEOFF ; -int whichfork =XFS_DATA_FORK ; +xfs_fileoff_t cow_fsb; +int whichfork;struct xfs_bmbt_irec imap;struct xfs_iext_cursor icur;int retries =0 ;
@@ -381,6 +381,8 @@ xfs_map_blocks(* landed in a hole and we skip the block. */ retry: + cow_fsb =NULLFILEOFF ; + whichfork =XFS_DATA_FORK ;xfs_ilock (ip,XFS_ILOCK_SHARED );ASSERT (ip->i_df.if_format !=XFS_DINODE_FMT_BTREE || (ip->i_df.if_flags &XFS_IFEXTENTS ));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 84/255 selftests/ftrace: check for do_sys_openat2 in user-memory test
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e3e40312567087fbe6880f316cb2b0e1f3d8a82c ]
More recent libc implementations are now using openat/openat2 system calls so also add do_sys_openat2 to the tracing so that the test passes on these systems because do_sys_open may not be called.
Thanks to Masami Hiramatsu for the help on getting this fix to work correctly.
--- .../selftests/ftrace/test.d/kprobe/kprobe_args_user.tc | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc +4 -0
@@ -9,12 +9,16 @@ grep -A10 "fetcharg:" README | grep -q '\[u\]<offset>' || exit_unsupported :;: "user-memory access syntax and ustring working on user memory";: echo 'p:myevent do_sys_open path=+0($arg2):ustring path2=+u0($arg2):string' \ > kprobe_events +echo 'p:myevent2 do_sys_openat2 path=+0($arg2):ustring path2=+u0($arg2):string' \ + >> kprobe_events grep myevent kprobe_events | \ grep -q 'path=+0($arg2):ustring path2=+u0($arg2):string' echo 1 > events/kprobes/myevent/enable +echo 1 > events/kprobes/myevent2/enable echo > /dev/null echo 0 > events/kprobes/myevent/enable +echo 0 > events/kprobes/myevent2/enable grep myevent trace | grep -q 'path="/dev/null" path2="/dev/null"'
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 86/255 ALSA: hda: Separate runtime and system suspend
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit f5dac54d9d93826a776dffc848df76746f7135bb ]
Both pm_runtime_force_suspend() and pm_runtime_force_resume() have some implicit checks, so it can make code flow more straightforward if we separate runtime and system suspend callbacks.
High Definition Audio Specification, 4.5.9.3 Codec Wake From System S3 states that codec can wake the system up from S3 if WAKEEN is toggled. Since HDA controller has different wakeup settings for runtime and system susend, we also need to explicitly disable direct-complete which can be enabled automatically by PCI core. In addition to that, avoid waking up codec if runtime resume is for system suspend, to not break direct-complete for codecs.
While at it, also remove AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP, as the original bug commit a6630529aecb ("ALSA: hda: Workaround for spurious wakeups on some Intel platforms") solves doesn't happen with this patch.
--- sound/pci/hda/hda_controller.h | 3 +- sound/pci/hda/hda_intel.c | 62 +++++++++++++++++++--------------- 2 files changed, 36 insertions(+), 29 deletions(-)
sound/pci/hda/hda_controller.h +2 -1
@@ -41,7 +41,7 @@/* 24 unused */ #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25)/* Take LPIB as delay */ #define AZX_DCAPS_PM_RUNTIME (1 << 26)/* runtime PM support */ -#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27)/* Workaround for spurious wakeups after suspend */ +/* 27 unused */ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)/* CORBRP clears itself after reset */ #define AZX_DCAPS_NO_MSI64 (1 << 29)/* Stick to 32-bit MSIs */ #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30)/* capture and playback use separate stream tag */
@@ -143,6 +143,7 @@ struct azx { unsigned int align_buffer_size:1; unsigned int region_requested:1; unsigned int disabled:1; /* disabled by vga_switcheroo */ + unsigned int pm_prepared:1;/* GTS present */ unsigned int gts_present:1;
sound/pci/hda/hda_intel.c +34 -28
122 lines not on this page · raw message
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 60/255 xfs: fix scrub flagging rtinherit even if there is no rt device
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit c1f6b1ac00756a7108e5fcb849a2f8230c0b62a5 ]
The kernel has always allowed directories to have the rtinherit flag set, even if there is no rt device, so this check is wrong.
--- fs/xfs/scrub/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/xfs/scrub/inode.c +1 -2
@@ -121,8 +121,7 @@ xchk_inode_flags( goto bad;/* rt flags require rt device */ -if ((flags & (XFS_DIFLAG_REALTIME |XFS_DIFLAG_RTINHERIT )) && - !mp->m_rtdev_targp) +if ((flags &XFS_DIFLAG_REALTIME ) && !mp->m_rtdev_targp) goto bad;/* new rt bitmap flag only valid for rbmino */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 61/255 io_uring: ensure consistent view of original task ->mm from SQPOLL
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 4b70cf9dea4cd239b425f3282fa56ce19e234c8a ]
Ensure we get a valid view of the task mm, by using task_lock() when attempting to grab the original task mm.
--- fs/io_uring.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
fs/io_uring.c +20 -7
@@ -952,20 +952,33 @@ static void io_sq_thread_drop_mm(void)if (mm) {kthread_unuse_mm (mm);mmput (mm); + current->mm =NULL ; } }static int __io_sq_thread_acquire_mm (struct io_ring_ctx *ctx) { -if (!current->mm) { -if (unlikely (!(ctx->flags &IORING_SETUP_SQPOLL ) || - !ctx->sqo_task->mm || - !mmget_not_zero (ctx->sqo_task->mm))) -return -EFAULT ; -kthread_use_mm (ctx->sqo_task->mm); +struct mm_struct *mm; + +if (current->mm) +return 0 ; + +/* Should never happen */ +if (unlikely (!(ctx->flags &IORING_SETUP_SQPOLL ))) +return -EFAULT ; + +task_lock (ctx->sqo_task); + mm = ctx->sqo_task->mm; +if (unlikely (!mm || !mmget_not_zero (mm))) + mm =NULL ; +task_unlock (ctx->sqo_task); + +if (mm) { +kthread_use_mm (mm); +return 0 ; } -return 0 ; +return -EFAULT ; } static int io_sq_thread_acquire_mm(struct io_ring_ctx *ctx,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 62/255 spi: fsl-dspi: fix wrong pointer in suspend/resume
In reply to Greg Kroah-HartmanFrom: Zhao Qiang <[email protected]>
[ Upstream commit 9bd77a9ce31dd242fece27219d14fbee5068dd85 ]
Since commit 530b5affc675 ("spi: fsl-dspi: fix use-after-free in remove path"), this driver causes a "NULL pointer dereference" in dspi_suspend/resume.
This is because since this commit, the drivers private data point to "dspi" instead of "ctlr", the codes in suspend and resume func were not modified correspondly.
--- drivers/spi/spi-fsl-dspi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/spi/spi-fsl-dspi.c +4 -6
@@ -1106,12 +1106,11 @@ MODULE_DEVICE_TABLE(of, fsl_dspi_dt_ids);#ifdef CONFIG_PM_SLEEP static int dspi_suspend (struct device *dev) { -struct spi_controller *ctlr =dev_get_drvdata (dev); -struct fsl_dspi *dspi =spi_controller_get_devdata (ctlr); +struct fsl_dspi *dspi =dev_get_drvdata (dev);if (dspi->irq)disable_irq (dspi->irq); -spi_controller_suspend (ctlr); +spi_controller_suspend (dspi->ctlr);clk_disable_unprepare (dspi->clk);pinctrl_pm_select_sleep_state (dev);
@@ -1121,8 +1120,7 @@ static int dspi_suspend(struct device *dev)static int dspi_resume (struct device *dev) { -struct spi_controller *ctlr =dev_get_drvdata (dev); -struct fsl_dspi *dspi =spi_controller_get_devdata (ctlr); +struct fsl_dspi *dspi =dev_get_drvdata (dev);int ret;pinctrl_pm_select_default_state (dev);
@@ -1130,7 +1128,7 @@ static int dspi_resume(struct device *dev) ret =clk_prepare_enable (dspi->clk);if (ret)return ret; -spi_controller_resume (ctlr); +spi_controller_resume (dspi->ctlr);if (dspi->irq)enable_irq (dspi->irq);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 63/255 PCI: mvebu: Fix duplicate resource requests
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
[ Upstream commit 832ea234277a2465ec6602fa6a4db5cd9ee87ae3 ]
With commit 669cbc708122 ("PCI: Move DT resource setup into devm_pci_alloc_host_bridge()"), the DT 'ranges' is parsed and populated into resources when the host bridge is allocated. The resources are requested as well, but that happens a second time for the mvebu driver in mvebu_pcie_parse_request_resources(). We should only be requesting the additional resources added in mvebu_pcie_parse_request_resources(). These are not added by default because they use custom properties rather than standard DT address translation.
Also, the bus ranges was also populated by default, so we can remove it from mvebu_pci_host_probe().
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209729
--- drivers/pci/controller/pci-mvebu.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/pci/controller/pci-mvebu.c +10 -13
@@ -960,25 +960,16 @@ static void mvebu_pcie_powerdown(struct mvebu_pcie_port *port) }/* -* We can't use devm_of_pci_get_host_bridge_resources() because we -* need to parse our special DT properties encoding the MEM and IO -* apertures. +* devm_of_pci_get_host_bridge_resources() only sets up translateable resources, +* so we need extra resource setup parsing our special DT properties encoding +* the MEM and IO apertures. */ static int mvebu_pcie_parse_request_resources (struct mvebu_pcie *pcie) {struct device *dev = &pcie->pdev->dev; -struct device_node *np = dev->of_node;struct pci_host_bridge *bridge =pci_host_bridge_from_priv (pcie);int ret; -/* Get the bus range */ - ret =of_pci_parse_bus_range (np, &pcie->busn); -if (ret) { -dev_err (dev,"failed to parse bus-range property: %d\n" , ret); -return ret; - } -pci_add_resource (&bridge->windows, &pcie->busn); -/* Get the PCIe memory aperture */ mvebu_mbus_get_pcie_mem_aperture (&pcie->mem);if (resource_size (&pcie->mem) ==0 ) {
@@ -988,6 +979,9 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) pcie->mem.name ="PCI MEM" ;pci_add_resource (&bridge->windows, &pcie->mem); + ret =devm_request_resource (dev, &iomem_resource, &pcie->mem); +if (ret) +return ret;/* Get the PCIe IO aperture */ mvebu_mbus_get_pcie_io_aperture (&pcie->io);
@@ -1001,9 +995,12 @@ static int mvebu_pcie_parse_request_resources(struct mvebu_pcie *pcie) pcie->realio.name ="PCI I/O" ;pci_add_resource (&bridge->windows, &pcie->realio); + ret =devm_request_resource (dev, &ioport_resource, &pcie->realio); +if (ret) +return ret; } -return devm_request_pci_bus_resources (dev, &bridge->windows); +return 0 ; }/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 56/255 can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
In reply to Greg Kroah-HartmanFrom: Joakim Zhang <[email protected]>
[ Upstream commit 018799649071a1638c0c130526af36747df4355a ]
After double check with Layerscape CAN owner (Pankaj Bansal), confirm that LS1021A doesn't support ECC feature, so remove FLEXCAN_QUIRK_DISABLE_MECR quirk.
--- drivers/net/can/flexcan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/can/flexcan.c +1 -2
@@ -321,8 +321,7 @@ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {static const struct flexcan_devtype_data fsl_ls1021a_r2_devtype_data = { .quirks =FLEXCAN_QUIRK_DISABLE_RXFG |FLEXCAN_QUIRK_ENABLE_EACEN_RRS | -FLEXCAN_QUIRK_DISABLE_MECR |FLEXCAN_QUIRK_BROKEN_PERR_STATE | -FLEXCAN_QUIRK_USE_OFF_TIMESTAMP , +FLEXCAN_QUIRK_BROKEN_PERR_STATE |FLEXCAN_QUIRK_USE_OFF_TIMESTAMP , };static const struct can_bittiming_const flexcan_bittiming_const = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 104/255 ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
[ Upstream commit 3b57533b460c8dc22a432684b7e8d22571f34d2e ]
ARC HSDK platform stopped booting on released v5.10-rc1, getting stuck in startup of non master SMP cores.
This was bisected to upstream commit 7fef431be9c9ac25 "(mm/page_alloc: place pages to tail in __free_pages_core())" That commit itself is harmless, it just exposed a subtle assumption in our platform code (hence CC'ing linux-mm just as FYI in case some other arches / platforms trip on it).
The upstream commit is semantically disruptive as it reverses the order of page allocations (actually it can be good test for hardware verification to exercise different memory patterns altogether). For ARC HSDK platform that meant a remapped memory region (pertaining to unused Closely Coupled Memory) started getting used early for dynamice allocations, while not effectively remapped on all the cores, triggering memory error exception on those cores.
The fix is to move the CCM remapping from early platform code to to early core boot code. And while it is undesirable to riddle common boot code with platform quirks, there is no other way to do this since the faltering code involves setting up stack itself so even function calls are not allowed at that point.
If anyone is interested, all the gory details can be found at Link below.
--- arch/arc/kernel/head.S | 17 ++++++++++++++++- arch/arc/plat-hsdk/platform.c | 17 ----------------- 2 files changed, 16 insertions(+), 18 deletions(-)
arch/arc/kernel/head.S +16 -1
@@ -67,7 +67,22 @@ sr r5, [ARC_REG_LPB_CTRL] 1: #endif /* CONFIG_ARC_LPB_DISABLE */ -#endif + + /* On HSDK, CCMs need to remapped super early */ +#ifdef CONFIG_ARC_SOC_HSDK + mov r6, 0x60000000 + lr r5, [ARC_REG_ICCM_BUILD] + breq r5, 0, 1f + sr r6, [ARC_REG_AUX_ICCM] +1: + lr r5, [ARC_REG_DCCM_BUILD] + breq r5, 0, 2f + sr r6, [ARC_REG_AUX_DCCM] +2: +#endif /* CONFIG_ARC_SOC_HSDK */ + +#endif /* CONFIG_ISA_ARCV2 */ + ; Config DSP_CTRL properly, so kernel may use integer multiply, ; multiply-accumulate, and divide operations DSP_EARLY_INIT
arch/arc/plat-hsdk/platform.c +0 -17
@@ -17,22 +17,6 @@ int arc_hsdk_axi_dmac_coherent __section(.data) = 0;#define ARC_CCM_UNUSED_ADDR 0x60000000 -static void __init hsdk_init_per_cpu (unsigned int cpu) -{ -/* -* By default ICCM is mapped to 0x7z while this area is used for -* kernel virtual mappings, so move it to currently unused area. -*/ -if (cpuinfo_arc700[cpu].iccm.sz) -write_aux_reg (ARC_REG_AUX_ICCM ,ARC_CCM_UNUSED_ADDR ); - -/* -* By default DCCM is mapped to 0x8z while this area is used by kernel, -* so move it to currently unused area. -*/ -if (cpuinfo_arc700[cpu].dccm.sz) -write_aux_reg (ARC_REG_AUX_DCCM ,ARC_CCM_UNUSED_ADDR ); -}#define ARC_PERIPHERAL_BASE 0xf0000000#define CREG_BASE (ARC_PERIPHERAL_BASE + 0x1000)
@@ -339,5 +323,4 @@ static const char *hsdk_compat[] __initconst = {MACHINE_START (SIMULATION ,"hsdk" ) .dt_compat = hsdk_compat, .init_early = hsdk_init_early, - .init_per_cpu = hsdk_init_per_cpu,MACHINE_END
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 89/255 gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling return_all_reservations, but return_all_reservations still dereferences rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the call to return_all_reservations.
--- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/rgrp.c +1 -1
@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) }gfs2_free_clones (rgd); +return_all_reservations (rgd);kfree (rgd->rd_bits); rgd->rd_bits =NULL ; -return_all_reservations (rgd);kmem_cache_free (gfs2_rgrpd_cachep, rgd); } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 98/255 cfg80211: initialize wdev data earlier
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 9bdaf3b91efd229dd272b228e13df10310c80d19 ]
There's a race condition in the netdev registration in that NETDEV_REGISTER actually happens after the netdev is available, and so if we initialize things only there, we might get called with an uninitialized wdev through nl80211 - not using a wdev but using a netdev interface index.
I found this while looking into a syzbot report, but it doesn't really seem to be related, and unfortunately there's no repro for it (yet). I can't (yet) explain how it managed to get into cfg80211_release_pmsr() from nl80211_netlink_notify() without the wdev having been initialized, as the latter only iterates the wdevs that are linked into the rdev, which even without the change here happened after init.
However, looking at this, it seems fairly clear that the init needs to be done earlier, otherwise we might even re-init on a netns move, when data might still be pending.
--- net/wireless/core.c | 57 +++++++++++++++++++++++------------------- net/wireless/core.h | 5 ++-- net/wireless/nl80211.c | 3 ++- 3 files changed, 36 insertions(+), 29 deletions(-)
net/wireless/core.c +31 -26
@@ -1248,8 +1248,7 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev, }EXPORT_SYMBOL (cfg80211_stop_iface); -void cfg80211_init_wdev (struct cfg80211_registered_device *rdev, -struct wireless_dev *wdev) +void cfg80211_init_wdev (struct wireless_dev *wdev) {mutex_init (&wdev->mtx);INIT_LIST_HEAD (&wdev->event_list);
@@ -1260,6 +1259,30 @@ void cfg80211_init_wdev(struct cfg80211_registered_device *rdev,spin_lock_init (&wdev->pmsr_lock);INIT_WORK (&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk); +#ifdef CONFIG_CFG80211_WEXT + wdev->wext.default_key =-1 ; + wdev->wext.default_mgmt_key =-1 ; + wdev->wext.connect.auth_type =NL80211_AUTHTYPE_AUTOMATIC ; +#endif + +if (wdev->wiphy->flags &WIPHY_FLAG_PS_ON_BY_DEFAULT ) + wdev->ps = true; +else + wdev->ps = false; +/* allow mac80211 to determine the timeout */ + wdev->ps_timeout =-1 ; + +if ((wdev->iftype ==NL80211_IFTYPE_STATION || + wdev->iftype ==NL80211_IFTYPE_P2P_CLIENT || + wdev->iftype ==NL80211_IFTYPE_ADHOC ) && !wdev->use_4addr) + wdev->netdev->priv_flags |=IFF_DONT_BRIDGE ; + +INIT_WORK (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); +} + +void cfg80211_register_wdev (struct cfg80211_registered_device *rdev, +struct wireless_dev *wdev) +{/* * We get here also when the interface changes network namespaces, * as it's registered into the new one, but we don't want it to
@@ -1293,6 +1316,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,switch (state) {case NETDEV_POST_INIT :SET_NETDEV_DEVTYPE (dev, &wiphy_type); + wdev->netdev = dev; +/* can only change netns with wiphy */ + dev->features |=NETIF_F_NETNS_LOCAL ; + +cfg80211_init_wdev (wdev);break ;case NETDEV_REGISTER :/*
@@ -1300,35 +1328,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,* called within code protected by it when interfaces * are added with nl80211. */ -/* can only change netns with wiphy */ - dev->features |=NETIF_F_NETNS_LOCAL ; -if (sysfs_create_link (&dev->dev.kobj, &rdev->wiphy.dev.kobj,"phy80211" )) {pr_err ("failed to add phy80211 symlink to netdev!\n" ); } - wdev->netdev = dev; -#ifdef CONFIG_CFG80211_WEXT - wdev->wext.default_key =-1 ; - wdev->wext.default_mgmt_key =-1 ; - wdev->wext.connect.auth_type =NL80211_AUTHTYPE_AUTOMATIC ; -#endif - -if (wdev->wiphy->flags &WIPHY_FLAG_PS_ON_BY_DEFAULT ) - wdev->ps = true; -else - wdev->ps = false; -/* allow mac80211 to determine the timeout */ - wdev->ps_timeout =-1 ; - -if ((wdev->iftype ==NL80211_IFTYPE_STATION || - wdev->iftype ==NL80211_IFTYPE_P2P_CLIENT || - wdev->iftype ==NL80211_IFTYPE_ADHOC ) && !wdev->use_4addr) - dev->priv_flags |=IFF_DONT_BRIDGE ; - -INIT_WORK (&wdev->disconnect_wk, cfg80211_autodisconnect_wk); -cfg80211_init_wdev (rdev, wdev); +cfg80211_register_wdev (rdev, wdev);break ;case NETDEV_GOING_DOWN :cfg80211_leave (rdev, wdev);
net/wireless/core.h +3 -2
@@ -208,8 +208,9 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);int cfg80211_switch_netns (struct cfg80211_registered_device *rdev,struct net *net); -void cfg80211_init_wdev (struct cfg80211_registered_device *rdev, -struct wireless_dev *wdev); +void cfg80211_init_wdev (struct wireless_dev *wdev); +void cfg80211_register_wdev (struct cfg80211_registered_device *rdev, +struct wireless_dev *wdev); static inline void wdev_lock(struct wireless_dev *wdev) __acquires(wdev)
net/wireless/nl80211.c +2 -1
@@ -3801,7 +3801,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)* P2P Device and NAN do not have a netdev, so don't go * through the netdev notifier and must be added here */ -cfg80211_init_wdev (rdev, wdev); +cfg80211_init_wdev (wdev); +cfg80211_register_wdev (rdev, wdev);break ;default :break ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 99/255 mac80211: always wind down STA state
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ]
When (for example) an IBSS station is pre-moved to AUTHORIZED before it's inserted, and then the insertion fails, we don't clean up the fast RX/TX states that might already have been created, since we don't go through all the state transitions again on the way down.
Do that, if it hasn't been done already, when the station is freed. I considered only freeing the fast TX/RX state there, but we might add more state so it's more robust to wind down the state properly.
Note that we warn if the station was ever inserted, it should have been properly cleaned up in that case, and the driver will probably not like things happening out of order.
--- net/mac80211/sta_info.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
net/mac80211/sta_info.c +18 -0
@@ -258,6 +258,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,*/ void sta_info_free (struct ieee80211_local *local,struct sta_info *sta) { +/* +* If we had used sta_info_pre_move_state() then we might not +* have gone through the state transitions down again, so do +* it here now (and warn if it's inserted). +* +* This will clear state such as fast TX/RX that may have been +* allocated during state transitions. +*/ +while (sta->sta_state >IEEE80211_STA_NONE ) { +int ret; + +WARN_ON_ONCE (test_sta_flag (sta,WLAN_STA_INSERTED )); + + ret =sta_info_move_state (sta, sta->sta_state -1 ); +if (WARN_ONCE (ret,"sta_info_move_state() returned %d\n" , ret)) +break ; + } +if (sta->rate_ctrl)rate_control_free_sta (sta);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 100/255 cfg80211: regulatory: Fix inconsistent format argument
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ]
Fix follow warning:
[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2) requires 'int' but the argument type is 'unsigned int'.
--- net/wireless/reg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/reg.c +1 -1
@@ -3411,7 +3411,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd) power_rule = ®_rule->power_rule;if (reg_rule->flags &NL80211_RRF_AUTO_BW ) -snprintf (bw,sizeof (bw),"%d KHz, %d KHz AUTO" , +snprintf (bw,sizeof (bw),"%d KHz, %u KHz AUTO" , freq_range->max_bandwidth_khz,reg_get_max_bandwidth (rd, reg_rule));else
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 101/255 wireguard: selftests: check that route_me_harder packets use the right sk
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 ]
If netfilter changes the packet mark, the packet is rerouted. The ip_route_me_harder family of functions fails to use the right sk, opting to instead use skb->sk, resulting in a routing loop when used with tunnels. With the next change fixing this issue in netfilter, test for the relevant condition inside our test suite, since wireguard was where the bug was discovered.
--- tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++ 2 files changed, 10 insertions(+)
tools/testing/selftests/wireguard/netns.sh +8 -0
@@ -316,6 +316,14 @@ pp sleep 3 n2 ping -W 1 -c 1 192.168.241.1 n1 wg set wg0 peer "$pub2" persistent-keepalive 0 +# Test that sk_bound_dev_if works +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 +# What about when the mark changes and the packet must be rerouted? +n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 +n1 ping -c 1 -W 1 192.168.241.2 # First the boring case +n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case +n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 + # Test that onion routing works, even when it loops n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 ip1 addr add 192.168.242.1/24 dev wg0
tools/testing/selftests/wireguard/qemu/kernel.config +2 -0
@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y CONFIG_NETFILTER_XTABLES=y CONFIG_NETFILTER_XT_NAT=y CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MARK=y CONFIG_NF_CONNTRACK_IPV4=y CONFIG_NF_NAT_IPV4=y CONFIG_IP_NF_IPTABLES=y CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_MANGLE=y CONFIG_IP_NF_NAT=y CONFIG_IP_ADVANCED_ROUTER=y CONFIG_IP_MULTIPLE_TABLES=y
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 103/255 Revert "nvme-pci: remove last_sq_tail"
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 38210800bf66d7302da1bb5b624ad68638da1562 ]
Multiple CPUs may be mapped to the same hctx, allowing mulitple submission contexts to attempt commit_rqs(). We need to verify we're not writing the same doorbell value multiple times since that's a spec violation.
Revert commit 54b2fcee1db041a83b52b51752dade6090cf952f.
--- drivers/nvme/host/pci.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
drivers/nvme/host/pci.c +19 -4
@@ -198,6 +198,7 @@ struct nvme_queue {u32 q_depth;u16 cq_vector;u16 sq_tail; +u16 last_sq_tail;u16 cq_head;u16 qid;u8 cq_phase;
@@ -455,11 +456,24 @@ static int nvme_pci_map_queues(struct blk_mq_tag_set *set)return 0 ; } -static inline void nvme_write_sq_db (struct nvme_queue *nvmeq) +/* +* Write sq tail if we are asked to, or if the next command would wrap. +*/ +static inline void nvme_write_sq_db (struct nvme_queue *nvmeq,bool write_sq) { +if (!write_sq) { +u16 next_tail = nvmeq->sq_tail +1 ; + +if (next_tail == nvmeq->q_depth) + next_tail =0 ; +if (next_tail != nvmeq->last_sq_tail) +return ; + } +if (nvme_dbbuf_update_and_check_event (nvmeq->sq_tail, nvmeq->dbbuf_sq_db, nvmeq->dbbuf_sq_ei))writel (nvmeq->sq_tail, nvmeq->q_db); + nvmeq->last_sq_tail = nvmeq->sq_tail; }/**
@@ -476,8 +490,7 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd, cmd, sizeof(*cmd));if (++nvmeq->sq_tail == nvmeq->q_depth) nvmeq->sq_tail =0 ; -if (write_sq) -nvme_write_sq_db (nvmeq); +nvme_write_sq_db (nvmeq, write_sq);spin_unlock (&nvmeq->sq_lock); }
@@ -486,7 +499,8 @@ static void nvme_commit_rqs(struct blk_mq_hw_ctx *hctx)struct nvme_queue *nvmeq = hctx->driver_data;spin_lock (&nvmeq->sq_lock); -nvme_write_sq_db (nvmeq); +if (nvmeq->sq_tail != nvmeq->last_sq_tail) +nvme_write_sq_db (nvmeq, true);spin_unlock (&nvmeq->sq_lock); }
@@ -1496,6 +1510,7 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid)struct nvme_dev *dev = nvmeq->dev; nvmeq->sq_tail =0 ; + nvmeq->last_sq_tail =0 ; nvmeq->cq_head =0 ; nvmeq->cq_phase =1 ; nvmeq->q_db = &dev->dbs[qid *2 * dev->db_stride];
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 65/255 selftests: core: use SKIP instead of XFAIL in close_range_test.c
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit 1d44d0dd61b6121b49f25b731f2f7f605cb3c896 ]
XFAIL is gone since commit 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP"), use SKIP instead.
--- tools/testing/selftests/core/close_range_test.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/core/close_range_test.c +4 -4
@@ -44,7 +44,7 @@ TEST(close_range) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
@@ -52,7 +52,7 @@ TEST(close_range) EXPECT_EQ(-1, sys_close_range(open_fds[0], open_fds[100], -1)) {if (errno ==ENOSYS ) -XFAIL (return,"close_range() syscall not supported" ); +SKIP (return,"close_range() syscall not supported" ); }EXPECT_EQ (0 ,sys_close_range (open_fds[0 ], open_fds[50 ],0 ));
@@ -108,7 +108,7 @@ TEST(close_range_unshare) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
@@ -197,7 +197,7 @@ TEST(close_range_unshare_capped) fd =open ("/dev/null" ,O_RDONLY |O_CLOEXEC ); ASSERT_GE(fd, 0) {if (errno ==ENOENT ) -XFAIL (return,"Skipping test since /dev/null does not exist" ); +SKIP (return,"Skipping test since /dev/null does not exist" ); } open_fds[i] = fd;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 102/255 tracing: Fix the checking of stackidx in __ftrace_trace_stack
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
[ Upstream commit 906695e59324635c62b5ae59df111151a546ca66 ]
The array size is FTRACE_KSTACK_NESTING, so the index FTRACE_KSTACK_NESTING is illegal too. And fix two typos by the way.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -2611,7 +2611,7 @@ trace_event_buffer_lock_reserve(struct trace_buffer **current_rb,/* * If tracing is off, but we have triggers enabled * we still need to look at the event data. Use the temp_buffer -* to store the trace event for the tigger to use. It's recusive +* to store the trace event for the trigger to use. It's recursive * safe and will not be recorded anywhere. */ if (!entry && trace_file->flags &EVENT_FILE_FL_TRIGGER_COND ) {
@@ -2934,7 +2934,7 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, stackidx =__this_cpu_inc_return (ftrace_stack_reserve) -1 ;/* This should never happen. If it does, yell once and skip */ -if (WARN_ON_ONCE (stackidx >FTRACE_KSTACK_NESTING )) +if (WARN_ON_ONCE (stackidx >=FTRACE_KSTACK_NESTING )) goto out;/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 106/255 scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 5feed64f9199ff90c4239971733f23f30aeb2484 ]
While reenabling the IRQ after irq poll there may be small time window where HBA firmware has posted some replies and raise the interrupts but driver has not received the interrupts. So we may observe I/O timeouts as the driver has not processed the replies as interrupts got missed while reenabling the IRQ.
To fix this issue the driver has to go for one more round of processing the reply descriptors from reply descriptor post queue after enabling the IRQ.
--- drivers/scsi/mpt3sas/mpt3sas_base.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/mpt3sas/mpt3sas_base.c +7 -0
@@ -1742,6 +1742,13 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget) reply_q->irq_poll_scheduled = false; reply_q->irq_line_enable = true;enable_irq (reply_q->os_irq); +/* +* Go for one more round of processing the +* reply descriptor post queue incase if HBA +* Firmware has posted some reply descriptors +* while reenabling the IRQ. +*/ +_base_process_reply_queue (reply_q); }return num_entries;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 107/255 nvme: introduce nvme_sync_io_queues
In reply to Greg Kroah-HartmanFrom: Chao Leng <[email protected]>
[ Upstream commit 04800fbff4764ab7b32c49d19628605a5d4cb85c ]
Introduce sync io queues for some scenarios which just only need sync io queues not sync all queues.
--- drivers/nvme/host/core.c | 8 ++++++-- drivers/nvme/host/nvme.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +6 -2
@@ -4641,8 +4641,7 @@ void nvme_start_queues(struct nvme_ctrl *ctrl) }EXPORT_SYMBOL_GPL (nvme_start_queues); - -void nvme_sync_queues (struct nvme_ctrl *ctrl) +void nvme_sync_io_queues (struct nvme_ctrl *ctrl) {struct nvme_ns *ns;
@@ -4650,7 +4649,12 @@ void nvme_sync_queues(struct nvme_ctrl *ctrl)list_for_each_entry (ns, &ctrl->namespaces, list)blk_sync_queue (ns->queue);up_read (&ctrl->namespaces_rwsem); +} +EXPORT_SYMBOL_GPL (nvme_sync_io_queues); +void nvme_sync_queues (struct nvme_ctrl *ctrl) +{ +nvme_sync_io_queues (ctrl);if (ctrl->admin_q)blk_sync_queue (ctrl->admin_q); }
drivers/nvme/host/nvme.h +1 -0
@@ -602,6 +602,7 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl);void nvme_start_queues (struct nvme_ctrl *ctrl);void nvme_kill_queues (struct nvme_ctrl *ctrl);void nvme_sync_queues (struct nvme_ctrl *ctrl); +void nvme_sync_io_queues (struct nvme_ctrl *ctrl);void nvme_unfreeze (struct nvme_ctrl *ctrl);void nvme_wait_freeze (struct nvme_ctrl *ctrl);int nvme_wait_freeze_timeout (struct nvme_ctrl *ctrl,long timeout);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 109/255 nvme-tcp: avoid race between time out and tear down
In reply to Greg Kroah-HartmanFrom: Chao Leng <[email protected]>
[ Upstream commit d6f66210f4b1aa2f5944f0e34e0f8db44f499f92 ]
Now use teardown_lock to serialize for time out and tear down. This may cause abnormal: first cancel all request in tear down, then time out may complete the request again, but the request may already be freed or restarted.
To avoid race between time out and tear down, in tear down process, first we quiesce the queue, and then delete the timer and cancel the time out work for the queue. At the same time we need to delete teardown_lock.
--- drivers/nvme/host/tcp.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/nvme/host/tcp.c +3 -11
@@ -124,7 +124,6 @@ struct nvme_tcp_ctrl {struct sockaddr_storage src_addr;struct nvme_ctrl ctrl; -struct mutex teardown_lock;struct work_struct err_work;struct delayed_work connect_work;struct nvme_tcp_request async_req;
@@ -1886,8 +1885,8 @@ out_free_queue:static void nvme_tcp_teardown_admin_queue (struct nvme_ctrl *ctrl,bool remove) { -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);blk_mq_quiesce_queue (ctrl->admin_q); +blk_sync_queue (ctrl->admin_q);nvme_tcp_stop_queue (ctrl,0 );if (ctrl->admin_tagset) { blk_mq_tagset_busy_iter(ctrl->admin_tagset,
@@ -1897,18 +1896,17 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,if (remove)blk_mq_unquiesce_queue (ctrl->admin_q);nvme_tcp_destroy_admin_queue (ctrl, remove); -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); }static void nvme_tcp_teardown_io_queues (struct nvme_ctrl *ctrl,bool remove) { -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);if (ctrl->queue_count <=1 ) - goto out; +return ;blk_mq_quiesce_queue (ctrl->admin_q);nvme_start_freeze (ctrl);nvme_stop_queues (ctrl); +nvme_sync_io_queues (ctrl);nvme_tcp_stop_io_queues (ctrl);if (ctrl->tagset) { blk_mq_tagset_busy_iter(ctrl->tagset,
@@ -1918,8 +1916,6 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,if (remove)nvme_start_queues (ctrl);nvme_tcp_destroy_io_queues (ctrl, remove); -out: -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); }static void nvme_tcp_reconnect_or_remove (struct nvme_ctrl *ctrl)
@@ -2171,14 +2167,11 @@ static void nvme_tcp_complete_timed_out(struct request *rq)struct nvme_tcp_request *req =blk_mq_rq_to_pdu (rq);struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl; -/* fence other contexts that may complete the command */ -mutex_lock (&to_tcp_ctrl (ctrl)->teardown_lock);nvme_tcp_stop_queue (ctrl,nvme_tcp_queue_id (req->queue));if (!blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); } -mutex_unlock (&to_tcp_ctrl (ctrl)->teardown_lock); } static enum blk_eh_timer_return
@@ -2455,7 +2448,6 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev, nvme_tcp_reconnect_ctrl_work);INIT_WORK (&ctrl->err_work, nvme_tcp_error_recovery_work);INIT_WORK (&ctrl->ctrl.reset_work, nvme_reset_ctrl_work); -mutex_init (&ctrl->teardown_lock);if (!(opts->mask &NVMF_OPT_TRSVCID )) { opts->trsvcid =
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 110/255 nvme-rdma: avoid repeated request completion
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit fdf58e02adecbef4c7cbb2073d8ea225e6fd5f26 ]
The request may be executed asynchronously, and rq->state may be changed to IDLE. To avoid repeated request completion, only MQ_RQ_COMPLETE of rq->state is checked in nvme_rdma_complete_timed_out. It is not safe, so need adding check IDLE for rq->state.
--- drivers/nvme/host/rdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/rdma.c +1 -1
@@ -1974,7 +1974,7 @@ static void nvme_rdma_complete_timed_out(struct request *rq)struct nvme_rdma_queue *queue = req->queue;nvme_rdma_stop_queue (queue); -if (!blk_mq_request_completed (rq)) { +if (blk_mq_request_started (rq) && !blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 112/255 iommu/amd: Increase interrupt remapping table limit to 512 entries
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ]
Certain device drivers allocate IO queues on a per-cpu basis. On AMD EPYC platform, which can support up-to 256 cpu threads, this can exceed the current MAX_IRQ_PER_TABLE limit of 256, and result in the error message:
AMD-Vi: Failed to allocate IRTE
This has been observed with certain NVME devices.
AMD IOMMU hardware can actually support upto 512 interrupt remapping table entries. Therefore, update the driver to match the hardware limit.
Please note that this also increases the size of interrupt remapping table to 8KB per device when using the 128-bit IRTE format.
--- drivers/iommu/amd/amd_iommu_types.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iommu/amd/amd_iommu_types.h +5 -1
@@ -406,7 +406,11 @@ extern bool amd_iommu_np_cache;/* Only true if all IOMMUs support device IOTLBs */ extern bool amd_iommu_iotlb_sup; -#define MAX_IRQS_PER_TABLE 256 +/* +* AMD IOMMU hardware only support 512 IRTEs despite +* the architectural limitation of 2048 entries. +*/ +#define MAX_IRQS_PER_TABLE 512#define IRQ_TABLE_ALIGNMENT 128struct irq_remap_table {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 111/255 nvme-tcp: avoid repeated request completion
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 0a8a2c85b83589a5c10bc5564b796836bf4b4984 ]
The request may be executed asynchronously, and rq->state may be changed to IDLE. To avoid repeated request completion, only MQ_RQ_COMPLETE of rq->state is checked in nvme_tcp_complete_timed_out. It is not safe, so need adding check IDLE for rq->state.
--- drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/tcp.c +1 -1
@@ -2168,7 +2168,7 @@ static void nvme_tcp_complete_timed_out(struct request *rq)struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;nvme_tcp_stop_queue (ctrl,nvme_tcp_queue_id (req->queue)); -if (!blk_mq_request_completed (rq)) { +if (blk_mq_request_started (rq) && !blk_mq_request_completed (rq)) {nvme_req (rq)->status =NVME_SC_HOST_ABORTED_CMD ;blk_mq_complete_request (rq); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 113/255 s390/smp: move rcu_cpu_starting() earlier
In reply to Greg Kroah-HartmanFrom: Qian Cai <[email protected]>
[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ]
The call to rcu_cpu_starting() in smp_init_secondary() is not early enough in the CPU-hotplug onlining process, which results in lockdep splats as follows:
WARNING: suspicious RCU usage
-----------------------------
kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!!
other info that might help us debug this:
RCU used illegally from offline CPU!
rcu_scheduler_active = 1, debug_locks = 1
no locks held by swapper/1/0.
Call Trace: show_stack+0x158/0x1f0 dump_stack+0x1f2/0x238 __lock_acquire+0x2640/0x4dd0 lock_acquire+0x3a8/0xd08 _raw_spin_lock_irqsave+0xc0/0xf0 clockevents_register_device+0xa8/0x528 init_cpu_timer+0x33e/0x468 smp_init_secondary+0x11a/0x328 smp_start_secondary+0x82/0x88
This is avoided by moving the call to rcu_cpu_starting up near the beginning of the smp_init_secondary() function. Note that the raw_smp_processor_id() is required in order to avoid calling into lockdep before RCU has declared the CPU to be watched for readers.
--- arch/s390/kernel/smp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/kernel/smp.c +2 -1
@@ -855,13 +855,14 @@ void __init smp_detect_cpus(void)static void smp_init_secondary (void ) { -int cpu =smp_processor_id (); +int cpu =raw_smp_processor_id (); S390_lowcore.last_update_clock =get_tod_clock ();restore_access_regs (S390_lowcore.access_regs_save_area);set_cpu_flag (CIF_ASCE_PRIMARY );set_cpu_flag (CIF_ASCE_SECONDARY );cpu_init (); +rcu_cpu_starting (cpu);preempt_disable ();init_cpu_timer ();vtime_init ();
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 115/255 vfio/pci: Bypass IGD init in case of -ENODEV
In reply to Greg Kroah-HartmanFrom: Fred Gao <[email protected]>
[ Upstream commit e4eccb853664de7bcf9518fb658f35e748bf1f68 ]
Bypass the IGD initialization when -ENODEV returns, that should be the case if opregion is not available for IGD or within discrete graphics device's option ROM, or host/lpc bridge is not found.
Then use of -ENODEV here means no special device resources found which needs special care for VFIO, but we still allow other normal device resource access.
--- drivers/vfio/pci/vfio_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci.c +1 -1
@@ -385,7 +385,7 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) pdev->vendor == PCI_VENDOR_ID_INTEL && IS_ENABLED(CONFIG_VFIO_PCI_IGD)) { ret =vfio_pci_igd_init (vdev); -if (ret) { +if (ret && ret != -ENODEV ) {pci_warn (pdev,"Failed to setup Intel IGD regions\n" ); goto disable_exit; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 117/255 amd/amdgpu: Disable VCN DPG mode for Picasso
In reply to Greg Kroah-HartmanFrom: Veerabadhran Gopalakrishnan <[email protected]>
[ Upstream commit c6d2b0fbb893d5c7dda405aa0e7bcbecf1c75f98 ]
Concurrent operation of VCN and JPEG decoder in DPG mode is causing ring timeout due to power state.
--- drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc15.c +1 -2
@@ -1220,8 +1220,7 @@ static int soc15_common_early_init(void *handle) adev->pg_flags =AMD_PG_SUPPORT_SDMA |AMD_PG_SUPPORT_MMHUB | -AMD_PG_SUPPORT_VCN | -AMD_PG_SUPPORT_VCN_DPG ; +AMD_PG_SUPPORT_VCN ; }else { adev->cg_flags =AMD_CG_SUPPORT_GFX_MGCG | AMD_CG_SUPPORT_GFX_MGLS |
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 91/255 gfs2: check for live vs. read-only file system in gfs2_fitrim
In reply to Greg Kroah-HartmanFrom: Bob Peterson <[email protected]>
[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ]
Before this patch, gfs2_fitrim was not properly checking for a "live" file system. If the file system had something to trim and the file system was read-only (or spectator) it would start the trim, but when it starts the transaction, gfs2_trans_begin returns -EROFS (read-only file system) and it errors out. However, if the file system was already trimmed so there's no work to do, it never called gfs2_trans_begin. That code is bypassed so it never returns the error. Instead, it returns a good return code with 0 work. All this makes for inconsistent behavior:
The same fstrim command can return -EROFS in one case and 0 in another. This tripped up xfstests generic/537 which reports the error as:
+fstrim with unrecovered metadata just ate your filesystem
This patch adds a check for a "live" (iow, active journal, iow, RW) file system, and if not, returns the error properly.
--- fs/gfs2/rgrp.c | 3 +++ 1 file changed, 3 insertions(+)
fs/gfs2/rgrp.c +3 -0
@@ -1374,6 +1374,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)if (!capable (CAP_SYS_ADMIN ))return -EPERM ; +if (!test_bit (SDF_JOURNAL_LIVE , &sdp->sd_flags)) +return -EROFS ; +if (!blk_queue_discard (q))return -EOPNOTSUPP ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 116/255 i2c: mediatek: move dma reset before i2c reset
In reply to Greg Kroah-HartmanFrom: Qii Wang <[email protected]>
[ Upstream commit aafced673c06b7c77040c1df42e2e965be5d0376 ]
The i2c driver default do dma reset after i2c reset, but sometimes i2c reset will trigger dma tx2rx, then apdma write data to dram which has been i2c_put_dma_safe_msg_buf(kfree). Move dma reset before i2c reset in mtk_i2c_init_hw to fix it.
--- drivers/i2c/busses/i2c-mt65xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +4 -4
@@ -475,6 +475,10 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) {u16 control_reg; +writel (I2C_DMA_HARD_RST , i2c->pdmabase +OFFSET_RST ); +udelay (50 ); +writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST ); +mtk_i2c_writew (i2c,I2C_SOFT_RST ,OFFSET_SOFTRESET );/* Set ioconfig */
@@ -529,10 +533,6 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)mtk_i2c_writew (i2c, control_reg,OFFSET_CONTROL );mtk_i2c_writew (i2c,I2C_DELAY_LEN ,OFFSET_DELAY_LEN ); - -writel (I2C_DMA_HARD_RST , i2c->pdmabase +OFFSET_RST ); -udelay (50 ); -writel (I2C_DMA_CLR_FLAG , i2c->pdmabase +OFFSET_RST ); }static const struct i2c_spec_values *mtk_i2c_get_spec (unsigned int speed)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 118/255 iomap: clean up writeback state logic on writepage error
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
[ Upstream commit 50e7d6c7a5210063b9a6f0d8799d9d1440907fcf ]
The iomap writepage error handling logic is a mash of old and slightly broken XFS writepage logic. When keepwrite writeback state tracking was introduced in XFS in commit 0d085a529b42 ("xfs: ensure WB_SYNC_ALL writeback handles partial pages correctly"), XFS had an additional cluster writeback context that scanned ahead of ->writepage() to process dirty pages over the current ->writepage() extent mapping. This context expected a dirty page and required retention of the TOWRITE tag on partial page processing so the higher level writeback context would revisit the page (in contrast to ->writepage(), which passes a page with the dirty bit already cleared).
The cluster writeback mechanism was eventually removed and some of the error handling logic folded into the primary writeback path in commit 150d5be09ce4 ("xfs: remove xfs_cancel_ioend"). This patch accidentally conflated the two contexts by using the keepwrite logic in ->writepage() without accounting for the fact that the page is not dirty. Further, the keepwrite logic has no practical effect on the core ->writepage() caller (write_cache_pages()) because it never revisits a page in the current function invocation.
Technically, the page should be redirtied for the keepwrite logic to have any effect. Otherwise, write_cache_pages() may find the tagged page but will skip it since it is clean. Even if the page was redirtied, however, there is still no practical effect to keepwrite since write_cache_pages() does not wrap around within a single invocation of the function. Therefore, the dirty page would simply end up retagged on the next writeback sequence over the associated range.
All that being said, none of this really matters because redirtying a partially processed page introduces a potential infinite redirty -> writeback failure loop that deviates from the current design principle of clearing the dirty state on writepage failure to avoid building up too much dirty, unreclaimable memory on the system. Therefore, drop the spurious keepwrite usage and dirty state clearing logic from iomap_writepage_map(), treat the partially processed page the same as a fully processed page, and let the imminent ioend failure clean up the writeback state.
--- fs/iomap/buffered-io.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
fs/iomap/buffered-io.c +2 -13
@@ -1395,6 +1395,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,WARN_ON_ONCE (!wpc->ioend && !list_empty (&submit_list));WARN_ON_ONCE (!PageLocked (page));WARN_ON_ONCE (PageWriteback (page)); +WARN_ON_ONCE (PageDirty (page));/* * We cannot cancel the ioend directly here on error. We may have
@@ -1415,21 +1416,9 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,unlock_page (page); goto done; } - -/* -* If the page was not fully cleaned, we need to ensure that the -* higher layers come back to it correctly. That means we need -* to keep the page dirty, and for WB_SYNC_ALL writeback we need -* to ensure the PAGECACHE_TAG_TOWRITE index mark is not removed -* so another attempt to write this page in this writeback sweep -* will be made. -*/ -set_page_writeback_keepwrite (page); - }else { -clear_page_dirty_for_io (page); -set_page_writeback (page); } +set_page_writeback (page);unlock_page (page);/*
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 92/255 scsi: hpsa: Fix memory leak in hpsa_init_one()
In reply to Greg Kroah-HartmanFrom: Keita Suzuki <[email protected]>
[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ]
When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is missing a free() in the error handler.
Fix this by adding free() when hpsa_scsi_add_host() fails.
--- drivers/scsi/hpsa.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/hpsa.c +3 -1
@@ -8854,7 +8854,7 @@ reinit_after_soft_reset:/* hook into SCSI subsystem */ rc =hpsa_scsi_add_host (h);if (rc) - goto clean7;/* perf, sg, cmd, irq, shost, pci, lu, aer/h */ + goto clean8;/* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ /* Monitor the controller for firmware lockups */ h->heartbeat_sample_interval =HEARTBEAT_SAMPLE_INTERVAL ;
@@ -8869,6 +8869,8 @@ reinit_after_soft_reset: HPSA_EVENT_MONITOR_INTERVAL);return 0 ; +clean8:/* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ +kfree (h->lastlogicals); clean7:/* perf, sg, cmd, irq, shost, pci, lu, aer/h */ hpsa_free_performant_mode (h); h->access.set_intr_mask (h,HPSA_INTR_OFF );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 120/255 arm64: kexec_file: try more regions if loading segments fails
In reply to Greg Kroah-HartmanFrom: Benjamin Gwin <[email protected]>
[ Upstream commit 108aa503657ee2fe8aa071dc620d96372c252ecd ]
It's possible that the first region picked for the new kernel will make it impossible to fit the other segments in the required 32GB window, especially if we have a very large initrd.
Instead of giving up, we can keep testing other regions for the kernel until we find one that works.
--- arch/arm64/kernel/kexec_image.c | 41 +++++++++++++++++++------- arch/arm64/kernel/machine_kexec_file.c | 9 +++++- 2 files changed, 39 insertions(+), 11 deletions(-)
arch/arm64/kernel/kexec_image.c +31 -10
@@ -43,7 +43,7 @@ static void *image_load(struct kimage *image,u64 flags, value;bool be_image, be_kernel;struct kexec_buf kbuf; -unsigned long text_offset; +unsigned long text_offset, kernel_segment_number;struct kexec_segment *kernel_segment;int ret;
@@ -88,11 +88,37 @@ static void *image_load(struct kimage *image,/* Adjust kernel segment with TEXT_OFFSET */ kbuf.memsz += text_offset; - ret =kexec_add_buffer (&kbuf); -if (ret) + kernel_segment_number = image->nr_segments; + +/* +* The location of the kernel segment may make it impossible to satisfy +* the other segment requirements, so we try repeatedly to find a +* location that will work. +*/ +while ((ret =kexec_add_buffer (&kbuf)) ==0 ) { +/* Try to load additional data */ + kernel_segment = &image->segment[kernel_segment_number]; + ret =load_other_segments (image, kernel_segment->mem, + kernel_segment->memsz, initrd, + initrd_len, cmdline); +if (!ret) +break ; + +/* +* We couldn't find space for the other segments; erase the +* kernel segment and try the next available hole. +*/ + image->nr_segments -=1 ; + kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz; + kbuf.mem =KEXEC_BUF_MEM_UNKNOWN ; + } + +if (ret) { +pr_err ("Could not find any suitable kernel location!" );return ERR_PTR (ret); + } - kernel_segment = &image->segment[image->nr_segments -1 ]; + kernel_segment = &image->segment[kernel_segment_number]; kernel_segment->mem += text_offset; kernel_segment->memsz -= text_offset; image->start = kernel_segment->mem;
@@ -101,12 +127,7 @@ static void *image_load(struct kimage *image, kernel_segment->mem, kbuf.bufsz, kernel_segment->memsz); -/* Load additional data */ - ret =load_other_segments (image, - kernel_segment->mem, kernel_segment->memsz, - initrd, initrd_len, cmdline); - -return ERR_PTR (ret); +return 0 ; }#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG
arch/arm64/kernel/machine_kexec_file.c +8 -1
@@ -242,6 +242,11 @@ static int prepare_elf_headers(void **addr, unsigned long *sz)return ret; } +/* +* Tries to add the initrd and DTB to the image. If it is not possible to find +* valid locations, this function will undo changes to the image and return non +* zero. +*/ int load_other_segments(struct kimage *image, unsigned long kernel_load_addr, unsigned long kernel_size,
@@ -250,7 +255,8 @@ int load_other_segments(struct kimage *image, {struct kexec_buf kbuf;void *headers, *dtb =NULL ; -unsigned long headers_sz, initrd_load_addr =0 , dtb_len; +unsigned long headers_sz, initrd_load_addr =0 , dtb_len, + orig_segments = image->nr_segments;int ret =0 ; kbuf.image = image;
@@ -336,6 +342,7 @@ int load_other_segments(struct kimage *image,return 0 ; out_err: + image->nr_segments = orig_segments;vfree (dtb);return ret; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 94/255 drm/amd/pm: correct the baco reset sequence for CI ASICs
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit c108725ef589af462be6b957f63c7925e38213eb ]
Correct some registers bitmasks and add mmBIOS_SCRATCH_7 reset.
--- drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c +4 -3
@@ -142,12 +142,12 @@ static const struct baco_cmd_entry exit_baco_tbl[] = { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_BCLK_OFF_MASK, BACO_CNTL__BACO_BCLK_OFF__SHIFT, 0, 0x00 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_POWER_OFF_MASK, BACO_CNTL__BACO_POWER_OFF__SHIFT, 0, 0x00 }, { CMD_DELAY_MS, 0, 0, 0, 20, 0 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x20 }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x200 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ISO_DIS_MASK, BACO_CNTL__BACO_ISO_DIS__SHIFT, 0, 0x01 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c00 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ANA_ISO_DIS_MASK, BACO_CNTL__BACO_ANA_ISO_DIS__SHIFT, 0, 0x01 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_RESET_EN_MASK, BACO_CNTL__BACO_RESET_EN__SHIFT, 0, 0x00 }, - { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x10 }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x100 }, { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_EN_MASK, BACO_CNTL__BACO_EN__SHIFT, 0, 0x00 }, { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__BACO_MODE_MASK, 0, 0xffffffff, 0x00 } };
@@ -155,6 +155,7 @@ static const struct baco_cmd_entry exit_baco_tbl[] =static const struct baco_cmd_entry clean_baco_tbl[] = { {CMD_WRITE , mmBIOS_SCRATCH_6,0 ,0 ,0 ,0 }, + {CMD_WRITE , mmBIOS_SCRATCH_7,0 ,0 ,0 ,0 }, {CMD_WRITE , mmCP_PFP_UCODE_ADDR,0 ,0 ,0 ,0 } };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 96/255 drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ]
This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu:
Fix bug where DPM is not enabled after hibernate and resume"). It was intended to fix Hawaii S4(hibernation) issue but break S3. As ixFEATURE_STATUS is filled with garbage data on resume which can be only cleared by reloading smc firmware(but that will involve many changes). So, we will revert this S4 fix and seek a new way.
--- drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +1 -4
@@ -2726,10 +2726,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)static bool ci_is_dpm_running (struct pp_hwmgr *hwmgr) { -return (1 ==PHM_READ_INDIRECT_FIELD (hwmgr->device, -CGS_IND_REG__SMC ,FEATURE_STATUS , -VOLTAGE_CONTROLLER_ON )) - ? true : false; +return ci_is_smc_ram_running (hwmgr); }static int ci_smu_init (struct pp_hwmgr *hwmgr)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 88/255 x86/boot/compressed/64: Introduce sev_status
In reply to Greg Kroah-HartmanFrom: Joerg Roedel <[email protected]>
[ Upstream commit 3ad84246a4097010f3ae3d6944120c0be00e9e7a ]
Introduce sev_status and initialize it together with sme_me_mask to have an indicator which SEV features are enabled.
--- arch/x86/boot/compressed/mem_encrypt.S | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/x86/boot/compressed/mem_encrypt.S +15 -1
@@ -81,6 +81,19 @@ SYM_FUNC_START(set_sev_encryption_mask) bts %rax, sme_me_mask(%rip) /* Create the encryption mask */ + /* + * Read MSR_AMD64_SEV again and store it to sev_status. Can't do this in + * get_sev_encryption_bit() because this function is 32-bit code and + * shared between 64-bit and 32-bit boot path. + */ + movl $MSR_AMD64_SEV, %ecx /* Read the SEV MSR */ + rdmsr + + /* Store MSR value in sev_status */ + shlq $32, %rdx + orq %rdx, %rax + movq %rax, sev_status(%rip) + .Lno_sev_mask: movq %rbp, %rsp /* Restore original stack pointer */
@@ -96,5 +109,6 @@ SYM_FUNC_END(set_sev_encryption_mask) #ifdef CONFIG_AMD_MEM_ENCRYPT .balign 8 -SYM_DATA(sme_me_mask, .quad 0) +SYM_DATA(sme_me_mask, .quad 0) +SYM_DATA(sev_status, .quad 0) #endif
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 95/255 drm/amd/pm: perform SMC reset on suspend/hibernation
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ]
So that the succeeding resume can be performed based on a clean state.
--- .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++ drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++ .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++ drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++ 5 files changed, 39 insertions(+)
drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +4 -0
@@ -1541,6 +1541,10 @@ static int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)PP_ASSERT_WITH_CODE ((tmp_result ==0 ),"Failed to reset to default!" , result = tmp_result); + tmp_result =smum_stop_smc (hwmgr); +PP_ASSERT_WITH_CODE ((tmp_result ==0 ), +"Failed to stop smc!" , result = tmp_result); + tmp_result =smu7_force_switch_to_arbf0 (hwmgr);PP_ASSERT_WITH_CODE ((tmp_result ==0 ),"Failed to force to switch arbf0!" , result = tmp_result);
drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +1 -0
@@ -229,6 +229,7 @@ struct pp_smumgr_func {bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr);int (*update_dpm_settings)(struct pp_hwmgr *hwmgr,void *profile_setting);int (*smc_table_manager)(struct pp_hwmgr *hwmgr,uint8_t *table,uint16_t table_id,bool rw);/*rw: true for read, false for write */ +int (*stop_smc)(struct pp_hwmgr *hwmgr); };struct pp_hwmgr_func {
drivers/gpu/drm/amd/powerplay/inc/smumgr.h +2 -0
@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settinextern int smum_smc_table_manager (struct pp_hwmgr *hwmgr,uint8_t *table,uint16_t table_id,bool rw); +extern int smum_stop_smc (struct pp_hwmgr *hwmgr); +#endif
drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +24 -0
@@ -2939,6 +2939,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type)return 0 ; } +static void ci_reset_smc (struct pp_hwmgr *hwmgr) +{ +PHM_WRITE_INDIRECT_FIELD (hwmgr->device,CGS_IND_REG__SMC , +SMC_SYSCON_RESET_CNTL , + rst_reg,1 ); +} + + +static void ci_stop_smc_clock (struct pp_hwmgr *hwmgr) +{ +PHM_WRITE_INDIRECT_FIELD (hwmgr->device,CGS_IND_REG__SMC , +SMC_SYSCON_CLOCK_CNTL_0 , + ck_disable,1 ); +} + +static int ci_stop_smc (struct pp_hwmgr *hwmgr) +{ +ci_reset_smc (hwmgr); +ci_stop_smc_clock (hwmgr); + +return 0 ; +} +const struct pp_smumgr_func ci_smu_funcs = { .name ="ci_smu" , .smu_init = ci_smu_init,
@@ -2964,4 +2987,5 @@ const struct pp_smumgr_func ci_smu_funcs = { .is_dpm_running = ci_is_dpm_running, .update_dpm_settings = ci_update_dpm_settings, .update_smc_table = ci_update_smc_table, + .stop_smc = ci_stop_smc, };
drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +8 -0
@@ -245,3 +245,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tablreturn -EINVAL ; } + +int smum_stop_smc (struct pp_hwmgr *hwmgr) +{ +if (hwmgr->smumgr_funcs->stop_smc) +return hwmgr->smumgr_funcs->stop_smc (hwmgr); + +return 0 ; +}
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 97/255 mac80211: fix use of skb payload instead of header
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ]
When ieee80211_skb_resize() is called from ieee80211_build_hdr() the skb has no 802.11 header yet, in fact it consist only of the payload as the ethernet frame is removed. As such, we're using the payload data for ieee80211_is_mgmt(), which is of course completely wrong. This didn't really hurt us because these are always data frames, so we could only have added more tailroom than we needed if we determined it was a management frame and sdata->crypto_tx_tailroom_needed_cnt was false.
However, syzbot found that of course there need not be any payload, so we're using at best uninitialized memory for the check.
Fix this to pass explicitly the kind of frame that we have instead of checking there, by replacing the "bool may_encrypt" argument with an argument that can carry the three possible states - it's not going to be encrypted, it's a management frame, or it's a data frame (and then we check sdata->crypto_tx_tailroom_needed_cnt).
--- net/mac80211/tx.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
net/mac80211/tx.c +24 -13
@@ -1938,19 +1938,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,/* device xmit handlers */ +enum ieee80211_encrypt { +ENCRYPT_NO , +ENCRYPT_MGMT , +ENCRYPT_DATA , +}; +static int ieee80211_skb_resize (struct ieee80211_sub_if_data *sdata,struct sk_buff *skb, -int head_need,bool may_encrypt) +int head_need, +enum ieee80211_encrypt encrypt) {struct ieee80211_local *local = sdata->local; -struct ieee80211_hdr *hdr;bool enc_tailroom;int tail_need =0 ; - hdr = (struct ieee80211_hdr *) skb->data; - enc_tailroom = may_encrypt && - (sdata->crypto_tx_tailroom_needed_cnt || -ieee80211_is_mgmt (hdr->frame_control)); + enc_tailroom = encrypt ==ENCRYPT_MGMT || + (encrypt ==ENCRYPT_DATA && + sdata->crypto_tx_tailroom_needed_cnt);if (enc_tailroom) { tail_need =IEEE80211_ENCRYPT_TAILROOM ;
@@ -1981,23 +1986,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, {struct ieee80211_local *local = sdata->local;struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb); -struct ieee80211_hdr *hdr; +struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;int headroom; -bool may_encrypt; +enum ieee80211_encrypt encrypt; - may_encrypt = !(info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT ); +if (info->flags &IEEE80211_TX_INTFL_DONT_ENCRYPT ) + encrypt =ENCRYPT_NO ; +else if (ieee80211_is_mgmt (hdr->frame_control)) + encrypt =ENCRYPT_MGMT ; +else + encrypt =ENCRYPT_DATA ; headroom = local->tx_headroom; -if (may_encrypt) +if (encrypt !=ENCRYPT_NO ) headroom += sdata->encrypt_headroom; headroom -=skb_headroom (skb); headroom =max_t (int,0 , headroom); -if (ieee80211_skb_resize (sdata, skb, headroom, may_encrypt)) { +if (ieee80211_skb_resize (sdata, skb, headroom, encrypt)) {ieee80211_free_txskb (&local->hw, skb);return ; } +/* reload after potential resize */ hdr = (struct ieee80211_hdr *) skb->data; info->control.vif = &sdata->vif;
@@ -2822,7 +2833,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, head_need += sdata->encrypt_headroom; head_need += local->tx_headroom; head_need =max_t (int,0 , head_need); -if (ieee80211_skb_resize (sdata, skb, head_need, true)) { +if (ieee80211_skb_resize (sdata, skb, head_need,ENCRYPT_DATA )) {ieee80211_free_txskb (&local->hw, skb); skb =NULL ;return ERR_PTR (-ENOMEM );
@@ -3496,7 +3507,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,if (unlikely (ieee80211_skb_resize (sdata, skb,max_t (int, extra_head + hw_headroom -skb_headroom (skb),0 ), - false))) { +ENCRYPT_NO ))) {kfree_skb (skb);return true; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 122/255 i2c: sh_mobile: implement atomic transfers
In reply to Greg Kroah-HartmanFrom: Ulrich Hecht <[email protected]>
[ Upstream commit a49cc1fe9d64a2dc4e19b599204f403e5d25f44b ]
Implements atomic transfers to fix reboot/shutdown on r8a7790 Lager and similar boards.
--- drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++++++++++++++++++------- 1 file changed, 66 insertions(+), 20 deletions(-)
drivers/i2c/busses/i2c-sh_mobile.c +66 -20
@@ -129,6 +129,7 @@ struct sh_mobile_i2c_data {int sr;bool send_stop;bool stop_after_dma; +bool atomic_xfer;struct resource *res;struct dma_chan *dma_tx;
@@ -330,13 +331,15 @@ static unsigned char i2c_op(struct sh_mobile_i2c_data *pd, enum sh_mobile_i2c_op ret =iic_rd (pd,ICDR );break ;case OP_RX_STOP :/* enable DTE interrupt, issue stop */ -iic_wr (pd,ICIC , -ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); +if (!pd->atomic_xfer) +iic_wr (pd,ICIC , +ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE );iic_wr (pd,ICCR ,ICCR_ICE |ICCR_RACK );break ;case OP_RX_STOP_DATA :/* enable DTE interrupt, read data, issue stop */ -iic_wr (pd,ICIC , -ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); +if (!pd->atomic_xfer) +iic_wr (pd,ICIC , +ICIC_DTEE |ICIC_WAITE |ICIC_ALE |ICIC_TACKE ); ret =iic_rd (pd,ICDR );iic_wr (pd,ICCR ,ICCR_ICE |ICCR_RACK );break ;
@@ -429,7 +432,8 @@ static irqreturn_t sh_mobile_i2c_isr(int irq, void *dev_id)if (wakeup) { pd->sr |=SW_DONE ; -wake_up (&pd->wait); +if (!pd->atomic_xfer) +wake_up (&pd->wait); }/* defeat write posting to avoid spurious WAIT interrupts */
@@ -581,6 +585,9 @@ static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg, pd->pos =-1 ; pd->sr =0 ; +if (pd->atomic_xfer) +return ; + pd->dma_buf =i2c_get_dma_safe_msg_buf (pd->msg,8 );if (pd->dma_buf)sh_mobile_i2c_xfer_dma (pd);
@@ -637,15 +644,13 @@ static int poll_busy(struct sh_mobile_i2c_data *pd)return i ?0 : -ETIMEDOUT ; } -static int sh_mobile_i2c_xfer (struct i2c_adapter *adapter, -struct i2c_msg *msgs, -int num) +static int sh_mobile_xfer (struct sh_mobile_i2c_data *pd, +struct i2c_msg *msgs,int num) { -struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter);struct i2c_msg *msg;int err =0 ;int i; -long timeout; +long time_left;/* Wake up device and enable clock */ pm_runtime_get_sync (pd->dev);
@@ -662,15 +667,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,if (do_start)i2c_op (pd,OP_START ); -/* The interrupt handler takes care of the rest... */ - timeout =wait_event_timeout (pd->wait, - pd->sr & (ICSR_TACK |SW_DONE ), - adapter->timeout); - -/* 'stop_after_dma' tells if DMA transfer was complete */ -i2c_put_dma_safe_msg_buf (pd->dma_buf, pd->msg, pd->stop_after_dma); +if (pd->atomic_xfer) { +unsigned long j = jiffies + pd->adap.timeout; + + time_left =time_before_eq (jiffies, j); +while (time_left && + !(pd->sr & (ICSR_TACK |SW_DONE ))) { +unsigned char sr =iic_rd (pd,ICSR ); + +if (sr & (ICSR_AL |ICSR_TACK | +ICSR_WAIT |ICSR_DTE )) { +sh_mobile_i2c_isr (0 , pd); +udelay (150 ); + }else { +cpu_relax (); + } + time_left =time_before_eq (jiffies, j); + } + }else { +/* The interrupt handler takes care of the rest... */ + time_left =wait_event_timeout (pd->wait, + pd->sr & (ICSR_TACK |SW_DONE ), + pd->adap.timeout); + +/* 'stop_after_dma' tells if DMA xfer was complete */ +i2c_put_dma_safe_msg_buf (pd->dma_buf, pd->msg, + pd->stop_after_dma); + } -if (!timeout) { +if (!time_left) {dev_err (pd->dev,"Transfer request timed out\n" );if (pd->dma_direction !=DMA_NONE )sh_mobile_i2c_cleanup_dma (pd);
@@ -696,14 +721,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,return err ?: num; } +static int sh_mobile_i2c_xfer (struct i2c_adapter *adapter, +struct i2c_msg *msgs, +int num) +{ +struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter); + + pd->atomic_xfer = false; +return sh_mobile_xfer (pd, msgs, num); +} + +static int sh_mobile_i2c_xfer_atomic (struct i2c_adapter *adapter, +struct i2c_msg *msgs, +int num) +{ +struct sh_mobile_i2c_data *pd =i2c_get_adapdata (adapter); + + pd->atomic_xfer = true; +return sh_mobile_xfer (pd, msgs, num); +} +static u32 sh_mobile_i2c_func (struct i2c_adapter *adapter) {return I2C_FUNC_I2C |I2C_FUNC_SMBUS_EMUL |I2C_FUNC_PROTOCOL_MANGLING ; }static const struct i2c_algorithm sh_mobile_i2c_algorithm = { - .functionality = sh_mobile_i2c_func, - .master_xfer = sh_mobile_i2c_xfer, + .functionality = sh_mobile_i2c_func, + .master_xfer = sh_mobile_i2c_xfer, + .master_xfer_atomic = sh_mobile_i2c_xfer_atomic, };static const struct i2c_adapter_quirks sh_mobile_i2c_quirks = {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 132/255 bpf: Dont rely on GCC __attribute__((optimize)) to disable GCSE
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 080b6f40763565f65ebb9540219c71ce885cf568 ]
Commit 3193c0836 ("bpf: Disable GCC -fgcse optimization for ___bpf_prog_run()") introduced a __no_fgcse macro that expands to a function scope __attribute__((optimize("-fno-gcse"))), to disable a GCC specific optimization that was causing trouble on x86 builds, and was not expected to have any positive effect in the first place.
However, as the GCC manual documents, __attribute__((optimize)) is not for production use, and results in all other optimization options to be forgotten for the function in question. This can cause all kinds of trouble, but in one particular reported case, it causes -fno-asynchronous-unwind-tables to be disregarded, resulting in .eh_frame info to be emitted for the function.
This reverts commit 3193c0836, and instead, it disables the -fgcse optimization for the entire source file, but only when building for X86 using GCC with CONFIG_BPF_JIT_ALWAYS_ON disabled. Note that the original commit states that CONFIG_RETPOLINE=n triggers the issue, whereas CONFIG_RETPOLINE=y performs better without the optimization, so it is kept disabled in both cases.
--- include/linux/compiler-gcc.h | 2 -- include/linux/compiler_types.h | 4 ---- kernel/bpf/Makefile | 6 +++++- kernel/bpf/core.c | 2 +- 4 files changed, 6 insertions(+), 8 deletions(-)
include/linux/compiler-gcc.h +0 -2
@@ -175,5 +175,3 @@#else #define __diag_GCC_8 (s)#endif - -#define __no_fgcse __attribute__((optimize("-fno-gcse")))
include/linux/compiler_types.h +0 -4
@@ -247,10 +247,6 @@ struct ftrace_likely_data {#define asm_inline asm#endif -#ifndef __no_fgcse -# define __no_fgcse -#endif -/* Are two types/vars the same type (ignoring qualifiers)? */ #define __same_type (a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
kernel/bpf/Makefile +5 -1
@@ -1,6 +1,10 @@ # SPDX-License-Identifier: GPL-2.0 obj-y := core.o -CFLAGS_core.o += $(call cc-disable-warning, override-init) +ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y) +# ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details +cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse +endif +CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy) obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o bpf_iter.o map_iter.o task_iter.o prog_iter.o obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
kernel/bpf/core.c +1 -1
@@ -1364,7 +1364,7 @@ u64 __weak bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr)* * Decode and execute eBPF instructions. */ -static u64 __no_fgcse ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) +static u64 ___bpf_prog_run (u64 *regs,const struct bpf_insn *insn,u64 *stack) {#define BPF_INSN_2_LBL (x, y) [BPF_##x | BPF_##y] = &&x##_##y#define BPF_INSN_3_LBL (x, y, z) [BPF_##x | BPF_##y | BPF_##z] = &&x##_##y##_##z
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 133/255 libbpf, hashmap: Fix undefined behavior in hash_bits
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 7a078d2d18801bba7bde7337a823d7342299acf7 ]
If bits is 0, the case when the map is empty, then the >> is the size of the register which is undefined behavior - on x86 it is the same as a shift by 0.
Fix by handling the 0 case explicitly and guarding calls to hash_bits for empty maps in hashmap__for_each_key_entry and hashmap__for_each_entry_safe.
--- tools/lib/bpf/hashmap.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
tools/lib/bpf/hashmap.h +9 -6
@@ -15,6 +15,9 @@static inline size_t hash_bits (size_t h,int bits) {/* shuffle bits and return requested number of upper bits */ +if (bits ==0 ) +return 0 ; +#if (__SIZEOF_SIZE_T__ == __SIZEOF_LONG_LONG__)/* LP64 case */ return (h *11400714819323198485llu ) >> (__SIZEOF_LONG_LONG__ *8 - bits);
@@ -162,17 +165,17 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value);* @key: key to iterate entries for */ #define hashmap__for_each_key_entry (map, cur, _key) \ - for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ - map->cap_bits); \ - map->buckets ? map->buckets[bkt] : NULL; }); \ + for (cur = map->buckets \ + ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ + : NULL; \ cur; \ cur = cur->next) \ if (map->equal_fn(cur->key, (_key), map->ctx))#define hashmap__for_each_key_entry_safe (map, cur, tmp, _key) \ - for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ - map->cap_bits); \ - cur = map->buckets ? map->buckets[bkt] : NULL; }); \ + for (cur = map->buckets \ + ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ + : NULL; \ cur && ({ tmp = cur->next; true; }); \ cur = tmp) \ if (map->equal_fn(cur->key, (_key), map->ctx))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 134/255 pinctrl: mcp23s08: Use full chunk of memory for regmap configuration
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 2b12c13637134897ba320bd8906a8d918ee7069b ]
It appears that simplification of mcp23s08_spi_regmap_init() made a regression due to wrong size calculation for dev_kmemdup() call. It misses the fact that config variable is already a pointer, thus the sizeof() calculation is wrong and only 4 or 8 bytes were copied.
Fix the parameters to devm_kmemdup() to copy a full chunk of memory.
--- drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-mcp23s08_spi.c +1 -1
@@ -119,7 +119,7 @@ static int mcp23s08_spi_regmap_init(struct mcp23s08 *mcp, struct device *dev,return -EINVAL ; } - copy =devm_kmemdup (dev, &config,sizeof (config),GFP_KERNEL ); + copy =devm_kmemdup (dev, config,sizeof (*config),GFP_KERNEL );if (!copy)return -ENOMEM ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 137/255 net/mlx5e: Protect encap route dev from concurrent release
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit 78c906e430b13d30a8cfbdef4ccbbe1686841a9e ]
In functions mlx5e_route_lookup_ipv{4|6}() route_dev can be arbitrary net device and not necessary mlx5 eswitch port representor. As such, in order to ensure that route_dev is not destroyed concurrent the code needs either explicitly take reference to the device before releasing reference to rtable instance or ensure that caller holds rtnl lock. First approach is chosen as a fix since rtnl lock dependency was intentionally removed from mlx5 TC layer.
To prevent unprotected usage of route_dev in encap code take a reference to the device before releasing rt. Don't save direct pointer to the device in mlx5_encap_entry structure and use ifindex instead. Modify users of route_dev pointer to properly obtain the net device instance from its ifindex.
--- .../ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +- .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 72 ++++++++++++------- .../net/ethernet/mellanox/mlx5/core/en_rep.h | 2 +- 3 files changed, 52 insertions(+), 28 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c +5 -1
@@ -107,12 +107,16 @@ void mlx5e_rep_update_flows(struct mlx5e_priv *priv,mlx5e_tc_encap_flows_del (priv, e, &flow_list);if (neigh_connected && !(e->flags &MLX5_ENCAP_ENTRY_VALID )) { +struct net_device *route_dev; +ether_addr_copy (e->h_dest, ha);ether_addr_copy (eth->h_dest, ha);/* Update the encap source mac, in case that we delete * the flows when encap source mac changed. */ -ether_addr_copy (eth->h_source, e->route_dev->dev_addr); + route_dev =__dev_get_by_index (dev_net (priv->netdev), e->route_dev_ifindex); +if (route_dev) +ether_addr_copy (eth->h_source, route_dev->dev_addr);mlx5e_tc_encap_flows_add (priv, e, &flow_list); }
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +46 -26
161 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/en_rep.h +1 -1
@@ -187,7 +187,7 @@ struct mlx5e_encap_entry {unsigned char h_dest[ETH_ALEN ];/* destination eth addr */ struct net_device *out_dev; -struct net_device *route_dev; +int route_dev_ifindex;struct mlx5e_tc_tunnel *tunnel;int reformat_type;u8 flags;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 138/255 net/mlx5e: Use spin_lock_bh for async_icosq_lock
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit f42139ba49791ab6b12443c60044872705b74a1e ]
async_icosq_lock may be taken from softirq and non-softirq contexts. It requires protection with spin_lock_bh, otherwise a softirq may be triggered in the middle of the critical section, and it may deadlock if it tries to take the same lock. This patch fixes such a scenario by using spin_lock_bh to disable softirqs on that CPU while inside the critical section.
--- .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 4 ++-- .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 4 ++-- .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 14 +++++++------- 3 files changed, 11 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +2 -2
@@ -122,9 +122,9 @@ void mlx5e_activate_xsk(struct mlx5e_channel *c)set_bit (MLX5E_RQ_STATE_ENABLED , &c->xskrq.state);/* TX queue is created active. */ -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock);mlx5e_trigger_irq (&c->async_icosq); -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock); }void mlx5e_deactivate_xsk (struct mlx5e_channel *c)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +2 -2
@@ -36,9 +36,9 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags)if (test_and_set_bit (MLX5E_SQ_STATE_PENDING_XSK_TX , &c->async_icosq.state))return 0 ; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock);mlx5e_trigger_irq (&c->async_icosq); -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock); }return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +7 -7
@@ -188,7 +188,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c, err =0 ; sq = &c->async_icosq; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock); cseg =post_static_params (sq, priv_rx);if (IS_ERR (cseg))
@@ -199,7 +199,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c,mlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); unlock: -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock);return err;
@@ -265,10 +265,10 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,BUILD_BUG_ON (MLX5E_KTLS_GET_PROGRESS_WQEBBS !=1 ); -spin_lock (&sq->channel->async_icosq_lock); +spin_lock_bh (&sq->channel->async_icosq_lock);if (unlikely (!mlx5e_wqc_has_room_for (&sq->wq, sq->cc, sq->pc,1 ))) { -spin_unlock (&sq->channel->async_icosq_lock); +spin_unlock_bh (&sq->channel->async_icosq_lock); err = -ENOSPC ; goto err_dma_unmap; }
@@ -299,7 +299,7 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq,icosq_fill_wi (sq, pi, &wi); sq->pc++;mlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); -spin_unlock (&sq->channel->async_icosq_lock); +spin_unlock_bh (&sq->channel->async_icosq_lock);return 0 ;
@@ -360,7 +360,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rx err =0 ; sq = &c->async_icosq; -spin_lock (&c->async_icosq_lock); +spin_lock_bh (&c->async_icosq_lock); cseg =post_static_params (sq, priv_rx);if (IS_ERR (cseg)) {
@@ -372,7 +372,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rxmlx5e_notify_hw (&sq->wq, sq->pc, sq->uar_map, cseg); priv_rx->stats->tls_resync_res_ok++; unlock: -spin_unlock (&c->async_icosq_lock); +spin_unlock_bh (&c->async_icosq_lock);return err; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 93/255 drm/amdgpu: perform srbm soft reset always on SDMA resume
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ]
This can address the random SDMA hang after pci config reset seen on Hawaii.
--- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik_sdma.c +12 -15
@@ -1071,22 +1071,19 @@ static int cik_sdma_soft_reset(void *handle) {u32 srbm_soft_reset =0 ;struct amdgpu_device *adev = (struct amdgpu_device *)handle; -u32 tmp =RREG32 (mmSRBM_STATUS2); +u32 tmp; -if (tmp &SRBM_STATUS2__SDMA_BUSY_MASK ) { -/* sdma0 */ - tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET ); - tmp |=SDMA0_F32_CNTL__HALT_MASK ; -WREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET , tmp); - srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK ; - } -if (tmp &SRBM_STATUS2__SDMA1_BUSY_MASK ) { -/* sdma1 */ - tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET ); - tmp |=SDMA0_F32_CNTL__HALT_MASK ; -WREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET , tmp); - srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK ; - } +/* sdma0 */ + tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET ); + tmp |=SDMA0_F32_CNTL__HALT_MASK ; +WREG32 (mmSDMA0_F32_CNTL +SDMA0_REGISTER_OFFSET , tmp); + srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK ; + +/* sdma1 */ + tmp =RREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET ); + tmp |=SDMA0_F32_CNTL__HALT_MASK ; +WREG32 (mmSDMA0_F32_CNTL +SDMA1_REGISTER_OFFSET , tmp); + srbm_soft_reset |=SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK ;if (srbm_soft_reset) { tmp =RREG32 (mmSRBM_SOFT_RESET);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 123/255 i2c: designware: call i2c_dw_read_clear_intrbits_slave() once
In reply to Greg Kroah-HartmanFrom: Michael Wu <[email protected]>
[ Upstream commit 66b92313e2ca9208b5f3ebf5d86e9a818299d8fa ]
If some bits were cleared by i2c_dw_read_clear_intrbits_slave() in i2c_dw_isr_slave() and not handled immediately, those cleared bits would not be shown again by later i2c_dw_read_clear_intrbits_slave(). They therefore were forgotten to be handled.
i2c_dw_read_clear_intrbits_slave() should be called once in an ISR and take its returned state for all later handlings.
--- drivers/i2c/busses/i2c-designware-slave.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/i2c/busses/i2c-designware-slave.c +1 -6
@@ -159,7 +159,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)u32 raw_stat, stat, enabled, tmp;u8 val =0 , slave_activity; -regmap_read (dev->map,DW_IC_INTR_STAT , &stat);regmap_read (dev->map,DW_IC_ENABLE , &enabled);regmap_read (dev->map,DW_IC_RAW_INTR_STAT , &raw_stat);regmap_read (dev->map,DW_IC_STATUS , &tmp);
@@ -168,6 +167,7 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY ) || !dev->slave)return 0 ; + stat =i2c_dw_read_clear_intrbits_slave (dev);dev_dbg (dev->dev,"%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n" , enabled, slave_activity, raw_stat, stat);
@@ -188,11 +188,9 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) val); }regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); - stat =i2c_dw_read_clear_intrbits_slave (dev); } else {regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp);regmap_read (dev->map,DW_IC_CLR_RX_UNDER , &tmp); - stat =i2c_dw_read_clear_intrbits_slave (dev); } if (!i2c_slave_event(dev->slave, I2C_SLAVE_READ_REQUESTED,
@@ -207,7 +205,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)regmap_read (dev->map,DW_IC_CLR_RX_DONE , &tmp);i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); - stat =i2c_dw_read_clear_intrbits_slave (dev);return 1 ; }
@@ -219,7 +216,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)dev_vdbg (dev->dev,"Byte %X acked!" , val); }else {i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); - stat =i2c_dw_read_clear_intrbits_slave (dev); }return 1 ;
@@ -230,7 +226,6 @@ static irqreturn_t i2c_dw_isr_slave(int this_irq, void *dev_id)struct dw_i2c_dev *dev = dev_id;int ret; -i2c_dw_read_clear_intrbits_slave (dev); ret =i2c_dw_irq_handler_slave (dev);if (ret >0 )complete (&dev->cmd_complete);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 136/255 net/mlx5e: Fix modify header actions memory leak
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit e68e28b4a9d71261e3f8fd05a72d6cf0b443a493 ]
Modify header actions are allocated during parse tc actions and only freed during the flow creation, however, on error flow the allocated memory is wrongly unfreed.
Fix this by calling dealloc_mod_hdr_actions in __mlx5e_add_fdb_flow and mlx5e_add_nic_flow error flow.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +2 -0
@@ -4430,6 +4430,7 @@ __mlx5e_add_fdb_flow(struct mlx5e_priv *priv,return flow; err_free: +dealloc_mod_hdr_actions (&parse_attr->mod_hdr_acts);mlx5e_flow_put (priv, flow); out:return ERR_PTR (err);
@@ -4564,6 +4565,7 @@ mlx5e_add_nic_flow(struct mlx5e_priv *priv,return 0 ; err_free: +dealloc_mod_hdr_actions (&parse_attr->mod_hdr_acts);mlx5e_flow_put (priv, flow);kvfree (parse_attr); out:
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 119/255 selftests: proc: fix warning: _GNU_SOURCE redefined
In reply to Greg Kroah-HartmanFrom: Tommi Rantala <[email protected]>
[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ]
Makefile already contains -D_GNU_SOURCE, so we can remove it from the *.c files.
--- tools/testing/selftests/proc/proc-loadavg-001.c | 1 - tools/testing/selftests/proc/proc-self-syscall.c | 1 - tools/testing/selftests/proc/proc-uptime-002.c | 1 - 3 files changed, 3 deletions(-)
tools/testing/selftests/proc/proc-loadavg-001.c +0 -1
@@ -14,7 +14,6 @@* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ /* Test that /proc/loadavg correctly reports last pid in pid namespace. */ -#define _GNU_SOURCE#include <errno.h> #include <sched.h> #include <sys/types.h>
tools/testing/selftests/proc/proc-self-syscall.c +0 -1
@@ -13,7 +13,6 @@* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -#define _GNU_SOURCE#include <unistd.h> #include <sys/syscall.h> #include <sys/types.h>
tools/testing/selftests/proc/proc-uptime-002.c +0 -1
@@ -15,7 +15,6 @@*/ // Test that values in /proc/uptime increment monotonically // while shifting across CPUs. -#define _GNU_SOURCE#undef NDEBUG#include <assert.h> #include <unistd.h>
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 135/255 pinctrl: aspeed: Fix GPI only function problem.
In reply to Greg Kroah-HartmanFrom: Billy Tsai <[email protected]>
[ Upstream commit 9b92f5c51e9a41352d665f6f956bd95085a56a83 ]
Some gpio pin at aspeed soc is input only and the prefix name of these pin is "GPI" only.
This patch fine-tune the condition of GPIO check from "GPIO" to "GPI" and it will fix the usage error of banks D and E in the AST2400/AST2500 and banks T and U in the AST2600.
--- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed.c +4 -3
@@ -286,13 +286,14 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,static bool aspeed_expr_is_gpio (const struct aspeed_sig_expr *expr) {/* -* The signal type is GPIO if the signal name has "GPIO" as a prefix. +* The signal type is GPIO if the signal name has "GPI" as a prefix. * strncmp (rather than strcmp) is used to implement the prefix * requirement. * -* expr->signal might look like "GPIOT3" in the GPIO case. +* expr->signal might look like "GPIOB1" in the GPIO case. +* expr->signal might look like "GPIT0" in the GPI case. */ -return strncmp (expr->signal,"GPIO" ,4 ) ==0 ; +return strncmp (expr->signal,"GPI" ,3 ) ==0 ; }static bool aspeed_gpio_in_exprs (const struct aspeed_sig_expr **exprs)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 139/255 net/mlx5: Fix deletion of duplicate rules
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit 465e7baab6d93b399344f5868f84c177ab5cd16f ]
When a rule is duplicated, the refcount of the rule is increased so only the second deletion of the rule should cause destruction of the FTE. Currently, the FTE will be destroyed in the first deletion of rule since the modify_mask will be 0.
Fix it and call to destroy FTE only if all the rules (FTE's children) have been removed.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +4 -3
@@ -1994,10 +1994,11 @@ void mlx5_del_flow_rules(struct mlx5_flow_handle *handle)down_write_ref_node (&fte->node, false);for (i = handle->num_rules -1 ; i >=0 ; i--)tree_remove_node (&handle->rule[i]->node, true); -if (fte->modify_mask && fte->dests_size) { -modify_fte (fte); +if (fte->dests_size) { +if (fte->modify_mask) +modify_fte (fte);up_write_ref_node (&fte->node, false); - }else { + }else if (list_empty (&fte->node.children)) {del_hw_fte (&fte->node);/* Avoid double call to del_hw_fte */ fte->node.del_hw_func =NULL ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 142/255 net/mlx5e: Fix incorrect access of RCU-protected xdp_prog
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 1a50cf9a67ff2241c2949d30bc11c8dd4280eef8 ]
rq->xdp_prog is RCU-protected and should be accessed only with rcu_access_pointer for the NULL check in mlx5e_poll_rx_cq.
rq->xdp_prog may change on the fly only from one non-NULL value to another non-NULL value, so the checks in mlx5e_xdp_handle and mlx5e_poll_rx_cq will have the same result during one NAPI cycle, meaning that no additional synchronization is needed.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +1 -1
@@ -1566,7 +1566,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget) }while ((++work_done < budget) && (cqe =mlx5_cqwq_get_cqe (cqwq))); out: -if (rq->xdp_prog) +if (rcu_access_pointer (rq->xdp_prog))mlx5e_xdp_rx_poll_complete (rq);mlx5_cqwq_update_db_record (cqwq);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 141/255 net/mlx5e: Fix VXLAN synchronization after function reload
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit c5eb51adf06b2644fa28d4af886bfdcc53e288da ]
During driver reload, perform firmware tear-down which results in firmware losing the configured VXLAN ports. These ports are still available in the driver's database. Fix this by cleaning up driver's VXLAN database in the nic unload flow, before firmware tear-down. With that, minimize mlx5_vxlan_destroy() to remove only what was added in mlx5_vxlan_create() and warn on leftover UDP ports.
--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 1 + .../ethernet/mellanox/mlx5/core/lib/vxlan.c | 23 ++++++++++++++----- .../ethernet/mellanox/mlx5/core/lib/vxlan.h | 2 ++ 3 files changed, 20 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -0
@@ -5226,6 +5226,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv)mlx5e_disable_async_events (priv);mlx5_lag_remove (mdev); +mlx5_vxlan_reset_to_default (mdev->vxlan); }int mlx5e_update_nic_rx (struct mlx5e_priv *priv)
drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c +17 -6
@@ -167,6 +167,17 @@ struct mlx5_vxlan *mlx5_vxlan_create(struct mlx5_core_dev *mdev) }void mlx5_vxlan_destroy (struct mlx5_vxlan *vxlan) +{ +if (!mlx5_vxlan_allowed (vxlan)) +return ; + +mlx5_vxlan_del_port (vxlan,IANA_VXLAN_UDP_PORT ); +WARN_ON (!hash_empty (vxlan->htable)); + +kfree (vxlan); +} + +void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan) {struct mlx5_vxlan_port *vxlanp;struct hlist_node *tmp;
@@ -175,12 +186,12 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan)if (!mlx5_vxlan_allowed (vxlan))return ; -/* Lockless since we are the only hash table consumers*/ hash_for_each_safe (vxlan->htable, bkt, tmp, vxlanp, hlist) { -hash_del (&vxlanp->hlist); -mlx5_vxlan_core_del_port_cmd (vxlan->mdev, vxlanp->udp_port); -kfree (vxlanp); +/* Don't delete default UDP port added by the HW. +* Remove only user configured ports +*/ +if (vxlanp->udp_port ==IANA_VXLAN_UDP_PORT ) +continue ; +mlx5_vxlan_del_port (vxlan, vxlanp->udp_port); } - -kfree (vxlan); }
drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h +2 -0
@@ -56,6 +56,7 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan);int mlx5_vxlan_add_port (struct mlx5_vxlan *vxlan,u16 port);int mlx5_vxlan_del_port (struct mlx5_vxlan *vxlan,u16 port);bool mlx5_vxlan_lookup_port (struct mlx5_vxlan *vxlan,u16 port); +void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan);#else static inline struct mlx5_vxlan *mlx5_vxlan_create (struct mlx5_core_dev *mdev) {return ERR_PTR (-EOPNOTSUPP ); }
@@ -63,6 +64,7 @@ static inline void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan) { return; }static inline int mlx5_vxlan_add_port (struct mlx5_vxlan *vxlan,u16 port) {return -EOPNOTSUPP ; }static inline int mlx5_vxlan_del_port (struct mlx5_vxlan *vxlan,u16 port) {return -EOPNOTSUPP ; }static inline bool mlx5_vxlan_lookup_port (struct mlx5_vxlan *vxlan,u16 port) {return false; } +static inline void mlx5_vxlan_reset_to_default (struct mlx5_vxlan *vxlan) {return ; }#endif #endif /* __MLX5_VXLAN_H__ */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 151/255 pinctrl: qcom: sm8250: Specify PDC map
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit b41efeed507addecb92e83dd444d86c1fbe38ae0 ]
Specify the PDC mapping for SM8250, so that gpio interrupts are propertly mapped to the wakeup IRQs of the PDC.
--- drivers/pinctrl/qcom/pinctrl-sm8250.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pinctrl/qcom/pinctrl-sm8250.c +18 -0
@@ -1313,6 +1313,22 @@ static const struct msm_pingroup sm8250_groups[] = { [183] = SDC_PINGROUP(sdc2_data, 0xb7000, 9, 0), }; +static const struct msm_gpio_wakeirq_map sm8250_pdc_map[] = { + {0 ,79 }, {1 ,84 }, {2 ,80 }, {3 ,82 }, {4 ,107 }, {7 ,43 }, + {11 ,42 }, {14 ,44 }, {15 ,52 }, {19 ,67 }, {23 ,68 }, {24 ,105 }, + {27 ,92 }, {28 ,106 }, {31 ,69 }, {35 ,70 }, {39 ,37 }, + {40 ,108 }, {43 ,71 }, {45 ,72 }, {47 ,83 }, {51 ,74 }, {55 ,77 }, + {59 ,78 }, {63 ,75 }, {64 ,81 }, {65 ,87 }, {66 ,88 }, {67 ,89 }, + {68 ,54 }, {70 ,85 }, {77 ,46 }, {80 ,90 }, {81 ,91 }, {83 ,97 }, + {84 ,98 }, {86 ,99 }, {87 ,100 }, {88 ,101 }, {89 ,102 }, + {92 ,103 }, {93 ,104 }, {100 ,53 }, {103 ,47 }, {104 ,48 }, + {108 ,49 }, {109 ,94 }, {110 ,95 }, {111 ,96 }, {112 ,55 }, + {113 ,56 }, {118 ,50 }, {121 ,51 }, {122 ,57 }, {123 ,58 }, + {124 ,45 }, {126 ,59 }, {128 ,76 }, {129 ,86 }, {132 ,93 }, + {133 ,65 }, {134 ,66 }, {136 ,62 }, {137 ,63 }, {138 ,64 }, + {142 ,60 }, {143 ,61 } +}; +static const struct msm_pinctrl_soc_data sm8250_pinctrl = { .pins = sm8250_pins, .npins =ARRAY_SIZE (sm8250_pins),
@@ -1323,6 +1339,8 @@ static const struct msm_pinctrl_soc_data sm8250_pinctrl = { .ngpios = 181, .tiles = sm8250_tiles, .ntiles = ARRAY_SIZE(sm8250_tiles), + .wakeirq_map = sm8250_pdc_map, + .nwakeirq_map = ARRAY_SIZE(sm8250_pdc_map), };static int sm8250_pinctrl_probe (struct platform_device *pdev)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 148/255 r8169: fix potential skb double free in an error path
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit cc6528bc9a0c901c83b8220a2e2617f3354d6dd9 ]
The caller of rtl8169_tso_csum_v2() frees the skb if false is returned. eth_skb_pad() internally frees the skb on error what would result in a double free. Therefore use __skb_put_padto() directly and instruct it to not free the skb on error.
--- drivers/net/ethernet/realtek/r8169_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/realtek/r8169_main.c +2 -1
@@ -4145,7 +4145,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, opts[1 ] |= transport_offset <<TCPHO_SHIFT ; }else {if (unlikely (skb->len <ETH_ZLEN &&rtl_test_hw_pad_bug (tp))) -return !eth_skb_pad (skb); +/* eth_skb_pad would free the skb on error */ +return !__skb_put_padto (skb,ETH_ZLEN , false); }return true;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 124/255 i2c: designware: slave should do WRITE_REQUESTED before WRITE_RECEIVED
In reply to Greg Kroah-HartmanFrom: Michael Wu <[email protected]>
[ Upstream commit 3b5f7f10ff6e6b66f553e12cc50d9bb751ce60ad ]
Sometimes we would get the following flow when doing an i2cset:
0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4 I2C_SLAVE_WRITE_RECEIVED0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x714 : INTR_STAT=0x204 I2C_SLAVE_WRITE_REQUESTEDI2C_SLAVE_WRITE_RECEIVED
Documentation/i2c/slave-interface.rst says that I2C_SLAVE_WRITE_REQUESTED, which is mandatory, should be sent while the data did not arrive yet. It means in a write-request I2C_SLAVE_WRITE_REQUESTED should be reported before any I2C_SLAVE_WRITE_RECEIVED.
By the way, I2C_SLAVE_STOP didn't be reported in the above case because DW_IC_INTR_STAT was not 0x200.
dev->status can be used to record the current state, especially Designware I2C controller has no interrupts to identify a write-request. This patch makes not only I2C_SLAVE_WRITE_REQUESTED been reported first when IC_INTR_RX_FULL is rising and dev->status isn't STATUS_WRITE_IN_PROGRESS but also I2C_SLAVE_STOP been reported when a STOP condition is received.
--- drivers/i2c/busses/i2c-designware-slave.c | 45 +++++++++-------------- 1 file changed, 18 insertions(+), 27 deletions(-)
drivers/i2c/busses/i2c-designware-slave.c +18 -27
@@ -172,26 +172,25 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)"%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n" , enabled, slave_activity, raw_stat, stat); -if ((stat &DW_IC_INTR_RX_FULL ) && (stat &DW_IC_INTR_STOP_DET )) -i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_REQUESTED , &val); +if (stat &DW_IC_INTR_RX_FULL ) { +if (dev->status !=STATUS_WRITE_IN_PROGRESS ) { + dev->status =STATUS_WRITE_IN_PROGRESS ; +i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_REQUESTED , + &val); + } + +regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); + val = tmp; +if (!i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_RECEIVED , + &val)) +dev_vdbg (dev->dev,"Byte %X acked!" , val); + }if (stat &DW_IC_INTR_RD_REQ ) {if (slave_activity) { -if (stat &DW_IC_INTR_RX_FULL ) { -regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); - val = tmp; - -if (!i2c_slave_event (dev->slave, -I2C_SLAVE_WRITE_RECEIVED , - &val)) { -dev_vdbg (dev->dev,"Byte %X acked!" , - val); - } -regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); - }else { -regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); -regmap_read (dev->map,DW_IC_CLR_RX_UNDER , &tmp); - } +regmap_read (dev->map,DW_IC_CLR_RD_REQ , &tmp); + + dev->status =STATUS_READ_IN_PROGRESS ;if (!i2c_slave_event (dev->slave,I2C_SLAVE_READ_REQUESTED , &val))
@@ -203,18 +202,10 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)if (!i2c_slave_event (dev->slave,I2C_SLAVE_READ_PROCESSED , &val))regmap_read (dev->map,DW_IC_CLR_RX_DONE , &tmp); - -i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); -return 1 ; } -if (stat &DW_IC_INTR_RX_FULL ) { -regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); - val = tmp; -if (!i2c_slave_event (dev->slave,I2C_SLAVE_WRITE_RECEIVED , - &val)) -dev_vdbg (dev->dev,"Byte %X acked!" , val); - }else { +if (stat &DW_IC_INTR_STOP_DET ) { + dev->status =STATUS_IDLE ;i2c_slave_event (dev->slave,I2C_SLAVE_STOP , &val); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 127/255 mfd: sprd: Add wakeup capability for PMIC IRQ
In reply to Greg Kroah-HartmanFrom: Baolin Wang <[email protected]>
commit a75bfc824a2d33f57ebdc003bfe6b7a9e11e9cb9 upstream.
When changing to use suspend-to-idle to save power, the PMIC irq can not wakeup the system due to lack of wakeup capability, which will cause the sub-irqs (such as power key) of the PMIC can not wake up the system. Thus we can add the wakeup capability for PMIC irq to solve this issue, as well as removing the IRQF_NO_SUSPEND flag to allow PMIC irq to be a wakeup source.
--- drivers/mfd/sprd-sc27xx-spi.c | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-)
drivers/mfd/sprd-sc27xx-spi.c +27 -1
@@ -189,7 +189,7 @@ static int sprd_pmic_probe(struct spi_de ddata->irqs[i].mask =BIT (i); ret =devm_regmap_add_irq_chip (&spi->dev, ddata->regmap, ddata->irq, -IRQF_ONESHOT |IRQF_NO_SUSPEND ,0 , +IRQF_ONESHOT ,0 , &ddata->irq_chip, &ddata->irq_data);if (ret) {dev_err (&spi->dev,"Failed to add PMIC irq chip %d\n" , ret);
@@ -202,9 +202,34 @@ static int sprd_pmic_probe(struct spi_dereturn ret; } +device_init_wakeup (&spi->dev, true);return 0 ; } +#ifdef CONFIG_PM_SLEEP +static int sprd_pmic_suspend (struct device *dev) +{ +struct sprd_pmic *ddata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev)) +enable_irq_wake (ddata->irq); + +return 0 ; +} + +static int sprd_pmic_resume (struct device *dev) +{ +struct sprd_pmic *ddata =dev_get_drvdata (dev); + +if (device_may_wakeup (dev)) +disable_irq_wake (ddata->irq); + +return 0 ; +} +#endif + +static SIMPLE_DEV_PM_OPS(sprd_pmic_pm_ops, sprd_pmic_suspend, sprd_pmic_resume); +static const struct of_device_id sprd_pmic_match[] = { { .compatible ="sprd,sc2731" , .data = &sc2731_data }, {},
@@ -215,6 +240,7 @@ static struct spi_driver sprd_pmic_drive .driver = { .name = "sc27xx-pmic", .of_match_table = sprd_pmic_match, + .pm = &sprd_pmic_pm_ops, }, .probe = sprd_pmic_probe, };
Greg Kroah-Hartman
maintainerPATCH 128/255 pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit dd26209bc56886cacdbd828571e54a6bca251e55 ]
2 kOhm bias was never an option in Intel GPIO hardware, the available matrix is:
000 none 001 1 kOhm (if available) 010 5 kOhm 100 20 kOhm
As easy to get the 3 resistors are gated separately and according to parallel circuits calculations we may get combinations of the above where the result is always strictly less than minimal resistance. Hence, additional values can be:
011 ~833.3 Ohm 101 ~952.4 Ohm 110 ~4 kOhm 111 ~800 Ohm
That said, convert TERM definitions to be the bit masks to reflect the above.
While at it, enable the same setting for pull down case.
--- drivers/pinctrl/intel/pinctrl-intel.c | 32 ++++++++++++++++++--------- 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +22 -10
@@ -62,10 +62,10 @@#define PADCFG1_TERM_UP BIT(13)#define PADCFG1_TERM_SHIFT 10#define PADCFG1_TERM_MASK GENMASK(12, 10) -#define PADCFG1_TERM_20K 4 -#define PADCFG1_TERM_2K 3 -#define PADCFG1_TERM_5K 2 -#define PADCFG1_TERM_1K 1 +#define PADCFG1_TERM_20K BIT(2) +#define PADCFG1_TERM_5K BIT(1) +#define PADCFG1_TERM_1K BIT(0) +#define PADCFG1_TERM_833 (BIT(1) | BIT(0))#define PADCFG2 0x008#define PADCFG2_DEBEN BIT(0)
@@ -549,12 +549,12 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin,return -EINVAL ;switch (term) { +case PADCFG1_TERM_833 : + *arg =833 ; +break ;case PADCFG1_TERM_1K : *arg =1000 ;break ; -case PADCFG1_TERM_2K : - *arg =2000 ; -break ;case PADCFG1_TERM_5K : *arg =5000 ;break ;
@@ -570,6 +570,11 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin,return -EINVAL ;switch (term) { +case PADCFG1_TERM_833 : +if (!(community->features &PINCTRL_FEATURE_1K_PD )) +return -EINVAL ; + *arg =833 ; +break ;case PADCFG1_TERM_1K :if (!(community->features &PINCTRL_FEATURE_1K_PD ))return -EINVAL ;
@@ -685,12 +690,12 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin,case 5000 : value |=PADCFG1_TERM_5K <<PADCFG1_TERM_SHIFT ;break ; -case 2000 : - value |=PADCFG1_TERM_2K <<PADCFG1_TERM_SHIFT ; -break ;case 1000 : value |=PADCFG1_TERM_1K <<PADCFG1_TERM_SHIFT ;break ; +case 833 : + value |=PADCFG1_TERM_833 <<PADCFG1_TERM_SHIFT ; +break ;default : ret = -EINVAL ; }
@@ -714,6 +719,13 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, } value |=PADCFG1_TERM_1K <<PADCFG1_TERM_SHIFT ;break ; +case 833 : +if (!(community->features &PINCTRL_FEATURE_1K_PD )) { + ret = -EINVAL ; +break ; + } + value |=PADCFG1_TERM_833 <<PADCFG1_TERM_SHIFT ; +break ;default : ret = -EINVAL ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 129/255 pinctrl: intel: Set default bias in case no particular value given
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit f3c75e7a9349d1d33eb53ddc1b31640994969f73 ]
When GPIO library asks pin control to set the bias, it doesn't pass any value of it and argument is considered boolean (and this is true for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual drivers must behave well, when they got the resistance value of 1 Ohm, i.e. transforming it to sane default.
In case of Intel pin control hardware the 5 kOhm sounds plausible because on one hand it's a minimum of resistors present in all hardware generations and at the same time it's high enough to minimize leakage current (will be only 200 uA with the above choice).
--- drivers/pinctrl/intel/pinctrl-intel.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/pinctrl/intel/pinctrl-intel.c +8 -0
@@ -683,6 +683,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, value |=PADCFG1_TERM_UP ; +/* Set default strength value in case none is given */ +if (arg ==1 ) + arg =5000 ; +switch (arg) {case 20000 : value |=PADCFG1_TERM_20K <<PADCFG1_TERM_SHIFT ;
@@ -705,6 +709,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin,case PIN_CONFIG_BIAS_PULL_DOWN : value &= ~(PADCFG1_TERM_UP |PADCFG1_TERM_MASK ); +/* Set default strength value in case none is given */ +if (arg ==1 ) + arg =5000 ; +switch (arg) {case 20000 : value |=PADCFG1_TERM_20K <<PADCFG1_TERM_SHIFT ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 121/255 riscv: Set text_offset correctly for M-Mode
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 79605f1394261995c2b955c906a5a20fb27cdc84 ]
M-Mode Linux is loaded at the start of RAM, not 2MB later. Perhaps this should be calculated based on PAGE_OFFSET somehow? Even better would be to deprecate text_offset and instead introduce something absolute.
--- arch/riscv/kernel/head.S | 5 +++++ 1 file changed, 5 insertions(+)
arch/riscv/kernel/head.S +5 -0
@@ -27,12 +27,17 @@ ENTRY(_start) /* reserved */ .word 0 .balign 8 +#ifdef CONFIG_RISCV_M_MODE + /* Image load offset (0MB) from start of RAM for M-mode */ + .dword 0 +#else #if __riscv_xlen == 64 /* Image load offset(2MB) from start of RAM */ .dword 0x200000 #else /* Image load offset(4MB) from start of RAM */ .dword 0x400000 +#endif #endif /* Effective size of kernel image */ .dword _end - _start
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 163/255 xfs: fix a missing unlock on error in xfs_fs_map_blocks
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 2bd3fa793aaa7e98b74e3653fdcc72fa753913b5 ]
We also need to drop the iolock when invalidate_inode_pages2 fails, not only on all other error or successful cases.
--- fs/xfs/xfs_pnfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_pnfs.c +1 -1
@@ -134,7 +134,7 @@ xfs_fs_map_blocks( goto out_unlock; error =invalidate_inode_pages2 (inode->i_mapping);if (WARN_ON_ONCE (error)) -return error; + goto out_unlock; end_fsb =XFS_B_TO_FSB (mp, (xfs_ufsize_t )offset + length); offset_fsb =XFS_B_TO_FSBT (mp, offset);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 165/255 ch_ktls: Update cheksum information
In reply to Greg Kroah-HartmanFrom: Rohit Maheshwari <[email protected]>
[ Upstream commit 86716b51d14fc2201938939b323ba3ad99186910 ]
Checksum update was missing in the WR.
--- drivers/crypto/chelsio/chcr_ktls.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/crypto/chelsio/chcr_ktls.c +11 -4
@@ -926,6 +926,7 @@ chcr_ktls_write_tcp_options(struct chcr_ktls_info *tx_info, struct sk_buff *skb,struct iphdr *ip;int credits;u8 buf[150 ]; +u64 cntrl1;void *pos; iplen =skb_network_header_len (skb);
@@ -964,22 +965,28 @@ chcr_ktls_write_tcp_options(struct chcr_ktls_info *tx_info, struct sk_buff *skb, TXPKT_PF_V(tx_info->adap->pf)); cpl->pack =0 ; cpl->len =htons (pktlen); -/* checksum offload */ - cpl->ctrl1 =0 ; - - pos = cpl +1 ;memcpy (buf, skb->data, pktlen);if (tx_info->ip_family ==AF_INET ) {/* we need to correct ip header len */ ip = (struct iphdr *)(buf + maclen); ip->tot_len =htons (pktlen - maclen); + cntrl1 =TXPKT_CSUM_TYPE_V (TX_CSUM_TCPIP );#if IS_ENABLED (CONFIG_IPV6 ) } else { ip6 = (struct ipv6hdr *)(buf + maclen); ip6->payload_len =htons (pktlen - maclen - iplen); + cntrl1 =TXPKT_CSUM_TYPE_V (TX_CSUM_TCPIP6 );#endif } + + cntrl1 |=T6_TXPKT_ETHHDR_LEN_V (maclen -ETH_HLEN ) | +TXPKT_IPHDR_LEN_V (iplen); +/* checksum offload */ + cpl->ctrl1 =cpu_to_be64 (cntrl1); + + pos = cpl +1 ; +/* now take care of the tcp header, if fin is not set then clear push * bit as well, and if fin is set, it will be sent at the last so we * need to update the tcp sequence number as per the last packet.
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 166/255 ch_ktls: tcb update fails sometimes
In reply to Greg Kroah-HartmanFrom: Rohit Maheshwari <[email protected]>
[ Upstream commit 7d01c428c86b525dc780226924d74df2048cf411 ]
context id and port id should be filled while sending tcb update.
--- drivers/crypto/chelsio/chcr_ktls.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/crypto/chelsio/chcr_ktls.c +8 -4
@@ -659,7 +659,8 @@ int chcr_ktls_cpl_set_tcb_rpl(struct adapter *adap, unsigned char *input) }static void *__chcr_write_cpl_set_tcb_ulp (struct chcr_ktls_info *tx_info, -u32 tid,void *pos,u16 word,u64 mask, +u32 tid,void *pos,u16 word, +struct sge_eth_txq *q,u64 mask,u64 val,u32 reply) {struct cpl_set_tcb_field_core *cpl;
@@ -668,7 +669,10 @@ static void *__chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info,/* ULP_TXPKT */ txpkt = pos; - txpkt->cmd_dest =htonl (ULPTX_CMD_V (ULP_TX_PKT ) |ULP_TXPKT_DEST_V (0 )); + txpkt->cmd_dest =htonl (ULPTX_CMD_V (ULP_TX_PKT ) | +ULP_TXPKT_CHANNELID_V (tx_info->port_id) | +ULP_TXPKT_FID_V (q->q.cntxt_id) | +ULP_TXPKT_RO_F ); txpkt->len =htonl (DIV_ROUND_UP (CHCR_SET_TCB_FIELD_LEN ,16 ));/* ULPTX_IDATA sub-command */
@@ -723,7 +727,7 @@ static void *chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, }else {u8 buf[48 ] = {0 }; -__chcr_write_cpl_set_tcb_ulp (tx_info, tid, buf, word, +__chcr_write_cpl_set_tcb_ulp (tx_info, tid, buf, word, q, mask, val, reply); return chcr_copy_to_txd(buf, &q->q, pos,
@@ -731,7 +735,7 @@ static void *chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, } } - pos =__chcr_write_cpl_set_tcb_ulp (tx_info, tid, pos, word, + pos =__chcr_write_cpl_set_tcb_ulp (tx_info, tid, pos, word, q, mask, val, reply);/* check again if we are at the end of the queue */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 167/255 cosa: Add missing kfree in error path of cosa_write
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 52755b66ddcef2e897778fac5656df18817b59ab ]
If memory allocation for 'kbuf' succeed, cosa_write() doesn't have a corresponding kfree() in exception handling. Thus add kfree() for this function implementation.
--- drivers/net/wan/cosa.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wan/cosa.c +1 -0
@@ -889,6 +889,7 @@ static ssize_t cosa_write(struct file *file, chan->tx_status =1 ;spin_unlock_irqrestore (&cosa->lock, flags);up (&chan->wsem); +kfree (kbuf);return -ERESTARTSYS ; } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 168/255 hwmon: (applesmc) Re-work SMC comms
In reply to Greg Kroah-HartmanFrom: Brad Campbell <[email protected]>
[ Upstream commit 4d64bb4ba5ecf4831448cdb2fe16d0ae91b2b40b ]
Commit fff2d0f701e6 ("hwmon: (applesmc) avoid overlong udelay()") introduced an issue whereby communication with the SMC became unreliable with write errors like :
[ 120.378614] applesmc: send_byte(0x00, 0x0300) fail: 0x40 [ 120.378621] applesmc: LKSB: write data fail [ 120.512782] applesmc: send_byte(0x00, 0x0300) fail: 0x40 [ 120.512787] applesmc: LKSB: write data fail
The original code appeared to be timing sensitive and was not reliable with the timing changes in the aforementioned commit.
This patch re-factors the SMC communication to remove the timing dependencies and restore function with the changes previously committed.
Tested on : MacbookAir6,2 MacBookPro11,1 iMac12,2, MacBookAir1,1, MacBookAir3,1
--- drivers/hwmon/applesmc.c | 130 ++++++++++++++++++++++++--------------- 1 file changed, 82 insertions(+), 48 deletions(-)
drivers/hwmon/applesmc.c +82 -48
@@ -32,6 +32,7 @@#include <linux/hwmon.h> #include <linux/workqueue.h> #include <linux/err.h> +#include <linux/bits.h> /* data port used by Apple SMC */ #define APPLESMC_DATA_PORT 0x300
@@ -42,10 +43,13 @@#define APPLESMC_MAX_DATA_LENGTH 32 -/* wait up to 128 ms for a status change. */ -#define APPLESMC_MIN_WAIT 0x0010 -#define APPLESMC_RETRY_WAIT 0x0100 -#define APPLESMC_MAX_WAIT 0x20000 +/* Apple SMC status bits */ +#define SMC_STATUS_AWAITING_DATA BIT(0)/* SMC has data waiting to be read */ +#define SMC_STATUS_IB_CLOSED BIT(1)/* Will ignore any input */ +#define SMC_STATUS_BUSY BIT(2)/* Command in progress */ + +/* Initial wait is 8us */ +#define APPLESMC_MIN_WAIT 0x0008#define APPLESMC_READ_CMD 0x10#define APPLESMC_WRITE_CMD 0x11
@@ -151,65 +155,84 @@ static unsigned int key_at_index;static struct workqueue_struct *applesmc_led_wq;/* -* wait_read - Wait for a byte to appear on SMC port. Callers must -* hold applesmc_lock. +* Wait for specific status bits with a mask on the SMC. +* Used before all transactions. +* This does 10 fast loops of 8us then exponentially backs off for a +* minimum total wait of 262ms. Depending on usleep_range this could +* run out past 500ms. */ -static int wait_read (void ) + +static int wait_status (u8 val,u8 mask) { -unsigned long end = jiffies + (APPLESMC_MAX_WAIT *HZ ) /USEC_PER_SEC ;u8 status;int us; +int i; -for (us =APPLESMC_MIN_WAIT ; us <APPLESMC_MAX_WAIT ; us <<=1 ) { -usleep_range (us, us *16 ); + us =APPLESMC_MIN_WAIT ; +for (i =0 ; i <24 ; i++) { status =inb (APPLESMC_CMD_PORT ); -/* read: wait for smc to settle */ -if (status &0x01 ) +if ((status & mask) == val)return 0 ; -/* timeout: give up */ -if (time_after (jiffies, end)) -break ; +usleep_range (us, us *2 ); +if (i >9 ) + us <<=1 ; } - -pr_warn ("wait_read() fail: 0x%02x\n" , status);return -EIO ; } -/* -* send_byte - Write to SMC port, retrying when necessary. Callers -* must hold applesmc_lock. -*/ +/* send_byte - Write to SMC data port. Callers must hold applesmc_lock. */ +static int send_byte (u8 cmd,u16 port) { -u8 status; -int us; -unsigned long end = jiffies + (APPLESMC_MAX_WAIT *HZ ) /USEC_PER_SEC ; +int status; + + status =wait_status (0 ,SMC_STATUS_IB_CLOSED ); +if (status) +return status; +/* +* This needs to be a separate read looking for bit 0x04 +* after bit 0x02 falls. If consolidated with the wait above +* this extra read may not happen if status returns both +* simultaneously and this would appear to be required. +*/ + status =wait_status (SMC_STATUS_BUSY ,SMC_STATUS_BUSY ); +if (status) +return status;outb (cmd, port); -for (us =APPLESMC_MIN_WAIT ; us <APPLESMC_MAX_WAIT ; us <<=1 ) { -usleep_range (us, us *16 ); - status =inb (APPLESMC_CMD_PORT ); -/* write: wait for smc to settle */ -if (status &0x02 ) -continue ; -/* ready: cmd accepted, return */ -if (status &0x04 ) -return 0 ; -/* timeout: give up */ -if (time_after (jiffies, end)) -break ; -/* busy: long wait and resend */ -udelay (APPLESMC_RETRY_WAIT ); -outb (cmd, port); - } - -pr_warn ("send_byte(0x%02x, 0x%04x) fail: 0x%02x\n" , cmd, port, status); -return -EIO ; +return 0 ; } +/* send_command - Write a command to the SMC. Callers must hold applesmc_lock. */ +static int send_command (u8 cmd) { -return send_byte (cmd,APPLESMC_CMD_PORT ); +int ret; + + ret =wait_status (0 ,SMC_STATUS_IB_CLOSED ); +if (ret) +return ret; +outb (cmd,APPLESMC_CMD_PORT ); +return 0 ; +} + +/* +* Based on logic from the Apple driver. This is issued before any interaction +* If busy is stuck high, issue a read command to reset the SMC state machine. +* If busy is stuck high after the command then the SMC is jammed. +*/ + +static int smc_sane (void ) +{ +int ret; + + ret =wait_status (0 ,SMC_STATUS_BUSY ); +if (!ret) +return ret; + ret =send_command (APPLESMC_READ_CMD ); +if (ret) +return ret; +return wait_status (0 ,SMC_STATUS_BUSY ); }static int send_argument (const char *key)
@@ -226,6 +249,11 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) {u8 status, data =0 ;int i; +int ret; + + ret =smc_sane (); +if (ret) +return ret;if (send_command (cmd) ||send_argument (key)) {pr_warn ("%.4s: read arg fail\n" , key);
@@ -239,7 +267,8 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) }for (i =0 ; i < len; i++) { -if (wait_read ()) { +if (wait_status (SMC_STATUS_AWAITING_DATA |SMC_STATUS_BUSY , +SMC_STATUS_AWAITING_DATA |SMC_STATUS_BUSY )) {pr_warn ("%.4s: read data[%d] fail\n" , key, i);return -EIO ; }
@@ -250,19 +279,24 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)for (i =0 ; i <16 ; i++) {udelay (APPLESMC_MIN_WAIT ); status =inb (APPLESMC_CMD_PORT ); -if (!(status &0x01 )) +if (!(status &SMC_STATUS_AWAITING_DATA ))break ; data =inb (APPLESMC_DATA_PORT ); }if (i)pr_warn ("flushed %d bytes, last value is: %d\n" , i, data); -return 0 ; +return wait_status (0 ,SMC_STATUS_BUSY ); }static int write_smc (u8 cmd,const char *key,const u8 *buffer,u8 len) {int i; +int ret; + + ret =smc_sane (); +if (ret) +return ret;if (send_command (cmd) ||send_argument (key)) {pr_warn ("%s: write arg fail\n" , key);
@@ -281,7 +315,7 @@ static int write_smc(u8 cmd, const char *key, const u8 *buffer, u8 len) } } -return 0 ; +return wait_status (0 ,SMC_STATUS_BUSY ); }static int read_register_count (unsigned int *count)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 169/255 NFS: Fix listxattr receive buffer size
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit 6c2190b3fcbc92cb79e39cc7e7531656b341e463 ]
Certain NFSv4.2/RDMA tests fail with v5.9-rc1.
rpcrdma_convert_kvec() runs off the end of the rl_segments array because rq_rcv_buf.tail[0].iov_len holds a very large positive value. The resultant kernel memory corruption is enough to crash the client system.
Callers of rpc_prepare_reply_pages() must reserve an extra XDR_UNIT in the maximum decode size for a possible XDR pad of the contents of the xdr_buf's pages. That guarantees the allocated receive buffer will be large enough to accommodate the usual contents plus that XDR pad word.
encode_op_hdr() cannot add that extra word. If it does, xdr_inline_pages() underruns the length of the tail iovec.
--- fs/nfs/nfs42xdr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/nfs42xdr.c +2 -2
@@ -179,7 +179,7 @@ 1 + nfs4_xattr_name_maxsz + 1)#define decode_setxattr_maxsz (op_decode_hdr_maxsz + decode_change_info_maxsz)#define encode_listxattrs_maxsz (op_encode_hdr_maxsz + 2 + 1) -#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1) +#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1 + 1)#define encode_removexattr_maxsz (op_encode_hdr_maxsz + 1 + \ nfs4_xattr_name_maxsz)#define decode_removexattr_maxsz (op_decode_hdr_maxsz + \
@@ -504,7 +504,7 @@ static void encode_listxattrs(struct xdr_stream *xdr, {__be32 *p; -encode_op_hdr (xdr,OP_LISTXATTRS , decode_listxattrs_maxsz +1 , hdr); +encode_op_hdr (xdr,OP_LISTXATTRS , decode_listxattrs_maxsz, hdr); p =reserve_space (xdr,12 );if (unlikely (!p))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 171/255 lan743x: fix use of uninitialized variable
In reply to Greg Kroah-HartmanFrom: Sven Van Asbroeck <[email protected]>
[ Upstream commit edbc21113bde13ca3d06eec24b621b1f628583dd ]
When no devicetree is present, the driver will use an uninitialized variable.
Fix by initializing this variable.
--- drivers/net/ethernet/microchip/lan743x_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/microchip/lan743x_main.c +1 -1
@@ -1015,8 +1015,8 @@ static void lan743x_phy_close(struct lan743x_adapter *adapter)static int lan743x_phy_open (struct lan743x_adapter *adapter) {struct lan743x_phy *phy = &adapter->phy; +struct phy_device *phydev =NULL ;struct device_node *phynode; -struct phy_device *phydev;struct net_device *netdev;int ret = -EIO ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 170/255 vrf: Fix fast path output packet handling with async Netfilter rules
In reply to Greg Kroah-HartmanFrom: Martin Willi <[email protected]>
[ Upstream commit 9e2b7fa2df4365e99934901da4fb4af52d81e820 ]
VRF devices use an optimized direct path on output if a default qdisc is involved, calling Netfilter hooks directly. This path, however, does not consider Netfilter rules completing asynchronously, such as with NFQUEUE. The Netfilter okfn() is called for asynchronously accepted packets, but the VRF never passes that packet down the stack to send it out over the slave device. Using the slower redirect path for this seems not feasible, as we do not know beforehand if a Netfilter hook has asynchronously completing rules.
Fix the use of asynchronously completing Netfilter rules in OUTPUT and POSTROUTING by using a special completion function that additionally calls dst_output() to pass the packet down the stack. Also, slightly adjust the use of nf_reset_ct() so that is called in the asynchronous case, too.
--- drivers/net/vrf.c | 92 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 69 insertions(+), 23 deletions(-)
drivers/net/vrf.c +69 -23
@@ -608,8 +608,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)return ret; } -static int vrf_finish_direct (struct net *net,struct sock *sk, -struct sk_buff *skb) +static void vrf_finish_direct (struct sk_buff *skb) {struct net_device *vrf_dev = skb->dev;
@@ -628,7 +627,8 @@ static int vrf_finish_direct(struct net *net, struct sock *sk,skb_pull (skb,ETH_HLEN ); } -return 1 ; +/* reset skb device */ +nf_reset_ct (skb); }#if IS_ENABLED (CONFIG_IPV6 )
@@ -707,15 +707,41 @@ static struct sk_buff *vrf_ip6_out_redirect(struct net_device *vrf_dev,return skb; } +static int vrf_output6_direct_finish (struct net *net,struct sock *sk, +struct sk_buff *skb) +{ +vrf_finish_direct (skb); + +return vrf_ip6_local_out (net, sk, skb); +} +static int vrf_output6_direct (struct net *net,struct sock *sk,struct sk_buff *skb) { +int err =1 ; + skb->protocol =htons (ETH_P_IPV6 ); -return NF_HOOK_COND (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , - net, sk, skb,NULL , skb->dev, - vrf_finish_direct, - !(IPCB (skb)->flags &IPSKB_REROUTED )); +if (!(IPCB (skb)->flags &IPSKB_REROUTED )) + err =nf_hook (NFPROTO_IPV6 ,NF_INET_POST_ROUTING , net, sk, skb, +NULL , skb->dev, vrf_output6_direct_finish); + +if (likely (err ==1 )) +vrf_finish_direct (skb); + +return err; +} + +static int vrf_ip6_out_direct_finish (struct net *net,struct sock *sk, +struct sk_buff *skb) +{ +int err; + + err =vrf_output6_direct (net, sk, skb); +if (likely (err ==1 )) + err =vrf_ip6_local_out (net, sk, skb); + +return err; } static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
@@ -728,18 +754,15 @@ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev, skb->dev = vrf_dev; err =nf_hook (NFPROTO_IPV6 ,NF_INET_LOCAL_OUT , net, sk, - skb,NULL , vrf_dev, vrf_output6_direct); + skb,NULL , vrf_dev, vrf_ip6_out_direct_finish);if (likely (err ==1 )) err =vrf_output6_direct (net, sk, skb); -/* reset skb device */ if (likely (err ==1 )) -nf_reset_ct (skb); -else - skb =NULL ; +return skb; -return skb; +return NULL ; } static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
@@ -919,15 +942,41 @@ static struct sk_buff *vrf_ip_out_redirect(struct net_device *vrf_dev,return skb; } +static int vrf_output_direct_finish (struct net *net,struct sock *sk, +struct sk_buff *skb) +{ +vrf_finish_direct (skb); + +return vrf_ip_local_out (net, sk, skb); +} +static int vrf_output_direct (struct net *net,struct sock *sk,struct sk_buff *skb) { +int err =1 ; + skb->protocol =htons (ETH_P_IP ); -return NF_HOOK_COND (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , - net, sk, skb,NULL , skb->dev, - vrf_finish_direct, - !(IPCB (skb)->flags &IPSKB_REROUTED )); +if (!(IPCB (skb)->flags &IPSKB_REROUTED )) + err =nf_hook (NFPROTO_IPV4 ,NF_INET_POST_ROUTING , net, sk, skb, +NULL , skb->dev, vrf_output_direct_finish); + +if (likely (err ==1 )) +vrf_finish_direct (skb); + +return err; +} + +static int vrf_ip_out_direct_finish (struct net *net,struct sock *sk, +struct sk_buff *skb) +{ +int err; + + err =vrf_output_direct (net, sk, skb); +if (likely (err ==1 )) + err =vrf_ip_local_out (net, sk, skb); + +return err; } static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
@@ -940,18 +989,15 @@ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev, skb->dev = vrf_dev; err =nf_hook (NFPROTO_IPV4 ,NF_INET_LOCAL_OUT , net, sk, - skb,NULL , vrf_dev, vrf_output_direct); + skb,NULL , vrf_dev, vrf_ip_out_direct_finish);if (likely (err ==1 )) err =vrf_output_direct (net, sk, skb); -/* reset skb device */ if (likely (err ==1 )) -nf_reset_ct (skb); -else - skb =NULL ; +return skb; -return skb; +return NULL ; } static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 172/255 arm64/mm: Validate hotplug range before creating linear mapping
In reply to Greg Kroah-HartmanFrom: Anshuman Khandual <[email protected]>
[ Upstream commit 58284a901b426e6130672e9f14c30dfd5a9dbde0 ]
During memory hotplug process, the linear mapping should not be created for a given memory range if that would fall outside the maximum allowed linear range. Else it might cause memory corruption in the kernel virtual space.
Maximum linear mapping region is [PAGE_OFFSET..(PAGE_END -1)] accommodating both its ends but excluding PAGE_END. Max physical range that can be mapped inside this linear mapping range, must also be derived from its end points.
This ensures that arch_add_memory() validates memory hot add range for its potential linear mapping requirements, before creating it with __create_pgd_mapping().
--- arch/arm64/mm/mmu.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
arch/arm64/mm/mmu.c +17 -0
@@ -1433,11 +1433,28 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)free_empty_tables (start, end,PAGE_OFFSET ,PAGE_END ); } +static bool inside_linear_region (u64 start,u64 size) +{ +/* +* Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] +* accommodating both its ends but excluding PAGE_END. Max physical +* range which can be mapped inside this linear mapping range, must +* also be derived from its end points. +*/ +return start >=__pa (_PAGE_OFFSET (vabits_actual)) && + (start + size -1 ) <=__pa (PAGE_END -1 ); +} +int arch_add_memory (int nid,u64 start,u64 size,struct mhp_params *params) {int ret, flags =0 ; +if (!inside_linear_region (start, size)) { +pr_err ("[%llx %llx] is outside linear mapping region\n" , start, start + size); +return -EINVAL ; + } +if (rodata_full ||debug_pagealloc_enabled ()) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 155/255 igc: Fix returning wrong statistics
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit 6b7ed22ae4c96a415001f0c3116ebee15bb8491a ]
'igc_update_stats()' was not updating 'netdev->stats', so the returned statistics, for example, requested by:
$ ip -s link show dev enp3s0
were not being updated and were always zero.
Fix by returning a set of statistics that are actually being updated (adapter->stats64).
--- drivers/net/ethernet/intel/igc/igc_main.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +8 -6
@@ -3890,21 +3890,23 @@ static int igc_change_mtu(struct net_device *netdev, int new_mtu) }/** -* igc_get_stats - Get System Network Statistics +* igc_get_stats64 - Get System Network Statistics * @netdev: network interface device structure +* @stats: rtnl_link_stats64 pointer * * Returns the address of the device statistics structure. * The statistics are updated here and also from the timer callback. */ -static struct net_device_stats *igc_get_stats (struct net_device *netdev) +static void igc_get_stats64 (struct net_device *netdev, +struct rtnl_link_stats64 *stats) {struct igc_adapter *adapter =netdev_priv (netdev); +spin_lock (&adapter->stats64_lock);if (!test_bit (__IGC_RESETTING, &adapter->state))igc_update_stats (adapter); - -/* only return the current stats */ -return &netdev->stats; +memcpy (stats, &adapter->stats64,sizeof (*stats)); +spin_unlock (&adapter->stats64_lock); } static netdev_features_t igc_fix_features(struct net_device *netdev,
@@ -4833,7 +4835,7 @@ static const struct net_device_ops igc_netdev_ops = { .ndo_set_rx_mode = igc_set_rx_mode, .ndo_set_mac_address = igc_set_mac, .ndo_change_mtu = igc_change_mtu, - .ndo_get_stats = igc_get_stats, + .ndo_get_stats64 = igc_get_stats64, .ndo_fix_features = igc_fix_features, .ndo_set_features = igc_set_features, .ndo_features_check = igc_features_check,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 173/255 kernel/watchdog: fix watchdog_allowed_mask not used warning
In reply to Greg Kroah-HartmanFrom: Santosh Sivaraj <[email protected]>
[ Upstream commit e7e046155af04cdca5e1157f28b07e1651eb317b ]
Define watchdog_allowed_mask only when SOFTLOCKUP_DETECTOR is enabled.
--- kernel/watchdog.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/watchdog.c +2 -2
@@ -44,8 +44,6 @@ int __read_mostly soft_watchdog_user_enabled = 1;int __read_mostly watchdog_thresh =10 ;static int __read_mostly nmi_watchdog_available; -static struct cpumask watchdog_allowed_mask__read_mostly ; -struct cpumask watchdog_cpumask__read_mostly ;unsigned long *watchdog_cpumask_bits =cpumask_bits (&watchdog_cpumask);
@@ -162,6 +160,8 @@ static void lockup_detector_update_enable(void)int __read_mostly sysctl_softlockup_all_cpu_backtrace;#endif +static struct cpumask watchdog_allowed_mask__read_mostly ; +/* Global variables, exported for sysctl */ unsigned int __read_mostly softlockup_panic =CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 176/255 perf: Fix get_recursion_context()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit ce0f17fc93f63ee91428af10b7b2ddef38cd19e5 ]
One should use in_serving_softirq() to detect SoftIRQ context.
--- kernel/events/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/internal.h +1 -1
@@ -211,7 +211,7 @@ static inline int get_recursion_context(int *recursion) rctx =3 ; else if (in_irq()) rctx =2 ; - else if (in_softirq()) + else if (in_serving_softirq()) rctx =1 ; else rctx =0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 131/255 ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
In reply to Greg Kroah-HartmanFrom: Andrew Jeffery <[email protected]>
[ Upstream commit 9fa2e7af3d53a4b769136eccc32c02e128a4ee51 ]
Setting both CONFIG_KPROBES=y and CONFIG_FORTIFY_SOURCE=y on ARM leads to a panic in memcpy() when injecting a kprobe despite the fixes found in commit e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") and commit 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes:
optimized kprobes illegal instruction").
arch/arm/include/asm/kprobes.h effectively declares
the target type of the optprobe_template_entry assembly label as a u32 which leads memcpy()'s __builtin_object_size() call to determine that the pointed-to object is of size four. However, the symbol is used as a handle for the optimised probe assembly template that is at least 96 bytes in size. The symbol's use despite its type blows up the memcpy() in ARM's arch_prepare_optimized_kprobe() with a false-positive fortify_panic() when it should instead copy the optimised probe template into place:
``` $ sudo perf probe -a aspeed_g6_pinctrl_probe [ 158.457252] detected buffer overflow in memcpy [ 158.458069] ------------[ cut here ]------------ [ 158.458283] kernel BUG at lib/string.c:1153! [ 158.458436] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 158.458768] Modules linked in: [ 158.459043] CPU: 1 PID: 99 Comm: perf Not tainted 5.9.0-rc7-00038-gc53ebf8167e9 #158 [ 158.459296] Hardware name: Generic DT based system [ 158.459529] PC is at fortify_panic+0x18/0x20 [ 158.459658] LR is at __irq_work_queue_local+0x3c/0x74 [ 158.459831] pc : [<8047451c>] lr : [<8020ecd4>] psr: 60000013 [ 158.460032] sp : be2d1d50 ip : be2d1c58 fp : be2d1d5c [ 158.460174] r10: 00000006 r9 : 00000000 r8 : 00000060 [ 158.460348] r7 : 8011e434 r6 : b9e0b800 r5 : 7f000000 r4 : b9fe4f0c [ 158.460557] r3 : 80c04cc8 r2 : 00000000 r1 : be7c03cc r0 : 00000022 [ 158.460801] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 158.461037] Control: 10c5387d Table: b9cd806a DAC: 00000051 [ 158.461251] Process perf (pid: 99, stack limit = 0x81c71a69) [ 158.461472] Stack: (0xbe2d1d50 to 0xbe2d2000) [ 158.461757] 1d40: be2d1d84 be2d1d60 8011e724 80474510 [ 158.462104] 1d60: b9e0b800 b9fe4f0c 00000000 b9fe4f14 80c8ec80 be235000 be2d1d9c be2d1d88 [ 158.462436] 1d80: 801cee44 8011e57c b9fe4f0c 00000000 be2d1dc4 be2d1da0 801d0ad0 801cedec [ 158.462742] 1da0: 00000000 00000000 b9fe4f00 ffffffea 00000000 be235000 be2d1de4 be2d1dc8 [ 158.463087] 1dc0: 80204604 801d0738 00000000 00000000 b9fe4004 ffffffea be2d1e94 be2d1de8 [ 158.463428] 1de0: 80205434 80204570 00385c00 00000000 00000000 00000000 be2d1e14 be2d1e08 [ 158.463880] 1e00: 802ba014 b9fe4f00 b9e718c0 b9fe4f84 b9e71ec8 be2d1e24 00000000 00385c00 [ 158.464365] 1e20: 00000000 626f7270 00000065 802b905c be2d1e94 0000002e 00000000 802b9914 [ 158.464829] 1e40: be2d1e84 be2d1e50 802b9914 8028ff78 804629d0 b9e71ec0 0000002e b9e71ec0 [ 158.465141] 1e60: be2d1ea8 80c04cc8 00000cc0 b9e713c4 00000002 80205834 80205834 0000002e [ 158.465488] 1e80: be235000 be235000 be2d1ea4 be2d1e98 80205854 80204e94 be2d1ecc be2d1ea8 [ 158.465806] 1ea0: 801ee4a0 80205840 00000002 80c04cc8 00000000 0000002e 0000002e 00000000 [ 158.466110] 1ec0: be2d1f0c be2d1ed0 801ee5c8 801ee428 00000000 be2d0000 006b1fd0 00000051 [ 158.466398] 1ee0: 00000000 b9eedf00 0000002e 80204410 006b1fd0 be2d1f60 00000000 00000004 [ 158.466763] 1f00: be2d1f24 be2d1f10 8020442c 801ee4c4 80205834 802c613c be2d1f5c be2d1f28 [ 158.467102] 1f20: 802c60ac 8020441c be2d1fac be2d1f38 8010c764 802e9888 be2d1f5c b9eedf00 [ 158.467447] 1f40: b9eedf00 006b1fd0 0000002e 00000000 be2d1f94 be2d1f60 802c634c 802c5fec [ 158.467812] 1f60: 00000000 00000000 00000000 80c04cc8 006b1fd0 00000003 76f7a610 00000004 [ 158.468155] 1f80: 80100284 be2d0000 be2d1fa4 be2d1f98 802c63ec 802c62e8 00000000 be2d1fa8 [ 158.468508] 1fa0: 80100080 802c63e0 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 [ 158.468858] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c [ 158.469202] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 60000010 00000003 00000000 00000000 [ 158.469461] Backtrace: [ 158.469683] [<80474504>] (fortify_panic) from [<8011e724>] (arch_prepare_optimized_kprobe+0x1b4/0x1f8) [ 158.470021] [<8011e570>] (arch_prepare_optimized_kprobe) from [<801cee44>] (alloc_aggr_kprobe+0x64/0x70) [ 158.470287] r9:be235000 r8:80c8ec80 r7:b9fe4f14 r6:00000000 r5:b9fe4f0c r4:b9e0b800 [ 158.470478] [<801cede0>] (alloc_aggr_kprobe) from [<801d0ad0>] (register_kprobe+0x3a4/0x5a0) [ 158.470685] r5:00000000 r4:b9fe4f0c [ 158.470790] [<801d072c>] (register_kprobe) from [<80204604>] (__register_trace_kprobe+0xa0/0xa4) [ 158.471001] r9:be235000 r8:00000000 r7:ffffffea r6:b9fe4f00 r5:00000000 r4:00000000 [ 158.471188] [<80204564>] (__register_trace_kprobe) from [<80205434>] (trace_kprobe_create+0x5ac/0x9ac) [ 158.471408] r7:ffffffea r6:b9fe4004 r5:00000000 r4:00000000 [ 158.471553] [<80204e88>] (trace_kprobe_create) from [<80205854>] (create_or_delete_trace_kprobe+0x20/0x3c) [ 158.471766] r10:be235000 r9:be235000 r8:0000002e r7:80205834 r6:80205834 r5:00000002 [ 158.471949] r4:b9e713c4 [ 158.472027] [<80205834>] (create_or_delete_trace_kprobe) from [<801ee4a0>] (trace_run_command+0x84/0x9c) [ 158.472255] [<801ee41c>] (trace_run_command) from [<801ee5c8>] (trace_parse_run_command+0x110/0x1f8) [ 158.472471] r6:00000000 r5:0000002e r4:0000002e [ 158.472594] [<801ee4b8>] (trace_parse_run_command) from [<8020442c>] (probes_write+0x1c/0x28) [ 158.472800] r10:00000004 r9:00000000 r8:be2d1f60 r7:006b1fd0 r6:80204410 r5:0000002e [ 158.472968] r4:b9eedf00 [ 158.473046] [<80204410>] (probes_write) from [<802c60ac>] (vfs_write+0xcc/0x1e8) [ 158.473226] [<802c5fe0>] (vfs_write) from [<802c634c>] (ksys_write+0x70/0xf8) [ 158.473400] r8:00000000 r7:0000002e r6:006b1fd0 r5:b9eedf00 r4:b9eedf00 [ 158.473567] [<802c62dc>] (ksys_write) from [<802c63ec>] (sys_write+0x18/0x1c) [ 158.473745] r9:be2d0000 r8:80100284 r7:00000004 r6:76f7a610 r5:00000003 r4:006b1fd0 [ 158.473932] [<802c63d4>] (sys_write) from [<80100080>] (ret_fast_syscall+0x0/0x54) [ 158.474126] Exception stack(0xbe2d1fa8 to 0xbe2d1ff0) [ 158.474305] 1fa0: 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 [ 158.474573] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c [ 158.474811] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 [ 158.475171] Code: e24cb004 e1a01000 e59f0004 ebf40dd3 (e7f001f2) [ 158.475847] ---[ end trace 55a5b31c08a29f00 ]--- [ 158.476088] Kernel panic - not syncing: Fatal exception [ 158.476375] CPU0: stopping [ 158.476709] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G D 5.9.0-rc7-00038-gc53ebf8167e9 #158 [ 158.477176] Hardware name: Generic DT based system [ 158.477411] Backtrace: [ 158.477604] [<8010dd28>] (dump_backtrace) from [<8010dfd4>] (show_stack+0x20/0x24) [ 158.477990] r7:00000000 r6:60000193 r5:00000000 r4:80c2f634 [ 158.478323] [<8010dfb4>] (show_stack) from [<8046390c>] (dump_stack+0xcc/0xe8) [ 158.478686] [<80463840>] (dump_stack) from [<80110750>] (handle_IPI+0x334/0x3a0) [ 158.479063] r7:00000000 r6:00000004 r5:80b65cc8 r4:80c78278 [ 158.479352] [<8011041c>] (handle_IPI) from [<801013f8>] (gic_handle_irq+0x88/0x94) [ 158.479757] r10:10c5387d r9:80c01ed8 r8:00000000 r7:c0802000 r6:80c0537c r5:000003ff [ 158.480146] r4:c080200c r3:fffffff4 [ 158.480364] [<80101370>] (gic_handle_irq) from [<80100b6c>] (__irq_svc+0x6c/0x90) [ 158.480748] Exception stack(0x80c01ed8 to 0x80c01f20) [ 158.481031] 1ec0: 000128bc 00000000 [ 158.481499] 1ee0: be7b8174 8011d3a0 80c00000 00000000 80c04cec 80c04d28 80c5d7c2 80a026d4 [ 158.482091] 1f00: 10c5387d 80c01f34 80c01f38 80c01f28 80109554 80109558 60000013 ffffffff [ 158.482621] r9:80c00000 r8:80c5d7c2 r7:80c01f0c r6:ffffffff r5:60000013 r4:80109558 [ 158.482983] [<80109518>] (arch_cpu_idle) from [<80818780>] (default_idle_call+0x38/0x120) [ 158.483360] [<80818748>] (default_idle_call) from [<801585a8>] (do_idle+0xd4/0x158) [ 158.483945] r5:00000000 r4:80c00000 [ 158.484237] [<801584d4>] (do_idle) from [<801588f4>] (cpu_startup_entry+0x28/0x2c) [ 158.484784] r9:80c78000 r8:00000000 r7:80c78000 r6:80c78040 r5:80c04cc0 r4:000000d6 [ 158.485328] [<801588cc>] (cpu_startup_entry) from [<80810a78>] (rest_init+0x9c/0xbc) [ 158.485930] [<808109dc>] (rest_init) from [<80b00ae4>] (arch_call_rest_init+0x18/0x1c) [ 158.486503] r5:80c04cc0 r4:00000001 [ 158.486857] [<80b00acc>] (arch_call_rest_init) from [<80b00fcc>] (start_kernel+0x46c/0x548) [ 158.487589] [<80b00b60>] (start_kernel) from [<00000000>] (0x0) ```
--- arch/arm/include/asm/kprobes.h | 22 +++++++++++----------- arch/arm/probes/kprobes/opt-arm.c | 18 +++++++++--------- 2 files changed, 20 insertions(+), 20 deletions(-)
arch/arm/include/asm/kprobes.h +11 -11
@@ -44,20 +44,20 @@ int kprobe_exceptions_notify(struct notifier_block *self, unsigned long val, void *data);/* optinsn template addresses */ -extern __visible kprobe_opcode_t optprobe_template_entry; -extern __visible kprobe_opcode_t optprobe_template_val; -extern __visible kprobe_opcode_t optprobe_template_call; -extern __visible kprobe_opcode_t optprobe_template_end; -extern __visible kprobe_opcode_t optprobe_template_sub_sp; -extern __visible kprobe_opcode_t optprobe_template_add_sp; -extern __visible kprobe_opcode_t optprobe_template_restore_begin; -extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn; -extern __visible kprobe_opcode_t optprobe_template_restore_end; +extern __visible kprobe_opcode_t optprobe_template_entry[]; +extern __visible kprobe_opcode_t optprobe_template_val[]; +extern __visible kprobe_opcode_t optprobe_template_call[]; +extern __visible kprobe_opcode_t optprobe_template_end[]; +extern __visible kprobe_opcode_t optprobe_template_sub_sp[]; +extern __visible kprobe_opcode_t optprobe_template_add_sp[]; +extern __visible kprobe_opcode_t optprobe_template_restore_begin[]; +extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn[]; +extern __visible kprobe_opcode_t optprobe_template_restore_end[];#define MAX_OPTIMIZED_LENGTH 4#define MAX_OPTINSN_SIZE \ - ((unsigned long)&optprobe_template_end - \ - (unsigned long)&optprobe_template_entry) + ((unsigned long)optprobe_template_end - \ + (unsigned long)optprobe_template_entry)#define RELATIVEJUMP_SIZE 4struct arch_optimized_insn {
arch/arm/probes/kprobes/opt-arm.c +9 -9
@@ -85,21 +85,21 @@ asm ( "optprobe_template_end:\n");#define TMPL_VAL_IDX \ - ((unsigned long *)&optprobe_template_val - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_val - (unsigned long *)optprobe_template_entry)#define TMPL_CALL_IDX \ - ((unsigned long *)&optprobe_template_call - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_call - (unsigned long *)optprobe_template_entry)#define TMPL_END_IDX \ - ((unsigned long *)&optprobe_template_end - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_end - (unsigned long *)optprobe_template_entry)#define TMPL_ADD_SP \ - ((unsigned long *)&optprobe_template_add_sp - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_add_sp - (unsigned long *)optprobe_template_entry)#define TMPL_SUB_SP \ - ((unsigned long *)&optprobe_template_sub_sp - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_sub_sp - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_BEGIN \ - ((unsigned long *)&optprobe_template_restore_begin - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_begin - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_ORIGN_INSN \ - ((unsigned long *)&optprobe_template_restore_orig_insn - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_orig_insn - (unsigned long *)optprobe_template_entry)#define TMPL_RESTORE_END \ - ((unsigned long *)&optprobe_template_restore_end - (unsigned long *)&optprobe_template_entry) + ((unsigned long *)optprobe_template_restore_end - (unsigned long *)optprobe_template_entry)/* * ARM can always optimize an instruction when using ARM ISA, except
@@ -234,7 +234,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or }/* Copy arch-dep-instance from template. */ -memcpy (code, (unsigned long *)&optprobe_template_entry, +memcpy (code, (unsigned long *)optprobe_template_entry,TMPL_END_IDX *sizeof (kprobe_opcode_t));/* Adjust buffer according to instruction. */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 174/255 mm: memcontrol: fix missing wakeup polling thread
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
[ Upstream commit 8b21ca0218d29cc6bb7028125c7e5a10dfb4730c ]
When we poll the swap.events, we can miss being woken up when the swap event occurs. Because we didn't notify.
--- include/linux/memcontrol.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
include/linux/memcontrol.h +9 -2
@@ -897,12 +897,19 @@ static inline void count_memcg_event_mm(struct mm_struct *mm,static inline void memcg_memory_event (struct mem_cgroup *memcg,enum memcg_memory_event event) { +bool swap_event = event ==MEMCG_SWAP_HIGH || event ==MEMCG_SWAP_MAX || + event ==MEMCG_SWAP_FAIL ; +atomic_long_inc (&memcg->memory_events_local[event]); -cgroup_file_notify (&memcg->events_local_file); +if (!swap_event) +cgroup_file_notify (&memcg->events_local_file); do { atomic_long_inc(&memcg->memory_events[event]); - cgroup_file_notify(&memcg->events_file); + if (swap_event) + cgroup_file_notify(&memcg->swap_events_file); + else + cgroup_file_notify(&memcg->events_file); if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) break;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 143/255 SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow()
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
[ Upstream commit d321ff589c16d8c2207485a6d7fbdb14e873d46e ]
The TP_fast_assign() section is careful enough not to dereference xdr->rqst if it's NULL. The TP_STRUCT__entry section is not.
--- include/trace/events/sunrpc.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
include/trace/events/sunrpc.h +4 -4
@@ -607,10 +607,10 @@ TRACE_EVENT(rpc_xdr_overflow, __field(size_t, tail_len) __field(unsigned int, page_len) __field(unsigned int, len) - __string(progname, - xdr->rqst->rq_task->tk_client->cl_program->name) - __string(procedure, - xdr->rqst->rq_task->tk_msg.rpc_proc->p_name) + __string(progname, xdr->rqst ? + xdr->rqst->rq_task->tk_client->cl_program->name : "unknown") + __string(procedure, xdr->rqst ? + xdr->rqst->rq_task->tk_msg.rpc_proc->p_name : "unknown") ), TP_fast_assign(
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 144/255 NFSD: Fix use-after-free warning when doing inter-server copy
In reply to Greg Kroah-HartmanFrom: Dai Ngo <[email protected]>
[ Upstream commit 36e1e5ba90fb3fba6888fae26e4dfc28bf70aaf1 ]
The source file nfsd_file is not constructed the same as other nfsd_file's via nfsd_file_alloc. nfsd_file_put should not be called to free the object; nfsd_file_put is not the inverse of kzalloc, instead kfree is called by nfsd4_do_async_copy when done.
--- fs/nfsd/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4proc.c +1 -1
@@ -1299,7 +1299,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src, struct nfsd_file *dst) {nfs42_ssc_close (src->nf_file); -nfsd_file_put (src); +/* 'src' is freed by nfsd4_do_async_copy */ nfsd_file_put (dst);mntput (ss_mnt); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 175/255 afs: Fix afs_write_end() when called with copied == 0 [ver #3]
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 3ad216ee73abc554ed8f13f4f8b70845a7bef6da ]
When afs_write_end() is called with copied == 0, it tries to set the dirty region, but there's no way to actually encode a 0-length region in the encoding in page->private.
"0,0", for example, indicates a 1-byte region at offset 0. The maths miscalculates this and sets it incorrectly.
Fix it to just do nothing but unlock and put the page in this case. We don't actually need to mark the page dirty as nothing presumably changed.
--- fs/afs/write.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/afs/write.c +4 -1
@@ -169,11 +169,14 @@ int afs_write_end(struct file *file, struct address_space *mapping,unsigned int f, from = pos & (PAGE_SIZE -1 );unsigned int t, to = from + copied;loff_t i_size, maybe_i_size; -int ret; +int ret =0 ;_enter ("{%llx:%llu},{%lx}" , vnode->fid.vid, vnode->fid.vnode, page->index); +if (copied ==0 ) + goto out; + maybe_i_size = pos + copied; i_size =i_size_read (&vnode->vfs_inode);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 180/255 perf: Simplify group_sched_in()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 251ff2d49347793d348babcff745289b11910e96 ]
Collate the error paths. Code duplication only leads to divergence and extra bugs.
--- kernel/events/core.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
kernel/events/core.c +3 -7
@@ -2565,11 +2565,8 @@ group_sched_in(struct perf_event *group_event, pmu->start_txn (pmu,PERF_PMU_TXN_ADD ); -if (event_sched_in (group_event, cpuctx, ctx)) { - pmu->cancel_txn (pmu); -perf_mux_hrtimer_restart (cpuctx); -return -EAGAIN ; - } +if (event_sched_in (group_event, cpuctx, ctx)) + goto error;/* * Schedule in siblings as one group (if any):
@@ -2598,10 +2595,9 @@ group_error: }event_sched_out (group_event, cpuctx, ctx); +error: pmu->cancel_txn (pmu); -perf_mux_hrtimer_restart (cpuctx); -return -EAGAIN ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 156/255 lan743x: correctly handle chips with internal PHY
In reply to Greg Kroah-HartmanFrom: Sven Van Asbroeck <[email protected]>
[ Upstream commit 902a66e08ceaadb9a7a1ab3a4f3af611cd1d8cba ]
Commit 6f197fb63850 ("lan743x: Added fixed link and RGMII support") assumes that chips with an internal PHY will never have a devicetree entry. This is incorrect: even for these chips, a devicetree entry can be useful e.g. to pass the mac address from bootloader to chip:
&pcie {
status = "okay";
host@0 {
reg = <0 0 0 0 0>;
#address-cells = <3>;
#size-cells = <2>;
lan7430: ethernet@0 {
/* LAN7430 with internal PHY */
compatible = "microchip,lan743x";
status = "okay";
reg = <0 0 0 0 0>;
/* filled in by bootloader */
local-mac-address = [00 00 00 00 00 00];
};
};
};If a devicetree entry is present, the driver will not attach the chip to its internal phy, and the chip will be non-operational.
Fix by tweaking the phy connection algorithm:
- first try to connect to a phy specified in the devicetree (could be 'real' phy, or just a 'fixed-link')
- if that doesn't succeed, try to connect to an internal phy, even if the chip has a devnode
Tested on a LAN7430 with internal PHY. I cannot test a device using fixed-link, as I do not have access to one.
--- drivers/net/ethernet/microchip/lan743x_main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +6 -4
@@ -1027,9 +1027,9 @@ static int lan743x_phy_open(struct lan743x_adapter *adapter) netdev = adapter->netdev; phynode =of_node_get (adapter->pdev->dev.of_node); - adapter->phy_mode =PHY_INTERFACE_MODE_GMII ;if (phynode) { +/* try devicetree phy, or fixed link */ of_get_phy_mode (phynode, &adapter->phy_mode);if (of_phy_is_fixed_link (phynode)) {
@@ -1045,13 +1045,15 @@ static int lan743x_phy_open(struct lan743x_adapter *adapter) lan743x_phy_link_status_change,0 , adapter->phy_mode);of_node_put (phynode); -if (!phydev) - goto return_error; - }else { + } + +if (!phydev) { +/* try internal phy */ phydev =phy_find_first (adapter->mdiobus);if (!phydev) goto return_error; + adapter->phy_mode =PHY_INTERFACE_MODE_GMII ; ret =phy_connect_direct (netdev, phydev, lan743x_phy_link_status_change, adapter->phy_mode);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 181/255 perf: Fix event multiplexing for exclusive groups
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 2714c3962f304d031d5016c963c4b459337b0749 ]
Commit 9e6302056f80 ("perf: Use hrtimers for event multiplexing") placed the hrtimer (re)start call in the wrong place. Instead of capturing all scheduling failures, it only considered the PMU failure.
The result is that groups using perf_event_attr::exclusive are no longer rotated.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -2597,7 +2597,6 @@ group_error: error: pmu->cancel_txn (pmu); -perf_mux_hrtimer_restart (cpuctx);return -EAGAIN ; }
@@ -3653,6 +3652,7 @@ static int merge_sched_in(struct perf_event *event, void *data) *can_add_hw =0 ; ctx->rotate_necessary =1 ; +perf_mux_hrtimer_restart (cpuctx); }return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 182/255 firmware: xilinx: fix out-of-bounds access
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit f3217d6f2f7a76b36a3326ad58c8897f4d5fbe31 upstream.
The zynqmp_pm_set_suspend_mode() and zynqmp_pm_get_trustzone_version() functions pass values as api_id into zynqmp_pm_invoke_fn that are beyond PM_API_MAX, resulting in an out-of-bounds access:
drivers/firmware/xilinx/zynqmp.c: In function 'zynqmp_pm_set_suspend_mode':drivers/firmware/xilinx/zynqmp.c:150:24: warning: array subscript 2562 is above array bounds of 'u32[64]' {aka 'unsigned int[64]'} [-Warray-bounds]
150 | if (zynqmp_pm_features[api_id] != PM_FEATURE_UNCHECKED)
| ~~~~~~~~~~~~~~~~~~^~~~~~~~
drivers/firmware/xilinx/zynqmp.c:28:12: note: while referencing 'zynqmp_pm_features'
28 | static u32 zynqmp_pm_features[PM_API_MAX];
| ^~~~~~~~~~~~~~~~~~Replace the resulting undefined behavior with an error return. This may break some things that happen to work at the moment but seems better than randomly overwriting kernel data.
I assume we need additional fixes for the two functions that now return an error.
--- drivers/firmware/xilinx/zynqmp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/firmware/xilinx/zynqmp.c +3 -0
@@ -147,6 +147,9 @@ static int zynqmp_pm_feature(u32 api_id)return 0 ;/* Return value if feature is already checked */ +if (api_id >ARRAY_SIZE (zynqmp_pm_features)) +return PM_FEATURE_INVALID ; +if (zynqmp_pm_features[api_id] !=PM_FEATURE_UNCHECKED )return zynqmp_pm_features[api_id];
Greg Kroah-Hartman
maintainerPATCH 184/255 erofs: derive atime instead of leaving it empty
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
commit d3938ee23e97bfcac2e0eb6b356875da73d700df upstream.
EROFS has _only one_ ondisk timestamp (ctime is currently documented and recorded, we might also record mtime instead with a new compat feature if needed) for each extended inode since EROFS isn't mainly for archival purposes so no need to keep all timestamps on disk especially for Android scenarios due to security concerns. Also, romfs/cramfs don't have their own on-disk timestamp, and squashfs only records mtime instead.
Let's also derive access time from ondisk timestamp rather than leaving it empty, and if mtime/atime for each file are really needed for specific scenarios as well, we can also use xattrs to record them then.
--- fs/erofs/inode.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
fs/erofs/inode.c +11 -10
@@ -107,11 +107,9 @@ static struct page *erofs_read_inode(stri_gid_write (inode,le32_to_cpu (die->i_gid));set_nlink (inode,le32_to_cpu (die->i_nlink)); -/* ns timestamp */ - inode->i_mtime.tv_sec = inode->i_ctime.tv_sec = -le64_to_cpu (die->i_ctime); - inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec = -le32_to_cpu (die->i_ctime_nsec); +/* extended inode has its own timestamp */ + inode->i_ctime.tv_sec =le64_to_cpu (die->i_ctime); + inode->i_ctime.tv_nsec =le32_to_cpu (die->i_ctime_nsec); inode->i_size =le64_to_cpu (die->i_size);
@@ -149,11 +147,9 @@ static struct page *erofs_read_inode(stri_gid_write (inode,le16_to_cpu (dic->i_gid));set_nlink (inode,le16_to_cpu (dic->i_nlink)); -/* use build time to derive all file time */ - inode->i_mtime.tv_sec = inode->i_ctime.tv_sec = - sbi->build_time; - inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec = - sbi->build_time_nsec; +/* use build time for compact inodes */ + inode->i_ctime.tv_sec = sbi->build_time; + inode->i_ctime.tv_nsec = sbi->build_time_nsec; inode->i_size =le32_to_cpu (dic->i_size);if (erofs_inode_is_data_compressed (vi->datalayout))
@@ -167,6 +163,11 @@ static struct page *erofs_read_inode(str goto err_out; } + inode->i_mtime.tv_sec = inode->i_ctime.tv_sec; + inode->i_atime.tv_sec = inode->i_ctime.tv_sec; + inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec; + inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec; +if (!nblks)/* measure inode.i_blocks as generic filesystems */ inode->i_blocks =roundup (inode->i_size,EROFS_BLKSIZ ) >>9 ;
Greg Kroah-Hartman
maintainerPATCH 157/255 net: phy: realtek: support paged operations on RTL8201CP
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit f3037c5a31b58a73b32a36e938ad0560085acadd ]
The RTL8401-internal PHY identifies as RTL8201CP, and the init sequence in r8169, copied from vendor driver r8168, uses paged operations. Therefore set the same paged operation callbacks as for the other Realtek PHY's.
--- drivers/net/phy/realtek.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/realtek.c +2 -0
@@ -542,6 +542,8 @@ static struct phy_driver realtek_drvs[] = { { PHY_ID_MATCH_EXACT(0x00008201), .name = "RTL8201CP Ethernet", + .read_page = rtl821x_read_page, + .write_page = rtl821x_write_page, }, {PHY_ID_MATCH_EXACT (0x001cc816 ), .name = "RTL8201F Fast Ethernet",
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 158/255 xfs: fix flags argument to rmap lookup when converting shared file rmaps
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit ea8439899c0b15a176664df62aff928010fad276 ]
Pass the same oldext argument (which contains the existing rmapping's unwritten state) to xfs_rmap_lookup_le_range at the start of xfs_rmap_convert_shared. At this point in the code, flags is zero, which means that we perform lookups using the wrong key.
--- fs/xfs/libxfs/xfs_rmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/libxfs/xfs_rmap.c +1 -1
@@ -1514,7 +1514,7 @@ xfs_rmap_convert_shared(* record for our insertion point. This will also give us the record for * start block contiguity tests. */ - error =xfs_rmap_lookup_le_range (cur, bno, owner, offset, flags, + error =xfs_rmap_lookup_le_range (cur, bno, owner, offset, oldext, &PREV , &i);if (error) goto done;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 185/255 ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
In reply to Greg Kroah-HartmanFrom: Kaixu Xia <[email protected]>
commit 174fe5ba2d1ea0d6c5ab2a7d4aa058d6d497ae4d upstream.
The macro MOPT_Q is used to indicates the mount option is related to quota stuff and is defined to be MOPT_NOSUPPORT when CONFIG_QUOTA is disabled. Normally the quota options are handled explicitly, so it didn't matter that the MOPT_STRING flag was missing, even though the usrjquota and grpjquota mount options take a string argument. It's important that's present in the !CONFIG_QUOTA case, since without MOPT_STRING, the mount option matcher will match usrjquota= followed by an integer, and will otherwise skip the table entry, and so "mount option not supported" error message is never reported.
[ Fixed up the commit description to better explain why the fix
works. --TYT ]
--- fs/ext4/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext4/super.c +2 -2
@@ -1829,8 +1829,8 @@ static const struct mount_opts { {Opt_noquota, (EXT4_MOUNT_QUOTA |EXT4_MOUNT_USRQUOTA |EXT4_MOUNT_GRPQUOTA |EXT4_MOUNT_PRJQUOTA ), MOPT_CLEAR | MOPT_Q}, - {Opt_usrjquota, 0, MOPT_Q}, - {Opt_grpjquota, 0, MOPT_Q}, + {Opt_usrjquota, 0, MOPT_Q | MOPT_STRING}, + {Opt_grpjquota, 0, MOPT_Q | MOPT_STRING}, {Opt_offusrjquota, 0, MOPT_Q}, {Opt_offgrpjquota, 0, MOPT_Q}, {Opt_jqfmt_vfsold, QFMT_VFS_OLD, MOPT_QFMT},
Greg Kroah-Hartman
maintainerPATCH 159/255 xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 5dda3897fd90783358c4c6115ef86047d8c8f503 ]
When the bmbt scrubber is looking up rmap extents, we need to set the extent flags from the bmbt record fully. This will matter once we fix the rmap btree comparison functions to check those flags correctly.
--- fs/xfs/scrub/bmap.c | 2 ++ 1 file changed, 2 insertions(+)
fs/xfs/scrub/bmap.c +2 -0
@@ -113,6 +113,8 @@ xchk_bmap_get_rmap(if (info->whichfork ==XFS_ATTR_FORK ) rflags |=XFS_RMAP_ATTR_FORK ; +if (irec->br_state ==XFS_EXT_UNWRITTEN ) + rflags |=XFS_RMAP_UNWRITTEN ;/* * CoW staging extents are owned (on disk) by the refcountbt, so
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 160/255 xfs: fix rmap key and record comparison functions
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f ]
Keys for extent interval records in the reverse mapping btree are supposed to be computed as follows:
(physical block, owner, fork, is_btree, is_unwritten, offset)
This provides users the ability to look up a reverse mapping from a bmbt record -- start with the physical block; then if there are multiple records for the same block, move on to the owner; then the inode fork type; and so on to the file offset.
However, the key comparison functions incorrectly remove the fork/btree/unwritten information that's encoded in the on-disk offset. This means that lookup comparisons are only done with:
(physical block, owner, offset)
This means that queries can return incorrect results. On consistent filesystems this hasn't been an issue because blocks are never shared between forks or with bmbt blocks; and are never unwritten. However, this bug means that online repair cannot always detect corruption in the key information in internal rmapbt nodes.
Found by fuzzing keys[1].attrfork = ones on xfs/371.
--- fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/xfs/libxfs/xfs_rmap_btree.c +8 -8
@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff(else if (y > x)return -1 ; - x =XFS_RMAP_OFF (be64_to_cpu (kp->rm_offset)); - y = rec->rm_offset; + x =be64_to_cpu (kp->rm_offset); + y =xfs_rmap_irec_offset_pack (rec);if (x > y)return 1 ;else if (y > x)
@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys(else if (y > x)return -1 ; - x =XFS_RMAP_OFF (be64_to_cpu (kp1->rm_offset)); - y =XFS_RMAP_OFF (be64_to_cpu (kp2->rm_offset)); + x =be64_to_cpu (kp1->rm_offset); + y =be64_to_cpu (kp2->rm_offset);if (x > y)return 1 ;else if (y > x)
@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder(return 1 ; else if (a > b) return 0; - a =XFS_RMAP_OFF (be64_to_cpu (k1->rmap.rm_offset)); - b =XFS_RMAP_OFF (be64_to_cpu (k2->rmap.rm_offset)); + a =be64_to_cpu (k1->rmap.rm_offset); + b =be64_to_cpu (k2->rmap.rm_offset);if (a <= b)return 1 ;return 0 ;
@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder(return 1 ; else if (a > b) return 0; - a =XFS_RMAP_OFF (be64_to_cpu (r1->rmap.rm_offset)); - b =XFS_RMAP_OFF (be64_to_cpu (r2->rmap.rm_offset)); + a =be64_to_cpu (r1->rmap.rm_offset); + b =be64_to_cpu (r2->rmap.rm_offset);if (a <= b)return 1 ;return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 161/255 xfs: fix brainos in the refcount scrubbers rmap fragment processor
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 54e9b09e153842ab5adb8a460b891e11b39e9c3d ]
Fix some serious WTF in the reference count scrubber's rmap fragment processing. The code comment says that this loop is supposed to move all fragment records starting at or before bno onto the worklist, but there's no obvious reason why nr (the number of items added) should increment starting from 1, and breaking the loop when we've added the target number seems dubious since we could have more rmap fragments that should have been added to the worklist.
This seems to manifest in xfs/411 when adding one to the refcount field.
--- fs/xfs/scrub/refcount.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
fs/xfs/scrub/refcount.c +3 -5
@@ -170,7 +170,6 @@ xchk_refcountbt_process_rmap_fragments(*/ INIT_LIST_HEAD (&worklist); rbno =NULLAGBLOCK ; - nr =1 ;/* Make sure the fragments actually /are/ in agbno order. */ bno =0 ;
@@ -184,15 +183,14 @@ xchk_refcountbt_process_rmap_fragments(* Find all the rmaps that start at or before the refc extent, * and put them on the worklist. */ + nr =0 ;list_for_each_entry_safe (frag, n, &refchk->fragments, list) { -if (frag->rm.rm_startblock > refchk->bno) - goto done; +if (frag->rm.rm_startblock > refchk->bno || nr > target_nr) +break ; bno = frag->rm.rm_startblock + frag->rm.rm_blockcount;if (bno < rbno) rbno = bno;list_move_tail (&frag->list, &worklist); -if (nr == target_nr) -break ; nr++; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 162/255 lan743x: fix "BUG: invalid wait context" when setting rx mode
In reply to Greg Kroah-HartmanFrom: Sven Van Asbroeck <[email protected]>
[ Upstream commit 2b52a4b65bc8f14520fe6e996ea7fb3f7e400761 ]
In the net core, the struct net_device_ops -> ndo_set_rx_mode() callback is called with the dev->addr_list_lock spinlock held.
However, this driver's ndo_set_rx_mode callback eventually calls lan743x_dp_write(), which acquires a mutex. Mutex acquisition may sleep, and this is not allowed when holding a spinlock.
Fix by removing the dp_lock mutex entirely. Its purpose is to prevent concurrent accesses to the data port. No concurrent accesses are possible, because the dev->addr_list_lock spinlock in the core only lets through one thread at a time.
--- drivers/net/ethernet/microchip/lan743x_main.c | 12 +++--------- drivers/net/ethernet/microchip/lan743x_main.h | 3 --- 2 files changed, 3 insertions(+), 12 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +3 -9
@@ -675,14 +675,12 @@ clean_up:static int lan743x_dp_write (struct lan743x_adapter *adapter,u32 select,u32 addr,u32 length,u32 *buf) { -int ret = -EIO ;u32 dp_sel;int i; -mutex_lock (&adapter->dp_lock);if (lan743x_csr_wait_for_bit (adapter,DP_SEL ,DP_SEL_DPRDY_ ,1 ,40 ,100 ,100 )) - goto unlock; +return -EIO ; dp_sel =lan743x_csr_read (adapter,DP_SEL ); dp_sel &= ~DP_SEL_MASK_ ; dp_sel |= select;
@@ -694,13 +692,10 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter,lan743x_csr_write (adapter,DP_CMD ,DP_CMD_WRITE_ );if (lan743x_csr_wait_for_bit (adapter,DP_SEL ,DP_SEL_DPRDY_ ,1 ,40 ,100 ,100 )) - goto unlock; +return -EIO ; } - ret =0 ; -unlock: -mutex_unlock (&adapter->dp_lock); -return ret; +return 0 ; }static u32 lan743x_mac_mii_access (u16 id,u16 index,int read)
@@ -2737,7 +2732,6 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, adapter->intr.irq = adapter->pdev->irq;lan743x_csr_write (adapter,INT_EN_CLR ,0xFFFFFFFF ); -mutex_init (&adapter->dp_lock); ret =lan743x_gpio_init (adapter);if (ret)
drivers/net/ethernet/microchip/lan743x_main.h +0 -3
@@ -712,9 +712,6 @@ struct lan743x_adapter {struct lan743x_csr csr;struct lan743x_intr intr; -/* lock, used to prevent concurrent access to data port */ -struct mutex dp_lock; -struct lan743x_gpio gpio;struct lan743x_ptp ptp;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 199/255 uio: Fix use-after-free in uio_unregister_device()
In reply to Greg Kroah-HartmanFrom: Shin'ichiro Kawasaki <[email protected]>
commit 092561f06702dd4fdd7fb74dd3a838f1818529b7 upstream.
Commit 8fd0e2a6df26 ("uio: free uio id after uio file node is freed") triggered KASAN use-after-free failure at deletion of TCM-user backstores [1].
In uio_unregister_device(), struct uio_device *idev is passed to uio_free_minor() to refer idev->minor. However, before uio_free_minor() call, idev is already freed by uio_device_release() during call to device_unregister().
To avoid reference to idev->minor after idev free, keep idev->minor value in a local variable. Also modify uio_free_minor() argument to receive the value.
[1]
BUG: KASAN: use-after-free in uio_unregister_device+0x166/0x190 Read of size 4 at addr ffff888105196508 by task targetcli/49158 CPU: 3 PID: 49158 Comm: targetcli Not tainted 5.10.0-rc1 #1 Hardware name: Supermicro Super Server/X10SRL-F, BIOS 2.0 12/17/2015 Call Trace: dump_stack+0xae/0xe5 ? uio_unregister_device+0x166/0x190 print_address_description.constprop.0+0x1c/0x210 ? uio_unregister_device+0x166/0x190 ? uio_unregister_device+0x166/0x190 kasan_report.cold+0x37/0x7c ? kobject_put+0x80/0x410 ? uio_unregister_device+0x166/0x190 uio_unregister_device+0x166/0x190 tcmu_destroy_device+0x1c4/0x280 [target_core_user] ? tcmu_release+0x90/0x90 [target_core_user] ? __mutex_unlock_slowpath+0xd6/0x5d0 target_free_device+0xf3/0x2e0 [target_core_mod] config_item_cleanup+0xea/0x210 configfs_rmdir+0x651/0x860 ? detach_groups.isra.0+0x380/0x380 vfs_rmdir.part.0+0xec/0x3a0 ? __lookup_hash+0x20/0x150 do_rmdir+0x252/0x320 ? do_file_open_root+0x420/0x420 ? strncpy_from_user+0xbc/0x2f0 ? getname_flags.part.0+0x8e/0x450 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f9e2bfc91fb Code: 73 01 c3 48 8b 0d 9d ec 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6d ec 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdd2baafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f9e2beb44a0 RCX: 00007f9e2bfc91fb RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f9e1c20be90 RBP: 00007ffdd2bab000 R08: 0000000000000000 R09: 00007f9e2bdf2440 R10: 00007ffdd2baaf37 R11: 0000000000000246 R12: 00000000ffffff9c R13: 000055f9abb7e390 R14: 000055f9abcf9558 R15: 00007f9e2be7a780 Allocated by task 34735: kasan_save_stack+0x1b/0x40 __kasan_kmalloc.constprop.0+0xc2/0xd0 __uio_register_device+0xeb/0xd40 tcmu_configure_device+0x5a0/0xbc0 [target_core_user] target_configure_device+0x12f/0x760 [target_core_mod] target_dev_enable_store+0x32/0x50 [target_core_mod] configfs_write_file+0x2bb/0x450 vfs_write+0x1ce/0x610 ksys_write+0xe9/0x1b0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 49158: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x110/0x150 slab_free_freelist_hook+0x5a/0x170 kfree+0xc6/0x560 device_release+0x9b/0x210 kobject_put+0x13e/0x410 uio_unregister_device+0xf9/0x190 tcmu_destroy_device+0x1c4/0x280 [target_core_user] target_free_device+0xf3/0x2e0 [target_core_mod] config_item_cleanup+0xea/0x210 configfs_rmdir+0x651/0x860 vfs_rmdir.part.0+0xec/0x3a0 do_rmdir+0x252/0x320 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff888105196000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1288 bytes inside of 2048-byte region [ffff888105196000, ffff888105196800) The buggy address belongs to the page: page:0000000098e6ca81 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105190 head:0000000098e6ca81 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x17ffffc0010200(slab|head) raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100043040 raw: 0000000000000000 0000000000080008 00000001ffffffff ffff88810eb55c01 page dumped because: kasan: bad access detected
page->mem_cgroup:ffff88810eb55c01
Memory state around the buggy address:
ffff888105196400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105196480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888105196500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888105196580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888105196600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- drivers/uio/uio.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/uio/uio.c +6 -4
@@ -413,10 +413,10 @@ static int uio_get_minor(struct uio_devireturn retval; } -static void uio_free_minor (struct uio_device *idev) +static void uio_free_minor (unsigned long minor) {mutex_lock (&minor_lock); -idr_remove (&uio_idr, idev->minor); +idr_remove (&uio_idr, minor);mutex_unlock (&minor_lock); }
@@ -990,7 +990,7 @@ err_request_irq: err_uio_dev_add_attributes:device_del (&idev->dev); err_device_create: -uio_free_minor (idev); +uio_free_minor (idev->minor);put_device (&idev->dev);return ret; }
@@ -1042,11 +1042,13 @@ EXPORT_SYMBOL_GPL(__devm_uio_register_devoid uio_unregister_device (struct uio_info *info) {struct uio_device *idev; +unsigned long minor;if (!info || !info->uio_dev)return ; idev = info->uio_dev; + minor = idev->minor;mutex_lock (&idev->info_lock);uio_dev_del_attributes (idev);
@@ -1062,7 +1064,7 @@ void uio_unregister_device(struct uio_indevice_unregister (&idev->dev); -uio_free_minor (idev); +uio_free_minor (minor);return ; }
Greg Kroah-Hartman
maintainerPATCH 203/255 xhci: hisilicon: fix refercence leak in xhci_histb_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
commit 76255470ffa2795a44032e8b3c1ced11d81aa2db upstream.
pm_runtime_get_sync() will increment pm usage at first and it will resume the device later. We should decrease the usage count whetever it succeeded or failed(maybe runtime of the device has error, or device is in inaccessible state, or other error state). If we do not call put operation to decrease the reference, it will result in reference leak in xhci_histb_probe. Moreover, this device cannot enter the idle state and always stay busy or other non-idle state later. So we fixed it by jumping to error handling branch.
--- drivers/usb/host/xhci-histb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-histb.c +1 -1
@@ -240,7 +240,7 @@ static int xhci_histb_probe(struct platf/* Initialize dma_mask and coherent_dma_mask to 32-bits */ ret =dma_set_mask_and_coherent (dev,DMA_BIT_MASK (32 ));if (ret) -return ret; + goto disable_pm; hcd =usb_create_hcd (driver, dev,dev_name (dev));if (!hcd) {
Greg Kroah-Hartman
maintainerPATCH 204/255 virtio: virtio_console: fix DMA memory allocation for rproc serial
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 9d516aa82b7d4fbe7f6303348697960ba03a530b upstream.
Since commit 086d08725d34 ("remoteproc: create vdev subdevice with specific dma memory pool"), every remoteproc has a DMA subdevice ("remoteprocX#vdevYbuffer") for each virtio device, which inherits DMA capabilities from the corresponding platform device. This allowed to associate different DMA pools with each vdev, and required from virtio drivers to perform DMA operations with the parent device (vdev->dev.parent) instead of grandparent (vdev->dev.parent->parent).
virtio_rpmsg_bus was already changed in the same merge cycle with commit d999b622fcfb ("rpmsg: virtio: allocate buffer from parent"), but virtio_console did not. In fact, operations using the grandparent worked fine while the grandparent was the platform device, but since commit c774ad010873 ("remoteproc: Fix and restore the parenting hierarchy for vdev") this was changed, and now the grandparent device is the remoteproc device without any DMA capabilities.
So, starting v5.8-rc1 the following warning is observed:
[ 2.483925] ------------[ cut here ]------------ [ 2.489148] WARNING: CPU: 3 PID: 101 at kernel/dma/mapping.c:427 0x80e7eee8 [ 2.489152] Modules linked in: virtio_console(+) [ 2.503737] virtio_rpmsg_bus rpmsg_core [ 2.508903] [ 2.528898] <Other modules, stack and call trace here> [ 2.913043] [ 2.914907] ---[ end trace 93ac8746beab612c ]--- [ 2.920102] virtio-ports vport1p0: Error allocating inbufs
kernel/dma/mapping.c:427 is:
WARN_ON_ONCE(!dev->coherent_dma_mask);
obviously because the grandparent now is remoteproc dev without any DMA caps:
[ 3.104943] Parent: remoteproc0#vdev1buffer, grandparent: remoteproc0
Fix this the same way as it was for virtio_rpmsg_bus, using just the parent device (vdev->dev.parent, "remoteprocX#vdevYbuffer") for DMA operations.
This also allows now to reserve DMA pools/buffers for rproc serial via Device Tree.
Date: Thu, 5 Nov 2020 11:10:24 +0800
--- drivers/char/virtio_console.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/char/virtio_console.c +4 -4
@@ -435,12 +435,12 @@ static struct port_buffer *alloc_buf(str/* * Allocate DMA memory from ancestor. When a virtio * device is created by remoteproc, the DMA memory is -* associated with the grandparent device: -* vdev => rproc => platform-dev. +* associated with the parent device: +* virtioY => remoteprocX#vdevYbuffer. */ -if (!vdev->dev.parent || !vdev->dev.parent->parent) + buf->dev = vdev->dev.parent; +if (!buf->dev) goto free_buf; - buf->dev = vdev->dev.parent->parent;/* Increase device refcnt to avoid freeing it */ get_device (buf->dev);
Greg Kroah-Hartman
maintainerPATCH 207/255 jbd2: fix up sparse warnings in checkpoint code
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 05d5233df85e9621597c5838e95235107eb624a2 upstream.
Add missing __acquires() and __releases() annotations. Also, in an "this should never happen" WARN_ON check, if it *does* actually happen, we need to release j_state_lock since this function is always supposed to release that lock. Otherwise, things will quickly grind to a halt after the WARN_ON trips.
--- fs/jbd2/checkpoint.c | 2 ++ fs/jbd2/transaction.c | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-)
fs/jbd2/checkpoint.c +2 -0
@@ -106,6 +106,8 @@ static int __try_to_free_cp_buf(struct j* for a checkpoint to free up some space in the log. */ void __jbd2_log_wait_for_space (journal_t *journal) +__acquires(&journal->j_state_lock) +__releases(&journal->j_state_lock) {int nblocks, space_left;/* assert_spin_locked(&journal->j_state_lock); */
fs/jbd2/transaction.c +3 -1
@@ -195,8 +195,10 @@ static void wait_transaction_switching(jDEFINE_WAIT (wait);if (WARN_ON (!journal->j_running_transaction || - journal->j_running_transaction->t_state !=T_SWITCH )) + journal->j_running_transaction->t_state !=T_SWITCH )) { +read_unlock (&journal->j_state_lock);return ; + }prepare_to_wait (&journal->j_wait_transaction_locked, &wait,TASK_UNINTERRUPTIBLE );read_unlock (&journal->j_state_lock);
Greg Kroah-Hartman
maintainerPATCH 206/255 futex: Dont enable IRQs unconditionally in put_pi_state()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 1e106aa3509b86738769775969822ffc1ec21bf4 upstream.
The exit_pi_state_list() function calls put_pi_state() with IRQs disabled and is not expecting that IRQs will be enabled inside the function.
Use the _irqsave() variant so that IRQs are restored to the original state instead of being enabled unconditionally.
--- kernel/futex.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/futex.c +3 -2
@@ -788,8 +788,9 @@ static void put_pi_state(struct futex_pi*/ if (pi_state->owner) {struct task_struct *owner; +unsigned long flags; -raw_spin_lock_irq (&pi_state->pi_mutex.wait_lock); +raw_spin_lock_irqsave (&pi_state->pi_mutex.wait_lock, flags); owner = pi_state->owner;if (owner) {raw_spin_lock (&owner->pi_lock);
@@ -797,7 +798,7 @@ static void put_pi_state(struct futex_piraw_spin_unlock (&owner->pi_lock); }rt_mutex_proxy_unlock (&pi_state->pi_mutex, owner); -raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock); +raw_spin_unlock_irqrestore (&pi_state->pi_mutex.wait_lock, flags); }if (current->pi_state_cache) {
Greg Kroah-Hartman
maintainerPATCH 209/255 mm/compaction: count pages and stop correctly during page isolation
In reply to Greg Kroah-HartmanFrom: Zi Yan <[email protected]>
commit 38935861d85a4d9a353d1dd5a156c97700e2765d upstream.
In isolate_migratepages_block, when cc->alloc_contig is true, we are able to isolate compound pages. But nr_migratepages and nr_isolated did not count compound pages correctly, causing us to isolate more pages than we thought.
So count compound pages as the number of base pages they contain. Otherwise, we might be trapped in too_many_isolated while loop, since the actual isolated pages can go up to COMPACT_CLUSTER_MAX*512=16384, where COMPACT_CLUSTER_MAX is 32, since we stop isolation after cc->nr_migratepages reaches to COMPACT_CLUSTER_MAX.
In addition, after we fix the issue above, cc->nr_migratepages could never be equal to COMPACT_CLUSTER_MAX if compound pages are isolated, thus page isolation could not stop as we intended. Change the isolation stop condition to '>='.
The issue can be triggered as follows:
In a system with 16GB memory and an 8GB CMA region reserved by hugetlb_cma, if we first allocate 10GB THPs and mlock them (so some THPs are allocated in the CMA region and mlocked), reserving 6 1GB hugetlb pages via /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages will get stuck (looping in too_many_isolated function) until we kill either task. With the patch applied, oom will kill the application with 10GB THPs and let hugetlb page reservation finish.
[[email protected]: v3]
--- mm/compaction.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/compaction.c +4 -4
@@ -1013,8 +1013,8 @@ isolate_migratepages_block(struct compac isolate_success:list_add (&page->lru, &cc->migratepages); - cc->nr_migratepages++; - nr_isolated++; + cc->nr_migratepages +=compound_nr (page); + nr_isolated +=compound_nr (page);/* * Avoid isolating too much unless this block is being
@@ -1022,7 +1022,7 @@ isolate_success:* or a lock is contended. For contention, isolate quickly to * potentially remove one source of contention. */ -if (cc->nr_migratepages ==COMPACT_CLUSTER_MAX && +if (cc->nr_migratepages >=COMPACT_CLUSTER_MAX && !cc->rescan && !cc->contended) { ++low_pfn;break ;
@@ -1133,7 +1133,7 @@ isolate_migratepages_range(struct compacif (!pfn)break ; -if (cc->nr_migratepages ==COMPACT_CLUSTER_MAX ) +if (cc->nr_migratepages >=COMPACT_CLUSTER_MAX )break ; }
Greg Kroah-Hartman
maintainerPATCH 211/255 mm/slub: fix panic in slab_alloc_node()
In reply to Greg Kroah-HartmanFrom: Laurent Dufour <[email protected]>
commit 22e4663e916321b72972c69ca0c6b962f529bd78 upstream.
While doing memory hot-unplug operation on a PowerPC VM running 1024 CPUs with 11TB of ram, I hit the following panic:
BUG: Kernel NULL pointer dereference on read at 0x00000007
Faulting instruction address: 0xc000000000456048
Oops: Kernel access of bad area, sig: 11 [#2]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS= 2048 NUMA pSeries
Modules linked in: rpadlpar_io rpaphp
CPU: 160 PID: 1 Comm: systemd Tainted: G D 5.9.0 #1
NIP: c000000000456048 LR: c000000000455fd4 CTR: c00000000047b350
REGS: c00006028d1b77a0 TRAP: 0300 Tainted: G D (5.9.0)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004228 XER: 00000000
CFAR: c00000000000f1b0 DAR: 0000000000000007 DSISR: 40000000 IRQMASK: 0
GPR00: c000000000455fd4 c00006028d1b7a30 c000000001bec800 0000000000000000
GPR04: 0000000000000dc0 0000000000000000 00000000000374ef c00007c53df99320
GPR08: 000007c53c980000 0000000000000000 000007c53c980000 0000000000000000
GPR12: 0000000000004400 c00000001e8e4400 0000000000000000 0000000000000f6a
GPR16: 0000000000000000 c000000001c25930 c000000001d62528 00000000000000c1
GPR20: c000000001d62538 c00006be469e9000 0000000fffffffe0 c0000000003c0ff8
GPR24: 0000000000000018 0000000000000000 0000000000000dc0 0000000000000000
GPR28: c00007c513755700 c000000001c236a4 c00007bc4001f800 0000000000000001
NIP [c000000000456048] __kmalloc_node+0x108/0x790
LR [c000000000455fd4] __kmalloc_node+0x94/0x790
Call Trace:
kvmalloc_node+0x58/0x110
mem_cgroup_css_online+0x10c/0x270
online_css+0x48/0xd0
cgroup_apply_control_enable+0x2c4/0x470
cgroup_mkdir+0x408/0x5f0
kernfs_iop_mkdir+0x90/0x100
vfs_mkdir+0x138/0x250
do_mkdirat+0x154/0x1c0
system_call_exception+0xf8/0x200
system_call_common+0xf0/0x27c
Instruction dump:
e93e0000 e90d0030 39290008 7cc9402a e94d0030 e93e0000 7ce95214 7f89502a
2fbc0000 419e0018 41920230 e9270010 <89290007> 7f994800 419e0220 7ee6bb78This pointing to the following code:
mm/slub.c:2851
if (unlikely(!object || !node_match(page, node))) {
c000000000456038: 00 00 bc 2f cmpdi cr7,r28,0
c00000000045603c: 18 00 9e 41 beq cr7,c000000000456054 <__kmalloc_node+0x114>
node_match():
mm/slub.c:2491
if (node != NUMA_NO_NODE && page_to_nid(page) != node)
c000000000456040: 30 02 92 41 beq cr4,c000000000456270 <__kmalloc_node+0x330>
page_to_nid():
include/linux/mm.h:1294
c000000000456044: 10 00 27 e9 ld r9,16(r7)
c000000000456048: 07 00 29 89 lbz r9,7(r9) <<<< r9 = NULL
node_match():
mm/slub.c:2491
c00000000045604c: 00 48 99 7f cmpw cr7,r25,r9
c000000000456050: 20 02 9e 41 beq cr7,c000000000456270 <__kmalloc_node+0x330>The panic occurred in slab_alloc_node() when checking for the page's node:
object = c->freelist;
page = c->page;
if (unlikely(!object || !node_match(page, node))) {
object = __slab_alloc(s, gfpflags, node, addr, c);
stat(s, ALLOC_SLOWPATH);The issue is that object is not NULL while page is NULL which is odd but may happen if the cache flush happened after loading object but before loading page. Thus checking for the page pointer is required too.
The cache flush is done through an inter processor interrupt when a piece of memory is off-lined. That interrupt is triggered when a memory hot-unplug operation is initiated and offline_pages() is calling the slub's MEM_GOING_OFFLINE callback slab_mem_going_offline_callback() which is calling flush_cpu_slab(). If that interrupt is caught between the reading of c->freelist and the reading of c->page, this could lead to such a situation. That situation is expected and the later call to this_cpu_cmpxchg_double() will detect the change to c->freelist and redo the whole operation.
In commit 6159d0f5c03e ("mm/slub.c: page is always non-NULL in node_match()") check on the page pointer has been removed assuming that page is always valid when it is called. It happens that this is not true in that particular case, so check for page before calling node_match() here.
--- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/slub.c +1 -1
@@ -2848,7 +2848,7 @@ redo: object = c->freelist; page = c->page; -if (unlikely (!object || !node_match (page, node))) { +if (unlikely (!object || !page || !node_match (page, node))) { object =__slab_alloc (s, gfpflags, node, addr, c);stat (s,ALLOC_SLOWPATH ); }else {
Greg Kroah-Hartman
maintainerPATCH 213/255 mm/gup: use unpin_user_pages() in __gup_longterm_locked()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit 96e1fac162cc0086c50b2b14062112adb2ba640e upstream.
When FOLL_PIN is passed to __get_user_pages() the page list must be put back using unpin_user_pages() otherwise the page pin reference persists in a corrupted state.
There are two places in the unwind of __gup_longterm_locked() that put the pages back without checking. Normally on error this function would return the partial page list making this the caller's responsibility, but in these two cases the caller is not allowed to see these pages at all.
--- mm/gup.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
mm/gup.c +10 -4
@@ -1637,8 +1637,11 @@ check_again:/* * drop the above get_user_pages reference. */ -for (i =0 ; i < nr_pages; i++) -put_page (pages[i]); +if (gup_flags &FOLL_PIN ) +unpin_user_pages (pages, nr_pages); +else +for (i =0 ; i < nr_pages; i++) +put_page (pages[i]);if (migrate_pages (&cma_page_list, alloc_migration_target,NULL , (unsigned long )&mtc,MIGRATE_SYNC ,MR_CONTIG_RANGE )) {
@@ -1718,8 +1721,11 @@ static long __gup_longterm_locked(struct goto out;if (check_dax_vmas (vmas_tmp, rc)) { -for (i =0 ; i < rc; i++) -put_page (pages[i]); +if (gup_flags &FOLL_PIN ) +unpin_user_pages (pages, rc); +else +for (i =0 ; i < rc; i++) +put_page (pages[i]); rc = -EOPNOTSUPP ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 189/255 btrfs: fix min reserved size calculation in merge_reloc_root
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit fca3a45d08782a2bb85e048fb8e3128b1388d7b7 upstream.
The minimum reserve size was adjusted to take into account the height of the tree we are merging, however we can have a root with a level == 0. What we want is root_level + 1 to get the number of nodes we may have to cow. This fixes the enospc_debug warning pops with btrfs/101.
Nikolay: this fixes failures on btrfs/060 btrfs/062 btrfs/063 and btrfs/195 That I was seeing, the call trace was:
[ 3680.515564] ------------[ cut here ]------------ [ 3680.515566] BTRFS: block rsv returned -28 [ 3680.515585] WARNING: CPU: 2 PID: 8339 at fs/btrfs/block-rsv.c:521 btrfs_use_block_rsv+0x162/0x180 [ 3680.515587] Modules linked in: [ 3680.515591] CPU: 2 PID: 8339 Comm: btrfs Tainted: G W 5.9.0-rc8-default #95 [ 3680.515593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 [ 3680.515595] RIP: 0010:btrfs_use_block_rsv+0x162/0x180 [ 3680.515600] RSP: 0018:ffffa01ac9753910 EFLAGS: 00010282 [ 3680.515602] RAX: 0000000000000000 RBX: ffff984b34200000 RCX: 0000000000000027 [ 3680.515604] RDX: 0000000000000027 RSI: 0000000000000000 RDI: ffff984b3bd19e28 [ 3680.515606] RBP: 0000000000004000 R08: ffff984b3bd19e20 R09: 0000000000000001 [ 3680.515608] R10: 0000000000000004 R11: 0000000000000046 R12: ffff984b264fdc00 [ 3680.515609] R13: ffff984b13149000 R14: 00000000ffffffe4 R15: ffff984b34200000 [ 3680.515613] FS: 00007f4e2912b8c0(0000) GS:ffff984b3bd00000(0000) knlGS:0000000000000000 [ 3680.515615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3680.515617] CR2: 00007fab87122150 CR3: 0000000118e42000 CR4: 00000000000006e0 [ 3680.515620] Call Trace: [ 3680.515627] btrfs_alloc_tree_block+0x8b/0x340 [ 3680.515633] ? __lock_acquire+0x51a/0xac0 [ 3680.515646] alloc_tree_block_no_bg_flush+0x4f/0x60 [ 3680.515651] __btrfs_cow_block+0x14e/0x7e0 [ 3680.515662] btrfs_cow_block+0x144/0x2c0 [ 3680.515670] merge_reloc_root+0x4d4/0x610 [ 3680.515675] ? btrfs_lookup_fs_root+0x78/0x90 [ 3680.515686] merge_reloc_roots+0xee/0x280 [ 3680.515695] relocate_block_group+0x2ce/0x5e0 [ 3680.515704] btrfs_relocate_block_group+0x16e/0x310 [ 3680.515711] btrfs_relocate_chunk+0x38/0xf0 [ 3680.515716] btrfs_shrink_device+0x200/0x560 [ 3680.515728] btrfs_rm_device+0x1ae/0x6a6 [ 3680.515744] ? _copy_from_user+0x6e/0xb0 [ 3680.515750] btrfs_ioctl+0x1afe/0x28c0 [ 3680.515755] ? find_held_lock+0x2b/0x80 [ 3680.515760] ? do_user_addr_fault+0x1f8/0x418 [ 3680.515773] ? __x64_sys_ioctl+0x77/0xb0 [ 3680.515775] __x64_sys_ioctl+0x77/0xb0 [ 3680.515781] do_syscall_64+0x31/0x70 [ 3680.515785] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- fs/btrfs/relocation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/relocation.c +3 -1
@@ -1646,6 +1646,7 @@ static noinline_for_stack int merge_relostruct btrfs_root_item *root_item;struct btrfs_path *path;struct extent_buffer *leaf; +int reserve_level;int level;int max_level;int replaced =0 ;
@@ -1694,7 +1695,8 @@ static noinline_for_stack int merge_relo* Thus the needed metadata size is at most root_level * nodesize, * and * 2 since we have two trees to COW. */ - min_reserved = fs_info->nodesize *btrfs_root_level (root_item) *2 ; + reserve_level =max_t (int,1 ,btrfs_root_level (root_item)); + min_reserved = fs_info->nodesize * reserve_level *2 ;memset (&next_key,0 ,sizeof (next_key));while (1 ) {
Greg Kroah-Hartman
maintainerPATCH 215/255 reboot: fix overflow parsing reboot cpu number
In reply to Greg Kroah-HartmanFrom: Matteo Croce <[email protected]>
commit df5b0ab3e08a156701b537809914b339b0daa526 upstream.
Limit the CPU number to num_possible_cpus(), because setting it to a value lower than INT_MAX but higher than NR_CPUS produces the following error on reboot and shutdown:
BUG: unable to handle page fault for address: ffffffff90ab1bb0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1c09067 P4D 1c09067 PUD 1c0a063 PMD 0
Oops: 0000 [#1] SMP
CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 5.9.0-rc8-kvm #110
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
RIP: 0010:migrate_to_reboot_cpu+0xe/0x60
Code: ea ea 00 48 89 fa 48 c7 c7 30 57 f1 81 e9 fa ef ff ff 66 2e 0f 1f 84 00 00 00 00 00 53 8b 1d d5 ea ea 00 e8 14 33 fe ff 89 da <48> 0f a3 15 ea fc bd 00 48 89 d0 73 29 89 c2 c1 e8 06 65 48 8b 3c
RSP: 0018:ffffc90000013e08 EFLAGS: 00010246
RAX: ffff88801f0a0000 RBX: 0000000077359400 RCX: 0000000000000000
RDX: 0000000077359400 RSI: 0000000000000002 RDI: ffffffff81c199e0
RBP: ffffffff81c1e3c0 R08: ffff88801f41f000 R09: ffffffff81c1e348
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 00007f32bedf8830 R14: 00000000fee1dead R15: 0000000000000000
FS: 00007f32bedf8980(0000) GS:ffff88801f480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff90ab1bb0 CR3: 000000001d057000 CR4: 00000000000006a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__do_sys_reboot.cold+0x34/0x5b
do_syscall_64+0x2d/0x40--- kernel/reboot.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/reboot.c +7 -0
@@ -558,6 +558,13 @@ static int __init reboot_setup(char *str reboot_cpu =simple_strtoul (str+3 ,NULL ,0 ); else *mode =REBOOT_SOFT ; +if (reboot_cpu >=num_possible_cpus ()) { +pr_err ("Ignoring the CPU number in reboot= option. " +"CPU %d exceeds possible cpu number %d\n" , + reboot_cpu,num_possible_cpus ()); + reboot_cpu =0 ; +break ; + }break ;case 'g' :
Greg Kroah-Hartman
maintainerPATCH 216/255 hugetlbfs: fix anon huge page migration race
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit 336bf30eb76580b579dc711ded5d599d905c0217 upstream.
Qian Cai reported the following BUG in [1]
LTP: starting move_pages12
BUG: unable to handle page fault for address: ffffffffffffffe0
...
RIP: 0010:anon_vma_interval_tree_iter_first+0xa2/0x170 avc_start_pgoff at mm/interval_tree.c:63
Call Trace:
rmap_walk_anon+0x141/0xa30 rmap_walk_anon at mm/rmap.c:1864
try_to_unmap+0x209/0x2d0 try_to_unmap at mm/rmap.c:1763
migrate_pages+0x1005/0x1fb0
move_pages_and_store_status.isra.47+0xd7/0x1a0
__x64_sys_move_pages+0xa5c/0x1100
do_syscall_64+0x5f/0x310
entry_SYSCALL_64_after_hwframe+0x44/0xa9Hugh Dickins diagnosed this as a migration bug caused by code introduced to use i_mmap_rwsem for pmd sharing synchronization. Specifically, the routine unmap_and_move_huge_page() is always passing the TTU_RMAP_LOCKED flag to try_to_unmap() while holding i_mmap_rwsem. This is wrong for anon pages as the anon_vma_lock should be held in this case. Further analysis suggested that i_mmap_rwsem was not required to he held at all when calling try_to_unmap for anon pages as an anon page could never be part of a shared pmd mapping.
Discussion also revealed that the hack in hugetlb_page_mapping_lock_write to drop page lock and acquire i_mmap_rwsem is wrong. There is no way to keep mapping valid while dropping page lock.
This patch does the following:
- Do not take i_mmap_rwsem and set TTU_RMAP_LOCKED for anon pages when calling try_to_unmap.
- Remove the hacky code in hugetlb_page_mapping_lock_write. The routine will now simply do a 'trylock' while still holding the page lock. If the trylock fails, it will return NULL. This could impact the callers:
- migration calling code will receive -EAGAIN and retry up to the hard coded limit (10).
- memory error code will treat the page as BUSY. This will force killing (SIGKILL) instead of SIGBUS any mapping tasks.
Do note that this change in behavior only happens when there is a race. None of the standard kernel testing suites actually hit this race, but it is possible.
[1] https://lore.kernel.org/lkml/[email protected]/
[2] https://lore.kernel.org/linux-mm/[email protected]/
--- mm/hugetlb.c | 90 ++-------------------------------------------------- mm/memory-failure.c | 36 +++++++++----------- mm/migrate.c | 46 ++++++++++++++------------ mm/rmap.c | 5 -- 4 files changed, 48 insertions(+), 129 deletions(-)
mm/hugetlb.c +5 -85
@@ -1579,103 +1579,23 @@ int PageHeadHuge(struct page *page_head) }/* -* Find address_space associated with hugetlbfs page. -* Upon entry page is locked and page 'was' mapped although mapped state -* could change. If necessary, use anon_vma to find vma and associated -* address space. The returned mapping may be stale, but it can not be -* invalid as page lock (which is held) is required to destroy mapping. -*/ -static struct address_space *_get_hugetlb_page_mapping (struct page *hpage) -{ -struct anon_vma *anon_vma; -pgoff_t pgoff_start, pgoff_end; -struct anon_vma_chain *avc; -struct address_space *mapping =page_mapping (hpage); - -/* Simple file based mapping */ -if (mapping) -return mapping; - -/* -* Even anonymous hugetlbfs mappings are associated with an -* underlying hugetlbfs file (see hugetlb_file_setup in mmap -* code). Find a vma associated with the anonymous vma, and -* use the file pointer to get address_space. -*/ - anon_vma =page_lock_anon_vma_read (hpage); -if (!anon_vma) -return mapping;/* NULL */ - -/* Use first found vma */ - pgoff_start =page_to_pgoff (hpage); - pgoff_end = pgoff_start +pages_per_huge_page (page_hstate (hpage)) -1 ; -anon_vma_interval_tree_foreach (avc, &anon_vma->rb_root, - pgoff_start, pgoff_end) { -struct vm_area_struct *vma = avc->vma; - - mapping = vma->vm_file->f_mapping; -break ; - } - -anon_vma_unlock_read (anon_vma); -return mapping; -} - -/* * Find and lock address space (mapping) in write mode. * -* Upon entry, the page is locked which allows us to find the mapping -* even in the case of an anon page. However, locking order dictates -* the i_mmap_rwsem be acquired BEFORE the page lock. This is hugetlbfs -* specific. So, we first try to lock the sema while still holding the -* page lock. If this works, great! If not, then we need to drop the -* page lock and then acquire i_mmap_rwsem and reacquire page lock. Of -* course, need to revalidate state along the way. +* Upon entry, the page is locked which means that page_mapping() is +* stable. Due to locking order, we can only trylock_write. If we can +* not get the lock, simply return NULL to caller. */ struct address_space *hugetlb_page_mapping_lock_write (struct page *hpage) { -struct address_space *mapping, *mapping2; +struct address_space *mapping =page_mapping (hpage); - mapping =_get_hugetlb_page_mapping (hpage); -retry:if (!mapping)return mapping; -/* -* If no contention, take lock and return -*/ if (i_mmap_trylock_write (mapping))return mapping; -/* -* Must drop page lock and wait on mapping sema. -* Note: Once page lock is dropped, mapping could become invalid. -* As a hack, increase map count until we lock page again. -*/ -atomic_inc (&hpage->_mapcount); -unlock_page (hpage); -i_mmap_lock_write (mapping); -lock_page (hpage); -atomic_add_negative (-1 , &hpage->_mapcount); - -/* verify page is still mapped */ -if (!page_mapped (hpage)) { -i_mmap_unlock_write (mapping); -return NULL ; - } - -/* -* Get address space again and verify it is the same one -* we locked. If not, drop lock and retry. -*/ - mapping2 =_get_hugetlb_page_mapping (hpage); -if (mapping2 != mapping) { -i_mmap_unlock_write (mapping); - mapping = mapping2; - goto retry; - } - -return mapping; +return NULL ; }pgoff_t __basepage_index (struct page *page)
mm/memory-failure.c +17 -19
@@ -1031,27 +1031,25 @@ static bool hwpoison_user_mappings(strucif (!PageHuge (hpage)) { unmap_success =try_to_unmap (hpage, ttu); }else { -/* -* For hugetlb pages, try_to_unmap could potentially call -* huge_pmd_unshare. Because of this, take semaphore in -* write mode here and set TTU_RMAP_LOCKED to indicate we -* have taken the lock at this higer level. -* -* Note that the call to hugetlb_page_mapping_lock_write -* is necessary even if mapping is already set. It handles -* ugliness of potentially having to drop page lock to obtain -* i_mmap_rwsem. -*/ - mapping =hugetlb_page_mapping_lock_write (hpage); - -if (mapping) { - unmap_success =try_to_unmap (hpage, +if (!PageAnon (hpage)) { +/* +* For hugetlb pages in shared mappings, try_to_unmap +* could potentially call huge_pmd_unshare. Because of +* this, take semaphore in write mode here and set +* TTU_RMAP_LOCKED to indicate we have taken the lock +* at this higer level. +*/ + mapping =hugetlb_page_mapping_lock_write (hpage); +if (mapping) { + unmap_success =try_to_unmap (hpage, ttu|TTU_RMAP_LOCKED ); -i_mmap_unlock_write (mapping); +i_mmap_unlock_write (mapping); + }else { +pr_info ("Memory failure: %#lx: could not lock mapping for mapped huge page\n" , pfn); + unmap_success = false; + } }else { -pr_info ("Memory failure: %#lx: could not find mapping for mapped huge page\n" , - pfn); - unmap_success = false; + unmap_success =try_to_unmap (hpage, ttu); } }if (!unmap_success)
mm/migrate.c +25 -21
59 lines not on this page · raw message
mm/rmap.c +1 -4
@@ -1413,9 +1413,6 @@ static bool try_to_unmap_one(struct page/* * If sharing is possible, start and end will be adjusted * accordingly. -* -* If called for a huge page, caller must hold i_mmap_rwsem -* in write mode as it is possible to call huge_pmd_unshare. */ adjust_range_if_pmd_sharing_possible (vma, &range.start, &range.end);
@@ -1462,7 +1459,7 @@ static bool try_to_unmap_one(struct page subpage = page -page_to_pfn (page) +pte_pfn (*pvmw.pte); address = pvmw.address; -if (PageHuge (page)) { +if (PageHuge (page) && !PageAnon (page)) {/* * To call huge_pmd_unshare, i_mmap_rwsem must be * held in write mode. Caller needs to explicitly
Greg Kroah-Hartman
maintainerPATCH 190/255 btrfs: dev-replace: fail mount if we dont have replace item with target device
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit cf89af146b7e62af55470cf5f3ec3c56ec144a5e upstream.
If there is a device BTRFS_DEV_REPLACE_DEVID without the device replace item, then it means the filesystem is inconsistent state. This is either corruption or a crafted image. Fail the mount as this needs a closer look what is actually wrong.
As of now if BTRFS_DEV_REPLACE_DEVID is present without the replace item, in __btrfs_free_extra_devids() we determine that there is an extra device, and free those extra devices but continue to mount the device.
However, we were wrong in keeping tack of the rw_devices so the syzbot testcase failed:
WARNING: CPU: 1 PID: 3612 at fs/btrfs/volumes.c:1166 close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 3612 Comm: syz-executor.2 Not tainted 5.9.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 panic+0x347/0x7c0 kernel/panic.c:231 __warn.cold+0x20/0x46 kernel/panic.c:600 report_bug+0x1bd/0x210 lib/bug.c:198 handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:close_fs_devices.part.0+0x607/0x800 fs/btrfs/volumes.c:1166 RSP: 0018:ffffc900091777e0 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffffffffffff RCX: ffffc9000c8b7000 RDX: 0000000000040000 RSI: ffffffff83097f47 RDI: 0000000000000007 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880988a187f R10: 0000000000000000 R11: 0000000000000001 R12: ffff88809593a130 R13: ffff88809593a1ec R14: ffff8880988a1908 R15: ffff88809593a050 close_fs_devices fs/btrfs/volumes.c:1193 [inline] btrfs_close_devices+0x95/0x1f0 fs/btrfs/volumes.c:1179 open_ctree+0x4984/0x4a2d fs/btrfs/disk-io.c:3434 btrfs_fill_super fs/btrfs/super.c:1316 [inline] btrfs_mount_root.cold+0x14/0x165 fs/btrfs/super.c:1672
The fix here is, when we determine that there isn't a replace item then fail the mount if there is a replace target device (devid 0).
--- fs/btrfs/dev-replace.c | 26 ++++++++++++++++++++++++-- fs/btrfs/volumes.c | 26 +++++++------------------- 2 files changed, 31 insertions(+), 21 deletions(-)
fs/btrfs/dev-replace.c +24 -2
@@ -95,6 +95,17 @@ int btrfs_init_dev_replace(struct btrfs_ ret =btrfs_search_slot (NULL , dev_root, &key, path,0 ,0 );if (ret) { no_valid_dev_replace_entry_found: +/* +* We don't have a replace item or it's corrupted. If there is +* a replace target, fail the mount. +*/ +if (btrfs_find_device (fs_info->fs_devices, +BTRFS_DEV_REPLACE_DEVID ,NULL ,NULL , false)) { +btrfs_err (fs_info, +"found replace target device without a valid replace item" ); + ret = -EUCLEAN ; + goto out; + } ret =0 ; dev_replace->replace_state =BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED ;
@@ -147,8 +158,19 @@ no_valid_dev_replace_entry_found:case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED :case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED :case BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED : - dev_replace->srcdev =NULL ; - dev_replace->tgtdev =NULL ; +/* +* We don't have an active replace item but if there is a +* replace target, fail the mount. +*/ +if (btrfs_find_device (fs_info->fs_devices, +BTRFS_DEV_REPLACE_DEVID ,NULL ,NULL , false)) { +btrfs_err (fs_info, +"replace devid present without an active replace item" ); + ret = -EUCLEAN ; + }else { + dev_replace->srcdev =NULL ; + dev_replace->tgtdev =NULL ; + }break ;case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED :case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED :
fs/btrfs/volumes.c +7 -19
@@ -1064,22 +1064,13 @@ again:continue ; } -if (device->devid ==BTRFS_DEV_REPLACE_DEVID ) { -/* -* In the first step, keep the device which has -* the correct fsid and the devid that is used -* for the dev_replace procedure. -* In the second step, the dev_replace state is -* read from the device tree and it is known -* whether the procedure is really active or -* not, which means whether this device is -* used or whether it should be removed. -*/ -if (step ==0 ||test_bit (BTRFS_DEV_STATE_REPLACE_TGT , - &device->dev_state)) { -continue ; - } - } +/* +* We have already validated the presence of BTRFS_DEV_REPLACE_DEVID, +* in btrfs_init_dev_replace() so just continue. +*/ +if (device->devid ==BTRFS_DEV_REPLACE_DEVID ) +continue ; +if (device->bdev) {blkdev_put (device->bdev, device->mode); device->bdev =NULL ;
@@ -1088,9 +1079,6 @@ again:if (test_bit (BTRFS_DEV_STATE_WRITEABLE , &device->dev_state)) {list_del_init (&device->dev_alloc_list);clear_bit (BTRFS_DEV_STATE_WRITEABLE , &device->dev_state); -if (!test_bit (BTRFS_DEV_STATE_REPLACE_TGT , - &device->dev_state)) - fs_devices->rw_devices--; }list_del_init (&device->dev_list); fs_devices->num_devices--;