5.15.159-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 1/168 dmaengine: pl330: issue_pending waits until WFP state
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bumyong Lee <[email protected]>
[ Upstream commit 22a9d9585812440211b0b34a6bc02ade62314be4 ]
According to DMA-330 errata notice[1] 71930, DMAKILL cannot clear internal signal, named pipeline_req_active. it makes that pl330 would wait forever in WFP state although dma already send dma request if pl330 gets dma request before entering WFP state.
The errata suggests that polling until entering WFP state as workaround and then peripherals allows to issue dma request.
[1]: https://developer.arm.com/documentation/genc008428/latest
Stable-dep-of: afc89870ea67 ("dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"")
--- drivers/dma/pl330.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/dma/pl330.c +3 -0
@@ -1053,6 +1053,9 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; +if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) +UNTIL (thrd,PL330_STATE_WFP ); +return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/168 dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <[email protected]>
[ Upstream commit afc89870ea677bd5a44516eb981f7a259b74280c ]
This reverts commit 22a9d9585812 ("dmaengine: pl330: issue_pending waits until WFP state") as it seems to cause regression in pl330 driver. Note the issue now exists in mainline so a fix to be done.
--- drivers/dma/pl330.c | 3 --- 1 file changed, 3 deletions(-)
drivers/dma/pl330.c +0 -3
@@ -1053,9 +1053,6 @@ static bool _trigger(struct pl330_thread *thrd) thrd->req_running = idx; -if (desc->rqtype ==DMA_MEM_TO_DEV || desc->rqtype ==DMA_DEV_TO_MEM ) -UNTIL (thrd,PL330_STATE_WFP ); -return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/168 wifi: nl80211: dont free NULL coalescing rule
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7 ]
If the parsing fails, we can dereference a NULL pointer here.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -12890,6 +12890,8 @@ static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) error:for (i =0 ; i < new_coalesce.n_rules; i++) { tmp_rule = &new_coalesce.rules[i]; +if (!tmp_rule) +continue ;for (j =0 ; j < tmp_rule->n_patterns; j++)kfree (tmp_rule->patterns[j].mask);kfree (tmp_rule->patterns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/168 ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit c119f4ede3fa90a9463f50831761c28f989bfb20 ]
If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in smb2_allocate_rsp_buf(). This patch allocate response buffer after decrypting transform request. smb3_decrypt_req() will validate transform request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().
--- fs/ksmbd/server.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
fs/ksmbd/server.c +5 -8
@@ -167,20 +167,17 @@ static void __handle_ksmbd_work(struct ksmbd_work *work,int rc;bool is_chained = false; -if (conn->ops->allocate_rsp_buf (work)) -return ; -if (conn->ops->is_transform_hdr && conn->ops->is_transform_hdr (work->request_buf)) { rc = conn->ops->decrypt_req (work); -if (rc <0 ) { - conn->ops->set_rsp_status (work,STATUS_DATA_ERROR ); - goto send; - } - +if (rc <0 ) +return ; work->encrypted = true; } +if (conn->ops->allocate_rsp_buf (work)) +return ; + rc = conn->ops->init_rsp_hdr (work);if (rc) {/* either uid or tid is not correct */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/168 ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a ]
The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer.
--- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ksmbd/smb2pdu.c +4 -0
@@ -536,6 +536,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work)if (cmd ==SMB2_QUERY_INFO_HE ) {struct smb2_query_info_req *req; +if (get_rfc1002_len (work->request_buf) < + offsetof(struct smb2_query_info_req , OutputBufferLength)) +return -EINVAL ; + req =smb2_get_msg (work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainercover 5.15.159-rc1 review
This is the start of the stable review cycle for the 5.15.159 release. There are 168 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 16 May 2024 10:09:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.159-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.159-rc1
Johan Hovold <[email protected]>
Bluetooth: qca: fix firmware check error path
Johan Hovold <[email protected]>
Bluetooth: qca: fix NVM configuration parsing
Johan Hovold <[email protected]>
Bluetooth: qca: add missing firmware sanity checks
Johan Hovold <[email protected]>
regulator: core: fix debugfs creation regression
Lakshmi Yadlapati <[email protected]>
hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
Thadeu Lima de Souza Cascardo <[email protected]>
net: fix out-of-bounds access in ops_init
Zack Rusin <[email protected]>
drm/vmwgfx: Fix invalid reads in fence signaled events
Alexander Usyskin <[email protected]>
mei: me: add lunar lake point M DID
Viken Dadhaniya <[email protected]>
slimbus: qcom-ngd-ctrl: Add timeout for wait operation
Jim Cromie <[email protected]>
dyndbg: fix old BUG_ON in >control parser
Joao Paulo Goncalves <[email protected]>
ASoC: ti: davinci-mcasp: Fix race condition during probe
Sameer Pujar <[email protected]>
ASoC: tegra: Fix DSPK 16-bit playback
Doug Berger <[email protected]>
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
Paolo Abeni <[email protected]>
tipc: fix UAF in error path
Hans de Goede <[email protected]>
iio: accel: mxc4005: Interrupt handling fixes
Ramona Gradinariu <[email protected]>
iio:imu: adis16475: Fix sync mode setting
Javier Carrasco <[email protected]>
dt-bindings: iio: health: maxim,max30102: fix compatible check
Paolo Abeni <[email protected]>
mptcp: ensure snd_nxt is properly initialized on connect
Dominique Martinet <[email protected]>
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
Aman Dhoot <[email protected]>
ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
Thinh Nguyen <[email protected]>
usb: dwc3: core: Prevent phy suspend during init
Thinh Nguyen <[email protected]>
usb: xhci-plat: Don't include xhci.h
Chris Wulff <[email protected]>
usb: gadget: f_fs: Fix a race condition when processing setup packets.
Peter Korsgaard <[email protected]>
usb: gadget: composite: fix OS descriptors w_value logic
Guenter Roeck <[email protected]>
usb: ohci: Prevent missed ohci interrupts
Alan Stern <[email protected]>
usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Fix connector check on init
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Check for notifications after init
Rob Herring <[email protected]>
arm64: dts: qcom: Fix 'interrupt-map' parent address cells
Linus Torvalds <[email protected]>
Reapply "drm/qxl: simplify qxl_fence_wait"
Thanassis Avgerinos <[email protected]>
firewire: nosy: ensure user_length is taken into account when fetching packet contents
Dmitry Antipov <[email protected]>
btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
Vanshidhar Konda <[email protected]>
ACPI: CPPC: Fix access width used for PCC registers
Jarred White <[email protected]>
ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
Easwar Hariharan <[email protected]>
Revert "Revert "ACPI: CPPC: Use access_width over bit_width for system memory accesses""
Gabe Teeger <[email protected]>
drm/amd/display: Atom Integrated System Info v2_2 for DCN35
Douglas Anderson <[email protected]>
drm/connector: Add \n to message about demoting connector force-probes
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: add bandgap setting for g12
Jerome Brunet <[email protected]>
drm/meson: dw-hdmi: power up phy on device init
Yonglong Liu <[email protected]>
net: hns3: fix port vlan filter not disabled issue
Jian Shen <[email protected]>
net: hns3: split function hclge_init_vlan_config()
Peiyang Wang <[email protected]>
net: hns3: use appropriate barrier function after setting a bit value
Peiyang Wang <[email protected]>
net: hns3: change type of numa_node_mask as nodemask_t
Jie Wang <[email protected]>
net: hns3: refactor hclge_cmd_send with new hclge_comm_cmd_send API
Jie Wang <[email protected]>
net: hns3: create new set of unified hclge_comm_cmd_send APIs
Jie Wang <[email protected]>
net: hns3: create new cmdq hardware description structure hclge_comm_hw
Jie Wang <[email protected]>
net: hns3: refactor hns3 makefile to support hns3_common module
Jian Shen <[email protected]>
net: hns3: direct return when receive a unknown mailbox message
Hao Lan <[email protected]>
net: hns3: refactor function hclge_mbx_handler()
Guangbin Huang <[email protected]>
net: hns3: add query vf ring and vector map relation
Yufeng Mo <[email protected]>
net: hns3: add log for workqueue scheduled late
Peiyang Wang <[email protected]>
net: hns3: using user configure after hardware reset
Guangbin Huang <[email protected]>
net: hns3: PF support get unicast MAC address space assigned by firmware
Eric Dumazet <[email protected]>
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
Felix Fietkau <[email protected]>
net: bridge: fix corrupted ethernet header on multicast-to-unicast
Eric Dumazet <[email protected]>
phonet: fix rtm_phonet_notify() skb allocation
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
Aleksa Savic <[email protected]>
hwmon: (corsair-cpro) Use a separate buffer for sending commands
Roded Zats <[email protected]>
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Duoming Zhou <[email protected]>
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
Duoming Zhou <[email protected]>
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
Kuniyuki Iwashima <[email protected]>
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
Eric Dumazet <[email protected]>
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
Boy.Wu <[email protected]>
ARM: 9381/1: kasan: clear stale stack poison
Paul Davey <[email protected]>
xfrm: Preserve vlan tags for transport mode software GRO
Al Viro <[email protected]>
qibfs: fix dentry leak
Neil Armstrong <[email protected]>
ASoC: meson: axg-tdm-interface: Fix formatters in trigger"
Neil Armstrong <[email protected]>
ASoC: meson: axg-card: Fix nonatomic links
John Fastabend <[email protected]>
bpf, sockmap: Improved check for empty queue
John Fastabend <[email protected]>
bpf, sockmap: Reschedule is now done through backlog
John Fastabend <[email protected]>
bpf, sockmap: Convert schedule_work into delayed_work
John Fastabend <[email protected]>
bpf, sockmap: Handle fin correctly
John Fastabend <[email protected]>
bpf, sockmap: TCP data stall on recv before accept
Vanillan Wang <[email protected]>
net:usb:qmi_wwan: support Rolling modules
Lyude Paul <[email protected]>
drm/nouveau/dp: Don't probe eDP ports twice harder
Joakim Sindholt <[email protected]>
fs/9p: drop inodes immediately on non-.L too
Stephen Boyd <[email protected]>
clk: Don't hold prepare_lock when calling kref_put()
Andy Shevchenko <[email protected]>
gpio: crystalcove: Use -ENOTSUPP consistently
Andy Shevchenko <[email protected]>
gpio: wcove: Use -ENOTSUPP consistently
Jeff Layton <[email protected]>
9p: explicitly deny setlease attempts
Joakim Sindholt <[email protected]>
fs/9p: translate O_TRUNC into OTRUNC
Joakim Sindholt <[email protected]>
fs/9p: only translate RWX permissions for plain 9P2000
Krzysztof Kozlowski <[email protected]>
iommu: mtk: fix module autoloading
John Stultz <[email protected]>
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
Jiaxun Yang <[email protected]>
MIPS: scall: Save thread_info.syscall unconditionally on entry
Thierry Reding <[email protected]>
gpu: host1x: Do not setup DMA for virtual devices
Rik van Riel <[email protected]>
blk-iocost: avoid out of bounds shift
Maurizio Lombardi <[email protected]>
scsi: target: Fix SELinux error when systemd-modules loads the target module
Boris Burkov <[email protected]>
btrfs: always clear PERTRANS metadata during commit
Boris Burkov <[email protected]>
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
Peng Liu <[email protected]>
tools/power turbostat: Fix Bzy_MHz documentation typo
Doug Smythies <[email protected]>
tools/power turbostat: Fix added raw MSR output
Adam Goldman <[email protected]>
firewire: ohci: mask bus reset interrupts between ISR and bottom half
Chen Ni <[email protected]>
ata: sata_gemini: Check clk_enable() result
Phil Elwell <[email protected]>
net: bcmgenet: Reset RBUF on first open
Takashi Iwai <[email protected]>
ALSA: line6: Zero-initialize message buffers
Borislav Petkov (AMD) <[email protected]>
kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
Anand Jain <[email protected]>
btrfs: return accurate error code on open failure in open_fs_devices()
Saurav Kashyap <[email protected]>
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
linke li <[email protected]>
net: mark racy access on sk->sk_rcvbuf
Igor Artemiev <[email protected]>
wifi: cfg80211: fix rdev_dump_mpp() arguments order
Jeff Johnson <[email protected]>
wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
Andrew Price <[email protected]>
gfs2: Fix invalid metadata access in punch_hole
Justin Tee <[email protected]>
scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
Justin Tee <[email protected]>
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
Justin Tee <[email protected]>
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
Oliver Upton <[email protected]>
KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
Richard Gobert <[email protected]>
net: gro: add flush check in udp_gro_receive_segment
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Use predefined error codes
Andy Shevchenko <[email protected]>
drm/panel: ili9341: Respect deferred probe
Alexandra Winter <[email protected]>
s390/qeth: Fix kernel panic after setting hsuid
Julian Wiedmann <[email protected]>
s390/qeth: don't keep track of Input Queue count
Xin Long <[email protected]>
tipc: fix a possible memleak in tipc_buf_append
Felix Fietkau <[email protected]>
net: core: reject skb_copy(_expand) for fraglist GSO skbs
Felix Fietkau <[email protected]>
net: bridge: fix multicast-to-unicast with fraglist GSO
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
Sebastian Andrzej Siewior <[email protected]>
cxgb4: Properly lock TX queue for the selftest.
Bui Quang Minh <[email protected]>
s390/cio: Ensure the copied buf is NUL terminated
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
Jerome Brunet <[email protected]>
ASoC: meson: cards: select SND_DYNAMIC_MINORS
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-interface: manage formatters in trigger
Jerome Brunet <[email protected]>
ASoC: meson: axg-card: make links nonatomic
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use threaded irq to check periods
Jerome Brunet <[email protected]>
ASoC: meson: axg-fifo: use FIELD helpers
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_actions()
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flow_spec
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: use return from qede_parse_flow_attr() for flower
Asbjørn Sloth Tønnesen <[email protected]>
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
Jens Remus <[email protected]>
s390/vdso: Add CFI for RA register to asm macro vdso_func
David Bauer <[email protected]>
net l2tp: drop flow hash on forward
Kuniyuki Iwashima <[email protected]>
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().Bui Quang Minh <[email protected]>
octeontx2-af: avoid off-by-one read from userspace
Bui Quang Minh <[email protected]>
bna: ensure the copied buf is NUL terminated
Toke Høiland-Jørgensen <[email protected]>
xdp: use flags field to disambiguate broadcast redirect
Toke Høiland-Jørgensen <[email protected]>
xdp: Add xdp_do_redirect_frame() for pre-computed xdp_frames
Toke Høiland-Jørgensen <[email protected]>
xdp: Move conversion to xdp_frame out of map functions
Claudio Imbrenda <[email protected]>
s390/mm: Fix clearing storage keys for huge pages
Claudio Imbrenda <[email protected]>
s390/mm: Fix storage key clearing for guest huge pages
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
Anton Protopopov <[email protected]>
bpf: Fix a verifier verbose message
Jason Xing <[email protected]>
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
Andrii Nakryiko <[email protected]>
bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
AngeloGioacchino Del Regno <[email protected]>
regulator: mt6360: De-capitalize devicetree regulator subnodes
Zeng Heng <[email protected]>
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
AngeloGioacchino Del Regno <[email protected]>
power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
Arnd Bergmann <[email protected]>
power: rt9455: hide unused rt9455_boost_voltage_values
Kuniyuki Iwashima <[email protected]>
nfs: Handle error of rpc_proc_register() in nfs_net_init().
Josef Bacik <[email protected]>
nfs: make the rpc_stat per net namespace
Josef Bacik <[email protected]>
nfs: expose /proc/net/sunrpc/nfs in net namespaces
Josef Bacik <[email protected]>
sunrpc: add a struct rpc_stats arg to rpc_create_args
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
Chen-Yu Tsai <[email protected]>
pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
Dan Carpenter <[email protected]>
pinctrl: core: delete incorrect free in pinctrl_enable()
Jan Dakinevich <[email protected]>
pinctrl/meson: fix typo in PDM's pin name
Billy Tsai <[email protected]>
pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
Daniel Okazaki <[email protected]>
eeprom: at24: fix memory corruption race condition
Heiner Kallweit <[email protected]>
eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
Alexander Stein <[email protected]>
eeprom: at24: Use dev_err_probe for nvmem register failure
Marios Makassikis <[email protected]>
ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
Namjae Jeon <[email protected]>
ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
Namjae Jeon <[email protected]>
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
Johannes Berg <[email protected]>
wifi: nl80211: don't free NULL coalescing rule
Vinod Koul <[email protected]>
dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
Bumyong Lee <[email protected]>
dmaengine: pl330: issue_pending waits until WFP state
-------------
Diffstat:
.../bindings/iio/health/maxim,max30102.yaml | 2 +- Makefile | 4 +- arch/arm/kernel/sleep.S | 4 + arch/arm64/boot/dts/qcom/msm8998.dtsi | 8 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 16 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 12 +- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 +- arch/mips/kernel/scall32-o32.S | 23 +- arch/mips/kernel/scall64-n32.S | 3 +- arch/mips/kernel/scall64-n64.S | 3 +- arch/mips/kernel/scall64-o32.S | 33 +- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 + arch/s390/mm/gmap.c | 2 +- arch/s390/mm/hugetlbpage.c | 2 +- block/blk-iocost.c | 7 +- drivers/acpi/cppc_acpi.c | 67 ++- drivers/ata/sata_gemini.c | 5 +- drivers/bluetooth/btqca.c | 62 ++- drivers/clk/clk.c | 12 +- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +- drivers/firewire/nosy.c | 6 +- drivers/firewire/ohci.c | 6 +- drivers/gpio/gpio-crystalcove.c | 2 +- drivers/gpio/gpio-wcove.c | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + drivers/gpu/drm/drm_connector.c | 2 +- drivers/gpu/drm/meson/meson_dw_hdmi.c | 70 ++- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 +- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 8 +- drivers/gpu/drm/qxl/qxl_release.c | 50 +-- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +- drivers/gpu/host1x/bus.c | 8 - drivers/hwmon/corsair-cpro.c | 43 +- drivers/hwmon/pmbus/ucd9000.c | 6 +- drivers/iio/accel/mxc4005.c | 24 +- drivers/iio/imu/adis16475.c | 4 +- drivers/infiniband/hw/qib/qib_fs.c | 1 + drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + drivers/misc/eeprom/at24.c | 46 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 20 +- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +- drivers/net/ethernet/hisilicon/hns3/Makefile | 18 +- drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 15 + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 +- .../hisilicon/hns3/hns3_common/hclge_comm_cmd.c | 259 +++++++++++ .../hisilicon/hns3/hns3_common/hclge_comm_cmd.h | 121 +++++ drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 2 + .../net/ethernet/hisilicon/hns3/hns3pf/Makefile | 12 - .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 311 ++----------- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 85 +--- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 221 +++++---- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 17 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 494 +++++++++++++++------ .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 4 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- .../net/ethernet/hisilicon/hns3/hns3vf/Makefile | 10 - .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 10 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_filter.c | 14 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +- drivers/pinctrl/core.c | 8 +- drivers/pinctrl/devicetree.c | 10 +- drivers/pinctrl/mediatek/pinctrl-paris.c | 180 +++----- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +- drivers/power/supply/mt6360_charger.c | 2 +- drivers/power/supply/rt9455_charger.c | 2 + drivers/regulator/core.c | 27 +- drivers/regulator/mt6360-regulator.c | 32 +- drivers/s390/cio/cio_inject.c | 2 +- drivers/s390/net/qeth_core.h | 1 - drivers/s390/net/qeth_core_main.c | 78 ++-- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 - drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_nvme.c | 4 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_vport.c | 8 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- drivers/spi/spi-hisi-kunpeng.c | 2 - drivers/target/target_core_configfs.c | 12 + drivers/usb/core/hub.c | 5 +- drivers/usb/dwc3/core.c | 90 ++-- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/gadget.c | 2 + drivers/usb/dwc3/host.c | 27 ++ drivers/usb/gadget/composite.c | 6 +- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/usb/host/ohci-hcd.c | 8 + drivers/usb/host/xhci-plat.h | 4 +- drivers/usb/typec/ucsi/ucsi.c | 12 +- fs/9p/vfs_file.c | 2 + fs/9p/vfs_inode.c | 5 +- fs/9p/vfs_super.c | 1 + fs/btrfs/inode.c | 2 +- fs/btrfs/send.c | 4 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/volumes.c | 18 +- fs/gfs2/bmap.c | 5 +- fs/ksmbd/server.c | 13 +- fs/ksmbd/smb2pdu.c | 4 + fs/ksmbd/vfs.c | 5 + fs/nfs/client.c | 5 +- fs/nfs/inode.c | 13 +- fs/nfs/internal.h | 2 - fs/nfs/netns.h | 2 + include/linux/bpf.h | 20 +- include/linux/dma-fence.h | 7 - include/linux/filter.h | 4 + include/linux/skbuff.h | 15 + include/linux/skmsg.h | 5 +- include/linux/sunrpc/clnt.h | 1 + include/net/xfrm.h | 3 + kernel/bpf/cpumap.c | 8 +- kernel/bpf/devmap.c | 32 +- kernel/bpf/verifier.c | 3 +- lib/Kconfig.debug | 5 +- lib/dynamic_debug.c | 6 +- net/bluetooth/l2cap_core.c | 3 + net/bluetooth/sco.c | 4 + net/bridge/br_forward.c | 9 +- net/core/filter.c | 117 ++++- net/core/net_namespace.c | 13 +- net/core/rtnetlink.c | 2 +- net/core/skbuff.c | 27 +- net/core/skmsg.c | 53 +-- net/core/sock.c | 4 +- net/core/sock_map.c | 3 +- net/ipv4/tcp.c | 4 +- net/ipv4/tcp_bpf.c | 51 +++ net/ipv4/tcp_input.c | 2 + net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_output.c | 4 +- net/ipv4/udp_offload.c | 12 +- net/ipv4/xfrm4_input.c | 6 +- net/ipv6/fib6_rules.c | 6 +- net/ipv6/xfrm6_input.c | 6 +- net/l2tp/l2tp_eth.c | 3 + net/mac80211/ieee80211_i.h | 4 +- net/mptcp/protocol.c | 3 + net/nsh/nsh.c | 14 +- net/phonet/pn_netlink.c | 2 +- net/sunrpc/clnt.c | 5 +- net/tipc/msg.c | 8 +- net/wireless/nl80211.c | 2 + net/wireless/trace.h | 2 +- net/xfrm/xfrm_input.c | 8 + scripts/Makefile.modfinal | 2 +- sound/hda/intel-sdw-acpi.c | 2 + sound/pci/hda/patch_realtek.c | 1 + sound/soc/meson/Kconfig | 1 + sound/soc/meson/axg-fifo.c | 56 ++- sound/soc/meson/axg-fifo.h | 12 +- sound/soc/meson/axg-frddr.c | 5 +- sound/soc/meson/axg-toddr.c | 22 +- sound/soc/tegra/tegra186_dspk.c | 7 +- sound/soc/ti/davinci-mcasp.c | 12 +- sound/usb/line6/driver.c | 6 +- tools/power/x86/turbostat/turbostat.8 | 2 +- tools/power/x86/turbostat/turbostat.c | 7 +- tools/testing/selftests/timers/valid-adjtimex.c | 73 ++- 169 files changed, 2199 insertions(+), 1417 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 7/168 eeprom: at24: Use dev_err_probe for nvmem register failure
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit a3c10035d12f5ec10915d5c00c2e8f7d7c066182 ]
When using nvmem layouts it is possible devm_nvmem_register returns -EPROBE_DEFER, resulting in an 'empty' in /sys/kernel/debug/devices_deferred. Use dev_err_probe for providing additional information.
Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")
--- drivers/misc/eeprom/at24.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/eeprom/at24.c +2 -1
@@ -762,7 +762,8 @@ static int at24_probe(struct i2c_client *client)pm_runtime_disable (dev);if (!pm_runtime_status_suspended (dev))regulator_disable (at24->vcc_reg); -return PTR_ERR (at24->nvmem); +return dev_err_probe (dev,PTR_ERR (at24->nvmem), +"failed to register nvmem\n" ); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/168 sunrpc: add a struct rpc_stats arg to rpc_create_args
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 2057a48d0dd00c6a2a94ded7df2bf1d3f2a4a0da ]
We want to be able to have our rpc stats handled in a per network namespace manner, so add an option to rpc_create_args to specify a different rpc_stats struct instead of using the one on the rpc_program.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -130,6 +130,7 @@ struct rpc_create_args {const char *servername;const char *nodename;const struct rpc_program *program; +struct rpc_stat *stats;u32 prognumber;/* overrides program->number */ u32 version;rpc_authflavor_t authflavor;
net/sunrpc/clnt.c +4 -1
@@ -398,7 +398,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, clnt->cl_maxproc = version->nrprocs; clnt->cl_prog = args->prognumber ? : program->number; clnt->cl_vers = version->number; - clnt->cl_stats = program->stats; + clnt->cl_stats = args->stats ? : program->stats; clnt->cl_metrics =rpc_alloc_iostats (clnt);rpc_init_pipe_dir_head (&clnt->cl_pipedir_objects); err = -ENOMEM ;
@@ -677,6 +677,7 @@ struct rpc_clnt *rpc_clone_client(struct rpc_clnt *clnt) .version = clnt->cl_vers, .authflavor = clnt->cl_auth->au_flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -699,6 +700,7 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor) .version = clnt->cl_vers, .authflavor = flavor, .cred = clnt->cl_cred, + .stats = clnt->cl_stats, };return __rpc_clone_client (&args, clnt); }
@@ -979,6 +981,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old, .version = vers, .authflavor = old->cl_auth->au_flavor, .cred = old->cl_cred, + .stats = old->cl_stats, };struct rpc_clnt *clnt;int err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/168 nfs: expose /proc/net/sunrpc/nfs in net namespaces
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit d47151b79e3220e72ae323b8b8e9d6da20dc884e ]
We're using nfs mounts inside of containers in production and noticed that the nfs stats are not exposed in /proc. This is a problem for us as we use these stats for monitoring, and have to do this awkward bind mount from the main host into the container in order to get to these states.
Add the rpc_proc_register call to the pernet operations entry and exit points so these stats can be exposed inside of network namespaces.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/inode.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfs/inode.c +2 -4
@@ -2361,11 +2361,13 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) {nfs_clients_init (net); +rpc_proc_register (net, &nfs_rpcstat);return nfs_fs_proc_net_init (net); }static void nfs_net_exit (struct net *net) { +rpc_proc_unregister (net,"nfs" );nfs_fs_proc_net_exit (net);nfs_clients_exit (net); }
@@ -2424,15 +2426,12 @@ static int __init init_nfs_fs(void)if (err) goto out1; -rpc_proc_register (&init_net, &nfs_rpcstat); - err =register_nfs_fs ();if (err) goto out0;return 0 ; out0: -rpc_proc_unregister (&init_net,"nfs" );nfs_destroy_directcache (); out1:nfs_destroy_writepagecache ();
@@ -2465,7 +2464,6 @@ static void __exit exit_nfs_fs(void)nfs_destroy_nfspagecache ();nfs_fscache_unregister ();unregister_pernet_subsys (&nfs_net_ops); -rpc_proc_unregister (&init_net,"nfs" );unregister_nfs_fs ();nfs_fs_proc_exit ();nfsiod_stop ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/168 nfs: make the rpc_stat per net namespace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
[ Upstream commit 1548036ef1204df65ca5a16e8b199c858cb80075 ]
Now that we're exposing the rpc stats on a per-network namespace basis, move this struct into struct nfs_net and use that to make sure only the per-network namespace stats are exposed.
Stable-dep-of: 24457f1be29f ("nfs: Handle error of rpc_proc_register() in nfs_net_init().")
--- fs/nfs/client.c | 5 ++++- fs/nfs/inode.c | 4 +++- fs/nfs/internal.h | 2 -- fs/nfs/netns.h | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-)
fs/nfs/client.c +4 -1
@@ -73,7 +73,6 @@ const struct rpc_program nfs_program = { .number = NFS_PROGRAM, .nrvers = ARRAY_SIZE(nfs_version), .version = nfs_version, - .stats = &nfs_rpcstat, .pipe_dir_name = NFS_PIPE_DIRNAME, };
@@ -500,6 +499,7 @@ int nfs_create_rpc_client(struct nfs_client *clp,const struct nfs_client_initdata *cl_init, rpc_authflavor_t flavor) { + struct nfs_net *nn = net_generic(clp->cl_net, nfs_net_id);struct rpc_clnt *clnt =NULL ; struct rpc_create_args args = { .net = clp->cl_net,
@@ -511,6 +511,7 @@ int nfs_create_rpc_client(struct nfs_client *clp, .servername = clp->cl_hostname, .nodename = cl_init->nodename, .program = &nfs_program, + .stats = &nn->rpcstats, .version = clp->rpc_ops->version, .authflavor = flavor, .cred = cl_init->cred,
@@ -1129,6 +1130,8 @@ void nfs_clients_init(struct net *net)#endif spin_lock_init (&nn->nfs_client_lock); nn->boot_time =ktime_get_real (); +memset (&nn->rpcstats,0 ,sizeof (nn->rpcstats)); + nn->rpcstats.program = &nfs_program;nfs_netns_sysfs_setup (nn, net); }
fs/nfs/inode.c +3 -1
@@ -2360,8 +2360,10 @@ EXPORT_SYMBOL_GPL(nfs_net_id);static int nfs_net_init (struct net *net) { +struct nfs_net *nn =net_generic (net, nfs_net_id); +nfs_clients_init (net); -rpc_proc_register (net, &nfs_rpcstat); +rpc_proc_register (net, &nn->rpcstats);return nfs_fs_proc_net_init (net); }
fs/nfs/internal.h +0 -2
@@ -428,8 +428,6 @@ int nfs_try_get_tree(struct fs_context *);int nfs_get_tree_common (struct fs_context *);void nfs_kill_super (struct super_block *); -extern struct rpc_stat nfs_rpcstat; -extern int __init register_nfs_fs (void ); extern void __exit unregister_nfs_fs(void);extern bool nfs_sb_active (struct super_block *sb);
fs/nfs/netns.h +2 -0
@@ -9,6 +9,7 @@#include <linux/nfs4.h> #include <net/net_namespace.h> #include <net/netns/generic.h> +#include <linux/sunrpc/stats.h> struct bl_dev_msg {int32_t status;
@@ -34,6 +35,7 @@ struct nfs_net {struct nfs_netns_client *nfs_client;spinlock_t nfs_client_lock;ktime_t boot_time; +struct rpc_stat rpcstats;#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_nfsfs;#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/168 nfs: Handle error of rpc_proc_register() in nfs_net_init().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 24457f1be29f1e7042e50a7749f5c2dde8c433c8 ]
syzkaller reported a warning [0] triggered while destroying immature netns.
rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2").
Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible.
Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns.
Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below.
Let's handle the error of rpc_proc_register() properly in nfs_net_init().
[0]:
name 'nfs'
WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Modules linked in: CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8 FS: 00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170 setup_net+0x46c/0x660 net/core/net_namespace.c:372 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228 ksys_unshare+0x342/0x760 kernel/fork.c:3322 __do_sys_unshare kernel/fork.c:3393 [inline] __se_sys_unshare kernel/fork.c:3391 [inline] __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000 </TASK>
--- fs/nfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/inode.c +6 -1
@@ -2363,7 +2363,12 @@ static int nfs_net_init(struct net *net)struct nfs_net *nn =net_generic (net, nfs_net_id);nfs_clients_init (net); -rpc_proc_register (net, &nn->rpcstats); + +if (!rpc_proc_register (net, &nn->rpcstats)) { +nfs_clients_exit (net); +return -ENOMEM ; + } +return nfs_fs_proc_net_init (net); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/168 power: rt9455: hide unused rt9455_boost_voltage_values
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 452d8950db3e839aba1bb13bc5378f4bac11fa04 ]
The rt9455_boost_voltage_values[] array is only used when USB PHY support is enabled, causing a W=1 warning otherwise:
drivers/power/supply/rt9455_charger.c:200:18: error: 'rt9455_boost_voltage_values' defined but not used [-Werror=unused-const-variable=]
Enclose the definition in the same #ifdef as the references to it.
--- drivers/power/supply/rt9455_charger.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/power/supply/rt9455_charger.c +2 -0
@@ -193,6 +193,7 @@ static const int rt9455_voreg_values[] = { 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000 }; +#if IS_ENABLED (CONFIG_USB_PHY )/* * When the charger is in boost mode, REG02[7:2] represent boost output * voltage.
@@ -208,6 +209,7 @@ static const int rt9455_boost_voltage_values[] = {5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 ,5600000 , 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, }; +#endif /* REG07[3:0] (VMREG) in uV */ static const int rt9455_vmreg_values[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/168 power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 1e0fb113646182e073539db96016b00cfeb18ecc ]
The of_match shall correspond to the name of the regulator subnode, or the deprecated regulator-compatible property must be used:
failing to do so, the regulator won't probe (and the driver will as well not probe).
Since the devicetree binding for this driver is actually correct and wants DTs to use the "usb-otg-vbus-regulator" subnode name, fix this driver by aligning the of_match string to what the DT binding wants.
--- drivers/power/supply/mt6360_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6360_charger.c +1 -1
@@ -591,7 +591,7 @@ static const struct regulator_ops mt6360_chg_otg_ops = { };static const struct regulator_desc mt6360_otg_rdesc = { - .of_match ="usb-otg-vbus" , + .of_match ="usb-otg-vbus-regulator" , .name ="usb-otg-vbus" , .ops = &mt6360_chg_otg_ops, .owner =THIS_MODULE ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/168 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zeng Heng <[email protected]>
[ Upstream commit a0cedbcc8852d6c77b00634b81e41f17f29d9404 ]
If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.
Message-ID: <[email protected]>
--- drivers/pinctrl/devicetree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/pinctrl/devicetree.c +6 -4
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)for (state =0 ; ; state++) {/* Retrieve the pinctrl-* property */ propname =kasprintf (GFP_KERNEL ,"pinctrl-%d" , state); -if (!propname) -return -ENOMEM ; +if (!propname) { + ret = -ENOMEM ; + goto err; + } prop =of_find_property (np, propname, &size);kfree (propname);if (!prop) {if (state ==0 ) { -of_node_put (np); -return -ENODEV ; + ret = -ENODEV ; + goto err; }break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/168 regulator: mt6360: De-capitalize devicetree regulator subnodes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit d3cf8a17498dd9104c04ad28eeac3ef3339f9f9f ]
The MT6360 regulator binding, the example in the MT6360 mfd binding, and the devicetree users of those bindings are rightfully declaring MT6360 regulator subnodes with non-capital names, and luckily without using the deprecated regulator-compatible property.
With this driver declaring capitalized BUCKx/LDOx as of_match string for the node names, obviously no regulator gets probed: fix that by changing the MT6360_REGULATOR_DESC macro to add a "match" parameter which gets assigned to the of_match.
--- drivers/regulator/mt6360-regulator.c | 32 +++++++++++++++++----------- 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/regulator/mt6360-regulator.c +20 -12
@@ -319,15 +319,15 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) } } -#define MT6360_REGULATOR_DESC (_name, _sname, ereg, emask, vreg, vmask, \ - mreg, mmask, streg, stmask, vranges, \ - vcnts, offon_delay, irq_tbls) \ +#define MT6360_REGULATOR_DESC (match, _name, _sname, ereg, emask, vreg, \ + vmask, mreg, mmask, streg, stmask, \ + vranges, vcnts, offon_delay, irq_tbls) \ { \ .desc = { \ .name = #_name, \ .supply_name = #_sname, \ .id = MT6360_REGULATOR_##_name, \ - .of_match = of_match_ptr(#_name), \ + .of_match = of_match_ptr(match), \ .regulators_node = of_match_ptr("regulator"), \ .of_map_mode = mt6360_regulator_of_map_mode, \ .owner = THIS_MODULE, \
@@ -351,21 +351,29 @@ static unsigned int mt6360_regulator_of_map_mode(unsigned int hw_mode) }static const struct mt6360_regulator_desc mt6360_regulator_descs[] = { -MT6360_REGULATOR_DESC (BUCK1 ,BUCK1_VIN ,0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , +MT6360_REGULATOR_DESC ("buck1" ,BUCK1 ,BUCK1_VIN , +0x117 ,0x40 ,0x110 ,0xff ,0x117 ,0x30 ,0x117 ,0x04 , buck_vout_ranges,256 ,0 , buck1_irq_tbls), -MT6360_REGULATOR_DESC (BUCK2 ,BUCK2_VIN ,0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , +MT6360_REGULATOR_DESC ("buck2" ,BUCK2 ,BUCK2_VIN , +0x127 ,0x40 ,0x120 ,0xff ,0x127 ,0x30 ,0x127 ,0x04 , buck_vout_ranges,256 ,0 , buck2_irq_tbls), -MT6360_REGULATOR_DESC (LDO6 ,LDO_VIN3 ,0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , +MT6360_REGULATOR_DESC ("ldo6" ,LDO6 ,LDO_VIN3 , +0x137 ,0x40 ,0x13B ,0xff ,0x137 ,0x30 ,0x137 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo6_irq_tbls), -MT6360_REGULATOR_DESC (LDO7 ,LDO_VIN3 ,0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , +MT6360_REGULATOR_DESC ("ldo7" ,LDO7 ,LDO_VIN3 , +0x131 ,0x40 ,0x135 ,0xff ,0x131 ,0x30 ,0x131 ,0x04 , ldo_vout_ranges1,256 ,0 , ldo7_irq_tbls), -MT6360_REGULATOR_DESC (LDO1 ,LDO_VIN1 ,0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , +MT6360_REGULATOR_DESC ("ldo1" ,LDO1 ,LDO_VIN1 , +0x217 ,0x40 ,0x21B ,0xff ,0x217 ,0x30 ,0x217 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo1_irq_tbls), -MT6360_REGULATOR_DESC (LDO2 ,LDO_VIN1 ,0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , +MT6360_REGULATOR_DESC ("ldo2" ,LDO2 ,LDO_VIN1 , +0x211 ,0x40 ,0x215 ,0xff ,0x211 ,0x30 ,0x211 ,0x04 , ldo_vout_ranges2,256 ,0 , ldo2_irq_tbls), -MT6360_REGULATOR_DESC (LDO3 ,LDO_VIN1 ,0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , +MT6360_REGULATOR_DESC ("ldo3" ,LDO3 ,LDO_VIN1 , +0x205 ,0x40 ,0x209 ,0xff ,0x205 ,0x30 ,0x205 ,0x04 , ldo_vout_ranges2,256 ,100 , ldo3_irq_tbls), -MT6360_REGULATOR_DESC (LDO5 ,LDO_VIN2 ,0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , +MT6360_REGULATOR_DESC ("ldo5" ,LDO5 ,LDO_VIN2 , +0x20B ,0x40 ,0x20F ,0x7f ,0x20B ,0x30 ,0x20B ,0x04 , ldo_vout_ranges3,128 ,100 , ldo5_irq_tbls), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/168 bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 229087f6f1dc2d0c38feba805770f28529980ec0 ]
Turns out that due to CONFIG_DEBUG_INFO_BTF_MODULES not having an explicitly specified "menu item name" in Kconfig, it's basically impossible to turn it off (see [0]).
This patch fixes the issue by defining menu name for CONFIG_DEBUG_INFO_BTF_MODULES, which makes it actually adjustable and independent of CONFIG_DEBUG_INFO_BTF, in the sense that one can have DEBUG_INFO_BTF=y and DEBUG_INFO_BTF_MODULES=n.
We still keep it as defaulting to Y, of course.
--- lib/Kconfig.debug | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/Kconfig.debug +3 -2
@@ -319,7 +319,7 @@ config DEBUG_INFO_DWARF5 endchoice # "DWARF version" config DEBUG_INFO_BTF - bool "Generate BTF typeinfo" + bool "Generate BTF type information" depends on !DEBUG_INFO_SPLIT && !DEBUG_INFO_REDUCED depends on !GCC_PLUGIN_RANDSTRUCT || COMPILE_TEST help
@@ -331,7 +331,8 @@ config PAHOLE_HAS_SPLIT_BTF def_bool PAHOLE_VERSION >= 119 config DEBUG_INFO_BTF_MODULES - def_bool y + bool "Generate BTF type information for kernel modules" + default y depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF help Generate compact split BTF type information for kernel modules.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/168 bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 6648e613226e18897231ab5e42ffc29e63fa3365 ]
Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1].
[1]
BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue
write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:
sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:
sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75
value changed: 0xffffffff83d7feb0 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);".
To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.
--- include/linux/skmsg.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/skmsg.h +2 -0
@@ -462,10 +462,12 @@ static inline void sk_psock_put(struct sstatic inline void sk_psock_data_ready (struct sock *sk,struct sk_psock *psock) { +read_lock_bh (&sk->sk_callback_lock);if (psock->saved_data_ready) psock->saved_data_ready (sk);else sk->sk_data_ready (sk); +read_unlock_bh (&sk->sk_callback_lock); } static inline void psock_set_prog(struct bpf_prog **pprog,
Greg Kroah-Hartman
maintainerPATCH 8/168 eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit caba40ec3531b0849f44502a03117796e8c9f4a1 ]
The DDR3 SPD data structure advertises the presence of a thermal sensor on a DDR3 module in byte 32, bit 7. Let's use this information to explicitly instantiate the thermal sensor I2C client instead of having to rely on class-based I2C probing.
The temp sensor i2c address can be derived from the SPD i2c address, so we can directly instantiate the device and don't have to probe for it. If the temp sensor has been instantiated already by other means (e.g. class-based auto-detection), then the busy-check in i2c_new_client_device will detect this.
Note: Thermal sensors on DDR4 DIMM's are instantiated from the
ee1004 driver.
Stable-dep-of: f42c97027fb7 ("eeprom: at24: fix memory corruption race condition")
--- drivers/misc/eeprom/at24.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/misc/eeprom/at24.c +29 -0
@@ -585,6 +585,31 @@ static unsigned int at24_get_offset_adj(u8 flags, unsigned int byte_len) } } +static void at24_probe_temp_sensor (struct i2c_client *client) +{ +struct at24_data *at24 =i2c_get_clientdata (client); +struct i2c_board_info info = { .type ="jc42" }; +int ret; +u8 val; + +/* +* Byte 2 has value 11 for DDR3, earlier versions don't +* support the thermal sensor present flag +*/ + ret =at24_read (at24,2 , &val,1 ); +if (ret || val !=11 ) +return ; + +/* Byte 32, bit 7 is set if temp sensor is present */ + ret =at24_read (at24,32 , &val,1 ); +if (ret || !(val &BIT (7 ))) +return ; + + info.addr =0x18 | (client->addr &7 ); + +i2c_new_client_device (client->adapter, &info); +} +static int at24_probe (struct i2c_client *client) {struct regmap_config regmap_config = { };
@@ -778,6 +803,10 @@ static int at24_probe(struct i2c_client *client)return -ENODEV ; } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ +if (cdata == &at24_data_spd) +at24_probe_temp_sensor (client); +pm_runtime_idle (dev);if (writable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/168 bpf: Fix a verifier verbose message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <[email protected]>
[ Upstream commit 37eacb9f6e89fb399a79e952bc9c78eb3e16290e ]
Long ago a map file descriptor in a pseudo ldimm64 instruction could only be present as an immediate value insn[0].imm, and thus this value was used in a verbose verifier message printed when the file descriptor wasn't valid. Since addition of BPF_PSEUDO_MAP_IDX_VALUE/BPF_PSEUDO_MAP_IDX the insn[0].imm field can also contain an index pointing to the file descriptor in the attr.fd_array array. However, if the file descriptor is invalid, the verifier still prints the verbose message containing value of insn[0].imm. Patch the verifier message to always print the actual file descriptor value.
--- kernel/bpf/verifier.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/bpf/verifier.c +1 -2
@@ -11875,8 +11875,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env) f =fdget (fd); map =__bpf_map_get (f);if (IS_ERR (map)) { -verbose (env,"fd %d is not pointing to valid bpf_map\n" , - insn[0 ].imm); +verbose (env,"fd %d is not pointing to valid bpf_map\n" , fd);return PTR_ERR (map); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/168 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit 7430764f5a85d30314aeef2d5438dff1fb0b1d68 ]
Due to the reading of FIFO during the dump of data registers in debugfs, if SPI transmission is in progress, it will be affected and may result in transmission failure. Therefore, the dump interface of data registers in debugfs is removed.
--- drivers/spi/spi-hisi-kunpeng.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spi-hisi-kunpeng.c +0 -2
@@ -151,8 +151,6 @@ static const struct debugfs_reg32 hisi_spi_regs[] = {HISI_SPI_DBGFS_REG ("ENR" ,HISI_SPI_ENR ),HISI_SPI_DBGFS_REG ("FIFOC" ,HISI_SPI_FIFOC ),HISI_SPI_DBGFS_REG ("IMR" ,HISI_SPI_IMR ), -HISI_SPI_DBGFS_REG ("DIN" ,HISI_SPI_DIN ), -HISI_SPI_DBGFS_REG ("DOUT" ,HISI_SPI_DOUT ),HISI_SPI_DBGFS_REG ("SR" ,HISI_SPI_SR ),HISI_SPI_DBGFS_REG ("RISR" ,HISI_SPI_RISR ), HISI_SPI_DBGFS_REG("ISR", HISI_SPI_ISR),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/168 s390/mm: Fix storage key clearing for guest huge pages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 843c3280686fc1a83d89ee1e0b5599c9f6b09d0c ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/gmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/gmap.c +1 -1
@@ -2632,7 +2632,7 @@ static int __s390_enable_skey_hugetlb(pte_t *pte, unsigned long addr,return 0 ; start =pmd_val (*pmd) &HPAGE_MASK ; - end = start +HPAGE_SIZE -1 ; + end = start +HPAGE_SIZE ;__storage_key_init_range (start, end);set_bit (PG_arch_1, &page->flags);cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/168 s390/mm: Fix clearing storage keys for huge pages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudio Imbrenda <[email protected]>
[ Upstream commit 412050af2ea39407fe43324b0be4ab641530ce88 ]
The function __storage_key_init_range() expects the end address to be the first byte outside the range to be initialized. I.e. end - start should be the size of the area to be initialized.
The current code works because __storage_key_init_range() will still loop over every page in the range, but it is slower than using sske_frame().
--- arch/s390/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/mm/hugetlbpage.c +1 -1
@@ -146,7 +146,7 @@ static void clear_huge_pte_skeys(struct mm_struct *mm, unsigned long rste) }if (!test_and_set_bit (PG_arch_1, &page->flags)) -__storage_key_init_range (paddr, paddr + size -1 ); +__storage_key_init_range (paddr, paddr + size); } void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/168 xdp: Move conversion to xdp_frame out of map functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit d53ad5d8b218a885e95080d4d3d556b16b91b1b9 ]
All map redirect functions except XSK maps convert xdp_buff to xdp_frame before enqueueing it. So move this conversion of out the map functions and into xdp_do_redirect(). This removes a bit of duplicated code, but more importantly it makes it possible to support caller-allocated xdp_frame structures, which will be added in a subsequent commit.
Stable-dep-of: 5bcf0dcbf906 ("xdp: use flags field to disambiguate broadcast redirect")
--- include/linux/bpf.h | 20 ++++++++++---------- kernel/bpf/cpumap.c | 8 +------- kernel/bpf/devmap.c | 32 +++++++++++--------------------- net/core/filter.c | 24 +++++++++++++++++------- 4 files changed, 39 insertions(+), 45 deletions(-)
include/linux/bpf.h +10 -10
@@ -1651,17 +1651,17 @@ void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);struct btf *bpf_get_btf_vmlinux (void );/* Map specifics */ -struct xdp_buff ; +struct xdp_frame ;struct sk_buff ;struct bpf_dtab_netdev ;struct bpf_cpu_map_entry ;void __dev_flush (void ); -int dev_xdp_enqueue (struct net_device *dev,struct xdp_buff *xdp, +int dev_xdp_enqueue (struct net_device *dev,struct xdp_frame *xdpf,struct net_device *dev_rx); -int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_buff *xdp, +int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_frame *xdpf,struct net_device *dev_rx); -int dev_map_enqueue_multi (struct xdp_buff *xdp,struct net_device *dev_rx, +int dev_map_enqueue_multi (struct xdp_frame *xdpf,struct net_device *dev_rx,struct bpf_map *map,bool exclude_ingress);int dev_map_generic_redirect (struct bpf_dtab_netdev *dst,struct sk_buff *skb,struct bpf_prog *xdp_prog);
@@ -1670,7 +1670,7 @@ int dev_map_redirect_multi(struct net_device *dev, struct sk_buff *skb, bool exclude_ingress);void __cpu_map_flush (void ); -int cpu_map_enqueue (struct bpf_cpu_map_entry *rcpu,struct xdp_buff *xdp, +int cpu_map_enqueue (struct bpf_cpu_map_entry *rcpu,struct xdp_frame *xdpf,struct net_device *dev_rx);int cpu_map_generic_redirect (struct bpf_cpu_map_entry *rcpu,struct sk_buff *skb);
@@ -1823,26 +1823,26 @@ static inline void __dev_flush(void) { } -struct xdp_buff ; +struct xdp_frame ;struct bpf_dtab_netdev ;struct bpf_cpu_map_entry ;static inline -int dev_xdp_enqueue (struct net_device *dev,struct xdp_buff *xdp, +int dev_xdp_enqueue (struct net_device *dev,struct xdp_frame *xdpf,struct net_device *dev_rx) {return 0 ; }static inline -int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_buff *xdp, +int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_frame *xdpf,struct net_device *dev_rx) {return 0 ; }static inline -int dev_map_enqueue_multi (struct xdp_buff *xdp,struct net_device *dev_rx, +int dev_map_enqueue_multi (struct xdp_frame *xdpf,struct net_device *dev_rx,struct bpf_map *map,bool exclude_ingress) {return 0 ;
@@ -1870,7 +1870,7 @@ static inline void __cpu_map_flush(void) }static inline int cpu_map_enqueue (struct bpf_cpu_map_entry *rcpu, -struct xdp_buff *xdp, +struct xdp_frame *xdpf,struct net_device *dev_rx) {return 0 ;
kernel/bpf/cpumap.c +1 -7
@@ -764,15 +764,9 @@ static void bq_enqueue(struct bpf_cpu_map_entry *rcpu, struct xdp_frame *xdpf)list_add (&bq->flush_node, flush_list); } -int cpu_map_enqueue (struct bpf_cpu_map_entry *rcpu,struct xdp_buff *xdp, +int cpu_map_enqueue (struct bpf_cpu_map_entry *rcpu,struct xdp_frame *xdpf,struct net_device *dev_rx) { -struct xdp_frame *xdpf; - - xdpf =xdp_convert_buff_to_frame (xdp); -if (unlikely (!xdpf)) -return -EOVERFLOW ; -/* Info needed when constructing SKB on remote CPU */ xdpf->dev_rx = dev_rx;
kernel/bpf/devmap.c +11 -21
@@ -468,24 +468,19 @@ static void bq_enqueue(struct net_device *dev, struct xdp_frame *xdpf, bq->q[bq->count++] = xdpf; } -static inline int __xdp_enqueue (struct net_device *dev,struct xdp_buff *xdp, +static inline int __xdp_enqueue (struct net_device *dev,struct xdp_frame *xdpf,struct net_device *dev_rx,struct bpf_prog *xdp_prog) { -struct xdp_frame *xdpf;int err;if (!dev->netdev_ops->ndo_xdp_xmit)return -EOPNOTSUPP ; - err =xdp_ok_fwd_dev (dev, xdp->data_end - xdp->data); + err =xdp_ok_fwd_dev (dev, xdpf->len);if (unlikely (err))return err; - xdpf =xdp_convert_buff_to_frame (xdp); -if (unlikely (!xdpf)) -return -EOVERFLOW ; -bq_enqueue (dev, xdpf, dev_rx, xdp_prog);return 0 ; }
@@ -521,27 +516,27 @@ static u32 dev_map_bpf_prog_run_skb(struct sk_buff *skb, struct bpf_dtab_netdevreturn act; } -int dev_xdp_enqueue (struct net_device *dev,struct xdp_buff *xdp, +int dev_xdp_enqueue (struct net_device *dev,struct xdp_frame *xdpf,struct net_device *dev_rx) { -return __xdp_enqueue (dev, xdp, dev_rx,NULL ); +return __xdp_enqueue (dev, xdpf, dev_rx,NULL ); } -int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_buff *xdp, +int dev_map_enqueue (struct bpf_dtab_netdev *dst,struct xdp_frame *xdpf,struct net_device *dev_rx) {struct net_device *dev = dst->dev; -return __xdp_enqueue (dev, xdp, dev_rx, dst->xdp_prog); +return __xdp_enqueue (dev, xdpf, dev_rx, dst->xdp_prog); } -static bool is_valid_dst (struct bpf_dtab_netdev *obj,struct xdp_buff *xdp) +static bool is_valid_dst (struct bpf_dtab_netdev *obj,struct xdp_frame *xdpf) {if (!obj || !obj->dev->netdev_ops->ndo_xdp_xmit)return false; -if (xdp_ok_fwd_dev (obj->dev, xdp->data_end - xdp->data)) +if (xdp_ok_fwd_dev (obj->dev, xdpf->len))return false;return true;
@@ -587,14 +582,13 @@ static int get_upper_ifindexes(struct net_device *dev, int *indexes)return n; } -int dev_map_enqueue_multi (struct xdp_buff *xdp,struct net_device *dev_rx, +int dev_map_enqueue_multi (struct xdp_frame *xdpf,struct net_device *dev_rx,struct bpf_map *map,bool exclude_ingress) { struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);struct bpf_dtab_netdev *dst, *last_dst =NULL ;int excluded_devices[1 +MAX_NEST_DEV ];struct hlist_head *head; -struct xdp_frame *xdpf;int num_excluded =0 ;unsigned int i;int err;
@@ -604,15 +598,11 @@ int dev_map_enqueue_multi(struct xdp_buff *xdp, struct net_device *dev_rx, excluded_devices[num_excluded++] = dev_rx->ifindex; } - xdpf =xdp_convert_buff_to_frame (xdp); -if (unlikely (!xdpf)) -return -EOVERFLOW ; -if (map->map_type ==BPF_MAP_TYPE_DEVMAP ) {for (i =0 ; i < map->max_entries; i++) { dst =rcu_dereference_check (dtab->netdev_map[i],rcu_read_lock_bh_held ()); -if (!is_valid_dst (dst, xdp)) +if (!is_valid_dst (dst, xdpf))continue ;if (is_ifindex_excluded (excluded_devices, num_excluded, dst->dev->ifindex))
@@ -635,7 +625,7 @@ int dev_map_enqueue_multi(struct xdp_buff *xdp, struct net_device *dev_rx, head =dev_map_index_hash (dtab, i);hlist_for_each_entry_rcu (dst, head, index_hlist,lockdep_is_held (&dtab->index_lock)) { -if (!is_valid_dst (dst, xdp)) +if (!is_valid_dst (dst, xdpf))continue ; if (is_ifindex_excluded(excluded_devices, num_excluded,
net/core/filter.c +17 -7
@@ -3994,12 +3994,24 @@ int xdp_do_redirect(struct net_device *dev, struct xdp_buff *xdp,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +struct xdp_frame *xdpf;struct bpf_map *map;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ ri->map_type =BPF_MAP_TYPE_UNSPEC ; +if (map_type ==BPF_MAP_TYPE_XSKMAP ) { + err =__xsk_map_redirect (fwd, xdp); + goto out; + } + + xdpf =xdp_convert_buff_to_frame (xdp); +if (unlikely (!xdpf)) { + err = -EOVERFLOW ; + goto err; + } +switch (map_type) {case BPF_MAP_TYPE_DEVMAP : fallthrough;
@@ -4007,17 +4019,14 @@ int xdp_do_redirect(struct net_device *dev, struct xdp_buff *xdp, map =READ_ONCE (ri->map);if (unlikely (map)) {WRITE_ONCE (ri->map,NULL ); - err =dev_map_enqueue_multi (xdp, dev, map, + err =dev_map_enqueue_multi (xdpf, dev, map, ri->flags &BPF_F_EXCLUDE_INGRESS ); }else { - err =dev_map_enqueue (fwd, xdp, dev); + err =dev_map_enqueue (fwd, xdpf, dev); }break ;case BPF_MAP_TYPE_CPUMAP : - err =cpu_map_enqueue (fwd, xdp, dev); -break ; -case BPF_MAP_TYPE_XSKMAP : - err =__xsk_map_redirect (fwd, xdp); + err =cpu_map_enqueue (fwd, xdpf, dev);break ;case BPF_MAP_TYPE_UNSPEC :if (map_id ==INT_MAX ) {
@@ -4026,7 +4035,7 @@ int xdp_do_redirect(struct net_device *dev, struct xdp_buff *xdp, err = -EINVAL ;break ; } - err =dev_xdp_enqueue (fwd, xdp, dev); + err =dev_xdp_enqueue (fwd, xdpf, dev);break ; } fallthrough;
@@ -4034,6 +4043,7 @@ int xdp_do_redirect(struct net_device *dev, struct xdp_buff *xdp, err = -EBADRQC ; } +out:if (unlikely (err)) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/168 xdp: Add xdp_do_redirect_frame() for pre-computed xdp_frames
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 1372d34ccf6dd480332b2bcb2fd59a2b9a0df415 ]
Add an xdp_do_redirect_frame() variant which supports pre-computed xdp_frame structures. This will be used in bpf_prog_run() to avoid having to write to the xdp_frame structure when the XDP program doesn't modify the frame boundaries.
Stable-dep-of: 5bcf0dcbf906 ("xdp: use flags field to disambiguate broadcast redirect")
--- include/linux/filter.h | 4 +++ net/core/filter.c | 65 +++++++++++++++++++++++++++++++++++------- 2 files changed, 58 insertions(+), 11 deletions(-)
include/linux/filter.h +4 -0
@@ -1020,6 +1020,10 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,int xdp_do_redirect (struct net_device *dev,struct xdp_buff *xdp,struct bpf_prog *prog); +int xdp_do_redirect_frame (struct net_device *dev, +struct xdp_buff *xdp, +struct xdp_frame *xdpf, +struct bpf_prog *prog);void xdp_do_flush (void );/* The xdp_do_flush_map() helper has been renamed to drop the _map suffix, as
net/core/filter.c +54 -11
95 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/168 xdp: use flags field to disambiguate broadcast redirect
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 5bcf0dcbf9066348058b88a510c57f70f384c92c ]
When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination.
When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue().
To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non-broadcast fast path.
--- net/core/filter.c | 42 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 10 deletions(-)
net/core/filter.c +32 -10
@@ -4019,10 +4019,12 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;struct bpf_map *map;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (unlikely (!xdpf)) {
@@ -4034,11 +4036,20 @@ static __always_inline int __xdp_do_redirect_frame(struct bpf_redirect_info *ri,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_enqueue_multi (xdpf, dev, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_enqueue (fwd, xdpf, dev); }
@@ -4101,9 +4112,9 @@ EXPORT_SYMBOL_GPL(xdp_do_redirect_frame);static int xdp_do_generic_redirect_map (struct net_device *dev,struct sk_buff *skb,struct xdp_buff *xdp, -struct bpf_prog *xdp_prog, -void *fwd, -enum bpf_map_type map_type,u32 map_id) +struct bpf_prog *xdp_prog,void *fwd, +enum bpf_map_type map_type,u32 map_id, +u32 flags) {struct bpf_redirect_info *ri =this_cpu_ptr (&bpf_redirect_info);struct bpf_map *map;
@@ -4113,11 +4124,20 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,case BPF_MAP_TYPE_DEVMAP : fallthrough;case BPF_MAP_TYPE_DEVMAP_HASH : - map =READ_ONCE (ri->map); -if (unlikely (map)) { +if (unlikely (flags &BPF_F_BROADCAST )) { + map =READ_ONCE (ri->map); + +/* The map pointer is cleared when the map is being torn +* down by bpf_clear_redirect_map() +*/ +if (unlikely (!map)) { + err = -ENOENT ; +break ; + } +WRITE_ONCE (ri->map,NULL ); err =dev_map_redirect_multi (dev, skb, xdp_prog, map, - ri->flags &BPF_F_EXCLUDE_INGRESS ); + flags &BPF_F_EXCLUDE_INGRESS ); }else { err =dev_map_generic_redirect (fwd, skb, xdp_prog); }
@@ -4154,9 +4174,11 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,enum bpf_map_type map_type = ri->map_type;void *fwd = ri->tgt_value;u32 map_id = ri->map_id; +u32 flags = ri->flags;int err; ri->map_id =0 ;/* Valid map id idr range: [1,INT_MAX[ */ + ri->flags =0 ; ri->map_type =BPF_MAP_TYPE_UNSPEC ;if (map_type ==BPF_MAP_TYPE_UNSPEC && map_id ==INT_MAX ) {
@@ -4176,7 +4198,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,return 0 ; } -return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id); +return xdp_do_generic_redirect_map (dev, skb, xdp, xdp_prog, fwd, map_type, map_id, flags); err:_trace_xdp_redirect_err (dev, xdp_prog, ri->tgt_index, err);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/168 bna: ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f ]
Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
--- drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/brocade/bna/bnad_debugfs.c +2 -2
@@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
@@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,void *kern_buf;/* Copy the user space buf */ - kern_buf =memdup_user (buf, nbytes); + kern_buf =memdup_user_nul (buf, nbytes);if (IS_ERR (kern_buf))return PTR_ERR (kern_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/168 octeontx2-af: avoid off-by-one read from userspace
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +1 -3
@@ -559,12 +559,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,u16 pcifunc;int ret, lf; - cmd_buf =memdup_user (buffer, count +1 ); + cmd_buf =memdup_user_nul (buffer, count);if (IS_ERR (cmd_buf))return -ENOMEM ; - cmd_buf[count] ='\0' ; - cmd_buf_tmp =strchr (cmd_buf,'\n' );if (cmd_buf_tmp) { *cmd_buf_tmp ='\0' ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/168 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4b911a9690d72641879ea6d13cce1de31d346d79 ]
syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO_NET_HDR_GSO_UDP layering the following protocols:
ETH_P_8021AD + ETH_P_NSH + ETH_P_IPV6 + IPPROTO_UDP
NSH can encapsulate IPv4, IPv6, Ethernet, NSH, and MPLS. As the inner protocol can be Ethernet, NSH GSO handler, nsh_gso_segment(), calls skb_mac_gso_segment() to invoke inner protocol GSO handlers.
nsh_gso_segment() does the following for the original skb before calling skb_mac_gso_segment()
1. reset skb->network_header
2. save the original skb->{mac_heaeder,mac_len} in a local variable
3. pull the NSH header
4. resets skb->mac_header
5. set up skb->mac_len and skb->protocol for the inner protocol.
and does the following for the segmented skb
6. set ntohs(ETH_P_NSH) to skb->protocol
7. push the NSH header
8. restore skb->mac_header
9. set skb->mac_header + mac_len to skb->network_header
10. restore skb->mac_len
There are two problems in 6-7 and 8-9.
(a)
After 6 & 7, skb->data points to the NSH header, so the outer header (ETH_P_8021AD in this case) is stripped when skb is sent out of netdev.
Also, if NSH is encapsulated by NSH + Ethernet (so NSH-Ethernet-NSH), skb_pull() in the first nsh_gso_segment() will make skb->data point to the middle of the outer NSH or Ethernet header because the Ethernet header is not pulled by the second nsh_gso_segment().
(b)
While restoring skb->{mac_header,network_header} in 8 & 9, nsh_gso_segment() does not assume that the data in the linear buffer is shifted.
However, udp6_ufo_fragment() could shift the data and change skb->mac_header accordingly as demonstrated by syzbot.
If this happens, even the restored skb->mac_header points to the middle of the outer header.
It seems nsh_gso_segment() has never worked with outer headers so far.
At the end of nsh_gso_segment(), the outer header must be restored for the segmented skb, instead of the NSH header.
To do that, let's calculate the outer header position relatively from the inner header and set skb->{data,mac_header,protocol} properly.
[0]:
BUG: KMSAN: uninit-value in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] BUG: KMSAN: uninit-value in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] BUG: KMSAN: uninit-value in ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:524 [inline] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] ipvlan_queue_xmit+0xf44/0x16b0 drivers/net/ipvlan/ipvlan_core.c:668 ipvlan_start_xmit+0x5c/0x1a0 drivers/net/ipvlan/ipvlan_main.c:222 __netdev_start_xmit include/linux/netdevice.h:4989 [inline] netdev_start_xmit include/linux/netdevice.h:5003 [inline] xmit_one net/core/dev.c:3547 [inline] dev_hard_start_xmit+0x244/0xa10 net/core/dev.c:3563 __dev_queue_xmit+0x33ed/0x51c0 net/core/dev.c:4351 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x705/0x1000 mm/slub.c:4001 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 skb_segment+0x20aa/0x7080 net/core/skbuff.c:4647 udp6_ufo_fragment+0xcab/0x1150 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x14be/0x2ca0 net/ipv6/ip6_offload.c:152 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 nsh_gso_segment+0x6f4/0xf70 net/nsh/nsh.c:108 skb_mac_gso_segment+0x3e8/0x760 net/core/gso.c:53 __skb_gso_segment+0x4b0/0x730 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x107f/0x1930 net/core/dev.c:3628 __dev_queue_xmit+0x1f28/0x51c0 net/core/dev.c:4343 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 1 PID: 5101 Comm: syz-executor421 Not tainted 6.8.0-rc5-syzkaller-00297-gf2e367d6ad3b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
--- net/nsh/nsh.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/nsh/nsh.c +8 -6
@@ -76,13 +76,15 @@ EXPORT_SYMBOL_GPL(nsh_pop);static struct sk_buff *nsh_gso_segment (struct sk_buff *skb,netdev_features_t features) { +unsigned int outer_hlen, mac_len, nsh_len;struct sk_buff *segs =ERR_PTR (-EINVAL );u16 mac_offset = skb->mac_header; -unsigned int nsh_len, mac_len; -__be16 proto; +__be16 outer_proto, proto;skb_reset_network_header (skb); + outer_proto = skb->protocol; + outer_hlen =skb_mac_header_len (skb); mac_len = skb->mac_len;if (unlikely (!pskb_may_pull (skb,NSH_BASE_HDR_LEN )))
@@ -112,10 +114,10 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, }for (skb = segs; skb; skb = skb->next) { - skb->protocol =htons (ETH_P_NSH ); -__skb_push (skb, nsh_len); - skb->mac_header = mac_offset; - skb->network_header = skb->mac_header + mac_len; + skb->protocol = outer_proto; +__skb_push (skb, nsh_len + outer_hlen); +skb_reset_mac_header (skb); +skb_set_network_header (skb, outer_hlen); skb->mac_len = mac_len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/168 eeprom: at24: fix memory corruption race condition
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Okazaki <[email protected]>
[ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]
If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory.
Move the failure point before registering the nvmem device.
--- drivers/misc/eeprom/at24.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/misc/eeprom/at24.c +9 -9
@@ -782,15 +782,6 @@ static int at24_probe(struct i2c_client *client)pm_runtime_set_active (dev);pm_runtime_enable (dev); - at24->nvmem =devm_nvmem_register (dev, &nvmem_config); -if (IS_ERR (at24->nvmem)) { -pm_runtime_disable (dev); -if (!pm_runtime_status_suspended (dev)) -regulator_disable (at24->vcc_reg); -return dev_err_probe (dev,PTR_ERR (at24->nvmem), -"failed to register nvmem\n" ); - } -/* * Perform a one-byte test read to verify that the * chip is functional.
@@ -803,6 +794,15 @@ static int at24_probe(struct i2c_client *client)return -ENODEV ; } + at24->nvmem =devm_nvmem_register (dev, &nvmem_config); +if (IS_ERR (at24->nvmem)) { +pm_runtime_disable (dev); +if (!pm_runtime_status_suspended (dev)) +regulator_disable (at24->vcc_reg); +return dev_err_probe (dev,PTR_ERR (at24->nvmem), +"failed to register nvmem\n" ); + } +/* If this a SPD EEPROM, probe for DDR3 thermal sensor */ if (cdata == &at24_data_spd)at24_probe_temp_sensor (client);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/168 net l2tp: drop flow hash on forward
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Bauer <[email protected]>
[ Upstream commit 42f853b42899d9b445763b55c3c8adc72be0f0e1 ]
Drop the flow-hash of the skb when forwarding to the L2TP netdev.
This avoids the L2TP qdisc from using the flow-hash from the outer packet, which is identical for every flow within the tunnel.
This does not affect every platform but is specific for the ethernet driver. It depends on the platform including L4 information in the flow-hash.
One such example is the Mediatek Filogic MT798x family of networking processors.
--- net/l2tp/l2tp_eth.c | 3 +++ 1 file changed, 3 insertions(+)
net/l2tp/l2tp_eth.c +3 -0
@@ -136,6 +136,9 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,/* checksums verified by L2TP */ skb->ip_summed =CHECKSUM_NONE ; +/* drop outer flow-hash */ +skb_clear_hash (skb); +skb_dst_drop (skb);nf_reset_ct (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/168 s390/vdso: Add CFI for RA register to asm macro vdso_func
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit b961ec10b9f9719987470236feb50c967db5a652 ]
The return-address (RA) register r14 is specified as volatile in the s390x ELF ABI [1]. Nevertheless proper CFI directives must be provided for an unwinder to restore the return address, if the RA register value is changed from its value at function entry, as it is the case.
[1]: s390x ELF ABI, https://github.com/IBM/s390x-abi/releases
--- arch/s390/include/asm/dwarf.h | 1 + arch/s390/kernel/vdso64/vdso_user_wrapper.S | 2 ++ 2 files changed, 3 insertions(+)
arch/s390/include/asm/dwarf.h +1 -0
@@ -9,6 +9,7 @@#define CFI_DEF_CFA_OFFSET .cfi_def_cfa_offset#define CFI_ADJUST_CFA_OFFSET .cfi_adjust_cfa_offset#define CFI_RESTORE .cfi_restore +#define CFI_REL_OFFSET .cfi_rel_offset#ifdef CONFIG_AS_CFI_VAL_OFFSET #define CFI_VAL_OFFSET .cfi_val_offset
arch/s390/kernel/vdso64/vdso_user_wrapper.S +2 -0
@@ -23,8 +23,10 @@ __kernel_\func: CFI_DEF_CFA_OFFSET (STACK_FRAME_OVERHEAD + WRAPPER_FRAME_SIZE) CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD stg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_REL_OFFSET 14, STACK_FRAME_OVERHEAD brasl %r14,__s390_vdso_\func lg %r14,STACK_FRAME_OVERHEAD(%r15) + CFI_RESTORE 14 aghi %r15,WRAPPER_FRAME_SIZE CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD CFI_RESTORE 15
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/168 net: qede: sanitize rc in qede_add_tc_flower_fltr()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit e25714466abd9d96901b15efddf82c60a38abd86 ]
Explicitly set 'rc' (return code), before jumping to the unlock and return path.
By not having any code depend on that 'rc' remains at it's initial value of -EINVAL, then we can re-use 'rc' for the return code of function calls in subsequent patches.
Only compile tested.
Stable-dep-of: fcee2065a178 ("net: qede: use return from qede_parse_flow_attr() for flower")
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +8 -3
@@ -1868,8 +1868,8 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, struct flow_cls_offload *f) {struct qede_arfs_fltr_node *n; -int min_hlen, rc = -EINVAL ;struct qede_arfs_tuple t; +int min_hlen, rc;__qede_lock (edev);
@@ -1879,8 +1879,10 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) +if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { + rc = -EINVAL ; goto unlock; + }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
@@ -1888,12 +1890,15 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto,DP_NOTICE (edev,"Filter configuration invalidated, filter mode=0x%x, configured mode=0x%x, filter count=0x%x\n" , t.mode, edev->arfs->mode, edev->arfs->filter_count); + rc = -EINVAL ; goto unlock; }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) +if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { + rc = -EINVAL ; goto unlock; + }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/168 net: qede: use return from qede_parse_flow_attr() for flower
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit fcee2065a178f78be6fd516302830378b17dba3d ]
In qede_add_tc_flower_fltr(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced these functions.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1879,10 +1879,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse flower attribute and prepare filter */ -if (qede_parse_flow_attr (edev, proto, f->rule, &t)) { - rc = -EINVAL ; + rc =qede_parse_flow_attr (edev, proto, f->rule, &t); +if (rc) goto unlock; - }/* Validate profile mode and number of filters */ if ((edev->arfs->filter_count && edev->arfs->mode != t.mode) ||
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/168 pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit c10cd03d69403fa0f00be8631bd4cb4690440ebd ]
The register offset to disable the internal pull-down of GPIOR~T is 0x630 instead of 0x620, as specified in the Ast2600 datasheet v15 The datasheet can download from the official Aspeed website.
Message-ID: <[email protected]>
--- drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 34 +++++++++++----------- 1 file changed, 17 insertions(+), 17 deletions(-)
drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c +17 -17
@@ -43,7 +43,7 @@#define SCU614 0x614/* Disable GPIO Internal Pull-Down #1 */ #define SCU618 0x618/* Disable GPIO Internal Pull-Down #2 */ #define SCU61C 0x61c/* Disable GPIO Internal Pull-Down #3 */ -#define SCU620 0x620/* Disable GPIO Internal Pull-Down #4 */ +#define SCU630 0x630/* Disable GPIO Internal Pull-Down #4 */ #define SCU634 0x634/* Disable GPIO Internal Pull-Down #5 */ #define SCU638 0x638/* Disable GPIO Internal Pull-Down #6 */ #define SCU690 0x690/* Multi-function Pin Control #24 */
@@ -2487,38 +2487,38 @@ static struct aspeed_pin_config aspeed_g6_configs[] = {ASPEED_PULL_DOWN_PINCONF (D14 ,SCU61C ,0 ),/* GPIOS7 */ -ASPEED_PULL_DOWN_PINCONF (T24 ,SCU620 ,23 ), +ASPEED_PULL_DOWN_PINCONF (T24 ,SCU630 ,23 ),/* GPIOS6 */ -ASPEED_PULL_DOWN_PINCONF (P23 ,SCU620 ,22 ), +ASPEED_PULL_DOWN_PINCONF (P23 ,SCU630 ,22 ),/* GPIOS5 */ -ASPEED_PULL_DOWN_PINCONF (P24 ,SCU620 ,21 ), +ASPEED_PULL_DOWN_PINCONF (P24 ,SCU630 ,21 ),/* GPIOS4 */ -ASPEED_PULL_DOWN_PINCONF (R26 ,SCU620 ,20 ), +ASPEED_PULL_DOWN_PINCONF (R26 ,SCU630 ,20 ),/* GPIOS3*/ -ASPEED_PULL_DOWN_PINCONF (R24 ,SCU620 ,19 ), +ASPEED_PULL_DOWN_PINCONF (R24 ,SCU630 ,19 ),/* GPIOS2 */ -ASPEED_PULL_DOWN_PINCONF (T26 ,SCU620 ,18 ), +ASPEED_PULL_DOWN_PINCONF (T26 ,SCU630 ,18 ),/* GPIOS1 */ -ASPEED_PULL_DOWN_PINCONF (T25 ,SCU620 ,17 ), +ASPEED_PULL_DOWN_PINCONF (T25 ,SCU630 ,17 ),/* GPIOS0 */ -ASPEED_PULL_DOWN_PINCONF (R23 ,SCU620 ,16 ), +ASPEED_PULL_DOWN_PINCONF (R23 ,SCU630 ,16 ),/* GPIOR7 */ -ASPEED_PULL_DOWN_PINCONF (U26 ,SCU620 ,15 ), +ASPEED_PULL_DOWN_PINCONF (U26 ,SCU630 ,15 ),/* GPIOR6 */ -ASPEED_PULL_DOWN_PINCONF (W26 ,SCU620 ,14 ), +ASPEED_PULL_DOWN_PINCONF (W26 ,SCU630 ,14 ),/* GPIOR5 */ -ASPEED_PULL_DOWN_PINCONF (T23 ,SCU620 ,13 ), +ASPEED_PULL_DOWN_PINCONF (T23 ,SCU630 ,13 ),/* GPIOR4 */ -ASPEED_PULL_DOWN_PINCONF (U25 ,SCU620 ,12 ), +ASPEED_PULL_DOWN_PINCONF (U25 ,SCU630 ,12 ),/* GPIOR3*/ -ASPEED_PULL_DOWN_PINCONF (V26 ,SCU620 ,11 ), +ASPEED_PULL_DOWN_PINCONF (V26 ,SCU630 ,11 ),/* GPIOR2 */ -ASPEED_PULL_DOWN_PINCONF (V24 ,SCU620 ,10 ), +ASPEED_PULL_DOWN_PINCONF (V24 ,SCU630 ,10 ),/* GPIOR1 */ -ASPEED_PULL_DOWN_PINCONF (U24 ,SCU620 ,9 ), +ASPEED_PULL_DOWN_PINCONF (U24 ,SCU630 ,9 ),/* GPIOR0 */ -ASPEED_PULL_DOWN_PINCONF (V25 ,SCU620 ,8 ), +ASPEED_PULL_DOWN_PINCONF (V25 ,SCU630 ,8 ),/* GPIOX7 */ ASPEED_PULL_DOWN_PINCONF(AB10, SCU634, 31),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/168 pinctrl/meson: fix typo in PDMs pin name
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Dakinevich <[email protected]>
[ Upstream commit 368a90e651faeeb7049a876599cf2b0d74954796 ]
Other pins have _a or _x suffix, but this one doesn't have any. Most likely this is a typo.
Message-ID: <[email protected]>
--- drivers/pinctrl/meson/pinctrl-meson-a1.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/meson/pinctrl-meson-a1.c +3 -3
@@ -250,7 +250,7 @@ static const unsigned int pdm_dclk_x_pins[] = { GPIOX_10 };static const unsigned int pdm_din2_a_pins[] = {GPIOA_6 };static const unsigned int pdm_din1_a_pins[] = {GPIOA_7 };static const unsigned int pdm_din0_a_pins[] = {GPIOA_8 }; -static const unsigned int pdm_dclk_pins[] = {GPIOA_9 }; +static const unsigned int pdm_dclk_a_pins[] = {GPIOA_9 };/* gen_clk */ static const unsigned int gen_clk_x_pins[] = {GPIOX_7 };
@@ -591,7 +591,7 @@ static struct meson_pmx_group meson_a1_periphs_groups[] = {GROUP (pdm_din2_a,3 ),GROUP (pdm_din1_a,3 ),GROUP (pdm_din0_a,3 ), -GROUP (pdm_dclk,3 ), +GROUP (pdm_dclk_a,3 ),GROUP (pwm_c_a,3 ), GROUP(pwm_b_a, 3),
@@ -755,7 +755,7 @@ static const char * const spi_a_groups[] = {static const char *const pdm_groups[] = {"pdm_din0_x" ,"pdm_din1_x" ,"pdm_din2_x" ,"pdm_dclk_x" ,"pdm_din2_a" , -"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk" , +"pdm_din1_a" ,"pdm_din0_a" ,"pdm_dclk_a" , };static const char *const gen_clk_groups[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/168 pinctrl: core: delete incorrect free in pinctrl_enable()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 5038a66dad0199de60e5671603ea6623eb9e5c79 ]
The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free.
The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.
Message-ID: <[email protected]>
--- drivers/pinctrl/core.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pinctrl/core.c +1 -7
@@ -2098,13 +2098,7 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) error =pinctrl_claim_hogs (pctldev);if (error) { -dev_err (pctldev->dev,"could not claim hogs: %i\n" , - error); -pinctrl_free_pindescs (pctldev, pctldev->desc->pins, - pctldev->desc->npins); -mutex_destroy (&pctldev->mutex); -kfree (pctldev); - +dev_err (pctldev->dev,"could not claim hogs: %i\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/168 pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 9b780fa1ff14663c2e0f07ad098b96b8337f27a4 ]
The current code deals with optional features by testing for the function pointers and returning -ENOTSUPP if it is not valid. This is done for multiple pin config settings and results in the code that handles the supporting cases to get indented by one level. This is aggrevated by the fact that some features require another level of conditionals.
Instead of assigning the same error code in all unsupported optional feature cases, simply have that error code as the default, and break out of the switch/case block whenever a feature is unsupported, or an error is returned. This reduces indentation by one level for the useful code.
Also replace the goto statements with break statements. The result is the same, as the gotos simply exit the switch/case block, which can also be achieved with a break statement. With the latter the intent is clear and easier to understand.
Stable-dep-of: 08f66a8edd08 ("pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback")
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 144 ++++++++++------------- 1 file changed, 61 insertions(+), 83 deletions(-)
drivers/pinctrl/mediatek/pinctrl-paris.c +61 -83
@@ -79,37 +79,34 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, {struct mtk_pinctrl *hw =pinctrl_dev_get_drvdata (pctldev);u32 param =pinconf_to_config_param (*config); -int pullup, err, reg, ret =1 ; +int pullup, reg, err = -ENOTSUPP , ret =1 ;const struct mtk_pin_desc *desc; -if (pin >= hw->soc->npins) { - err = -EINVAL ; - goto out; - } +if (pin >= hw->soc->npins) +return -EINVAL ; + desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];switch (param) {case PIN_CONFIG_BIAS_DISABLE :case PIN_CONFIG_BIAS_PULL_UP :case PIN_CONFIG_BIAS_PULL_DOWN : -if (hw->soc->bias_get_combo) { - err = hw->soc->bias_get_combo (hw, desc, &pullup, &ret); -if (err) - goto out; -if (ret ==MTK_PUPD_SET_R1R0_00 ) - ret =MTK_DISABLE ; -if (param ==PIN_CONFIG_BIAS_DISABLE ) { -if (ret !=MTK_DISABLE ) - err = -EINVAL ; - }else if (param ==PIN_CONFIG_BIAS_PULL_UP ) { -if (!pullup || ret ==MTK_DISABLE ) - err = -EINVAL ; - }else if (param ==PIN_CONFIG_BIAS_PULL_DOWN ) { -if (pullup || ret ==MTK_DISABLE ) - err = -EINVAL ; - } - }else { - err = -ENOTSUPP ; +if (!hw->soc->bias_get_combo) +break ; + err = hw->soc->bias_get_combo (hw, desc, &pullup, &ret); +if (err) +break ; +if (ret ==MTK_PUPD_SET_R1R0_00 ) + ret =MTK_DISABLE ; +if (param ==PIN_CONFIG_BIAS_DISABLE ) { +if (ret !=MTK_DISABLE ) + err = -EINVAL ; + }else if (param ==PIN_CONFIG_BIAS_PULL_UP ) { +if (!pullup || ret ==MTK_DISABLE ) + err = -EINVAL ; + }else if (param ==PIN_CONFIG_BIAS_PULL_DOWN ) { +if (pullup || ret ==MTK_DISABLE ) + err = -EINVAL ; }break ;case PIN_CONFIG_SLEW_RATE :
@@ -119,7 +116,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,case PIN_CONFIG_OUTPUT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err) - goto out; +break ;/* CONFIG Current direction return value * ------------- ----------------- ---------------------- * OUTPUT_ENABLE output 1 (= HW value)
@@ -134,23 +131,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,case PIN_CONFIG_INPUT_SCHMITT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err) - goto out; +break ;/* return error when in output mode * because schmitt trigger only work in input mode */ if (ret) { err = -EINVAL ; - goto out; +break ; } err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SMT , &ret); -break ;case PIN_CONFIG_DRIVE_STRENGTH : -if (hw->soc->drive_get) - err = hw->soc->drive_get (hw, desc, &ret); -else - err = -ENOTSUPP ; +if (!hw->soc->drive_get) +break ; + err = hw->soc->drive_get (hw, desc, &ret);break ;case MTK_PIN_CONFIG_TDSEL :case MTK_PIN_CONFIG_RDSEL :
@@ -160,23 +155,18 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev,break ;case MTK_PIN_CONFIG_PU_ADV :case MTK_PIN_CONFIG_PD_ADV : -if (hw->soc->adv_pull_get) { - pullup = param ==MTK_PIN_CONFIG_PU_ADV ; - err = hw->soc->adv_pull_get (hw, desc, pullup, &ret); - }else - err = -ENOTSUPP ; +if (!hw->soc->adv_pull_get) +break ; + pullup = param ==MTK_PIN_CONFIG_PU_ADV ; + err = hw->soc->adv_pull_get (hw, desc, pullup, &ret);break ;case MTK_PIN_CONFIG_DRV_ADV : -if (hw->soc->adv_drive_get) - err = hw->soc->adv_drive_get (hw, desc, &ret); -else - err = -ENOTSUPP ; +if (!hw->soc->adv_drive_get) +break ; + err = hw->soc->adv_drive_get (hw, desc, &ret);break ; -default : - err = -ENOTSUPP ; } -out:if (!err) *config =pinconf_to_config_packed (param, ret);
@@ -188,33 +178,29 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, {struct mtk_pinctrl *hw =pinctrl_dev_get_drvdata (pctldev);const struct mtk_pin_desc *desc; -int err =0 ; +int err = -ENOTSUPP ;u32 reg; -if (pin >= hw->soc->npins) { - err = -EINVAL ; - goto err; - } +if (pin >= hw->soc->npins) +return -EINVAL ; + desc = (const struct mtk_pin_desc *)&hw->soc->pins[pin];switch ((u32 )param) {case PIN_CONFIG_BIAS_DISABLE : -if (hw->soc->bias_set_combo) - err = hw->soc->bias_set_combo (hw, desc,0 ,MTK_DISABLE ); -else - err = -ENOTSUPP ; +if (!hw->soc->bias_set_combo) +break ; + err = hw->soc->bias_set_combo (hw, desc,0 ,MTK_DISABLE );break ;case PIN_CONFIG_BIAS_PULL_UP : -if (hw->soc->bias_set_combo) - err = hw->soc->bias_set_combo (hw, desc,1 , arg); -else - err = -ENOTSUPP ; +if (!hw->soc->bias_set_combo) +break ; + err = hw->soc->bias_set_combo (hw, desc,1 , arg);break ;case PIN_CONFIG_BIAS_PULL_DOWN : -if (hw->soc->bias_set_combo) - err = hw->soc->bias_set_combo (hw, desc,0 , arg); -else - err = -ENOTSUPP ; +if (!hw->soc->bias_set_combo) +break ; + err = hw->soc->bias_set_combo (hw, desc,0 , arg);break ;case PIN_CONFIG_OUTPUT_ENABLE : err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_SMT,
@@ -223,7 +209,7 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,* does not have SMT control */ if (err != -ENOTSUPP ) - goto err; +break ; err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR ,MTK_OUTPUT );
@@ -232,7 +218,7 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,/* regard all non-zero value as enable */ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_IES , !!arg);if (err) - goto err; +break ; err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR ,MTK_INPUT );
@@ -245,7 +231,7 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DO , arg);if (err) - goto err; +break ; err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR ,MTK_OUTPUT );
@@ -257,15 +243,14 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,*/ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , !arg);if (err) - goto err; +break ; err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_SMT , !!arg);break ;case PIN_CONFIG_DRIVE_STRENGTH : -if (hw->soc->drive_set) - err = hw->soc->drive_set (hw, desc, arg); -else - err = -ENOTSUPP ; +if (!hw->soc->drive_set) +break ; + err = hw->soc->drive_set (hw, desc, arg);break ;case MTK_PIN_CONFIG_TDSEL :case MTK_PIN_CONFIG_RDSEL :
@@ -275,26 +260,19 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,break ;case MTK_PIN_CONFIG_PU_ADV :case MTK_PIN_CONFIG_PD_ADV : -if (hw->soc->adv_pull_set) { -bool pullup; - - pullup = param ==MTK_PIN_CONFIG_PU_ADV ; - err = hw->soc->adv_pull_set (hw, desc, pullup, - arg); - }else - err = -ENOTSUPP ; +if (!hw->soc->adv_pull_set) +break ; + err = hw->soc->adv_pull_set (hw, desc, + (param ==MTK_PIN_CONFIG_PU_ADV ), + arg);break ;case MTK_PIN_CONFIG_DRV_ADV : -if (hw->soc->adv_drive_set) - err = hw->soc->adv_drive_set (hw, desc, arg); -else - err = -ENOTSUPP ; +if (!hw->soc->adv_drive_set) +break ; + err = hw->soc->adv_drive_set (hw, desc, arg);break ; -default : - err = -ENOTSUPP ; } -err:return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/168 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 08f66a8edd08f6f7cfa769c81634b29a2b123908 ]
In the generic pin config library, readback of some options are handled differently compared to the setting of those options: the argument value is used to convey enable/disable of an option in the set path, but success or -EINVAL is used to convey if an option is enabled or disabled in the debugfs readback path.
PIN_CONFIG_INPUT_SCHMITT_ENABLE is one such option. Fix the readback of the option in the mediatek-paris library, so that the debugfs dump is not showing "input schmitt enabled" for pins that don't have it enabled.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/mediatek/pinctrl-paris.c +2 -0
@@ -141,6 +141,8 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, } err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SMT , &ret); +if (!ret) + err = -EINVAL ;break ;case PIN_CONFIG_DRIVE_STRENGTH :if (!hw->soc->drive_get)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/168 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit c5d3b64c568a344e998830e0e94a7c04e372f89b ]
There is a misinterpretation of some of the PIN_CONFIG_* options in this driver library. PIN_CONFIG_OUTPUT_ENABLE should refer to a buffer or switch in the output direction of the electrical path. The MediaTek hardware does not have such a thing. The driver incorrectly maps this option to the GPIO function's direction.
Likewise, PIN_CONFIG_INPUT_ENABLE should refer to a buffer or switch in the input direction. The hardware does have such a mechanism, and is mapped to the IES bit. The driver however sets the direction in addition to the IES bit, which is incorrect. On readback, the IES bit isn't even considered.
Ironically, the driver does not support readback for PIN_CONFIG_OUTPUT, while its readback of PIN_CONFIG_{INPUT,OUTPUT}_ENABLE is what it should be doing for PIN_CONFIG_OUTPUT.
Rework support for these three options, so that PIN_CONFIG_OUTPUT_ENABLE is completely removed, PIN_CONFIG_INPUT_ENABLE is only linked to the IES bit, and PIN_CONFIG_OUTPUT is linked to the GPIO function's direction and output level.
Message-ID: <[email protected]>
--- drivers/pinctrl/mediatek/pinctrl-paris.c | 38 +++++++----------------- 1 file changed, 11 insertions(+), 27 deletions(-)
drivers/pinctrl/mediatek/pinctrl-paris.c +11 -27
@@ -113,20 +113,21 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_SR , &ret);break ;case PIN_CONFIG_INPUT_ENABLE : -case PIN_CONFIG_OUTPUT_ENABLE : + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_IES , &ret); +if (!ret) + err = -EINVAL ; +break ; +case PIN_CONFIG_OUTPUT : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);if (err)break ; -/* CONFIG Current direction return value -* ------------- ----------------- ---------------------- -* OUTPUT_ENABLE output 1 (= HW value) -* input 0 (= HW value) -* INPUT_ENABLE output 0 (= reverse HW value) -* input 1 (= reverse HW value) -*/ -if (param ==PIN_CONFIG_INPUT_ENABLE ) - ret = !ret; +if (!ret) { + err = -EINVAL ; +break ; + } + + err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DO , &ret);break ;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : err =mtk_hw_get_value (hw, desc,PINCTRL_PIN_REG_DIR , &ret);
@@ -204,26 +205,9 @@ static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,break ; err = hw->soc->bias_set_combo (hw, desc,0 , arg);break ; -case PIN_CONFIG_OUTPUT_ENABLE : - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_SMT , -MTK_DISABLE ); -/* Keep set direction to consider the case that a GPIO pin -* does not have SMT control -*/ -if (err != -ENOTSUPP ) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_OUTPUT ); -break ;case PIN_CONFIG_INPUT_ENABLE :/* regard all non-zero value as enable */ err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_IES , !!arg); -if (err) -break ; - - err =mtk_hw_set_value (hw, desc,PINCTRL_PIN_REG_DIR , -MTK_INPUT );break ;case PIN_CONFIG_SLEW_RATE :/* regard all non-zero value as enable */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/168 ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marios Makassikis <[email protected]>
[ Upstream commit 4973b04d3ea577db80c501c5f14e68ec69fe1794 ]
File overwrite case is explicitly handled, so it is not necessary to pass RENAME_NOREPLACE to vfs_rename.
Clearing the flag fixes rename operations when the share is a ntfs-3g mount. The latter uses an older version of fuse with no support for flags in the ->rename op.
--- fs/ksmbd/vfs.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ksmbd/vfs.c +5 -0
@@ -745,10 +745,15 @@ int ksmbd_vfs_rename(struct ksmbd_work *work, const struct path *old_path, goto out4; } +/* +* explicitly handle file overwrite case, for compatibility with +* filesystems that may not support rename flags (e.g: fuse) +*/ if ((flags &RENAME_NOREPLACE ) &&d_is_positive (new_dentry)) { err = -EEXIST ; goto out4; } + flags &= ~(RENAME_NOREPLACE );if (old_child == trap) { err = -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/168 net: qede: use return from qede_parse_actions()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit f26f719a36e56381a1f4230e5364e7ad4d485888 ]
When calling qede_parse_actions() then the
return code was only used for a non-zero check,
and then -EINVAL was returned.
qede_parse_actions() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit broke the implicit assumption
that only -EINVAL would ever be returned.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -1894,10 +1894,9 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto, }/* parse tc actions and get the vf_id */ -if (qede_parse_actions (edev, &f->rule->action, f->common.extack)) { - rc = -EINVAL ; + rc =qede_parse_actions (edev, &f->rule->action, f->common.extack); +if (rc) goto unlock; - }if (qede_flow_find_fltr (edev, &t)) { rc = -EEXIST ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/168 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit b9a61c20179fda7bdfe2c1210aa72451991ab81a ]
The Topaz family (88E6141 and 88E6341) only support 256 Forwarding Information Tables.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +2 -2
@@ -5116,7 +5116,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6141", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_ports = 6, .num_internal_phys = 5,
@@ -5559,7 +5559,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341, .family = MV88E6XXX_FAMILY_6341, .name = "Marvell 88E6341", - .num_databases = 4096, + .num_databases = 256, .num_macs = 2048, .num_internal_phys = 5, .num_ports = 6,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/168 net: bridge: fix multicast-to-unicast with fraglist GSO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 59c878cbcdd80ed39315573b3511d0acfd3501b5 ]
Calling skb_copy on a SKB_GSO_FRAGLIST skb is not valid, since it returns an invalid linearized skb. This code only needs to change the ethernet header, so pskb_copy is the right function to call here.
--- net/bridge/br_forward.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_forward.c +1 -1
@@ -261,7 +261,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,if (skb->dev == p->dev &ðer_addr_equal (src, addr))return ; - skb =skb_copy (skb,GFP_ATOMIC ); + skb =pskb_copy (skb,GFP_ATOMIC );if (!skb) {DEV_STATS_INC (dev, tx_dropped);return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/168 net: core: reject skb_copy(_expand) for fraglist GSO skbs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit d091e579b864fa790dd6a0cd537a22c383126681 ]
SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.
--- net/core/skbuff.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
net/core/skbuff.c +19 -8
@@ -1583,11 +1583,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb)struct sk_buff *skb_copy (const struct sk_buff *skb,gfp_t gfp_mask) { -int headerlen =skb_headroom (skb); -unsigned int size =skb_end_offset (skb) + skb->data_len; -struct sk_buff *n =__alloc_skb (size, gfp_mask, -skb_alloc_rx_flag (skb),NUMA_NO_NODE ); +struct sk_buff *n; +unsigned int size; +int headerlen; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + headerlen =skb_headroom (skb); + size =skb_end_offset (skb) + skb->data_len; + n =__alloc_skb (size, gfp_mask, +skb_alloc_rx_flag (skb),NUMA_NO_NODE );if (!n)return NULL ;
@@ -1899,12 +1905,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,/* * Allocate the copy buffer */ -struct sk_buff *n =__alloc_skb (newheadroom + skb->len + newtailroom, - gfp_mask,skb_alloc_rx_flag (skb), -NUMA_NO_NODE ); -int oldheadroom =skb_headroom (skb);int head_copy_len, head_copy_off; +struct sk_buff *n; +int oldheadroom; + +if (WARN_ON_ONCE (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST )) +return NULL ; + oldheadroom =skb_headroom (skb); + n =__alloc_skb (newheadroom + skb->len + newtailroom, + gfp_mask,skb_alloc_rx_flag (skb), +NUMA_NO_NODE );if (!n)return NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/168 tipc: fix a possible memleak in tipc_buf_append
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ]
__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.
--- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/msg.c +1 -1
@@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)if (fragid ==FIRST_FRAGMENT ) {if (unlikely (head)) goto err; - *buf =NULL ;if (skb_has_frag_list (frag) &&__skb_linearize (frag)) goto err; + *buf =NULL ; frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/168 s390/qeth: dont keep track of Input Queue count
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
[ Upstream commit dc15012bb083c70502b625cf56fbf32b6cf17fe4 ]
The only actual user of qdio.no_input_queues is qeth_qdio_establish(), and there we already have full awareness of the current Input Queue configuration (1 RX queue, plus potentially 1 TX Completion queue).
So avoid this state tracking, and the ambiguity it brings with it.
Stable-dep-of: 8a2e4d37afb8 ("s390/qeth: Fix kernel panic after setting hsuid")
--- drivers/s390/net/qeth_core.h | 1 - drivers/s390/net/qeth_core_main.c | 17 +++++++---------- 2 files changed, 7 insertions(+), 11 deletions(-)
drivers/s390/net/qeth_core.h +0 -1
@@ -545,7 +545,6 @@ static inline bool qeth_out_queue_is_empty(struct qeth_qdio_out_q *queue)struct qeth_qdio_info {atomic_t state;/* input */ -int no_in_queues;struct qeth_qdio_q *in_q;struct qeth_qdio_q *c_q;struct qeth_qdio_buffer_pool in_buf_pool;
drivers/s390/net/qeth_core_main.c +7 -10
@@ -354,8 +354,8 @@ static int qeth_cq_init(struct qeth_card *card)qdio_reset_buffers (card->qdio.c_q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q ); card->qdio.c_q->next_buf_to_init =127 ; - rc =do_QDIO (CARD_DDEV (card),QDIO_FLAG_SYNC_INPUT , - card->qdio.no_in_queues -1 ,0 ,127 ,NULL ); + rc =do_QDIO (CARD_DDEV (card),QDIO_FLAG_SYNC_INPUT ,1 ,0 ,127 , +NULL );if (rc) {QETH_CARD_TEXT_ (card,2 ,"1err%d" , rc); goto out;
@@ -375,21 +375,16 @@ static int qeth_alloc_cq(struct qeth_card *card)dev_err (&card->gdev->dev,"Failed to create completion queue\n" );return -ENOMEM ; } - - card->qdio.no_in_queues =2 ; }else {QETH_CARD_TEXT (card,2 ,"nocq" ); card->qdio.c_q =NULL ; - card->qdio.no_in_queues =1 ; } -QETH_CARD_TEXT_ (card,2 ,"iqc%d" , card->qdio.no_in_queues);return 0 ; }static void qeth_free_cq (struct qeth_card *card) {if (card->qdio.c_q) { - --card->qdio.no_in_queues;qeth_free_qdio_queue (card->qdio.c_q); card->qdio.c_q =NULL ; }
@@ -1492,7 +1487,6 @@ static void qeth_init_qdio_info(struct qeth_card *card) card->qdio.default_out_queue =QETH_DEFAULT_QUEUE ;/* inbound */ - card->qdio.no_in_queues =1 ; card->qdio.in_buf_size =QETH_IN_BUF_SIZE_DEFAULT ;if (IS_IQD (card)) card->qdio.init_pool.buf_count =QETH_IN_BUF_COUNT_HSDEFAULT ;
@@ -5173,6 +5167,7 @@ static int qeth_qdio_establish(struct qeth_card *card)struct qdio_buffer **in_sbal_ptrs[QETH_MAX_IN_QUEUES ];struct qeth_qib_parms *qib_parms =NULL ;struct qdio_initialize init_data; +unsigned int no_input_qs =1 ;unsigned int i;int rc =0 ;
@@ -5187,8 +5182,10 @@ static int qeth_qdio_establish(struct qeth_card *card) } in_sbal_ptrs[0 ] = card->qdio.in_q->qdio_bufs; -if (card->options.cq ==QETH_CQ_ENABLED ) +if (card->options.cq ==QETH_CQ_ENABLED ) { in_sbal_ptrs[1 ] = card->qdio.c_q->qdio_bufs; + no_input_qs++; + }for (i =0 ; i < card->qdio.no_out_queues; i++) out_sbal_ptrs[i] = card->qdio.out_qs[i]->qdio_bufs;
@@ -5198,7 +5195,7 @@ static int qeth_qdio_establish(struct qeth_card *card)QDIO_QETH_QFMT ; init_data.qib_param_field_format =0 ; init_data.qib_param_field = (void *)qib_parms; - init_data.no_input_qs = card->qdio.no_in_queues; + init_data.no_input_qs = no_input_qs; init_data.no_output_qs = card->qdio.no_out_queues; init_data.input_handler = qeth_qdio_input_handler; init_data.output_handler = qeth_qdio_output_handler;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/168 s390/qeth: Fix kernel panic after setting hsuid
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Winter <[email protected]>
[ Upstream commit 8a2e4d37afb8500b276e5ee903dee06f50ab0494 ]
Symptom:
When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL.
Example:
---------------------------------------------------------------------------
[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP
[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6
nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de
s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod
qdio ccwgroup pkey zcrypt
[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1
[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)
[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)
[ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000
[ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80
[ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8
[ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68
[ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal
>0000000000000002: 0000 illegal
0000000000000004: 0000 illegal
0000000000000006: 0000 illegal
0000000000000008: 0000 illegal
000000000000000a: 0000 illegal
000000000000000c: 0000 illegal
000000000000000e: 0000 illegal
[ 2057.572800] Call Trace:
[ 2057.572801] ([<00000000ec639700>] 0xec639700)
[ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398
[ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0
[ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58
[ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60)
[ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98
[ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70
[ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv]
[ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv]
[ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv]
[ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8
[ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348
[ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8
[ 2057.572843] Last Breaking-Event-Address:
[ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8
[ 2057.572846]
[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt-------------------------------------------------------------------------------------------
Analysis:
There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open().
Since
commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again.
Reproduction:
chzdev -e $devno layer2=0
ip link set dev $network_interface up
echo 0 > /sys/bus/ccwgroup/devices/0.0.$devno/online
echo foo > /sys/bus/ccwgroup/devices/0.0.$devno/hsuid
echo 1 > /sys/bus/ccwgroup/devices/0.0.$devno/online
-> Crash (can be enforced e.g. by af_iucv connect(), ip link down/up, ...)
Note that a Completion Queue (CQ) is only enabled or disabled, when hsuid is set for the first time or when it is removed.
Workarounds:
- Set hsuid before setting the device online for the first time or
- Use chzdev -d $devno; chzdev $devno hsuid=xxx; chzdev -e $devno; to set hsuid on an existing device. (this will remove and recreate the network interface)
Fix:
There is no need to free the output queues when a completion queue is added or removed.card->qdio.state now indicates whether the inbound buffer pool and the outbound queues are allocated.card->qdio.c_q indicates whether a CQ is allocated.
--- drivers/s390/net/qeth_core_main.c | 61 ++++++++++++++----------------- 1 file changed, 27 insertions(+), 34 deletions(-)
drivers/s390/net/qeth_core_main.c +27 -34
@@ -366,30 +366,33 @@ static int qeth_cq_init(struct qeth_card *card)return rc; } +static void qeth_free_cq (struct qeth_card *card) +{ +if (card->qdio.c_q) { +qeth_free_qdio_queue (card->qdio.c_q); + card->qdio.c_q =NULL ; + } +} +static int qeth_alloc_cq (struct qeth_card *card) {if (card->options.cq ==QETH_CQ_ENABLED ) {QETH_CARD_TEXT (card,2 ,"cqon" ); - card->qdio.c_q =qeth_alloc_qdio_queue ();if (!card->qdio.c_q) { -dev_err (&card->gdev->dev,"Failed to create completion queue\n" ); -return -ENOMEM ; + card->qdio.c_q =qeth_alloc_qdio_queue (); +if (!card->qdio.c_q) { +dev_err (&card->gdev->dev, +"Failed to create completion queue\n" ); +return -ENOMEM ; + } } }else {QETH_CARD_TEXT (card,2 ,"nocq" ); - card->qdio.c_q =NULL ; +qeth_free_cq (card); }return 0 ; } -static void qeth_free_cq (struct qeth_card *card) -{ -if (card->qdio.c_q) { -qeth_free_qdio_queue (card->qdio.c_q); - card->qdio.c_q =NULL ; - } -} -static enum iucv_tx_notify qeth_compute_cq_notification (int sbalf15,int delayed) {
@@ -2586,6 +2589,10 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card)QETH_CARD_TEXT (card,2 ,"allcqdbf" ); +/* completion */ +if (qeth_alloc_cq (card)) + goto out_err; +if (atomic_cmpxchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ,QETH_QDIO_ALLOCATED ) !=QETH_QDIO_UNINITIALIZED )return 0 ;
@@ -2626,10 +2633,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) queue->priority =QETH_QIB_PQUE_PRIO_DEFAULT ; } -/* completion */ -if (qeth_alloc_cq (card)) - goto out_freeoutq; -return 0 ; out_freeoutq:
@@ -2643,6 +2646,8 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) card->qdio.in_q =NULL ; out_nomem:atomic_set (&card->qdio.state,QETH_QDIO_UNINITIALIZED ); +qeth_free_cq (card); +out_err:return -ENOMEM ; }
@@ -2650,11 +2655,12 @@ static void qeth_free_qdio_queues(struct qeth_card *card) {int i, j; +qeth_free_cq (card); +if (atomic_xchg (&card->qdio.state,QETH_QDIO_UNINITIALIZED ) ==QETH_QDIO_UNINITIALIZED )return ; -qeth_free_cq (card);for (j =0 ; j <QDIO_MAX_BUFFERS_PER_Q ; ++j) {if (card->qdio.in_q->bufs[j].rx_skb)dev_kfree_skb_any (card->qdio.in_q->bufs[j].rx_skb);
@@ -3707,24 +3713,11 @@ static void qeth_qdio_poll(struct ccw_device *cdev, unsigned long card_ptr)int qeth_configure_cq (struct qeth_card *card,enum qeth_cq cq) { -int rc; - -if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) { - rc =-1 ; - goto out; - }else { -if (card->options.cq == cq) { - rc =0 ; - goto out; - } - -qeth_free_qdio_queues (card); - card->options.cq = cq; - rc =0 ; - } -out: -return rc; +if (card->options.cq ==QETH_CQ_NOTAVAILABLE ) +return -1 ; + card->options.cq = cq; +return 0 ; }EXPORT_SYMBOL_GPL (qeth_configure_cq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/168 drm/panel: ili9341: Respect deferred probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 740fc1e0509be3f7e2207e89125b06119ed62943 ]
GPIO controller might not be available when driver is being probed. There are plenty of reasons why, one of which is deferred probe.
Since GPIOs are optional, return any error code we got to the upper layer, including deferred probe. With that in mind, use dev_err_probe() in order to avoid spamming the logs.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -716,11 +716,11 @@ static int ili9341_probe(struct spi_device *spi) reset =devm_gpiod_get_optional (dev,"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (reset)) -dev_err (dev,"Failed to get gpio 'reset'\n" ); +return dev_err_probe (dev,PTR_ERR (reset),"Failed to get gpio 'reset'\n" ); dc =devm_gpiod_get_optional (dev,"dc" ,GPIOD_OUT_LOW );if (IS_ERR (dc)) -dev_err (dev,"Failed to get gpio 'dc'\n" ); +return dev_err_probe (dev,PTR_ERR (dc),"Failed to get gpio 'dc'\n" );if (!strcmp (id->name,"sf-tc240t-9370-t" ))return ili9341_dpi_probe (spi, dc, reset);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/168 drm/panel: ili9341: Use predefined error codes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit da85f0aaa9f21999753b01d45c0343f885a8f905 ]
In one case the -1 is returned which is quite confusing code for the wrong device ID, in another the ret is returning instead of plain 0 that also confusing as readed may ask the possible meaning of positive codes, which are never the case there. Convert both to use explicit predefined error codes to make it clear what's going on there.
--- drivers/gpu/drm/panel/panel-ilitek-ili9341.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9341.c +2 -2
@@ -420,7 +420,7 @@ static int ili9341_dpi_prepare(struct drm_panel *panel)ili9341_dpi_init (ili); -return ret; +return 0 ; }static int ili9341_dpi_enable (struct drm_panel *panel)
@@ -727,7 +727,7 @@ static int ili9341_probe(struct spi_device *spi)else if (!strcmp (id->name,"yx240qv29" ))return ili9341_dbi_probe (spi, dc, reset); -return -1 ; +return -ENODEV ; }static int ili9341_remove (struct spi_device *spi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/168 net: gro: add flush check in udp_gro_receive_segment
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Gobert <[email protected]>
[ Upstream commit 5babae777c61aa8a8679d59d3cdc54165ad96d42 ]
GRO-GSO path is supposed to be transparent and as such L3 flush checks are relevant to all UDP flows merging in GRO. This patch uses the same logic and code from tcp_gro_receive, terminating merge if flush is non zero.
--- net/ipv4/udp_offload.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/ipv4/udp_offload.c +11 -1
@@ -434,6 +434,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,struct sk_buff *p;unsigned int ulen;int ret =0 ; +int flush;/* requires non zero csum, for symmetry with GSO */ if (!uh->check) {
@@ -467,13 +468,22 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,return p; } + flush =NAPI_GRO_CB (p)->flush; + +if (NAPI_GRO_CB (p)->flush_id !=1 || +NAPI_GRO_CB (p)->count !=1 || + !NAPI_GRO_CB (p)->is_atomic) + flush |=NAPI_GRO_CB (p)->flush_id; +else +NAPI_GRO_CB (p)->is_atomic = false; +/* Terminate the flow on len mismatch or if it grow "too much". * Under small packet flood GRO count could elsewhere grow a lot * leading to excessive truesize values. * On len mismatch merge the first packet shorter than gso_size, * otherwise complete the GRO packet. */ -if (ulen >ntohs (uh2->len)) { +if (ulen >ntohs (uh2->len) || flush) { pp = p; }else {if (NAPI_GRO_CB (skb)->is_flist) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/168 clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jernej Skrabec <[email protected]>
[ Upstream commit 7e91ed763dc07437777bd012af7a2bd4493731ff ]
While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.
--- drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6.c +17 -2
@@ -1181,12 +1181,19 @@ static const u32 usb2_clk_regs[] = { SUN50I_H6_USB3_CLK_REG, }; +static struct ccu_mux_nb sun50i_h6_cpu_nb = { + .common = &cpux_clk.common, + .cm = &cpux_clk.mux, + .delay_us =1 , + .bypass_index =0 ,/* index of 24 MHz oscillator */ +}; +static int sun50i_h6_ccu_probe (struct platform_device *pdev) {struct resource *res;void __iomem *reg; +int i, ret;u32 val; -int i; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); reg =devm_ioremap_resource (&pdev->dev, res);
@@ -1240,7 +1247,15 @@ static int sun50i_h6_ccu_probe(struct platform_device *pdev) val |=BIT (24 );writel (val, reg +SUN50I_H6_HDMI_CEC_CLK_REG ); -return devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); + ret =devm_sunxi_ccu_probe (&pdev->dev, reg, &sun50i_h6_ccu_desc); +if (ret) +return ret; + +/* Reparent CPU during PLL CPUX rate changes */ +ccu_mux_notifier_register (pll_cpux_clk.common.hw.clk, + &sun50i_h6_cpu_nb); + +return 0 ; }static const struct of_device_id sun50i_h6_ccu_ids[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/168 ASoC: meson: axg-fifo: use FIELD helpers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 9e6f39535c794adea6ba802a52c722d193c28124 ]
Use FIELD_GET() and FIELD_PREP() helpers instead of doing it manually.
Stable-dep-of: b11d26660dff ("ASoC: meson: axg-fifo: use threaded irq to check periods")
--- sound/soc/meson/axg-fifo.c | 25 +++++++++++++------------ sound/soc/meson/axg-fifo.h | 12 +++++------- sound/soc/meson/axg-frddr.c | 5 +++-- sound/soc/meson/axg-toddr.c | 22 ++++++++++------------ 4 files changed, 31 insertions(+), 33 deletions(-)
sound/soc/meson/axg-fifo.c +13 -12
@@ -3,6 +3,7 @@// Copyright (c) 2018 BayLibre, SAS. // Author: Jerome Brunet <[email protected]> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/of_irq.h> #include <linux/of_platform.h>
@@ -145,8 +146,8 @@ int axg_fifo_pcm_hw_params(struct snd_soc_component *component,/* Enable irq if necessary */ irq_en = runtime->no_period_wakeup ?0 :FIFO_INT_COUNT_REPEAT ;regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ), -CTRL0_INT_EN (irq_en)); +CTRL0_INT_EN , +FIELD_PREP (CTRL0_INT_EN , irq_en));return 0 ; }
@@ -176,9 +177,9 @@ int axg_fifo_pcm_hw_free(struct snd_soc_component *component, {struct axg_fifo *fifo =axg_fifo_data (ss); -/* Disable the block count irq */ +/* Disable irqs */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_COUNT_REPEAT ),0 ); +CTRL0_INT_EN ,0 );return 0 ; }
@@ -187,13 +188,13 @@ EXPORT_SYMBOL_GPL(axg_fifo_pcm_hw_free);static void axg_fifo_ack_irq (struct axg_fifo *fifo,u8 mask) {regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -CTRL1_INT_CLR (mask)); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR , mask));/* Clear must also be cleared */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_INT_CLR (FIFO_INT_MASK ), -0 ); +CTRL1_INT_CLR , +FIELD_PREP (CTRL1_INT_CLR ,0 )); }static irqreturn_t axg_fifo_pcm_irq_block (int irq,void *dev_id)
@@ -204,7 +205,7 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =STATUS1_INT_STS (status) &FIFO_INT_MASK ; + status =FIELD_GET (STATUS1_INT_STS , status);if (status &FIFO_INT_COUNT_REPEAT )snd_pcm_period_elapsed (ss);else
@@ -254,15 +255,15 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,/* Setup status2 so it reports the memory pointer */ regmap_update_bits (fifo->map,FIFO_CTRL1 , -CTRL1_STATUS2_SEL_MASK , -CTRL1_STATUS2_SEL (STATUS2_SEL_DDR_READ )); +CTRL1_STATUS2_SEL , +FIELD_PREP (CTRL1_STATUS2_SEL ,STATUS2_SEL_DDR_READ ));/* Make sure the dma is initially disabled */ __dma_enable (fifo, false);/* Disable irqs until params are ready */ regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_INT_EN (FIFO_INT_MASK ),0 ); +CTRL0_INT_EN ,0 );/* Clear any pending interrupt */ axg_fifo_ack_irq (fifo,FIFO_INT_MASK );
sound/soc/meson/axg-fifo.h +5 -7
@@ -42,21 +42,19 @@ struct snd_soc_pcm_runtime;#define FIFO_CTRL0 0x00#define CTRL0_DMA_EN BIT(31) -#define CTRL0_INT_EN (x) ((x) << 16) +#define CTRL0_INT_EN GENMASK(23, 16)#define CTRL0_SEL_MASK GENMASK(2, 0)#define CTRL0_SEL_SHIFT 0#define FIFO_CTRL1 0x04 -#define CTRL1_INT_CLR (x) ((x) << 0) -#define CTRL1_STATUS2_SEL_MASK GENMASK(11, 8) -#define CTRL1_STATUS2_SEL (x) ((x) << 8) +#define CTRL1_INT_CLR GENMASK(7, 0) +#define CTRL1_STATUS2_SEL GENMASK(11, 8)#define STATUS2_SEL_DDR_READ 0 -#define CTRL1_FRDDR_DEPTH_MASK GENMASK(31, 24) -#define CTRL1_FRDDR_DEPTH (x) ((x) << 24) +#define CTRL1_FRDDR_DEPTH GENMASK(31, 24)#define FIFO_START_ADDR 0x08#define FIFO_FINISH_ADDR 0x0c#define FIFO_INT_ADDR 0x10#define FIFO_STATUS1 0x14 -#define STATUS1_INT_STS (x) ((x) << 0) +#define STATUS1_INT_STS GENMASK(7, 0)#define FIFO_STATUS2 0x18#define FIFO_INIT_ADDR 0x24#define FIFO_CTRL2 0x28
sound/soc/meson/axg-frddr.c +3 -2
@@ -7,6 +7,7 @@* This driver implements the frontend playback DAI of AXG and G12A based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -59,8 +60,8 @@ static int axg_frddr_dai_hw_params(struct snd_pcm_substream *substream,/* Trim the FIFO depth if the period is small to improve latency */ depth =min (period, fifo->depth); val = (depth /AXG_FIFO_BURST ) -1 ; -regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH_MASK , -CTRL1_FRDDR_DEPTH (val)); +regmap_update_bits (fifo->map,FIFO_CTRL1 ,CTRL1_FRDDR_DEPTH , +FIELD_PREP (CTRL1_FRDDR_DEPTH , val));return 0 ; }
sound/soc/meson/axg-toddr.c +10 -12
@@ -5,6 +5,7 @@/* This driver implements the frontend capture DAI of AXG based SoCs */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/regmap.h> #include <linux/module.h>
@@ -19,12 +20,9 @@#define CTRL0_TODDR_EXT_SIGNED BIT(29)#define CTRL0_TODDR_PP_MODE BIT(28)#define CTRL0_TODDR_SYNC_CH BIT(27) -#define CTRL0_TODDR_TYPE_MASK GENMASK(15, 13) -#define CTRL0_TODDR_TYPE (x) ((x) << 13) -#define CTRL0_TODDR_MSB_POS_MASK GENMASK(12, 8) -#define CTRL0_TODDR_MSB_POS (x) ((x) << 8) -#define CTRL0_TODDR_LSB_POS_MASK GENMASK(7, 3) -#define CTRL0_TODDR_LSB_POS (x) ((x) << 3) +#define CTRL0_TODDR_TYPE GENMASK(15, 13) +#define CTRL0_TODDR_MSB_POS GENMASK(12, 8) +#define CTRL0_TODDR_LSB_POS GENMASK(7, 3)#define CTRL1_TODDR_FORCE_FINISH BIT(25)#define CTRL1_SEL_SHIFT 28
@@ -76,12 +74,12 @@ static int axg_toddr_dai_hw_params(struct snd_pcm_substream *substream, width =params_width (params);regmap_update_bits (fifo->map,FIFO_CTRL0 , -CTRL0_TODDR_TYPE_MASK | -CTRL0_TODDR_MSB_POS_MASK | -CTRL0_TODDR_LSB_POS_MASK , -CTRL0_TODDR_TYPE (type) | -CTRL0_TODDR_MSB_POS (TODDR_MSB_POS ) | -CTRL0_TODDR_LSB_POS (TODDR_MSB_POS - (width -1 ))); +CTRL0_TODDR_TYPE | +CTRL0_TODDR_MSB_POS | +CTRL0_TODDR_LSB_POS , +FIELD_PREP (CTRL0_TODDR_TYPE , type) | +FIELD_PREP (CTRL0_TODDR_MSB_POS ,TODDR_MSB_POS ) | +FIELD_PREP (CTRL0_TODDR_LSB_POS ,TODDR_MSB_POS - (width -1 )));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/168 KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
[ Upstream commit 4e7728c81a54b17bd33be402ac140bc11bb0c4f4 ]
When parsing a GICv2 attribute that contains a cpuid, handle this as the vcpu_id, not a vcpu_idx, as userspace cannot really know the mapping between the two. For this, use kvm_get_vcpu_by_id() instead of kvm_get_vcpu().
Take this opportunity to get rid of the pointless check against online_vcpus, which doesn't make much sense either, and switch to FIELD_GET as a way to extract the vcpu_id.
Stable-dep-of: 6ddb4f372fc6 ("KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()")
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +2 -6
@@ -286,13 +286,9 @@ int vgic_v2_parse_attr(struct kvm_device *dev, struct kvm_device_attr *attr, {int cpuid; - cpuid = (attr->attr &KVM_DEV_ARM_VGIC_CPUID_MASK ) >> -KVM_DEV_ARM_VGIC_CPUID_SHIFT ; + cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); -if (cpuid >=atomic_read (&dev->kvm->online_vcpus)) -return -EINVAL ; - - reg_attr->vcpu =kvm_get_vcpu (dev->kvm, cpuid); + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/168 KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <[email protected]>
[ Upstream commit 6ddb4f372fc63210034b903d96ebbeb3c7195adb ]
vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully.
Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.
--- arch/arm64/kvm/vgic/vgic-kvm-device.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-kvm-device.c +4 -4
@@ -284,12 +284,12 @@ int kvm_register_vgic_device(unsigned long type)int vgic_v2_parse_attr (struct kvm_device *dev,struct kvm_device_attr *attr,struct vgic_reg_attr *reg_attr) { -int cpuid; +int cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - cpuid =FIELD_GET (KVM_DEV_ARM_VGIC_CPUID_MASK , attr->attr); - - reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); reg_attr->addr = attr->attr &KVM_DEV_ARM_VGIC_OFFSET_MASK ; + reg_attr->vcpu =kvm_get_vcpu_by_id (dev->kvm, cpuid); +if (!reg_attr->vcpu) +return -EINVAL ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/168 scsi: lpfc: Move NPIVs transport unregistration to after resource clean up
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c ]
There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric.
Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch.
Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent.
--- drivers/scsi/lpfc/lpfc_vport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_vport.c +4 -4
@@ -651,10 +651,6 @@ lpfc_vport_delete(struct fc_vport *fc_vport)lpfc_free_sysfs_attr (vport);lpfc_debugfs_terminate (vport); -/* Remove FC host to break driver binding. */ -fc_remove_host (shost); -scsi_remove_host (shost); -/* Send the DA_ID and Fabric LOGO to cleanup Nameserver entries. */ ndlp =lpfc_findnode_did (vport, Fabric_DID);if (!ndlp)
@@ -700,6 +696,10 @@ lpfc_vport_delete(struct fc_vport *fc_vport) skip_logo: +/* Remove FC host to break driver binding. */ +fc_remove_host (shost); +scsi_remove_host (shost); +lpfc_cleanup (vport);/* Remove scsi host now. The nodes are cleaned up. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/168 scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit bb011631435c705cdeddca68d5c85fd40a4320f9 ]
Typically when an out of resource CQE status is detected, the lpfc_ramp_down_queue_handler() logic is called to help reduce I/O load by reducing an sdev's queue_depth.
However, the current lpfc_rampdown_queue_depth() logic does not help reduce queue_depth. num_cmd_success is never updated and is always zero, which means new_queue_depth will always be set to sdev->queue_depth. So, new_queue_depth = sdev->queue_depth - new_queue_depth always sets new_queue_depth to zero. And, scsi_change_queue_depth(sdev, 0) is essentially a no-op.
Change the lpfc_ramp_down_queue_handler() logic to set new_queue_depth equal to sdev->queue_depth subtracted from number of times num_rsrc_err was incremented. If num_rsrc_err is >= sdev->queue_depth, then set new_queue_depth equal to 1. Eventually, the frequency of Good_Status frames will signal SCSI upper layer to auto increase the queue_depth back to the driver default of 64 via scsi_handle_queue_ramp_up().
--- drivers/scsi/lpfc/lpfc.h | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 13 ++++--------- 2 files changed, 4 insertions(+), 10 deletions(-)
drivers/scsi/lpfc/lpfc.h +0 -1
@@ -1341,7 +1341,6 @@ struct lpfc_hba {unsigned long bit_flags;#define FABRIC_COMANDS_BLOCKED 0atomic_t num_rsrc_err; -atomic_t num_cmd_success;unsigned long last_rsrc_error_time;unsigned long last_ramp_down_time;#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
drivers/scsi/lpfc/lpfc_scsi.c +4 -9
@@ -231,11 +231,10 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)struct Scsi_Host *shost;struct scsi_device *sdev;unsigned long new_queue_depth; -unsigned long num_rsrc_err, num_cmd_success; +unsigned long num_rsrc_err;int i; num_rsrc_err =atomic_read (&phba->num_rsrc_err); - num_cmd_success =atomic_read (&phba->num_cmd_success);/* * The error and success command counters are global per
@@ -250,20 +249,16 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)for (i =0 ; i <= phba->max_vports && vports[i] !=NULL ; i++) { shost =lpfc_shost_from_vport (vports[i]);shost_for_each_device (sdev, shost) { - new_queue_depth = - sdev->queue_depth * num_rsrc_err / - (num_rsrc_err + num_cmd_success); -if (!new_queue_depth) - new_queue_depth = sdev->queue_depth -1 ; +if (num_rsrc_err >= sdev->queue_depth) + new_queue_depth =1 ;else new_queue_depth = sdev->queue_depth - - new_queue_depth; + num_rsrc_err;scsi_change_queue_depth (sdev, new_queue_depth); } }lpfc_destroy_vport_work_array (phba, vports);atomic_set (&phba->num_rsrc_err,0 ); -atomic_set (&phba->num_cmd_success,0 ); }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/168 scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit d11272be497e48a8e8f980470eb6b70e92eed0ce ]
The ndlp object update in lpfc_nvme_unregister_port() should be protected by the ndlp lock rather than hbalock.
--- drivers/scsi/lpfc/lpfc_nvme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nvme.c +2 -2
@@ -2539,9 +2539,9 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)/* No concern about the role change on the nvme remoteport. * The transport will update it. */ -spin_lock_irq (&vport->phba->hbalock); +spin_lock_irq (&ndlp->lock); ndlp->fc4_xpt_flags |=NVME_XPT_UNREG_WAIT ; -spin_unlock_irq (&vport->phba->hbalock); +spin_unlock_irq (&ndlp->lock);/* Don't let the host nvme transport keep sending keep-alives * on this remoteport. Vport is unloading, no recovery. The
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/168 gfs2: Fix invalid metadata access in punch_hole
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ]
In punch_hole(), when the offset lies in the final block for a given height, there is no hole to punch, but the maximum size check fails to detect that. Consequently, punch_hole() will try to punch a hole beyond the end of the metadata and fail. Fix the maximum size check.
--- fs/gfs2/bmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/gfs2/bmap.c +3 -2
@@ -1704,7 +1704,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)struct buffer_head *dibh, *bh;struct gfs2_holder rd_gh;unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; -u64 lblock = (offset + (1 << bsize_shift) -1 ) >> bsize_shift; +unsigned int bsize =1 << bsize_shift; +u64 lblock = (offset + bsize -1 ) >> bsize_shift;__u16 start_list[GFS2_MAX_META_HEIGHT ];__u16 __end_list[GFS2_MAX_META_HEIGHT ], *end_list =NULL ;unsigned int start_aligned, end_aligned;
@@ -1715,7 +1716,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)u64 prev_bnr =0 ;__be64 *start, *end; -if (offset >= maxsize) { +if (offset + bsize -1 >= maxsize) {/* * The starting point lies beyond the allocated meta-data; * there are no blocks do deallocate.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/168 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 774f8841f55d7ac4044c79812691649da203584a ]
Running kernel-doc on ieee80211_i.h flagged the following:net/mac80211/ieee80211_i.h:145: warning: expecting prototype for enum ieee80211_corrupt_data_flags. Prototype was for enum ieee80211_bss_corrupt_data_flags instead net/mac80211/ieee80211_i.h:162: warning: expecting prototype for enum ieee80211_valid_data_flags. Prototype was for enum ieee80211_bss_valid_data_flags instead
Fix these warnings.
--- net/mac80211/ieee80211_i.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/ieee80211_i.h +2 -2
@@ -113,7 +113,7 @@ struct ieee80211_bss { };/** -* enum ieee80211_corrupt_data_flags - BSS data corruption flags +* enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted *
@@ -126,7 +126,7 @@ enum ieee80211_bss_corrupt_data_flags { };/** -* enum ieee80211_valid_data_flags - BSS valid data flags +* enum ieee80211_bss_valid_data_flags - BSS valid data flags * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/168 wifi: cfg80211: fix rdev_dump_mpp() arguments order
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit ec50f3114e55406a1aad24b7dfaa1c3f4336d8eb ]
Fix the order of arguments in the TP_ARGS macro
for the rdev_dump_mpp tracepoint event.
Found by Linux Verification Center (linuxtesting.org).
--- net/wireless/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/trace.h +1 -1
@@ -963,7 +963,7 @@ TRACE_EVENT(rdev_get_mpp, TRACE_EVENT(rdev_dump_mpp, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx, u8 *dst, u8 *mpp), - TP_ARGS(wiphy, netdev, _idx, mpp, dst), + TP_ARGS(wiphy, netdev, _idx, dst, mpp), TP_STRUCT__entry( WIPHY_ENTRY NETDEV_ENTRY
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/168 net: mark racy access on sk->sk_rcvbuf
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: linke li <[email protected]>
[ Upstream commit c2deb2e971f5d9aca941ef13ee05566979e337a4 ]
sk->sk_rcvbuf in __sock_queue_rcv_skb() and __sk_receive_skb() can be changed by other threads. Mark this as benign using READ_ONCE().
This patch is aimed at reducing the number of benign races reported by KCSAN in order to focus future debugging effort on harmful races.
--- net/core/sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/sock.c +2 -2
@@ -459,7 +459,7 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)unsigned long flags;struct sk_buff_head *list = &sk->sk_receive_queue; -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { +if (atomic_read (&sk->sk_rmem_alloc) >=READ_ONCE (sk->sk_rcvbuf)) {atomic_inc (&sk->sk_drops);trace_sock_rcvqueue_full (sk, skb);return -ENOMEM ;
@@ -511,7 +511,7 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, skb->dev =NULL ; -if (sk_rcvqueues_full (sk, sk->sk_rcvbuf)) { +if (sk_rcvqueues_full (sk,READ_ONCE (sk->sk_rcvbuf))) {atomic_inc (&sk->sk_drops); goto discard_and_relse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/168 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <[email protected]>
[ Upstream commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 ]
The session resources are used by FW and driver when session is offloaded, once session is uploaded these resources are not used. The lock is not required as these fields won't be used any longer. The offload and upload calls are sequential, hence lock is not required.
This will suppress following BUG_ON():
[ 449.843143] ------------[ cut here ]------------ [ 449.848302] kernel BUG at mm/vmalloc.c:2727! [ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 Rebooting. [ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 [ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] [ 449.882910] RIP: 0010:vunmap+0x2e/0x30 [ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 [ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 [ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 [ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 [ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf [ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 [ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 [ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 [ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 [ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 449.993028] Call Trace: [ 449.995756] __iommu_dma_free+0x96/0x100 [ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] [ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] [ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] [ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] [ 450.023103] process_one_work+0x1e8/0x3c0 [ 450.027581] worker_thread+0x50/0x3b0 [ 450.031669] ? rescuer_thread+0x370/0x370 [ 450.036143] kthread+0x149/0x170 [ 450.039744] ? set_kthread_struct+0x40/0x40 [ 450.044411] ret_from_fork+0x22/0x30 [ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls [ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler [ 450.159753] ---[ end trace 712de2c57c64abc8 ]---
--- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/bnx2fc/bnx2fc_tgt.c +0 -2
@@ -833,7 +833,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba,BNX2FC_TGT_DBG (tgt,"Freeing up session resources\n" ); -spin_lock_bh (&tgt->cq_lock); ctx_base_ptr = tgt->ctx_base; tgt->ctx_base =NULL ;
@@ -889,7 +888,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, tgt->sq, tgt->sq_dma); tgt->sq =NULL ; } -spin_unlock_bh (&tgt->cq_lock);if (ctx_base_ptr)iounmap (ctx_base_ptr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/168 ASoC: meson: axg-fifo: use threaded irq to check periods
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit b11d26660dff8d7430892008616452dc8e5fb0f3 ]
With the AXG audio subsystem, there is a possible random channel shift on TDM capture, when the slot number per lane is more than 2, and there is more than one lane used.
The problem has been there since the introduction of the axg audio support but such scenario is pretty uncommon. This is why there is no loud complains about the problem.
Solving the problem require to make the links non-atomic and use the trigger() callback to start FEs and BEs in the appropriate order.
This was tried in the past and reverted because it caused the block irq to sleep while atomic. However, instead of reverting, the solution is to call snd_pcm_period_elapsed() in a non atomic context.
Use the bottom half of a threaded IRQ to do so.
--- sound/soc/meson/axg-fifo.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
sound/soc/meson/axg-fifo.c +19 -10
@@ -204,18 +204,26 @@ static irqreturn_t axg_fifo_pcm_irq_block(int irq, void *dev_id)unsigned int status;regmap_read (fifo->map,FIFO_STATUS1 , &status); - status =FIELD_GET (STATUS1_INT_STS , status); +axg_fifo_ack_irq (fifo, status); + +/* Use the thread to call period elapsed on nonatomic links */ if (status &FIFO_INT_COUNT_REPEAT ) -snd_pcm_period_elapsed (ss); -else -dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , - status); +return IRQ_WAKE_THREAD ; -/* Ack irqs */ -axg_fifo_ack_irq (fifo, status); +dev_dbg (axg_fifo_dev (ss),"unexpected irq - STS 0x%02x\n" , + status); + +return IRQ_NONE ; +} + +static irqreturn_t axg_fifo_pcm_irq_block_thread (int irq,void *dev_id) +{ +struct snd_pcm_substream *ss = dev_id; + +snd_pcm_period_elapsed (ss); -return IRQ_RETVAL (status); +return IRQ_HANDLED ; } int axg_fifo_pcm_open(struct snd_soc_component *component,
@@ -243,8 +251,9 @@ int axg_fifo_pcm_open(struct snd_soc_component *component,if (ret)return ret; - ret =request_irq (fifo->irq, axg_fifo_pcm_irq_block,0 , -dev_name (dev), ss); + ret =request_threaded_irq (fifo->irq, axg_fifo_pcm_irq_block, + axg_fifo_pcm_irq_block_thread, +IRQF_ONESHOT ,dev_name (dev), ss);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/168 btrfs: return accurate error code on open failure in open_fs_devices()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <[email protected]>
[ Upstream commit 2f1aeab9fca1a5f583be1add175d1ee95c213cfa ]
When attempting to exclusive open a device which has no exclusive open permission, such as a physical device associated with the flakey dm device, the open operation will fail, resulting in a mount failure.
In this particular scenario, we erroneously return -EINVAL instead of the correct error code provided by the bdev_open_by_path() function, which is -EBUSY.
Fix this, by returning error code from the bdev_open_by_path() function. With this correction, the mount error message will align with that of ext4 and xfs.
--- fs/btrfs/volumes.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/btrfs/volumes.c +12 -5
@@ -1260,25 +1260,32 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,struct btrfs_device *device;struct btrfs_device *latest_dev =NULL ;struct btrfs_device *tmp_device; +int ret =0 ; flags |=FMODE_EXCL ;list_for_each_entry_safe (device, tmp_device, &fs_devices->devices, dev_list) { -int ret; +int ret2; - ret =btrfs_open_one_device (fs_devices, device, flags, holder); -if (ret ==0 && + ret2 =btrfs_open_one_device (fs_devices, device, flags, holder); +if (ret2 ==0 && (!latest_dev || device->generation > latest_dev->generation)) { latest_dev = device; - }else if (ret == -ENODATA ) { + }else if (ret2 == -ENODATA ) { fs_devices->num_devices--;list_del (&device->dev_list);btrfs_free_device (device); } +if (ret ==0 && ret2 !=0 ) + ret = ret2; } -if (fs_devices->open_devices ==0 ) + +if (fs_devices->open_devices ==0 ) { +if (ret) +return ret;return -EINVAL ; + } fs_devices->opened =1 ; fs_devices->latest_dev = latest_dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/168 kbuild: Disable KCSAN for autogenerated *.mod.c intermediaries
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
[ Upstream commit 54babdc0343fff2f32dfaafaaa9e42c4db278204 ]
When KCSAN and CONSTRUCTORS are enabled, one can trigger the
"Unpatched return thunk in use. This should not happen!"
catch-all warning.
Usually, when objtool runs on the .o objects, it does generate a section .return_sites which contains all offsets in the objects to the return thunks of the functions present there. Those return thunks then get patched at runtime by the alternatives.
KCSAN and CONSTRUCTORS add this to the object file's .text.startup section:
-------------------
Disassembly of section .text.startup:
...
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <__UNIQUE_ID___addressable_cryptd_alloc_aead349+0x6>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
which, if it is built as a module goes through the intermediary stage of creating a <module>.mod.c file which, when translated, receives a second constructor:
-------------------
Disassembly of section .text.startup:
0000000000000010 <_sub_I_00099_0>:
10: f3 0f 1e fa endbr64
14: e8 00 00 00 00 call 19 <_sub_I_00099_0+0x9>
15: R_X86_64_PLT32 __tsan_init-0x4
19: e9 00 00 00 00 jmp 1e <_sub_I_00099_0+0xe>
1a: R_X86_64_PLT32 __x86_return_thunk-0x4...
0000000000000030 <_sub_I_00099_0>:
30: f3 0f 1e fa endbr64
34: e8 00 00 00 00 call 39 <_sub_I_00099_0+0x9>
35: R_X86_64_PLT32 __tsan_init-0x4
39: e9 00 00 00 00 jmp 3e <__ksymtab_cryptd_alloc_ahash+0x2>
3a: R_X86_64_PLT32 __x86_return_thunk-0x4-------------------
in the .ko file.
Objtool has run already so that second constructor's return thunk cannot be added to the .return_sites section and thus the return thunk remains unpatched and the warning rightfully fires.
Drop KCSAN flags from the mod.c generation stage as those constructors do not contain data races one would be interested about.
Debugged together with David Kaplan <[email protected]> and Nikolay Borisov <[email protected]>.
--- scripts/Makefile.modfinal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.modfinal +1 -1
@@ -23,7 +23,7 @@ modname = $(notdir $(@:.mod.o=)) part-of-module = y quiet_cmd_cc_o_c = CC [M] $@ - cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV), $(c_flags)) -c -o $@ $< + cmd_cc_o_c = $(CC) $(filter-out $(CC_FLAGS_CFI) $(CFLAGS_GCOV) $(CFLAGS_KCSAN), $(c_flags)) -c -o $@ $< %.mod.o: %.mod.c FORCE $(call if_changed_dep,cc_o_c)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/168 ALSA: line6: Zero-initialize message buffers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c4e51e424e2c772ce1836912a8b0b87cd61bc9d5 ]
For shutting up spurious KMSAN uninit-value warnings, just replace kmalloc() calls with kzalloc() for the buffers used for communications. There should be no real issue with the original code, but it's still better to cover.
Message-ID: <[email protected]>
--- sound/usb/line6/driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/line6/driver.c +3 -3
@@ -202,7 +202,7 @@ int line6_send_raw_message_async(struct usb_line6 *line6, const char *buffer,struct urb *urb;/* create message: */ - msg =kmalloc (sizeof (struct message ),GFP_ATOMIC ); + msg =kzalloc (sizeof (struct message ),GFP_ATOMIC );if (msg ==NULL )return -ENOMEM ;
@@ -688,7 +688,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)int ret;/* initialize USB buffers: */ - line6->buffer_listen =kmalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL ); + line6->buffer_listen =kzalloc (LINE6_BUFSIZE_LISTEN ,GFP_KERNEL );if (!line6->buffer_listen)return -ENOMEM ;
@@ -697,7 +697,7 @@ static int line6_init_cap_control(struct usb_line6 *line6)return -ENOMEM ;if (line6->properties->capabilities &LINE6_CAP_CONTROL_MIDI ) { - line6->buffer_message =kmalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL ); + line6->buffer_message =kzalloc (LINE6_MIDI_MESSAGE_MAXLEN ,GFP_KERNEL );if (!line6->buffer_message)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/168 net: bcmgenet: Reset RBUF on first open
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea ]
If the RBUF logic is not reset when the kernel starts then there may be some data left over from any network boot loader. If the 64-byte packet headers are enabled then this can be fatal.
Extend bcmgenet_dma_disable to do perform the reset, but not when called from bcmgenet_resume in order to preserve a wake packet.
N.B. This different handling of resume is just based on a hunch - why else wouldn't one reset the RBUF as well as the TBUF? If this isn't the case then it's easy to change the patch to make the RBUF reset unconditional.
See: https://github.com/raspberrypi/linux/issues/3850
See: https://github.com/raspberrypi/firmware/issues/1882
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -4
@@ -3256,7 +3256,7 @@ static void bcmgenet_get_hw_addr(struct bcmgenet_priv *priv, }/* Returns a reusable dma control register value */ -static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv) +static u32 bcmgenet_dma_disable (struct bcmgenet_priv *priv,bool flush_rx) {unsigned int i;u32 reg;
@@ -3281,6 +3281,14 @@ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)udelay (10 );bcmgenet_umac_writel (priv,0 ,UMAC_TX_FLUSH ); +if (flush_rx) { + reg =bcmgenet_rbuf_ctrl_get (priv); +bcmgenet_rbuf_ctrl_set (priv, reg |BIT (0 )); +udelay (10 ); +bcmgenet_rbuf_ctrl_set (priv, reg); +udelay (10 ); + } +return dma_ctrl; }
@@ -3344,8 +3352,8 @@ static int bcmgenet_open(struct net_device *dev)bcmgenet_set_hw_addr (priv, dev->dev_addr); -/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); +/* Disable RX/TX DMA and flush TX and RX queues */ + dma_ctrl =bcmgenet_dma_disable (priv, true);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
@@ -4201,7 +4209,7 @@ static int bcmgenet_resume(struct device *d)bcmgenet_hfb_create_rxnfc_filter (priv, rule);/* Disable RX/TX DMA and flush TX queues */ - dma_ctrl =bcmgenet_dma_disable (priv); + dma_ctrl =bcmgenet_dma_disable (priv, false);/* Reinitialize TDMA and RDMA and SW housekeeping */ ret =bcmgenet_init_dma (priv);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/168 ASoC: meson: axg-card: make links nonatomic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit e138233e56e9829e65b6293887063a1a3ccb2d68 ]
Non atomic operations need to be performed in the trigger callback of the TDM interfaces. Those are BEs but what matters is the nonatomic flag of the FE in the DPCM context. Just set nonatomic for everything so, at least, it is clear.
--- sound/soc/meson/axg-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/axg-card.c +1 -0
@@ -320,6 +320,7 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, dai_link->cpus = cpu; dai_link->num_cpus =1 ; + dai_link->nonatomic = true; ret =meson_card_parse_dai (card, np, &dai_link->cpus->of_node, &dai_link->cpus->dai_name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/168 ASoC: meson: axg-tdm-interface: manage formatters in trigger
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit bf5e4887eeddb48480568466536aa08ec7f179a5 ]
So far, the formatters have been reset/enabled using the .prepare() callback. This was done in this callback because walking the formatters use a mutex so it could not be done in .trigger(), which is atomic by default.
It turns out there is a problem on capture path of the AXG series. The FIFO may get out of sync with the TDM decoder if the IP are not enabled in a specific order. The FIFO must be enabled before the formatter starts producing data. IOW, we must deal with FE before the BE. The .prepare() callback is called on the BEs before the FE so it is not OK for the AXG.
The .trigger() callback order can be configured, and it deals with the FE before the BEs by default. To solve our problem, we just need to start and stop the formatters from the .trigger() callback. It is OK do so now that the links have been made 'nonatomic' in the card driver.
--- sound/soc/meson/axg-tdm-interface.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
sound/soc/meson/axg-tdm-interface.c +21 -5
@@ -362,13 +362,29 @@ static int axg_tdm_iface_hw_free(struct snd_pcm_substream *substream,return 0 ; } -static int axg_tdm_iface_prepare (struct snd_pcm_substream *substream, +static int axg_tdm_iface_trigger (struct snd_pcm_substream *substream, +int cmd,struct snd_soc_dai *dai) { -struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); +struct axg_tdm_stream *ts = +snd_soc_dai_get_dma_data (dai, substream); + +switch (cmd) { +case SNDRV_PCM_TRIGGER_START : +case SNDRV_PCM_TRIGGER_RESUME : +case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +axg_tdm_stream_start (ts); +break ; +case SNDRV_PCM_TRIGGER_SUSPEND : +case SNDRV_PCM_TRIGGER_PAUSE_PUSH : +case SNDRV_PCM_TRIGGER_STOP : +axg_tdm_stream_stop (ts); +break ; +default : +return -EINVAL ; + } -/* Force all attached formatters to update */ -return axg_tdm_stream_reset (ts); +return 0 ; }static int axg_tdm_iface_remove_dai (struct snd_soc_dai *dai)
@@ -408,8 +424,8 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { .set_fmt = axg_tdm_iface_set_fmt, .startup = axg_tdm_iface_startup, .hw_params = axg_tdm_iface_hw_params, - .prepare = axg_tdm_iface_prepare, .hw_free = axg_tdm_iface_hw_free, + .trigger = axg_tdm_iface_trigger, };/* TDM Backend DAIs */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/168 ASoC: meson: cards: select SND_DYNAMIC_MINORS
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 6db26f9ea4edd8a17d39ab3c20111e3ccd704aef ]
Amlogic sound cards do create a lot of pcm interfaces, possibly more than
8. Some pcm interfaces are internal (like DPCM backends and c2c) and not exposed to userspace.
Those interfaces still increase the number passed to snd_find_free_minor(), which eventually exceeds 8 causing -EBUSY error on card registration if CONFIG_SND_DYNAMIC_MINORS=n and the interface is exposed to userspace.
select CONFIG_SND_DYNAMIC_MINORS for Amlogic cards to avoid the problem.
--- sound/soc/meson/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/meson/Kconfig +1 -0
@@ -99,6 +99,7 @@ config SND_MESON_AXG_PDM config SND_MESON_CARD_UTILS tristate + select SND_DYNAMIC_MINORS config SND_MESON_CODEC_GLUE tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/168 ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit c158cf914713efc3bcdc25680c7156c48c12ef6a ]
The documentation for device_get_named_child_node() mentions this important point:
"
The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer.
"
Add fwnode_handle_put() to avoid a leaked reference.
Message-ID: <[email protected]>
--- sound/hda/intel-sdw-acpi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/hda/intel-sdw-acpi.c +2 -0
@@ -41,6 +41,8 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, int i)"intel-quirk-mask" , &quirk_mask); +fwnode_handle_put (link); +if (quirk_mask &SDW_INTEL_QUIRK_MASK_BUS_DISABLE )return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/168 s390/cio: Ensure the copied buf is NUL terminated
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bui Quang Minh <[email protected]>
[ Upstream commit da7c622cddd4fe36be69ca61e8c42e43cde94784 ]
Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
--- drivers/s390/cio/cio_inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/cio/cio_inject.c +1 -1
@@ -95,7 +95,7 @@ static ssize_t crw_inject_write(struct file *file, const char __user *buf,return -EINVAL ; } - buffer =vmemdup_user (buf, lbuf); + buffer =memdup_user_nul (buf, lbuf);if (IS_ERR (buffer))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/168 cxgb4: Properly lock TX queue for the selftest.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 9067eccdd7849dd120d5495dbd5a686fa6ed2c1a ]
The selftest for the driver sends a dummy packet and checks if the packet will be received properly as it should be. The regular TX path and the selftest can use the same network queue so locking is required and was missing in the selftest path. This was addressed in the commit cited below.
Unfortunately locking the TX queue requires BH to be disabled which is not the case in selftest path which is invoked in process context. Lockdep should be complaining about this.
Use __netif_tx_lock_bh() for TX queue locking.
--- drivers/net/ethernet/chelsio/cxgb4/sge.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/sge.c +3 -3
@@ -2682,12 +2682,12 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev) lb->loopback =1 ; q = &adap->sge.ethtxq[pi->first_qset]; -__netif_tx_lock (q->txq,smp_processor_id ()); +__netif_tx_lock_bh (q->txq);reclaim_completed_tx (adap, &q->q,-1 , true); credits =txq_avail (&q->q) - ndesc;if (unlikely (credits <0 )) { -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);return -ENOMEM ; }
@@ -2722,7 +2722,7 @@ int cxgb4_selftest_lb_pkt(struct net_device *netdev)init_completion (&lb->completion);txq_advance (&q->q, ndesc);cxgb4_ring_tx_db (adap, &q->q, ndesc); -__netif_tx_unlock (q->txq); +__netif_tx_unlock_bh (q->txq);/* wait for the pkt to return */ ret =wait_for_completion_timeout (&lb->completion,10 *HZ );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/168 net: qede: use return from qede_parse_flow_attr() for flow_spec
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asbjørn Sloth Tønnesen <[email protected]>
[ Upstream commit 27b44414a34b108c5a37cd5b4894f606061d86e7 ]
In qede_flow_spec_to_rule(), when callingqede_parse_flow_attr() then the return code
was only used for a non-zero check, and then-EINVAL was returned.
qede_parse_flow_attr() can currently fail with:
* -EINVAL
* -EOPNOTSUPP
* -EPROTONOSUPPORT
This patch changes the code to use the actual
return code, not just return -EINVAL.
The blaimed commit introduced qede_flow_spec_to_rule(), and this call to qede_parse_flow_attr(), it looks like it just duplicated how it was already used.
Only compile tested.
--- drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/qlogic/qede/qede_filter.c +2 -3
@@ -2002,10 +2002,9 @@ static int qede_flow_spec_to_rule(struct qede_dev *edev,if (IS_ERR (flow))return PTR_ERR (flow); -if (qede_parse_flow_attr (edev, proto, flow->rule, t)) { - err = -EINVAL ; + err =qede_parse_flow_attr (edev, proto, flow->rule, t); +if (err) goto err_out; - }/* Make sure location is valid and filter isn't already set */ err = qede_flow_spec_validate(edev, &flow->rule->action, t,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/168 firewire: ohci: mask bus reset interrupts between ISR and bottom half
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Goldman <[email protected]>
[ Upstream commit 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9 ]
In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt.
Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them.
irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally.
This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization.
irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired.
As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.
--- drivers/firewire/ohci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/firewire/ohci.c +5 -1
@@ -2049,6 +2049,8 @@ static void bus_reset_work(struct work_struct *work) ohci->generation = generation;reg_write (ohci, OHCI1394_IntEventClear, OHCI1394_busReset); +if (param_debug &OHCI_PARAM_DEBUG_BUSRESETS ) +reg_write (ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);if (ohci->quirks &QUIRK_RESET_PACKET ) ohci->request_generation = generation;
@@ -2115,12 +2117,14 @@ static irqreturn_t irq_handler(int irq, void *data)return IRQ_NONE ;/* -* busReset and postedWriteErr must not be cleared yet +* busReset and postedWriteErr events must not be cleared yet * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1) */ reg_write (ohci, OHCI1394_IntEventClear, event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));log_irqs (ohci, event); +if (event & OHCI1394_busReset) +reg_write (ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);if (event & OHCI1394_selfIDComplete)queue_work (selfid_workqueue, &ohci->bus_reset_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/168 selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit 076361362122a6d8a4c45f172ced5576b2d4a50d ]
The struct adjtimex freq field takes a signed value who's units are in shifted (<<16) parts-per-million.
Unfortunately for negative adjustments, the straightforward use of:
freq = ppm << 16 trips undefined behavior warnings with clang:
valid-adjtimex.c:66:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-499<<16,
~~~~^
valid-adjtimex.c:67:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
-450<<16,
~~~~^..
Fix it by using a multiply by (1 << 16) instead of shifting negative values in the valid-adjtimex test case. Align the values for better readability.
--- .../testing/selftests/timers/valid-adjtimex.c | 73 +++++++++---------- 1 file changed, 36 insertions(+), 37 deletions(-)
tools/testing/selftests/timers/valid-adjtimex.c +36 -37
@@ -21,9 +21,6 @@* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. */ - - -#include <stdio.h> #include <stdlib.h> #include <time.h>
@@ -62,45 +59,47 @@ int clear_time_state(void)#define NUM_FREQ_OUTOFRANGE 4#define NUM_FREQ_INVALID 2 +#define SHIFTED_PPM (1 << 16) +long valid_freq[NUM_FREQ_VALID ] = { --499 <<16 , --450 <<16 , --400 <<16 , --350 <<16 , --300 <<16 , --250 <<16 , --200 <<16 , --150 <<16 , --100 <<16 , --75 <<16 , --50 <<16 , --25 <<16 , --10 <<16 , --5 <<16 , --1 <<16 , +-499 *SHIFTED_PPM , +-450 *SHIFTED_PPM , +-400 *SHIFTED_PPM , +-350 *SHIFTED_PPM , +-300 *SHIFTED_PPM , +-250 *SHIFTED_PPM , +-200 *SHIFTED_PPM , +-150 *SHIFTED_PPM , +-100 *SHIFTED_PPM , +-75 *SHIFTED_PPM , +-50 *SHIFTED_PPM , +-25 *SHIFTED_PPM , +-10 *SHIFTED_PPM , +-5 *SHIFTED_PPM , +-1 *SHIFTED_PPM ,-1000 , -1 <<16 , -5 <<16 , -10 <<16 , -25 <<16 , -50 <<16 , -75 <<16 , -100 <<16 , -150 <<16 , -200 <<16 , -250 <<16 , -300 <<16 , -350 <<16 , -400 <<16 , -450 <<16 , -499 <<16 , +1 *SHIFTED_PPM , +5 *SHIFTED_PPM , +10 *SHIFTED_PPM , +25 *SHIFTED_PPM , +50 *SHIFTED_PPM , +75 *SHIFTED_PPM , +100 *SHIFTED_PPM , +150 *SHIFTED_PPM , +200 *SHIFTED_PPM , +250 *SHIFTED_PPM , +300 *SHIFTED_PPM , +350 *SHIFTED_PPM , +400 *SHIFTED_PPM , +450 *SHIFTED_PPM , +499 *SHIFTED_PPM , };long outofrange_freq[NUM_FREQ_OUTOFRANGE ] = { --1000 <<16 , --550 <<16 , -550 <<16 , -1000 <<16 , +-1000 *SHIFTED_PPM , +-550 *SHIFTED_PPM , +550 *SHIFTED_PPM , +1000 *SHIFTED_PPM , };#define LONG_MAX (~0UL>>1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/168 iommu: mtk: fix module autoloading
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7537e31df80cb58c27f3b6fef702534ea87a5957 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/iommu/mtk_iommu.c | 1 + drivers/iommu/mtk_iommu_v1.c | 1 + 2 files changed, 2 insertions(+)
drivers/iommu/mtk_iommu.c +1 -0
@@ -1101,6 +1101,7 @@ static const struct of_device_id mtk_iommu_of_ids[] = { { .compatible = "mediatek,mt8192-m4u", .data = &mt8192_data}, {} }; +MODULE_DEVICE_TABLE (of, mtk_iommu_of_ids);static struct platform_driver mtk_iommu_driver = { .probe = mtk_iommu_probe,
drivers/iommu/mtk_iommu_v1.c +1 -0
@@ -576,6 +576,7 @@ static const struct of_device_id mtk_iommu_of_ids[] = { { .compatible = "mediatek,mt2701-m4u", }, {} }; +MODULE_DEVICE_TABLE (of, mtk_iommu_v1_of_ids);static const struct component_master_ops mtk_iommu_com_ops = { .bind = mtk_iommu_bind,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/168 fs/9p: only translate RWX permissions for plain 9P2000
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit cd25e15e57e68a6b18dc9323047fe9c68b99290b ]
Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u.
--- fs/9p/vfs_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/9p/vfs_inode.c +1 -1
@@ -87,7 +87,7 @@ static int p9mode2perm(struct v9fs_session_info *v9ses,int res;int mode = stat->mode; - res = mode &S_IALLUGO ; + res = mode &0777 ;/* S_IRWXUGO */ if (v9fs_proto_dotu (v9ses)) {if ((mode &P9_DMSETUID ) ==P9_DMSETUID ) res |=S_ISUID ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/168 fs/9p: translate O_TRUNC into OTRUNC
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit 87de39e70503e04ddb58965520b15eb9efa7eef3 ]
This one hits both 9P2000 and .u as it appears v9fs has never translated the O_TRUNC flag.
--- fs/9p/vfs_inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/9p/vfs_inode.c +3 -0
@@ -178,6 +178,9 @@ int v9fs_uflags2omode(int uflags, int extended)break ; } +if (uflags &O_TRUNC ) + ret |=P9_OTRUNC ; +if (extended) {if (uflags &O_EXCL ) ret |=P9_OEXCL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/168 9p: explicitly deny setlease attempts
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit 7a84602297d36617dbdadeba55a2567031e5165b ]
9p is a remote network protocol, and it doesn't support asynchronous notifications from the server. Ensure that we don't hand out any leases since we can't guarantee they'll be broken when a file's contents change.
--- fs/9p/vfs_file.c | 2 ++ 1 file changed, 2 insertions(+)
fs/9p/vfs_file.c +2 -0
@@ -660,6 +660,7 @@ const struct file_operations v9fs_file_operations = { .splice_read = generic_file_splice_read, .splice_write = iter_file_splice_write, .fsync = v9fs_file_fsync, + .setlease = simple_nosetlease, };const struct file_operations v9fs_file_operations_dotl = {
@@ -701,4 +702,5 @@ const struct file_operations v9fs_mmap_file_operations_dotl = { .splice_read = generic_file_splice_read, .splice_write = iter_file_splice_write, .fsync = v9fs_file_fsync_dotl, + .setlease = simple_nosetlease, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/168 gpio: wcove: Use -ENOTSUPP consistently
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 0c3b532ad3fbf82884a2e7e83e37c7dcdd4d1d99 ]
The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this.
--- drivers/gpio/gpio-wcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-wcove.c +1 -1
@@ -104,7 +104,7 @@ static inline int to_reg(int gpio, enum ctrl_register type)unsigned int reg = type ==CTRL_IN ?GPIO_IN_CTRL_BASE :GPIO_OUT_CTRL_BASE ;if (gpio >=WCOVE_GPIO_NUM ) -return -EOPNOTSUPP ; +return -ENOTSUPP ;return reg + gpio; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/168 gpio: crystalcove: Use -ENOTSUPP consistently
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit ace0ebe5c98d66889f19e0f30e2518d0c58d0e04 ]
The GPIO library expects the drivers to return -ENOTSUPP in some cases and not using analogue POSIX code. Make the driver to follow this.
--- drivers/gpio/gpio-crystalcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-crystalcove.c +1 -1
@@ -91,7 +91,7 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)case 0x5e :return GPIOPANELCTL ;default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/168 clk: Dont hold prepare_lock when calling kref_put()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 6f63af7511e7058f3fa4ad5b8102210741c9f947 ]
We don't need to hold the prepare_lock when dropping a ref on a struct clk_core. The release function is only freeing memory and any code with a pointer reference has already unlinked anything pointing to the clk_core. This reduces the holding area of the prepare_lock a bit.
Note that we also don't call free_clk() with the prepare_lock held. There isn't any reason to do that.
--- drivers/clk/clk.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/clk/clk.c +5 -7
@@ -4227,7 +4227,8 @@ void clk_unregister(struct clk *clk)if (ops == &clk_nodrv_ops) {pr_err ("%s: unregistered clock: %s\n" , __func__, clk->core->name); - goto unlock; +clk_prepare_unlock (); +return ; }/* * Assign empty clock ops for consumers that might still hold
@@ -4261,11 +4262,10 @@ void clk_unregister(struct clk *clk)if (clk->core->protect_count)pr_warn ("%s: unregistering protected clock: %s\n" , __func__, clk->core->name); +clk_prepare_unlock ();kref_put (&clk->core->ref, __clk_release);free_clk (clk); -unlock: -clk_prepare_unlock (); }EXPORT_SYMBOL_GPL (clk_unregister);
@@ -4471,13 +4471,11 @@ void __clk_put(struct clk *clk) clk->max_rate < clk->core->req_rate)clk_core_set_rate_nolock (clk->core, clk->core->req_rate); - owner = clk->core->owner; -kref_put (&clk->core->ref, __clk_release); -clk_prepare_unlock (); + owner = clk->core->owner; +kref_put (&clk->core->ref, __clk_release);module_put (owner); -free_clk (clk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/168 fs/9p: drop inodes immediately on non-.L too
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Sindholt <[email protected]>
[ Upstream commit 7fd524b9bd1be210fe79035800f4bd78a41b349f ]
--- fs/9p/vfs_super.c | 1 + 1 file changed, 1 insertion(+)
fs/9p/vfs_super.c +1 -0
@@ -340,6 +340,7 @@ static const struct super_operations v9fs_super_ops = { .alloc_inode = v9fs_alloc_inode, .free_inode = v9fs_free_inode, .statfs = simple_statfs, + .drop_inode = v9fs_drop_inode, .evict_inode = v9fs_evict_inode, .show_options = v9fs_show_options, .umount_begin = v9fs_umount_begin,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/168 drm/nouveau/dp: Dont probe eDP ports twice harder
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
[ Upstream commit bf52d7f9b2067f02efe7e32697479097aba4a055 ]
I didn't pay close enough attention the last time I tried to fix this problem - while we currently do correctly take care to make sure we don't probe a connected eDP port more then once, we don't do the same thing for eDP ports we found to be disconnected.
So, fix this and make sure we only ever probe eDP ports once and then leave them at that connector state forever (since without HPD, it's not going to change on its own anyway). This should get rid of the last few GSP errors getting spit out during runtime suspend and resume on some machines, as we tried to reprobe eDP ports in response to ACPI hotplug probe events.
--- drivers/gpu/drm/nouveau/nouveau_dp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/nouveau/nouveau_dp.c +8 -5
@@ -109,12 +109,15 @@ nouveau_dp_detect(struct nouveau_connector *nv_connector,u8 *dpcd = nv_encoder->dp.dpcd;int ret =NOUVEAU_DP_NONE ; -/* If we've already read the DPCD on an eDP device, we don't need to -* reread it as it won't change +/* eDP ports don't support hotplugging - so there's no point in probing eDP ports unless we +* haven't probed them once before. */ -if (connector->connector_type == DRM_MODE_CONNECTOR_eDP && - dpcd[DP_DPCD_REV ] !=0 ) -return NOUVEAU_DP_SST ; +if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) { +if (connector->status == connector_status_connected) +return NOUVEAU_DP_SST ; +else if (connector->status == connector_status_disconnected) +return NOUVEAU_DP_NONE ; + }mutex_lock (&nv_encoder->dp.hpd_irq_lock);if (mstm) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/168 tools/power turbostat: Fix added raw MSR output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Smythies <[email protected]>
[ Upstream commit e5f4e68eed85fa8495d78cd966eecc2b27bb9e53 ]
When using --Summary mode, added MSRs in raw mode always print zeros. Print the actual register contents.
Example, with patch:
note the added column:
--add msr0x64f,u32,package,raw,REASON
Where:
0x64F is MSR_CORE_PERF_LIMIT_REASONS
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.00 4800 35 1.42 0.76 0x00000000 0.00 4801 34 1.42 0.76 0x00000000 80.08 4531 66 108.17 107.52 0x08000000 98.69 4530 66 133.21 132.54 0x08000000 99.28 4505 66 128.26 127.60 0x0c000400 99.65 4486 68 124.91 124.25 0x0c000400 99.63 4483 68 124.90 124.25 0x0c000400 79.34 4481 41 99.80 99.13 0x0c000000 0.00 4801 41 1.40 0.73 0x0c000000
Where, for the test processor (i5-10600K):
PKG Limit #1: 125.000 Watts, 8.000000 sec
MSR bit 26 = log; bit 10 = status
PKG Limit #2: 136.000 Watts, 0.002441 sec
MSR bit 27 = log; bit 11 = status
Example, without patch:
Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON 0.01 4800 35 1.43 0.77 0x00000000 0.00 4801 35 1.39 0.73 0x00000000 83.49 4531 66 112.71 112.06 0x00000000 98.69 4530 68 133.35 132.69 0x00000000 99.31 4500 67 127.96 127.30 0x00000000 99.63 4483 69 124.91 124.25 0x00000000 99.61 4481 69 124.90 124.25 0x00000000 99.61 4481 71 124.92 124.25 0x00000000 59.35 4479 42 75.03 74.37 0x00000000 0.00 4800 42 1.39 0.73 0x00000000 0.00 4801 42 1.42 0.76 0x00000000
c000000
[lenb: simplified patch to apply only to package scope]
--- tools/power/x86/turbostat/turbostat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
tools/power/x86/turbostat/turbostat.c +4 -3
@@ -1761,9 +1761,10 @@ int sum_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p) average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;for (i =0 , mp = sys.pp; mp; i++, mp = mp->next) { -if (mp->format ==FORMAT_RAW ) -continue ; - average.packages.counter[i] += p->counter[i]; +if ((mp->format ==FORMAT_RAW ) && (topo.num_packages ==0 )) + average.packages.counter[i] = p->counter[i]; +else + average.packages.counter[i] += p->counter[i]; }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/168 net:usb:qmi_wwan: support Rolling modules
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <[email protected]>
[ Upstream commit d362046021ea122309da8c8e0b6850c792ca97b5 ]
Update the qmi_wwan driver support for the Rolling LTE modules.
- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET interface for /Linux/Chrome OS)0x0104: RMNET, diag, at, pipe
Here are the outputs of usb-devices:
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0104 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling Module S: SerialNumber=ba2eb033 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1419,6 +1419,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ + {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET *//* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/168 bpf, sockmap: TCP data stall on recv before accept
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit ea444185a6bf7da4dd0df1598ee953e4f7174858 ]
A common mechanism to put a TCP socket into the sockmap is to hook the BPF_SOCK_OPS_{ACTIVE_PASSIVE}_ESTABLISHED_CB event with a BPF program that can map the socket info to the correct BPF verdict parser. When the user adds the socket to the map the psock is created and the new ops are assigned to ensure the verdict program will 'see' the sk_buffs as they arrive.
Part of this process hooks the sk_data_ready op with a BPF specific handler to wake up the BPF verdict program when data is ready to read. The logic is simple enough (posted here for easy reading)
static void sk_psock_verdict_data_ready(struct sock *sk)
{
struct socket *sock = sk->sk_socket;
if (unlikely(!sock || !sock->ops || !sock->ops->read_skb))
return;
sock->ops->read_skb(sk, sk_psock_verdict_recv);}
The oversight here is sk->sk_socket is not assigned until the application accepts() the new socket. However, its entirely ok for the peer application to do a connect() followed immediately by sends. The socket on the receiver is sitting on the backlog queue of the listening socket until its accepted and the data is queued up. If the peer never accepts the socket or is slow it will eventually hit data limits and rate limit the session. But, important for BPF sockmap hooks when this data is received TCP stack does the sk_data_ready() call but the read_skb() for this data is never called because sk_socket is missing. The data sits on the sk_receive_queue.
Then once the socket is accepted if we never receive more data from the peer there will be no further sk_data_ready calls and all the data is still on the sk_receive_queue(). Then user calls recvmsg after accept() and for TCP sockets in sockmap we use the tcp_bpf_recvmsg_parser() handler. The handler checks for data in the sk_msg ingress queue expecting that the BPF program has already run from the sk_data_ready hook and enqueued the data as needed. So we are stuck.
To fix do an unlikely check in recvmsg handler for data on the sk_receive_queue and if it exists wake up data_ready. We have the sock locked in both read_skb and recvmsg so should avoid having multiple runners.
--- net/ipv4/tcp_bpf.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
net/ipv4/tcp_bpf.c +20 -0
@@ -195,6 +195,26 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,return tcp_recvmsg (sk, msg, len, nonblock, flags, addr_len);lock_sock (sk); + +/* We may have received data on the sk_receive_queue pre-accept and +* then we can not use read_skb in this context because we haven't +* assigned a sk_socket yet so have no link to the ops. The work-around +* is to check the sk_receive_queue and in these cases read skbs off +* queue again. The read_skb hook is not running at this point because +* of lock_sock so we avoid having multiple runners in read_skb. +*/ +if (unlikely (!skb_queue_empty (&sk->sk_receive_queue))) { +tcp_data_ready (sk); +/* This handles the ENOMEM errors if we both receive data +* pre accept and are already under memory pressure. At least +* let user know to retry. +*/ +if (unlikely (!skb_queue_empty (&sk->sk_receive_queue))) { + copied = -EAGAIN ; + goto out; + } + } + msg_bytes_ready: copied =sk_msg_recvmsg (sk, psock, msg, len, flags);if (!copied) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/168 bpf, sockmap: Handle fin correctly
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit 901546fd8f9ca4b5c481ce00928ab425ce9aacc0 ]
The sockmap code is returning EAGAIN after a FIN packet is received and no more data is on the receive queue. Correct behavior is to return 0 to the user and the user can then close the socket. The EAGAIN causes many apps to retry which masks the problem. Eventually the socket is evicted from the sockmap because its released from sockmap sock free handling. The issue creates a delay and can cause some errors on application side.
To fix this check on sk_msg_recvmsg side if length is zero and FIN flag is set then set return to zero. A selftest will be added to check this condition.
--- net/ipv4/tcp_bpf.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+)
net/ipv4/tcp_bpf.c +31 -0
@@ -174,6 +174,24 @@ static int tcp_msg_wait_data(struct sock *sk, struct sk_psock *psock,return ret; } +static bool is_next_msg_fin (struct sk_psock *psock) +{ +struct scatterlist *sge; +struct sk_msg *msg_rx; +int i; + + msg_rx =sk_psock_peek_msg (psock); + i = msg_rx->sg.start; + sge =sk_msg_elem (msg_rx, i); +if (!sge->length) { +struct sk_buff *skb = msg_rx->skb; + +if (skb &&TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ) +return true; + } +return false; +} + static int tcp_bpf_recvmsg_parser(struct sock *sk, struct msghdr *msg, size_t len,
@@ -217,6 +235,19 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk, msg_bytes_ready: copied =sk_msg_recvmsg (sk, psock, msg, len, flags); +/* The typical case for EFAULT is the socket was gracefully +* shutdown with a FIN pkt. So check here the other case is +* some error on copy_page_to_iter which would be unexpected. +* On fin return correct return code to zero. +*/ +if (copied == -EFAULT ) { +bool is_fin =is_next_msg_fin (psock); + +if (is_fin) { + copied =0 ; + goto out; + } + }if (!copied) {long timeo;int data;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/168 bpf, sockmap: Convert schedule_work into delayed_work
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit 29173d07f79883ac94f5570294f98af3d4287382 ]
Sk_buffs are fed into sockmap verdict programs either from a strparser (when the user might want to decide how framing of skb is done by attaching another parser program) or directly through tcp_read_sock. The tcp_read_sock is the preferred method for performance when the BPF logic is a stream parser.
The flow for Cilium's common use case with a stream parser is,
tcp_read_sock()
sk_psock_verdict_recv
ret = bpf_prog_run_pin_on_cpu()
sk_psock_verdict_apply(sock, skb, ret)
// if system is under memory pressure or app is slow we may
// need to queue skb. Do this queuing through ingress_skb and
// then kick timer to wake up handler
skb_queue_tail(ingress_skb, skb)
schedule_work(work);The work queue is wired up to sk_psock_backlog(). This will then walk the ingress_skb skb list that holds our sk_buffs that could not be handled, but should be OK to run at some later point. However, its possible that the workqueue doing this work still hits an error when sending the skb. When this happens the skbuff is requeued on a temporary 'state' struct kept with the workqueue. This is necessary because its possible to partially send an skbuff before hitting an error and we need to know how and where to restart when the workqueue runs next.
Now for the trouble, we don't rekick the workqueue. This can cause a stall where the skbuff we just cached on the state variable might never be sent. This happens when its the last packet in a flow and no further packets come along that would cause the system to kick the workqueue from that side.
To fix we could do simple schedule_work(), but while under memory pressure it makes sense to back off some instead of continue to retry repeatedly. So instead to fix convert schedule_work to schedule_delayed_work and add backoff logic to reschedule from backlog queue on errors. Its not obvious though what a good backoff is so use '1'.
To test we observed some flakes whil running NGINX compliance test with sockmap we attributed these failed test to this bug and subsequent issue.
Quoted 1 line
From on list discussion. This commit
bec217197b41("skmsg: Schedule psock work if the cached skb exists on the psock")
was intended to address similar race, but had a couple cases it missed. Most obvious it only accounted for receiving traffic on the local socket so if redirecting into another socket we could still get an sk_buff stuck here. Next it missed the case where copied=0 in the recv() handler and then we wouldn't kick the scheduler. Also its sub-optimal to require userspace to kick the internal mechanisms of sockmap to wake it up and copy data to user. It results in an extra syscall and requires the app to actual handle the EAGAIN correctly.
Stable-dep-of: 405df89dd52c ("bpf, sockmap: Improved check for empty queue")
--- include/linux/skmsg.h | 2 +- net/core/skmsg.c | 21 ++++++++++++++------- net/core/sock_map.c | 3 ++- 3 files changed, 17 insertions(+), 9 deletions(-)
include/linux/skmsg.h +1 -1
@@ -107,7 +107,7 @@ struct sk_psock {struct proto *sk_proto;struct mutex work_mutex;struct sk_psock_work_state work_state; -struct work_struct work; +struct delayed_work work;struct rcu_work rwork; };
net/core/skmsg.c +14 -7
@@ -482,7 +482,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, } out:if (psock->work_state.skb && copied >0 ) -schedule_work (&psock->work); +schedule_delayed_work (&psock->work,0 );return copied; }EXPORT_SYMBOL_GPL (sk_msg_recvmsg);
@@ -633,7 +633,8 @@ static void sk_psock_skb_state(struct sk_psock *psock,static void sk_psock_backlog (struct work_struct *work) { - struct sk_psock *psock = container_of(work, struct sk_psock, work); +struct delayed_work *dwork =to_delayed_work (work); + struct sk_psock *psock = container_of(dwork, struct sk_psock, work);struct sk_psock_work_state *state = &psock->work_state;struct sk_buff *skb =NULL ;bool ingress;
@@ -673,6 +674,12 @@ static void sk_psock_backlog(struct work_struct *work)if (ret == -EAGAIN ) {sk_psock_skb_state (psock, state, skb, len, off); + +/* Delay slightly to prioritize any +* other work that might be here. +*/ +if (sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) +schedule_delayed_work (&psock->work,1 ); goto end; }/* Hard errors break pipe and stop xmit. */
@@ -727,7 +734,7 @@ struct sk_psock *sk_psock_init(struct sock *sk, int node)INIT_LIST_HEAD (&psock->link);spin_lock_init (&psock->link_lock); -INIT_WORK (&psock->work, sk_psock_backlog); +INIT_DELAYED_WORK (&psock->work, sk_psock_backlog);mutex_init (&psock->work_mutex);INIT_LIST_HEAD (&psock->ingress_msg);spin_lock_init (&psock->ingress_lock);
@@ -816,7 +823,7 @@ static void sk_psock_destroy(struct work_struct *work)sk_psock_done_strp (psock); -cancel_work_sync (&psock->work); +cancel_delayed_work_sync (&psock->work);mutex_destroy (&psock->work_mutex);psock_progs_drop (&psock->progs);
@@ -931,7 +938,7 @@ static int sk_psock_skb_redirect(struct sk_psock *from, struct sk_buff *skb) }skb_queue_tail (&psock_other->ingress_skb, skb); -schedule_work (&psock_other->work); +schedule_delayed_work (&psock_other->work,0 );spin_unlock_bh (&psock_other->ingress_lock);return 0 ; }
@@ -1011,7 +1018,7 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,spin_lock_bh (&psock->ingress_lock);if (sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) {skb_queue_tail (&psock->ingress_skb, skb); -schedule_work (&psock->work); +schedule_delayed_work (&psock->work,0 ); err =0 ; }spin_unlock_bh (&psock->ingress_lock);
@@ -1042,7 +1049,7 @@ static void sk_psock_write_space(struct sock *sk) psock =sk_psock (sk);if (likely (psock)) {if (sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) -schedule_work (&psock->work); +schedule_delayed_work (&psock->work,0 ); write_space = psock->saved_write_space; }rcu_read_unlock ();
net/core/sock_map.c +2 -1
@@ -1577,9 +1577,10 @@ void sock_map_close(struct sock *sk, long timeout)rcu_read_unlock ();sk_psock_stop (psock);release_sock (sk); -cancel_work_sync (&psock->work); +cancel_delayed_work_sync (&psock->work);sk_psock_put (sk, psock); } +/* Make sure we do not recurse. This is a bug. * Leak the socket instead of crashing on a stack overflow. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/168 bpf, sockmap: Reschedule is now done through backlog
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit bce22552f92ea7c577f49839b8e8f7d29afaf880 ]
Now that the backlog manages the reschedule() logic correctly we can drop the partial fix to reschedule from recvmsg hook.
Rescheduling on recvmsg hook was added to address a corner case where we still had data in the backlog state but had nothing to kick it and reschedule the backlog worker to run and finish copying data out of the state. This had a couple limitations, first it required user space to kick it introducing an unnecessary EBUSY and retry. Second it only handled the ingress case and egress redirects would still be hung.
With the correct fix, pushing the reschedule logic down to where the enomem error occurs we can drop this fix.
Stable-dep-of: 405df89dd52c ("bpf, sockmap: Improved check for empty queue")
--- net/core/skmsg.c | 2 -- 1 file changed, 2 deletions(-)
net/core/skmsg.c +0 -2
@@ -481,8 +481,6 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, msg_rx =sk_psock_peek_msg (psock); } out: -if (psock->work_state.skb && copied >0 ) -schedule_delayed_work (&psock->work,0 );return copied; }EXPORT_SYMBOL_GPL (sk_msg_recvmsg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/168 bpf, sockmap: Improved check for empty queue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
[ Upstream commit 405df89dd52cbcd69a3cd7d9a10d64de38f854b2 ]
We noticed some rare sk_buffs were stepping past the queue when system was under memory pressure. The general theory is to skip enqueueing sk_buffs when its not necessary which is the normal case with a system that is properly provisioned for the task, no memory pressure and enough cpu assigned.
But, if we can't allocate memory due to an ENOMEM error when enqueueing the sk_buff into the sockmap receive queue we push it onto a delayed workqueue to retry later. When a new sk_buff is received we then check if that queue is empty. However, there is a problem with simply checking the queue length. When a sk_buff is being processed from the ingress queue but not yet on the sockmap msg receive queue its possible to also recv a sk_buff through normal path. It will check the ingress queue which is zero and then skip ahead of the pkt being processed.
Previously we used sock lock from both contexts which made the problem harder to hit, but not impossible.
To fix instead of popping the skb from the queue entirely we peek the skb from the queue and do the copy there. This ensures checks to the queue length are non-zero while skb is being processed. Then finally when the entire skb has been copied to user space queue or another socket we pop it off the queue. This way the queue length check allows bypassing the queue only after the list has been completely processed.
To reproduce issue we run NGINX compliance test with sockmap running and observe some flakes in our testing that we attributed to this issue.
--- include/linux/skmsg.h | 1 - net/core/skmsg.c | 32 ++++++++------------------------ 2 files changed, 8 insertions(+), 25 deletions(-)
include/linux/skmsg.h +0 -1
@@ -73,7 +73,6 @@ struct sk_psock_link { };struct sk_psock_work_state { -struct sk_buff *skb;u32 len;u32 off; };
net/core/skmsg.c +8 -24
@@ -615,16 +615,12 @@ static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,static void sk_psock_skb_state (struct sk_psock *psock,struct sk_psock_work_state *state, -struct sk_buff *skb,int len,int off) {spin_lock_bh (&psock->ingress_lock);if (sk_psock_test_state (psock,SK_PSOCK_TX_ENABLED )) { - state->skb = skb; state->len = len; state->off = off; - }else { -sock_drop (psock->sk, skb); }spin_unlock_bh (&psock->ingress_lock); }
@@ -635,23 +631,17 @@ static void sk_psock_backlog(struct work_struct *work) struct sk_psock *psock = container_of(dwork, struct sk_psock, work);struct sk_psock_work_state *state = &psock->work_state;struct sk_buff *skb =NULL ; +u32 len =0 , off =0 ;bool ingress; -u32 len, off;int ret;mutex_lock (&psock->work_mutex); -if (unlikely (state->skb)) { -spin_lock_bh (&psock->ingress_lock); - skb = state->skb; +if (unlikely (state->len)) { len = state->len; off = state->off; - state->skb =NULL ; -spin_unlock_bh (&psock->ingress_lock); } -if (skb) - goto start; -while ((skb =skb_dequeue (&psock->ingress_skb))) { +while ((skb =skb_peek (&psock->ingress_skb))) { len = skb->len; off =0 ;if (skb_bpf_strparser (skb)) {
@@ -660,7 +650,6 @@ static void sk_psock_backlog(struct work_struct *work) off = stm->offset; len = stm->full_len; } -start: ingress =skb_bpf_ingress (skb);skb_bpf_redirect_clear (skb); do {
@@ -670,8 +659,7 @@ static void sk_psock_backlog(struct work_struct *work) len, ingress);if (ret <=0 ) {if (ret == -EAGAIN ) { -sk_psock_skb_state (psock, state, skb, - len, off); +sk_psock_skb_state (psock, state, len, off);/* Delay slightly to prioritize any * other work that might be here.
@@ -683,15 +671,16 @@ static void sk_psock_backlog(struct work_struct *work)/* Hard errors break pipe and stop xmit. */ sk_psock_report_error (psock, ret ? -ret :EPIPE );sk_psock_clear_state (psock,SK_PSOCK_TX_ENABLED ); -sock_drop (psock->sk, skb); goto end; } off += ret; len -= ret; }while (len); -if (!ingress) + skb =skb_dequeue (&psock->ingress_skb); +if (!ingress) {kfree_skb (skb); + } } end:mutex_unlock (&psock->work_mutex);
@@ -784,11 +773,6 @@ static void __sk_psock_zap_ingress(struct sk_psock *psock)skb_bpf_redirect_clear (skb);sock_drop (psock->sk, skb); } -kfree_skb (psock->work_state.skb); -/* We null the skb here to ensure that calls to sk_psock_backlog -* do not pick up the free'd skb. -*/ - psock->work_state.skb =NULL ;__sk_psock_purge_ingress_msg (psock); }
@@ -807,7 +791,6 @@ void sk_psock_stop(struct sk_psock *psock)spin_lock_bh (&psock->ingress_lock);sk_psock_clear_state (psock,SK_PSOCK_TX_ENABLED );sk_psock_cork_free (psock); -__sk_psock_zap_ingress (psock);spin_unlock_bh (&psock->ingress_lock); }
@@ -822,6 +805,7 @@ static void sk_psock_destroy(struct work_struct *work)sk_psock_done_strp (psock);cancel_delayed_work_sync (&psock->work); +__sk_psock_zap_ingress (psock);mutex_destroy (&psock->work_mutex);psock_progs_drop (&psock->progs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/168 ASoC: meson: axg-card: Fix nonatomic links
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit 0c9b152c72e53016e96593bdbb8cffe2176694b9 ]
This commit e138233e56e9829e65b6293887063a1a3ccb2d68 causes the following system crash when using audio on G12A/G12B & SM1 systems:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0 preempt_count: 10001, expected: 0 RCU nest depth: 0, expected: 0 Preemption disabled at: schedule_preempt_disabled+0x20/0x2c mutex_lock+0x24/0x60 _snd_pcm_stream_lock_irqsave+0x20/0x3c snd_pcm_period_elapsed+0x24/0xa4 axg_fifo_pcm_irq_block+0x64/0xdc __handle_irq_event_percpu+0x104/0x264 handle_irq_event+0x48/0xb4 ... start_kernel+0x3f0/0x484 __primary_switched+0xc0/0xc8
Revert this commit until the crash is fixed.
--- sound/soc/meson/axg-card.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/meson/axg-card.c +0 -1
@@ -320,7 +320,6 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, dai_link->cpus = cpu; dai_link->num_cpus =1 ; - dai_link->nonatomic = true; ret =meson_card_parse_dai (card, np, &dai_link->cpus->of_node, &dai_link->cpus->dai_name);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/168 ASoC: meson: axg-tdm-interface: Fix formatters in trigger"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <[email protected]>
[ Upstream commit c26830b6c5c534d273ce007eb33d5a2d2ad4e969 ]
This reverts commit bf5e4887eeddb48480568466536aa08ec7f179a5 because the following and required commit e138233e56e9829e65b6293887063a1a3ccb2d68 causes the following system crash when using audio:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282
--- sound/soc/meson/axg-tdm-interface.c | 26 +++++--------------------- 1 file changed, 5 insertions(+), 21 deletions(-)
sound/soc/meson/axg-tdm-interface.c +5 -21
@@ -362,29 +362,13 @@ static int axg_tdm_iface_hw_free(struct snd_pcm_substream *substream,return 0 ; } -static int axg_tdm_iface_trigger (struct snd_pcm_substream *substream, -int cmd, +static int axg_tdm_iface_prepare (struct snd_pcm_substream *substream,struct snd_soc_dai *dai) { -struct axg_tdm_stream *ts = -snd_soc_dai_get_dma_data (dai, substream); - -switch (cmd) { -case SNDRV_PCM_TRIGGER_START : -case SNDRV_PCM_TRIGGER_RESUME : -case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : -axg_tdm_stream_start (ts); -break ; -case SNDRV_PCM_TRIGGER_SUSPEND : -case SNDRV_PCM_TRIGGER_PAUSE_PUSH : -case SNDRV_PCM_TRIGGER_STOP : -axg_tdm_stream_stop (ts); -break ; -default : -return -EINVAL ; - } +struct axg_tdm_stream *ts =snd_soc_dai_get_dma_data (dai, substream); -return 0 ; +/* Force all attached formatters to update */ +return axg_tdm_stream_reset (ts); }static int axg_tdm_iface_remove_dai (struct snd_soc_dai *dai)
@@ -424,8 +408,8 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { .set_fmt = axg_tdm_iface_set_fmt, .startup = axg_tdm_iface_startup, .hw_params = axg_tdm_iface_hw_params, + .prepare = axg_tdm_iface_prepare, .hw_free = axg_tdm_iface_hw_free, - .trigger = axg_tdm_iface_trigger, };/* TDM Backend DAIs */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/168 qibfs: fix dentry leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit aa23317d0268b309bb3f0801ddd0d61813ff5afb ]
simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput().
--- drivers/infiniband/hw/qib/qib_fs.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/hw/qib/qib_fs.c +1 -0
@@ -441,6 +441,7 @@ static int remove_device_files(struct super_block *sb,return PTR_ERR (dir); }simple_recursive_removal (dir,NULL ); +dput (dir);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/168 xfrm: Preserve vlan tags for transport mode software GRO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Davey <[email protected]>
[ Upstream commit 58fbfecab965014b6e3cc956a76b4a96265a1add ]
The software GRO path for esp transport mode uses skb_mac_header_rebuild prior to re-injecting the packet via the xfrm_napi_dev. This only copies skb->mac_len bytes of header which may not be sufficient if the packet contains 802.1Q tags or other VLAN tags. Worse copying only the initial header will leave a packet marked as being VLAN tagged but without the corresponding tag leading to mangling when it is later untagged.
The VLAN tags are important when receiving the decrypted esp transport mode packet after GRO processing to ensure it is received on the correct interface.
Therefore record the full mac header length in xfrm*_transport_input for later use in corresponding xfrm*_transport_finish to copy the entire mac header when rebuilding the mac header for GRO. The skb->data pointer is left pointing skb->mac_header bytes after the start of the mac header as is expected by the network stack and network and transport header offsets reset to this location.
--- include/linux/skbuff.h | 15 +++++++++++++++ include/net/xfrm.h | 3 +++ net/ipv4/xfrm4_input.c | 6 +++++- net/ipv6/xfrm6_input.c | 6 +++++- net/xfrm/xfrm_input.c | 8 ++++++++ 5 files changed, 36 insertions(+), 2 deletions(-)
include/linux/skbuff.h +15 -0
@@ -2735,6 +2735,21 @@ static inline void skb_mac_header_rebuild(struct sk_buff *skb) } } +/* Move the full mac header up to current network_header. +* Leaves skb->data pointing at offset skb->mac_len into the mac_header. +* Must be provided the complete mac header length. +*/ +static inline void skb_mac_header_rebuild_full (struct sk_buff *skb,u32 full_mac_len) +{ +if (skb_mac_header_was_set (skb)) { +const unsigned char *old_mac =skb_mac_header (skb); + +skb_set_mac_header (skb, -full_mac_len); +memmove (skb_mac_header (skb), old_mac, full_mac_len); +__skb_push (skb, full_mac_len - skb->mac_len); + } +} +static inline int skb_checksum_start_offset (const struct sk_buff *skb) {return skb->csum_start -skb_headroom (skb);
include/net/xfrm.h +3 -0
@@ -1019,6 +1019,9 @@ struct xfrm_offload {#define CRYPTO_INVALID_PACKET_SYNTAX 64#define CRYPTO_INVALID_PROTOCOL 128 +/* Used to keep whole l2 header for transport mode GRO */ +__u32 orig_mac_len; +__u8 proto;__u8 inner_ipproto; };
net/ipv4/xfrm4_input.c +5 -1
@@ -61,7 +61,11 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)ip_send_check (iph);if (xo && (xo->flags &XFRM_GRO )) { -skb_mac_header_rebuild (skb); +/* The full l2 header needs to be preserved so that re-injecting the packet at l2 +* works correctly in the presence of vlan tags. +*/ +skb_mac_header_rebuild_full (skb, xo->orig_mac_len); +skb_reset_network_header (skb);skb_reset_transport_header (skb);return 0 ; }
net/ipv6/xfrm6_input.c +5 -1
@@ -56,7 +56,11 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)skb_postpush_rcsum (skb,skb_network_header (skb), nhlen);if (xo && (xo->flags &XFRM_GRO )) { -skb_mac_header_rebuild (skb); +/* The full l2 header needs to be preserved so that re-injecting the packet at l2 +* works correctly in the presence of vlan tags. +*/ +skb_mac_header_rebuild_full (skb, xo->orig_mac_len); +skb_reset_network_header (skb);skb_reset_transport_header (skb);return 0 ; }
net/xfrm/xfrm_input.c +8 -0
@@ -400,11 +400,15 @@ static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)*/ static int xfrm4_transport_input (struct xfrm_state *x,struct sk_buff *skb) { +struct xfrm_offload *xo =xfrm_offload (skb);int ihl = skb->data -skb_transport_header (skb);if (skb->transport_header != skb->network_header) {memmove (skb_transport_header (skb),skb_network_header (skb), ihl); +if (xo) + xo->orig_mac_len = +skb_mac_header_was_set (skb) ?skb_mac_header_len (skb) :0 ; skb->network_header = skb->transport_header; }ip_hdr (skb)->tot_len =htons (skb->len + ihl);
@@ -415,11 +419,15 @@ static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)static int xfrm6_transport_input (struct xfrm_state *x,struct sk_buff *skb) {#if IS_ENABLED (CONFIG_IPV6 ) +struct xfrm_offload *xo =xfrm_offload (skb);int ihl = skb->data -skb_transport_header (skb);if (skb->transport_header != skb->network_header) {memmove (skb_transport_header (skb),skb_network_header (skb), ihl); +if (xo) + xo->orig_mac_len = +skb_mac_header_was_set (skb) ?skb_mac_header_len (skb) :0 ; skb->network_header = skb->transport_header; } ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/168 tools/power turbostat: Fix Bzy_MHz documentation typo
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0b13410b52c4636aacb6964a4253a797c0fa0d16 ]
The code calculates Bzy_MHz by multiplying TSC_delta * APERF_delta/MPERF_delta The man page erroneously showed that TSC_delta was divided.
--- tools/power/x86/turbostat/turbostat.8 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.8 +1 -1
@@ -322,7 +322,7 @@ below the processor's base frequency. Busy% = MPERF_delta/TSC_delta -Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval +Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval Note that these calculations depend on TSC_delta, so they are not reliable during intervals when TSC_MHz is not running at the base frequency.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/168 ARM: 9381/1: kasan: clear stale stack poison
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boy.Wu <[email protected]>
[ Upstream commit c4238686f9093b98bd6245a348bcf059cdce23af ]
We found below OOB crash:
[ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [ 33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [ 33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset 112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw: 00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] ==================================================================
We find the root cause of this OOB is that arm does not clear stale stack poison in the case of cpuidle.
This patch refer to arch/arm64/kernel/sleep.S to resolve this issue.
Quoted 1 line
From cited commit [1] that explain the problem
Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning.
In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned.
If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in __cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel.
Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console.
To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online.
Quoted 1 line
From cited commit [2]
Extend to check for CONFIG_KASAN_STACK
[1] commit 0d97e6d8024c ("arm64: kasan: clear stale stack poison")
[2] commit d56a9ef84bd0 ("kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK")
--- arch/arm/kernel/sleep.S | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/kernel/sleep.S +4 -0
@@ -114,6 +114,10 @@ ENDPROC(cpu_resume_mmu) .popsection cpu_resume_after_mmu: bl cpu_init @ restore the und/abt/irq banked regs +#if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK) + mov r0, sp + bl kasan_unpoison_task_stack_below +#endif mov r0, #0 @ return zero on success ldmfd sp!, {r4 - r11, pc} ENDPROC(cpu_resume_after_mmu)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/168 tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 94062790aedb505bdda209b10bea47b294d6394f ]
TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers.
In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust()
A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called.
TCP_CLOSEconnect()
TCP_SYN_SENT
TCP_SYN_RECVshutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN)
TCP_FIN_WAIT1
To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway.
When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH, then look at sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state, and send a FIN packet from a sane socket state.
This means tcp_send_fin() can now be called from BH context, and must use GFP_ATOMIC allocations.
[1]
divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767 Code: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48 RSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246 RAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7 R10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30 R13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da FS: 00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0 Call Trace: <TASK> tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513 tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578 inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x109/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2803 ___sys_recvmsg net/socket.c:2845 [inline] do_recvmmsg+0x474/0xae0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faeb6363db9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9 RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
--- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_input.c | 2 ++ net/ipv4/tcp_output.c | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-)
net/ipv4/tcp.c +2 -2
@@ -2692,7 +2692,7 @@ void tcp_shutdown(struct sock *sk, int h/* If we've already sent a FIN, or it's a closed state, skip this. */ if ((1 << sk->sk_state) & (TCPF_ESTABLISHED |TCPF_SYN_SENT | -TCPF_SYN_RECV |TCPF_CLOSE_WAIT )) { +TCPF_CLOSE_WAIT )) {/* Clear out any half completed packets. FIN if needed. */ if (tcp_close_state (sk))tcp_send_fin (sk);
@@ -2803,7 +2803,7 @@ void __tcp_close(struct sock *sk, long t* machine. State transitions: * * TCP_ESTABLISHED -> TCP_FIN_WAIT1 -* TCP_SYN_RECV -> TCP_FIN_WAIT1 (forget it, it's impossible) +* TCP_SYN_RECV -> TCP_FIN_WAIT1 (it is difficult) * TCP_CLOSE_WAIT -> TCP_LAST_ACK * * are legal only when FIN has been sent (i.e. in window),
net/ipv4/tcp_input.c +2 -0
@@ -6543,6 +6543,8 @@ int tcp_rcv_state_process(struct sock *stcp_initialize_rcv_mss (sk);tcp_fast_path_on (tp); +if (sk->sk_shutdown &SEND_SHUTDOWN ) +tcp_shutdown (sk,SEND_SHUTDOWN );break ;case TCP_FIN_WAIT1 : {
net/ipv4/tcp_output.c +3 -1
@@ -3441,7 +3441,9 @@ void tcp_send_fin(struct sock *sk)return ; } }else { - skb =alloc_skb_fclone (MAX_TCP_HEADER , sk->sk_allocation); + skb =alloc_skb_fclone (MAX_TCP_HEADER , +sk_gfp_mask (sk,GFP_ATOMIC | + __GFP_NOWARN));if (unlikely (!skb))return ;
Greg Kroah-Hartman
maintainerPATCH 106/168 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit f2db7230f73a80dbb179deab78f88a7947f0ab7e ]
Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis.
Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock.
Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt.
If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else.
To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false.
[0]:refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027 RDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0 RBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0 R10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84 R13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0 FS: 00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> ? refcount_warn_saturate+0xe5/0x110 ? __warn+0x81/0x130 ? refcount_warn_saturate+0xe5/0x110 ? report_bug+0x171/0x1a0 ? refcount_warn_saturate+0xe5/0x110 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? refcount_warn_saturate+0xe5/0x110 tcp_twsk_unique+0x186/0x190 __inet_check_established+0x176/0x2d0 __inet_hash_connect+0x74/0x7d0 ? __pfx___inet_check_established+0x10/0x10 tcp_v4_connect+0x278/0x530 __inet_stream_connect+0x10f/0x3d0 inet_stream_connect+0x3a/0x60 __sys_connect+0xa8/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x83/0x170 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7f62c11a885d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d RDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003 RBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0 R13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0 </TASK>
--- net/ipv4/tcp_ipv4.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/ipv4/tcp_ipv4.c +7 -1
@@ -153,6 +153,12 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)if (tcptw->tw_ts_recent_stamp && (!twp || (reuse &&time_after32 (ktime_get_seconds (), tcptw->tw_ts_recent_stamp)))) { +/* inet_twsk_hashdance() sets sk_refcnt after putting twsk +* and releasing the bucket lock. +*/ +if (unlikely (!refcount_inc_not_zero (&sktw->sk_refcnt))) +return 0 ; +/* In case of repair and re-using TIME-WAIT sockets we still * want to be sure that it is safe as above but honor the * sequence numbers and time stamps set as part of the repair
@@ -173,7 +179,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) tp->rx_opt.ts_recent = tcptw->tw_ts_recent; tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; } -sock_hold (sktw); +return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/168 Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 483bc08181827fc475643272ffb69c533007e546 ]
When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below:
Cleanup Thread | Worker Thread
sco_sock_release |
sco_sock_close |
__sco_sock_close |
sco_sock_set_timer |
schedule_delayed_work |
sco_sock_kill | (wait a time)
sock_put(sk) //FREE | sco_sock_timeout
| sock_hold(sk) //USEThe KASAN report triggered by POC is shown below:
[ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] anon flags: 0x100000000000840(slab|head|node=0|zone=1) [ 95.890755] page_type: 0xffffffff() [ 95.890755] raw: 0100000000000840 ffff888006842dc0 0000000000000000 0000000000000001 [ 95.890755] raw: ffff88800c38a800 000000000010000a 00000001ffffffff 0000000000000000 [ 95.890755] head: 0100000000000840 ffff888006842dc0 0000000000000000 0000000000000001 [ 95.890755] head: ffff88800c38a800 000000000010000a 00000001ffffffff 0000000000000000 [ 95.890755] head: 0100000000000003 ffffea000030e201 ffffea000030e248 00000000ffffffff [ 95.890755] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 95.890755] page dumped because: kasan: bad access detected [ 95.890755] [ 95.890755] Memory state around the buggy address: [ 95.890755] ffff88800c387f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.890755] ffff88800c388000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] >ffff88800c388080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ^ [ 95.890755] ffff88800c388100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ffff88800c388180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ==================================================================
Fix this problem by adding a check protected by sco_conn_lock to judget whether the conn->hcon is null. Because the conn->hcon will be set to null, when the sock is releasing.
--- net/bluetooth/sco.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/sco.c +4 -0
@@ -83,6 +83,10 @@ static void sco_sock_timeout(struct work_struct *work)struct sock *sk;sco_conn_lock (conn); +if (!conn->hcon) { +sco_conn_unlock (conn); +return ; + } sk = conn->sk;if (sk)sock_hold (sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/168 btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 3c6f0c5ecc8910d4ffb0dfe85609ebc0c91c8f34 ]
Currently, this call site in btrfs_clear_delalloc_extent() only converts the reservation. We are marking it not delalloc, so I don't think it makes sense to keep the rsv around. This is a path where we are not sure to join a transaction, so it leads to incorrect free-ing during umount.
Helps with the pass rate of generic/269 and generic/475.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -2261,7 +2261,7 @@ void btrfs_clear_delalloc_extent(struct inode *vfs_inode,*/ if (*bits &EXTENT_CLEAR_META_RESV && root != fs_info->tree_root) -btrfs_delalloc_release_metadata (inode, len, false); +btrfs_delalloc_release_metadata (inode, len, true);/* For sanity tests. */ if (btrfs_is_testing (fs_info))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/168 btrfs: always clear PERTRANS metadata during commit
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 6e68de0bb0ed59e0554a0c15ede7308c47351e2d ]
It is possible to clear a root's IN_TRANS tag from the radix tree, but not clear its PERTRANS, if there is some error in between. Eliminate that possibility by moving the free up to where we clear the tag.
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1424,6 +1424,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)radix_tree_tag_clear (&fs_info->fs_roots_radix, (unsigned long )root->root_key.objectid,BTRFS_ROOT_TRANS_TAG ); +btrfs_qgroup_free_meta_all_pertrans (root);spin_unlock (&fs_info->fs_roots_radix_lock);btrfs_free_log (trans, root);
@@ -1448,7 +1449,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)if (ret2)return ret2;spin_lock (&fs_info->fs_roots_radix_lock); -btrfs_qgroup_free_meta_all_pertrans (root); } }spin_unlock (&fs_info->fs_roots_radix_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/168 scsi: target: Fix SELinux error when systemd-modules loads the target module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ]
If the systemd-modules service loads the target module, the credentials of that userspace process will be used to validate the access to the target db directory. SELinux will prevent it, reporting an error like the following:
kernel: audit: type=1400 audit(1676301082.205:4): avc: denied { read } for pid=1020 comm="systemd-modules" name="target" dev="dm-3" ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0
Fix the error by using the kernel credentials to access the db directory
--- drivers/target/target_core_configfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/target/target_core_configfs.c +12 -0
@@ -3566,6 +3566,8 @@ static int __init target_core_init_configfs(void) {struct configfs_subsystem *subsys = &target_core_fabrics;struct t10_alua_lu_gp *lu_gp; +struct cred *kern_cred; +const struct cred *old_cred;int ret; pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@@ -3642,11 +3644,21 @@ static int __init target_core_init_configfs(void)if (ret <0 ) goto out; +/* We use the kernel credentials to access the target directory */ + kern_cred =prepare_kernel_cred (&init_task); +if (!kern_cred) { + ret = -ENOMEM ; + goto out; + } + old_cred =override_creds (kern_cred);target_init_dbroot (); +revert_creds (old_cred); +put_cred (kern_cred);return 0 ; out: +target_xcopy_release_pt ();configfs_unregister_subsystem (subsys);core_dev_release_virtual_lun0 ();rd_module_exit ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/168 blk-iocost: avoid out of bounds shift
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit beaa51b36012fad5a4d3c18b88a617aea7a9b96d ]
UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures.
[ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace: <IRQ> dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250
...
Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large.
I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug.
--- block/blk-iocost.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
block/blk-iocost.c +4 -3
@@ -1336,7 +1336,7 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) {struct ioc *ioc = iocg->ioc;struct blkcg_gq *blkg =iocg_to_blkg (iocg); -u64 tdelta, delay, new_delay; +u64 tdelta, delay, new_delay, shift;s64 vover, vover_pct;u32 hwa;
@@ -1351,8 +1351,9 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now)/* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; -if (iocg->delay) - delay = iocg->delay >>div64_u64 (tdelta,USEC_PER_SEC ); + shift =div64_u64 (tdelta,USEC_PER_SEC ); +if (iocg->delay && shift <BITS_PER_LONG ) + delay = iocg->delay >> shift;else delay =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/168 gpu: host1x: Do not setup DMA for virtual devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thierry Reding <[email protected]>
[ Upstream commit 8ab58f6841b19423231c5db3378691ec80c778f8 ]
The host1x devices are virtual compound devices and do not perform DMA accesses themselves, so they do not need to be set up for DMA.
Ideally we would also not need to set up DMA masks for the virtual devices, but we currently still need those for legacy support on old hardware.
--- drivers/gpu/host1x/bus.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/gpu/host1x/bus.c +0 -8
@@ -367,11 +367,6 @@ static int host1x_device_uevent(struct device *dev,return 0 ; } -static int host1x_dma_configure (struct device *dev) -{ -return of_dma_configure (dev, dev->of_node, true); -} -static const struct dev_pm_ops host1x_device_pm_ops = { .suspend = pm_generic_suspend, .resume = pm_generic_resume,
@@ -385,7 +380,6 @@ struct bus_type host1x_bus_type = { .name = "host1x", .match = host1x_device_match, .uevent = host1x_device_uevent, - .dma_configure = host1x_dma_configure, .pm = &host1x_device_pm_ops, };
@@ -474,8 +468,6 @@ static int host1x_device_add(struct host1x *host1x, device->dev.bus = &host1x_bus_type; device->dev.parent = host1x->dev; -of_dma_configure (&device->dev, host1x->dev->of_node, true); - device->dev.dma_parms = &device->dma_parms;dma_set_max_seg_size (&device->dev,UINT_MAX );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/168 MIPS: scall: Save thread_info.syscall unconditionally on entry
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
[ Upstream commit 4370b673ccf240bf7587b0cb8e6726a5ccaf1f17 ]
thread_info.syscall is used by syscall_get_nr to supply syscall nr over a thread stack frame.
Previously, thread_info.syscall is only saved at syscall_trace_enter when syscall tracing is enabled. However rest of the kernel code do expect syscall_get_nr to be available without syscall tracing. The previous design breaks collect_syscall.
Move saving process to syscall entry to fix it.
--- arch/mips/include/asm/ptrace.h | 2 +- arch/mips/kernel/asm-offsets.c | 1 + arch/mips/kernel/ptrace.c | 15 ++++++--------- arch/mips/kernel/scall32-o32.S | 23 +++++++++++++---------- arch/mips/kernel/scall64-n32.S | 3 ++- arch/mips/kernel/scall64-n64.S | 3 ++- arch/mips/kernel/scall64-o32.S | 33 +++++++++++++++++---------------- 7 files changed, 42 insertions(+), 38 deletions(-)
arch/mips/include/asm/ptrace.h +1 -1
@@ -157,7 +157,7 @@ static inline long regs_return_value(struct pt_regs *regs)#define instruction_pointer (regs) ((regs)->cp0_epc)#define profile_pc (regs) instruction_pointer(regs) -extern asmlinkage long syscall_trace_enter (struct pt_regs *regs,long syscall); +extern asmlinkage long syscall_trace_enter (struct pt_regs *regs); extern asmlinkage void syscall_trace_leave(struct pt_regs *regs);extern void die (const char *,struct pt_regs *)__noreturn ;
arch/mips/kernel/asm-offsets.c +1 -0
@@ -98,6 +98,7 @@ void output_thread_info_defines(void)OFFSET (TI_CPU , thread_info, cpu);OFFSET (TI_PRE_COUNT , thread_info, preempt_count);OFFSET (TI_REGS , thread_info, regs); +OFFSET (TI_SYSCALL , thread_info, syscall);DEFINE (_THREAD_SIZE,THREAD_SIZE );DEFINE (_THREAD_MASK,THREAD_MASK );DEFINE (_IRQ_STACK_SIZE,IRQ_STACK_SIZE );
arch/mips/kernel/ptrace.c +6 -9
@@ -1310,16 +1310,13 @@ long arch_ptrace(struct task_struct *child, long request,* Notification of system call entry/exit * - triggered by current->work.syscall_trace */ -asmlinkage long syscall_trace_enter (struct pt_regs *regs,long syscall) +asmlinkage long syscall_trace_enter (struct pt_regs *regs) {user_exit (); -current_thread_info ()->syscall = syscall; -if (test_thread_flag (TIF_SYSCALL_TRACE )) {if (tracehook_report_syscall_entry (regs))return -1 ; - syscall =current_thread_info ()->syscall; }#ifdef CONFIG_SECCOMP
@@ -1328,7 +1325,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall)struct seccomp_data sd;unsigned long args[6 ]; - sd.nr = syscall; + sd.nr =current_thread_info ()->syscall; sd.arch =syscall_get_arch (current);syscall_get_arguments (current, regs, args);for (i =0 ; i <6 ; i++)
@@ -1338,23 +1335,23 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) ret =__secure_computing (&sd);if (ret ==-1 )return ret; - syscall = current_thread_info()->syscall; }#endif if (unlikely (test_thread_flag (TIF_SYSCALL_TRACEPOINT )))trace_sys_enter (regs, regs->regs[2 ]); -audit_syscall_entry (syscall, regs->regs[4 ], regs->regs[5 ], +audit_syscall_entry (current_thread_info ()->syscall, + regs->regs[4 ], regs->regs[5 ], regs->regs[6 ], regs->regs[7 ]);/* * Negative syscall numbers are mistaken for rejected syscalls, but * won't have had the return value set appropriately, so we do so now. */ -if (syscall <0 ) +if (current_thread_info ()->syscall <0 )syscall_set_return_value (current, regs, -ENOSYS ,0 ); -return syscall; +return current_thread_info ()->syscall; }/*
arch/mips/kernel/scall32-o32.S +13 -10
@@ -78,6 +78,18 @@ loads_done: PTR_WD load_a7, bad_stack_a7 .previous + /* + * syscall number is in v0 unless we called syscall(__NR_###) + * where the real syscall number is in a0 + */ + subu t2, v0, __NR_O32_Linux + bnez t2, 1f /* __NR_syscall at offset 0 */ + LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number + b 2f +1: + LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number +2: + lw t0, TI_FLAGS($28) # syscall tracing enabled? li t1, _TIF_WORK_SYSCALL_ENTRY and t0, t1
@@ -115,16 +127,7 @@ syscall_trace_entry: SAVE_STATIC move a0, sp - /* - * syscall number is in v0 unless we called syscall(__NR_###) - * where the real syscall number is in a0 - */ - move a1, v0 - subu t2, v0, __NR_O32_Linux - bnez t2, 1f /* __NR_syscall at offset 0 */ - lw a1, PT_R4(sp) - -1: jal syscall_trace_enter + jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-n32.S +2 -1
@@ -44,6 +44,8 @@ NESTED(handle_sysn32, PT_SIZE, sp) sd a3, PT_R26(sp) # save a3 for syscall restarting + LONG_S v0, TI_SYSCALL($28) # Store syscall number + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -72,7 +74,6 @@ syscall_common: n32_syscall_trace_entry: SAVE_STATIC move a0, sp - move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-n64.S +2 -1
@@ -47,6 +47,8 @@ NESTED(handle_sys64, PT_SIZE, sp) sd a3, PT_R26(sp) # save a3 for syscall restarting + LONG_S v0, TI_SYSCALL($28) # Store syscall number + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -83,7 +85,6 @@ n64_syscall_exit: syscall_trace_entry: SAVE_STATIC move a0, sp - move a1, v0 jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
arch/mips/kernel/scall64-o32.S +17 -16
@@ -79,6 +79,22 @@ loads_done: PTR_WD load_a7, bad_stack_a7 .previous + /* + * absolute syscall number is in v0 unless we called syscall(__NR_###) + * where the real syscall number is in a0 + * note: NR_syscall is the first O32 syscall but the macro is + * only defined when compiling with -mabi=32 (CONFIG_32BIT) + * therefore __NR_O32_Linux is used (4000) + */ + + subu t2, v0, __NR_O32_Linux + bnez t2, 1f /* __NR_syscall at offset 0 */ + LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number + b 2f +1: + LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number +2: + li t1, _TIF_WORK_SYSCALL_ENTRY LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? and t0, t1, t0
@@ -113,22 +129,7 @@ trace_a_syscall: sd a7, PT_R11(sp) # For indirect syscalls move a0, sp - /* - * absolute syscall number is in v0 unless we called syscall(__NR_###) - * where the real syscall number is in a0 - * note: NR_syscall is the first O32 syscall but the macro is - * only defined when compiling with -mabi=32 (CONFIG_32BIT) - * therefore __NR_O32_Linux is used (4000) - */ - .set push - .set reorder - subu t1, v0, __NR_O32_Linux - move a1, v0 - bnez t1, 1f /* __NR_syscall at offset 0 */ - ld a1, PT_R4(sp) /* Arg1 for __NR_syscall case */ - .set pop - -1: jal syscall_trace_enter + jal syscall_trace_enter bltz v0, 1f # seccomp failed? Skip syscall
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/168 ata: sata_gemini: Check clk_enable() result
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit e85006ae7430aef780cc4f0849692e266a102ec0 ]
The call to clk_enable() in gemini_sata_start_bridge() can fail. Add a check to detect such failure.
--- drivers/ata/sata_gemini.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/ata/sata_gemini.c +4 -1
@@ -201,7 +201,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge) pclk = sg->sata0_pclk; else pclk = sg->sata1_pclk; -clk_enable (pclk); + ret =clk_enable (pclk); +if (ret) +return ret; +msleep (10 );/* Do not keep clocking a bridge that is not online */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/168 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roded Zats <[email protected]>
[ Upstream commit 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489 ]
Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl.
--- net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/rtnetlink.c +1 -1
@@ -2383,7 +2383,7 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)nla_for_each_nested (attr, tb[IFLA_VF_VLAN_LIST ], rem) {if (nla_type (attr) !=IFLA_VF_VLAN_INFO || -nla_len (attr) <NLA_HDRLEN ) { +nla_len (attr) <sizeof (struct ifla_vf_vlan_info )) {return -EINVAL ; }if (len >=MAX_VLAN_LIST_LEN )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/168 net: hns3: add log for workqueue scheduled late
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yufeng Mo <[email protected]>
[ Upstream commit d9069dab207534d9f6f41993ee78a651733becea ]
When the mbx or reset message arrives, the driver is informed through an interrupt. This task can be processed only after the workqueue is scheduled. In some cases, this workqueue scheduling takes a long time. As a result, the mbx or reset service task cannot be processed in time. So add some warning message to improve debugging efficiency for this case.
Stable-dep-of: 669554c512d2 ("net: hns3: direct return when receive a unknown mailbox message")
--- .../net/ethernet/hisilicon/hns3/hclge_mbx.h | 3 +++ .../hisilicon/hns3/hns3pf/hclge_main.c | 22 +++++++++++++++++-- .../hisilicon/hns3/hns3pf/hclge_main.h | 2 ++ .../hisilicon/hns3/hns3pf/hclge_mbx.c | 8 +++++++ 4 files changed, 33 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +3 -0
@@ -80,6 +80,9 @@ enum hclge_mbx_tbl_cfg_subcode {#define HCLGE_MBX_MAX_RESP_DATA_SIZE 8U#define HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM 4 +#define HCLGE_RESET_SCHED_TIMEOUT (3 * HZ) +#define HCLGE_MBX_SCHED_TIMEOUT (HZ / 2) +struct hclge_ring_chain_param {u8 ring_type;u8 tqp_index;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +20 -2
@@ -2855,16 +2855,20 @@ static int hclge_mac_init(struct hclge_dev *hdev)static void hclge_mbx_task_schedule (struct hclge_dev *hdev) {if (!test_bit (HCLGE_STATE_REMOVING , &hdev->state) && - !test_and_set_bit (HCLGE_STATE_MBX_SERVICE_SCHED , &hdev->state)) + !test_and_set_bit (HCLGE_STATE_MBX_SERVICE_SCHED , &hdev->state)) { + hdev->last_mbx_scheduled = jiffies;mod_delayed_work (hclge_wq, &hdev->service_task,0 ); + } }static void hclge_reset_task_schedule (struct hclge_dev *hdev) {if (!test_bit (HCLGE_STATE_REMOVING , &hdev->state) &&test_bit (HCLGE_STATE_SERVICE_INITED , &hdev->state) && - !test_and_set_bit (HCLGE_STATE_RST_SERVICE_SCHED , &hdev->state)) + !test_and_set_bit (HCLGE_STATE_RST_SERVICE_SCHED , &hdev->state)) { + hdev->last_rst_scheduled = jiffies;mod_delayed_work (hclge_wq, &hdev->service_task,0 ); + } }static void hclge_errhand_task_schedule (struct hclge_dev *hdev)
@@ -3697,6 +3701,13 @@ static void hclge_mailbox_service_task(struct hclge_dev *hdev) test_and_set_bit(HCLGE_STATE_MBX_HANDLING, &hdev->state)) return; +if (time_is_before_jiffies (hdev->last_mbx_scheduled + +HCLGE_MBX_SCHED_TIMEOUT )) +dev_warn (&hdev->pdev->dev, +"mbx service task is scheduled after %ums on cpu%u!\n" , +jiffies_to_msecs (jiffies - hdev->last_mbx_scheduled), +smp_processor_id ()); +hclge_mbx_handler (hdev);clear_bit (HCLGE_STATE_MBX_HANDLING , &hdev->state);
@@ -4346,6 +4357,13 @@ static void hclge_reset_service_task(struct hclge_dev *hdev)if (!test_and_clear_bit (HCLGE_STATE_RST_SERVICE_SCHED , &hdev->state))return ; +if (time_is_before_jiffies (hdev->last_rst_scheduled + +HCLGE_RESET_SCHED_TIMEOUT )) +dev_warn (&hdev->pdev->dev, +"reset service task is scheduled after %ums on cpu%u!\n" , +jiffies_to_msecs (jiffies - hdev->last_rst_scheduled), +smp_processor_id ()); +down (&hdev->reset_sem);set_bit (HCLGE_STATE_RST_HANDLING , &hdev->state);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +2 -0
@@ -928,6 +928,8 @@ struct hclge_dev {u16 hclge_fd_rule_num;unsigned long serv_processed_cnt;unsigned long last_serv_processed; +unsigned long last_rst_scheduled; +unsigned long last_mbx_scheduled;unsigned long fd_bmap[BITS_TO_LONGS (MAX_FD_FILTER_NUM )];enum HCLGE_FD_ACTIVE_RULE_TYPE fd_active_type;u8 fd_en;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +8 -0
@@ -855,6 +855,14 @@ void hclge_mbx_handler(struct hclge_dev *hdev)if (hnae3_get_bit (req->mbx_need_resp,HCLGE_MBX_NEED_RESP_B ) && req->msg.code <HCLGE_MBX_GET_VF_FLR_STATUS ) { resp_msg.status = ret; +if (time_is_before_jiffies (hdev->last_mbx_scheduled + +HCLGE_MBX_SCHED_TIMEOUT )) +dev_warn (&hdev->pdev->dev, +"resp vport%u mbx(%u,%u) late\n" , + req->mbx_src_vfid, + req->msg.code, + req->msg.subcode); +hclge_gen_resp_to_vf (vport, req, &resp_msg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/168 net: hns3: add query vf ring and vector map relation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangbin Huang <[email protected]>
[ Upstream commit a1aed456e3261c0096e36618db9aa61d5974ad16 ]
This patch adds a new mailbox opcode to query map relation between vf ring and vector.
Stable-dep-of: 669554c512d2 ("net: hns3: direct return when receive a unknown mailbox message")
--- .../net/ethernet/hisilicon/hns3/hclge_mbx.h | 1 + .../hisilicon/hns3/hns3pf/hclge_mbx.c | 83 +++++++++++++++++++ 2 files changed, 84 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +1 -0
@@ -46,6 +46,7 @@ enum HCLGE_MBX_OPCODE {HCLGE_MBX_PUSH_PROMISC_INFO ,/* (PF -> VF) push vf promisc info */ HCLGE_MBX_VF_UNINIT ,/* (VF -> PF) vf is unintializing */ HCLGE_MBX_HANDLE_VF_TBL ,/* (VF -> PF) store/clear hw table */ +HCLGE_MBX_GET_RING_VECTOR_MAP ,/* (VF -> PF) get ring-to-vector map */ HCLGE_MBX_GET_VF_FLR_STATUS =200 ,/* (M7 -> PF) get vf flr status */ HCLGE_MBX_PUSH_LINK_STATUS, /* (M7 -> PF) get port link status */
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +83 -0
95 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/168 net: hns3: refactor function hclge_mbx_handler()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Lan <[email protected]>
[ Upstream commit 09431ed8de874881e2d5d430042d718ae074d371 ]
Currently, the function hclge_mbx_handler() has too many switch-case statements, it makes this function too long. To improve code readability, refactor this function and use lookup table instead.
Stable-dep-of: 669554c512d2 ("net: hns3: direct return when receive a unknown mailbox message")
--- .../net/ethernet/hisilicon/hns3/hclge_mbx.h | 11 + .../hisilicon/hns3/hns3pf/hclge_mbx.c | 415 ++++++++++++------ 2 files changed, 284 insertions(+), 142 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h +11 -0
@@ -212,6 +212,17 @@ struct hclgevf_mbx_arq_ring {__le16 msg_q[HCLGE_MBX_MAX_ARQ_MSG_NUM ][HCLGE_MBX_MAX_ARQ_MSG_SIZE ]; }; +struct hclge_dev ; + +#define HCLGE_MBX_OPCODE_MAX 256 +struct hclge_mbx_ops_param { +struct hclge_vport *vport; +struct hclge_mbx_vf_to_pf_cmd *req; +struct hclge_respond_to_vf_msg *resp_msg; +}; + +typedef int (*hclge_mbx_ops_fn )(struct hclge_mbx_ops_param *param); +#define hclge_mbx_ring_ptr_move_crq (crq) \ (crq->next_to_use = (crq->next_to_use + 1) % crq->desc_num)#define hclge_mbx_tail_ptr_move_arq (arq) \
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +273 -142
442 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/168 net: hns3: direct return when receive a unknown mailbox message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 669554c512d2107e2f21616f38e050d40655101f ]
Currently, the driver didn't return when receive a unknown mailbox message, and continue checking whether need to generate a response. It's unnecessary and may be incorrect.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +4 -3
@@ -1019,12 +1019,13 @@ static void hclge_mbx_request_handling(struct hclge_mbx_ops_param *param) hdev = param->vport->back; cmd_func = hclge_mbx_ops_list[param->req->msg.code]; -if (cmd_func) - ret =cmd_func (param); -else +if (!cmd_func) {dev_err (&hdev->pdev->dev,"un-supported mailbox message, code = %u\n" , param->req->msg.code); +return ; + } + ret =cmd_func (param);/* PF driver should not reply IMP */ if (hnae3_get_bit(param->req->mbx_need_resp, HCLGE_MBX_NEED_RESP_B) &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/168 net: hns3: refactor hns3 makefile to support hns3_common module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 5f20be4e90e603d8967962f81ac89307fd4f8af9 ]
Currently we plan to refactor PF and VF cmdq module. A new file folder hns3_common will be created to store new common APIs used by PF and VF cmdq module. Thus the PF and VF compilation process will both depends on the hns3_common. This may cause parallel building problems if we add a new makefile building unit.
So this patch combined the PF and VF makefile scripts to the top level makefile to support the new hns3_common which will be created in the next patch.
Stable-dep-of: 6639a7b95321 ("net: hns3: change type of numa_node_mask as nodemask_t")
--- drivers/net/ethernet/hisilicon/hns3/Makefile | 14 +++++++++++--- .../net/ethernet/hisilicon/hns3/hns3pf/Makefile | 12 ------------ .../net/ethernet/hisilicon/hns3/hns3vf/Makefile | 10 ---------- 3 files changed, 11 insertions(+), 25 deletions(-) delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
drivers/net/ethernet/hisilicon/hns3/Makefile +11 -3
@@ -4,9 +4,8 @@ # ccflags-y += -I$(srctree)/$(src) - -obj-$(CONFIG_HNS3) += hns3pf/ -obj-$(CONFIG_HNS3) += hns3vf/ +ccflags-y += -I$(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3pf +ccflags-y += -I$(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3vf obj-$(CONFIG_HNS3) += hnae3.o
@@ -14,3 +13,12 @@ obj-$(CONFIG_HNS3_ENET) += hns3.o hns3-objs = hns3_enet.o hns3_ethtool.o hns3_debugfs.o hns3-$(CONFIG_HNS3_DCB) += hns3_dcbnl.o + +obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o +hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_cmd.o hns3vf/hclgevf_mbx.o hns3vf/hclgevf_devlink.o + +obj-$(CONFIG_HNS3_HCLGE) += hclge.o +hclge-objs = hns3pf/hclge_main.o hns3pf/hclge_cmd.o hns3pf/hclge_mdio.o hns3pf/hclge_tm.o \ + hns3pf/hclge_mbx.o hns3pf/hclge_err.o hns3pf/hclge_debugfs.o hns3pf/hclge_ptp.o hns3pf/hclge_devlink.o + +hclge-$(CONFIG_HNS3_DCB) += hns3pf/hclge_dcb.o
drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile deleted +0 -12
@@ -1,12 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0+ -# -# Makefile for the HISILICON network device drivers. -# - -ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3 -ccflags-y += -I $(srctree)/$(src) - -obj-$(CONFIG_HNS3_HCLGE) += hclge.o -hclge-objs = hclge_main.o hclge_cmd.o hclge_mdio.o hclge_tm.o hclge_mbx.o hclge_err.o hclge_debugfs.o hclge_ptp.o hclge_devlink.o - -hclge-$(CONFIG_HNS3_DCB) += hclge_dcb.o
drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile deleted +0 -10
@@ -1,10 +0,0 @@ -# SPDX-License-Identifier: GPL-2.0+ -# -# Makefile for the HISILICON network device drivers. -# - -ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3 -ccflags-y += -I $(srctree)/$(src) - -obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o -hclgevf-objs = hclgevf_main.o hclgevf_cmd.o hclgevf_mbx.o hclgevf_devlink.o
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/168 net: hns3: create new cmdq hardware description structure hclge_comm_hw
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 0a7b6d221868be6aa3249c70ffab707a265b89d6 ]
Currently PF and VF cmdq APIs use struct hclge(vf)_hw to describe cmdq hardware information needed by hclge(vf)_cmd_send. There are a little differences between its child struct hclge_cmq_ring and hclgevf_cmq_ring. It is redundent to use two sets of structures to support same functions.
So this patch creates new set of common cmdq hardware description structures(hclge_comm_hw) to unify PF and VF cmdq functions. The struct hclge_desc is still kept to avoid too many meaningless replacement.
These new structures will be used to unify hclge(vf)_hw structures in PF and VF cmdq APIs in next patches.
Stable-dep-of: 6639a7b95321 ("net: hns3: change type of numa_node_mask as nodemask_t")
--- drivers/net/ethernet/hisilicon/hns3/Makefile | 1 + .../hns3/hns3_common/hclge_comm_cmd.h | 55 +++++++++++++++++++ .../hisilicon/hns3/hns3pf/hclge_cmd.h | 9 +-- 3 files changed, 57 insertions(+), 8 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h
drivers/net/ethernet/hisilicon/hns3/Makefile +1 -0
@@ -6,6 +6,7 @@ ccflags-y += -I$(srctree)/$(src) ccflags-y += -I$(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3pf ccflags-y += -I$(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3vf +ccflags-y += -I$(srctree)/drivers/net/ethernet/hisilicon/hns3/hns3_common obj-$(CONFIG_HNS3) += hnae3.o
drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h new file +55 -0
55 lines not on this page · raw message
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +1 -8
@@ -7,24 +7,17 @@#include <linux/io.h> #include <linux/etherdevice.h> #include "hnae3.h" +#include "hclge_comm_cmd.h" #define HCLGE_CMDQ_TX_TIMEOUT 30000#define HCLGE_CMDQ_CLEAR_WAIT_TIME 200#define HCLGE_DESC_DATA_LEN 6struct hclge_dev ; -struct hclge_desc { -__le16 opcode;#define HCLGE_CMDQ_RX_INVLD_B 0#define HCLGE_CMDQ_RX_OUTVLD_B 1 -__le16 flag; -__le16 retval; -__le16 rsv; -__le32 data[HCLGE_DESC_DATA_LEN ]; -}; -struct hclge_cmq_ring {dma_addr_t desc_dma_addr;struct hclge_desc *desc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/168 net: hns3: create new set of unified hclge_comm_cmd_send APIs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 8d307f8e8cf195921b10939dde673f1f039bd732 ]
This patch create new set of unified hclge_comm_cmd_send APIs for PF and VF cmdq module. Subfunctions called by hclge_comm_cmd_send are also created include cmdq result check, cmdq return code conversion and ring space opertaion APIs.
These new common cmdq APIs will be used to replace the old PF and VF cmdq APIs in next patches.
Stable-dep-of: 6639a7b95321 ("net: hns3: change type of numa_node_mask as nodemask_t")
--- .../hns3/hns3_common/hclge_comm_cmd.c | 259 ++++++++++++++++++ .../hns3/hns3_common/hclge_comm_cmd.h | 66 +++++ 2 files changed, 325 insertions(+) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c
drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c new file +259 -0
@@ -0,0 +1,259 @@ +// SPDX-License-Identifier: GPL-2.0+ +// Copyright (c) 2021-2021 Hisilicon Limited. + +#include "hnae3.h" +#include "hclge_comm_cmd.h" + +static bool hclge_is_elem_in_array (const u16 *spec_opcode,u32 size,u16 opcode) +{ +u32 i; + +for (i =0 ; i < size; i++) { +if (spec_opcode[i] == opcode) +return true; + } + +return false; +} + +static const u16 pf_spec_opcode[] = {HCLGE_COMM_OPC_STATS_64_BIT , +HCLGE_COMM_OPC_STATS_32_BIT , +HCLGE_COMM_OPC_STATS_MAC , +HCLGE_COMM_OPC_STATS_MAC_ALL , +HCLGE_COMM_OPC_QUERY_32_BIT_REG , +HCLGE_COMM_OPC_QUERY_64_BIT_REG , +HCLGE_COMM_QUERY_CLEAR_MPF_RAS_INT , +HCLGE_COMM_QUERY_CLEAR_PF_RAS_INT , +HCLGE_COMM_QUERY_CLEAR_ALL_MPF_MSIX_INT , +HCLGE_COMM_QUERY_CLEAR_ALL_PF_MSIX_INT , +HCLGE_COMM_QUERY_ALL_ERR_INFO }; + +static const u16 vf_spec_opcode[] = {HCLGE_COMM_OPC_STATS_64_BIT , +HCLGE_COMM_OPC_STATS_32_BIT , +HCLGE_COMM_OPC_STATS_MAC }; + +static bool hclge_comm_is_special_opcode (u16 opcode,bool is_pf) +{ +/* these commands have several descriptors, +* and use the first one to save opcode and return value +*/ +const u16 *spec_opcode = is_pf ? pf_spec_opcode : vf_spec_opcode; +u32 size = is_pf ?ARRAY_SIZE (pf_spec_opcode) : +ARRAY_SIZE (vf_spec_opcode); + +return hclge_is_elem_in_array (spec_opcode, size, opcode); +} + +static int hclge_comm_ring_space (struct hclge_comm_cmq_ring *ring) +{ +int ntc = ring->next_to_clean; +int ntu = ring->next_to_use; +int used = (ntu - ntc + ring->desc_num) % ring->desc_num; + +return ring->desc_num - used -1 ; +} + +static void hclge_comm_cmd_copy_desc (struct hclge_comm_hw *hw, +struct hclge_desc *desc,int num) +{ +struct hclge_desc *desc_to_use; +int handle =0 ; + +while (handle < num) { + desc_to_use = &hw->cmq.csq.desc[hw->cmq.csq.next_to_use]; + *desc_to_use = desc[handle]; + (hw->cmq.csq.next_to_use)++; +if (hw->cmq.csq.next_to_use >= hw->cmq.csq.desc_num) + hw->cmq.csq.next_to_use =0 ; + handle++; + } +} + +static int hclge_comm_is_valid_csq_clean_head (struct hclge_comm_cmq_ring *ring, +int head) +{ +int ntc = ring->next_to_clean; +int ntu = ring->next_to_use; + +if (ntu > ntc) +return head >= ntc && head <= ntu; + +return head >= ntc || head <= ntu; +} + +static int hclge_comm_cmd_csq_clean (struct hclge_comm_hw *hw) +{ +struct hclge_comm_cmq_ring *csq = &hw->cmq.csq; +int clean; +u32 head; + + head =hclge_comm_read_dev (hw,HCLGE_COMM_NIC_CSQ_HEAD_REG ); +rmb ();/* Make sure head is ready before touch any data */ + +if (!hclge_comm_is_valid_csq_clean_head (csq, head)) { +dev_warn (&hw->cmq.csq.pdev->dev,"wrong cmd head (%u, %d-%d)\n" , + head, csq->next_to_use, csq->next_to_clean); +dev_warn (&hw->cmq.csq.pdev->dev, +"Disabling any further commands to IMP firmware\n" ); +set_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hw->comm_state); +dev_warn (&hw->cmq.csq.pdev->dev, +"IMP firmware watchdog reset soon expected!\n" ); +return -EIO ; + } + + clean = (head - csq->next_to_clean + csq->desc_num) % csq->desc_num; + csq->next_to_clean = head; +return clean; +} + +static int hclge_comm_cmd_csq_done (struct hclge_comm_hw *hw) +{ +u32 head =hclge_comm_read_dev (hw,HCLGE_COMM_NIC_CSQ_HEAD_REG ); +return head == hw->cmq.csq.next_to_use; +} + +static void hclge_comm_wait_for_resp (struct hclge_comm_hw *hw, +bool *is_completed) +{ +u32 timeout =0 ; + +do { +if (hclge_comm_cmd_csq_done (hw)) { + *is_completed = true; +break ; + } +udelay (1 ); + timeout++; + }while (timeout < hw->cmq.tx_timeout); +} + +static int hclge_comm_cmd_convert_err_code (u16 desc_ret) +{ +struct hclge_comm_errcode hclge_comm_cmd_errcode[] = { + {HCLGE_COMM_CMD_EXEC_SUCCESS ,0 }, + {HCLGE_COMM_CMD_NO_AUTH , -EPERM }, + {HCLGE_COMM_CMD_NOT_SUPPORTED , -EOPNOTSUPP }, + {HCLGE_COMM_CMD_QUEUE_FULL , -EXFULL }, + {HCLGE_COMM_CMD_NEXT_ERR , -ENOSR }, + {HCLGE_COMM_CMD_UNEXE_ERR , -ENOTBLK }, + {HCLGE_COMM_CMD_PARA_ERR , -EINVAL }, + {HCLGE_COMM_CMD_RESULT_ERR , -ERANGE }, + {HCLGE_COMM_CMD_TIMEOUT , -ETIME }, + {HCLGE_COMM_CMD_HILINK_ERR , -ENOLINK }, + {HCLGE_COMM_CMD_QUEUE_ILLEGAL , -ENXIO }, + {HCLGE_COMM_CMD_INVALID , -EBADR }, + }; +u32 errcode_count =ARRAY_SIZE (hclge_comm_cmd_errcode); +u32 i; + +for (i =0 ; i < errcode_count; i++) +if (hclge_comm_cmd_errcode[i].imp_errcode == desc_ret) +return hclge_comm_cmd_errcode[i].common_errno; + +return -EIO ; +} + +static int hclge_comm_cmd_check_retval (struct hclge_comm_hw *hw, +struct hclge_desc *desc,int num, +int ntc,bool is_pf) +{ +u16 opcode, desc_ret; +int handle; + + opcode =le16_to_cpu (desc[0 ].opcode); +for (handle =0 ; handle < num; handle++) { + desc[handle] = hw->cmq.csq.desc[ntc]; + ntc++; +if (ntc >= hw->cmq.csq.desc_num) + ntc =0 ; + } +if (likely (!hclge_comm_is_special_opcode (opcode, is_pf))) + desc_ret =le16_to_cpu (desc[num -1 ].retval); +else + desc_ret =le16_to_cpu (desc[0 ].retval); + + hw->cmq.last_status = desc_ret; + +return hclge_comm_cmd_convert_err_code (desc_ret); +} + +static int hclge_comm_cmd_check_result (struct hclge_comm_hw *hw, +struct hclge_desc *desc, +int num,int ntc,bool is_pf) +{ +bool is_completed = false; +int handle, ret; + +/* If the command is sync, wait for the firmware to write back, +* if multi descriptors to be sent, use the first one to check +*/ +if (HCLGE_COMM_SEND_SYNC (le16_to_cpu (desc->flag))) +hclge_comm_wait_for_resp (hw, &is_completed); + +if (!is_completed) + ret = -EBADE ; +else + ret =hclge_comm_cmd_check_retval (hw, desc, num, ntc, is_pf); + +/* Clean the command send queue */ + handle =hclge_comm_cmd_csq_clean (hw); +if (handle <0 ) + ret = handle; +else if (handle != num) +dev_warn (&hw->cmq.csq.pdev->dev, +"cleaned %d, need to clean %d\n" , handle, num); +return ret; +} + +/** +* hclge_comm_cmd_send - send command to command queue +* @hw: pointer to the hw struct +* @desc: prefilled descriptor for describing the command +* @num : the number of descriptors to be sent +* @is_pf: bool to judge pf/vf module +* +* This is the main send command for command queue, it +* sends the queue, cleans the queue, etc +**/ +int hclge_comm_cmd_send (struct hclge_comm_hw *hw,struct hclge_desc *desc, +int num,bool is_pf) +{ +struct hclge_comm_cmq_ring *csq = &hw->cmq.csq; +int ret; +int ntc; + +spin_lock_bh (&hw->cmq.csq.lock); + +if (test_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hw->comm_state)) { +spin_unlock_bh (&hw->cmq.csq.lock); +return -EBUSY ; + } + +if (num >hclge_comm_ring_space (&hw->cmq.csq)) { +/* If CMDQ ring is full, SW HEAD and HW HEAD may be different, +* need update the SW HEAD pointer csq->next_to_clean +*/ + csq->next_to_clean = +hclge_comm_read_dev (hw,HCLGE_COMM_NIC_CSQ_HEAD_REG ); +spin_unlock_bh (&hw->cmq.csq.lock); +return -EBUSY ; + } + +/** +* Record the location of desc in the ring for this time +* which will be use for hardware to write back +*/ + ntc = hw->cmq.csq.next_to_use; + +hclge_comm_cmd_copy_desc (hw, desc, num); + +/* Write to hardware */ +hclge_comm_write_dev (hw,HCLGE_COMM_NIC_CSQ_TAIL_REG , + hw->cmq.csq.next_to_use); + + ret =hclge_comm_cmd_check_result (hw, desc, num, ntc, is_pf); + +spin_unlock_bh (&hw->cmq.csq.lock); + +return ret; +}
drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h +66 -0
76 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/168 net: hns3: refactor hclge_cmd_send with new hclge_comm_cmd_send API
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit eaa5607db377a73e639162a459d8b125c6a67bfb ]
This patch firstly uses new hardware description struct hclge_comm_hw as child member of hclge_hw and deletes the original child memebers of hclge_hw. All the hclge_hw variables used in PF module is modified according to the new hclge_hw.
Secondly hclge_cmd_send is refactored to use hclge_comm_cmd_send APIs. The old functions called by hclge_cmd_send are deleted and hclge_cmd_send is kept to avoid too many meaningless modifications.
Stable-dep-of: 6639a7b95321 ("net: hns3: change type of numa_node_mask as nodemask_t")
--- drivers/net/ethernet/hisilicon/hns3/Makefile | 7 +- .../hisilicon/hns3/hns3pf/hclge_cmd.c | 311 +++--------------- .../hisilicon/hns3/hns3pf/hclge_cmd.h | 72 +--- .../hisilicon/hns3/hns3pf/hclge_main.c | 56 ++-- .../hisilicon/hns3/hns3pf/hclge_main.h | 10 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 11 +- .../hisilicon/hns3/hns3pf/hclge_mdio.c | 4 +- .../hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- 8 files changed, 100 insertions(+), 373 deletions(-)
drivers/net/ethernet/hisilicon/hns3/Makefile +5 -2
@@ -16,10 +16,13 @@ hns3-objs = hns3_enet.o hns3_ethtool.o hns3_debugfs.o hns3-$(CONFIG_HNS3_DCB) += hns3_dcbnl.o obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o -hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_cmd.o hns3vf/hclgevf_mbx.o hns3vf/hclgevf_devlink.o + +hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_cmd.o hns3vf/hclgevf_mbx.o hns3vf/hclgevf_devlink.o \ + hns3_common/hclge_comm_cmd.o obj-$(CONFIG_HNS3_HCLGE) += hclge.o hclge-objs = hns3pf/hclge_main.o hns3pf/hclge_cmd.o hns3pf/hclge_mdio.o hns3pf/hclge_tm.o \ - hns3pf/hclge_mbx.o hns3pf/hclge_err.o hns3pf/hclge_debugfs.o hns3pf/hclge_ptp.o hns3pf/hclge_devlink.o + hns3pf/hclge_mbx.o hns3pf/hclge_err.o hns3pf/hclge_debugfs.o hns3pf/hclge_ptp.o hns3pf/hclge_devlink.o \ + hns3_common/hclge_comm_cmd.o hclge-$(CONFIG_HNS3_DCB) += hns3pf/hclge_dcb.o
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +47 -264
415 lines not on this page · raw message
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +4 -68
102 lines not on this page · raw message
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +29 -27
177 lines not on this page · raw message
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +6 -4
@@ -228,7 +228,6 @@ enum HCLGE_DEV_STATE {HCLGE_STATE_MBX_HANDLING ,HCLGE_STATE_ERR_SERVICE_SCHED ,HCLGE_STATE_STATISTICS_UPDATING , -HCLGE_STATE_CMD_DISABLE ,HCLGE_STATE_LINK_UPDATING ,HCLGE_STATE_RST_FAIL , HCLGE_STATE_FD_TBL_CHANGED,
@@ -297,11 +296,9 @@ struct hclge_mac { };struct hclge_hw { -void __iomem *io_base; -void __iomem *mem_base; +struct hclge_comm_hw hw;struct hclge_mac mac;int num_vec; -struct hclge_cmq cmq; };/* TQP stats */
@@ -616,6 +613,11 @@ struct key_info {#define MAX_FD_FILTER_NUM 4096#define HCLGE_ARFS_EXPIRE_INTERVAL 5UL +#define hclge_read_dev (a, reg) \ + hclge_comm_read_reg((a)->hw.io_base, reg) +#define hclge_write_dev (a, reg, value) \ + hclge_comm_write_reg((a)->hw.io_base, reg, value) +enum HCLGE_FD_ACTIVE_RULE_TYPE {HCLGE_FD_RULE_NONE ,HCLGE_FD_ARFS_ACTIVE ,
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +6 -5
@@ -33,7 +33,7 @@ static int hclge_gen_resp_to_vf(struct hclge_vport *vport, {struct hclge_mbx_pf_to_vf_cmd *resp_pf_to_vf;struct hclge_dev *hdev = vport->back; -enum hclge_cmd_status status; +enum hclge_comm_cmd_status status;struct hclge_desc desc;u16 resp;
@@ -92,7 +92,7 @@ static int hclge_send_mbx_msg(struct hclge_vport *vport, u8 *msg, u16 msg_len, {struct hclge_mbx_pf_to_vf_cmd *resp_pf_to_vf;struct hclge_dev *hdev = vport->back; -enum hclge_cmd_status status; +enum hclge_comm_cmd_status status;struct hclge_desc desc;if (msg_len >HCLGE_MBX_MAX_MSG_SIZE ) {
@@ -745,7 +745,7 @@ static bool hclge_cmd_crq_empty(struct hclge_hw *hw) {u32 tail =hclge_read_dev (hw,HCLGE_NIC_CRQ_TAIL_REG ); -return tail == hw->cmq.crq.next_to_use; +return tail == hw->hw.cmq.crq.next_to_use; }static void hclge_handle_ncsi_error (struct hclge_dev *hdev)
@@ -1045,7 +1045,7 @@ static void hclge_mbx_request_handling(struct hclge_mbx_ops_param *param)void hclge_mbx_handler (struct hclge_dev *hdev) { -struct hclge_cmq_ring *crq = &hdev->hw.cmq.crq; +struct hclge_comm_cmq_ring *crq = &hdev->hw.hw.cmq.crq;struct hclge_respond_to_vf_msg resp_msg;struct hclge_mbx_vf_to_pf_cmd *req;struct hclge_mbx_ops_param param;
@@ -1055,7 +1055,8 @@ void hclge_mbx_handler(struct hclge_dev *hdev) param.resp_msg = &resp_msg;/* handle all the mailbox requests in the queue */ while (!hclge_cmd_crq_empty (&hdev->hw)) { -if (test_bit (HCLGE_STATE_CMD_DISABLE , &hdev->state)) { +if (test_bit (HCLGE_COMM_STATE_CMD_DISABLE , + &hdev->hw.hw.comm_state)) {dev_warn (&hdev->pdev->dev,"command queue needs re-initializing\n" );return ;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c +2 -2
@@ -47,7 +47,7 @@ static int hclge_mdio_write(struct mii_bus *bus, int phyid, int regnum,struct hclge_desc desc;int ret; -if (test_bit (HCLGE_STATE_CMD_DISABLE , &hdev->state)) +if (test_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state))return 0 ;hclge_cmd_setup_basic_desc (&desc,HCLGE_OPC_MDIO_CONFIG , false);
@@ -85,7 +85,7 @@ static int hclge_mdio_read(struct mii_bus *bus, int phyid, int regnum)struct hclge_desc desc;int ret; -if (test_bit (HCLGE_STATE_CMD_DISABLE , &hdev->state)) +if (test_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state))return 0 ;hclge_cmd_setup_basic_desc (&desc,HCLGE_OPC_MDIO_CONFIG , true);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +1 -1
@@ -464,7 +464,7 @@ static int hclge_ptp_create_clock(struct hclge_dev *hdev) }spin_lock_init (&ptp->lock); - ptp->io_base = hdev->hw.io_base +HCLGE_PTP_REG_OFFSET ; + ptp->io_base = hdev->hw.hw.io_base +HCLGE_PTP_REG_OFFSET ; ptp->ts_cfg.rx_filter =HWTSTAMP_FILTER_NONE ; ptp->ts_cfg.tx_type =HWTSTAMP_TX_OFF ; hdev->ptp = ptp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/168 net: hns3: change type of numa_node_mask as nodemask_t
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang Wang <[email protected]>
[ Upstream commit 6639a7b953212ac51aa4baa7d7fb855bf736cf56 ]
It provides nodemask_t to describe the numa node mask in kernel. To improve transportability, change the type of numa_node_mask as nodemask_t.
--- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++-- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 7 ++++--- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- 5 files changed, 11 insertions(+), 8 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hnae3.h +1 -1
@@ -829,7 +829,7 @@ struct hnae3_handle {struct hnae3_roce_private_info rinfo; }; -u32 numa_node_mask;/* for multi-chip support */ +nodemask_t numa_node_mask;/* for multi-chip support */ enum hnae3_port_base_vlan_state port_base_vlan_state;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +4 -2
@@ -1825,7 +1825,8 @@ static int hclge_vport_setup(struct hclge_vport *vport, u16 num_tqps) nic->pdev = hdev->pdev; nic->ae_algo = &ae_algo; - nic->numa_node_mask = hdev->numa_node_mask; +bitmap_copy (nic->numa_node_mask.bits, hdev->numa_node_mask.bits, +MAX_NUMNODES ); nic->kinfo.io_base = hdev->hw.hw.io_base; ret = hclge_knic_setup(vport, num_tqps,
@@ -2517,7 +2518,8 @@ static int hclge_init_roce_base_info(struct hclge_vport *vport) roce->pdev = nic->pdev; roce->ae_algo = nic->ae_algo; - roce->numa_node_mask = nic->numa_node_mask; +bitmap_copy (roce->numa_node_mask.bits, nic->numa_node_mask.bits, +MAX_NUMNODES );return 0 ; }
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +1 -1
@@ -863,7 +863,7 @@ struct hclge_dev {u16 fdir_pf_filter_count;/* Num of guaranteed filters for this PF */ u16 num_alloc_vport;/* Num vports this driver supports */ -u32 numa_node_mask; +nodemask_t numa_node_mask;u16 rx_buf_len;u16 num_tx_desc;/* desc num of per tx queue */ u16 num_rx_desc;/* desc num of per rx queue */
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +4 -3
@@ -537,7 +537,8 @@ static int hclgevf_set_handle_info(struct hclgevf_dev *hdev) nic->ae_algo = &ae_algovf; nic->pdev = hdev->pdev; - nic->numa_node_mask = hdev->numa_node_mask; +bitmap_copy (nic->numa_node_mask.bits, hdev->numa_node_mask.bits, +MAX_NUMNODES ); nic->flags |=HNAE3_SUPPORT_VF ; nic->kinfo.io_base = hdev->hw.io_base;
@@ -2588,8 +2589,8 @@ static int hclgevf_init_roce_base_info(struct hclgevf_dev *hdev) roce->pdev = nic->pdev; roce->ae_algo = nic->ae_algo; - roce->numa_node_mask = nic->numa_node_mask; - +bitmap_copy (roce->numa_node_mask.bits, nic->numa_node_mask.bits, +MAX_NUMNODES );return 0 ; }
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +1 -1
@@ -298,7 +298,7 @@ struct hclgevf_dev {u16 rss_size_max;/* HW defined max RSS task queue */ u16 num_alloc_vport;/* num vports this driver supports */ -u32 numa_node_mask; +nodemask_t numa_node_mask;u16 rx_buf_len;u16 num_tx_desc;/* desc num of per tx queue */ u16 num_rx_desc;/* desc num of per rx queue */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/168 net: hns3: use appropriate barrier function after setting a bit value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang Wang <[email protected]>
[ Upstream commit 094c281228529d333458208fd02fcac3b139d93b ]
There is a memory barrier in followed case. When set the port down, hclgevf_set_timmer will set DOWN in state. Meanwhile, the service task has different behaviour based on whether the state is DOWN. Thus, to make sure service task see DOWN, use smp_mb__after_atomic after calling set_bit().
CPU0 CPU1
========================== ===================================hclgevf_set_timer_task() hclgevf_periodic_service_task()
set_bit(DOWN,state) test_bit(DOWN,state)
pf also has this issue.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +-- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -2
@@ -8156,8 +8156,7 @@ static void hclge_set_timer_task(struct hnae3_handle *handle, bool enable)/* Set the DOWN flag here to disable link updating */ set_bit (HCLGE_STATE_DOWN , &hdev->state); -/* flush memory to make sure DOWN is seen by service task */ -smp_mb__before_atomic (); +smp_mb__after_atomic ();/* flush memory to make sure DOWN is seen by service task */ hclge_flush_link_update (hdev); } }
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +1 -2
@@ -2722,8 +2722,7 @@ static void hclgevf_set_timer_task(struct hnae3_handle *handle, bool enable) }else {set_bit (HCLGEVF_STATE_DOWN , &hdev->state); -/* flush memory to make sure DOWN is seen by service task */ -smp_mb__before_atomic (); +smp_mb__after_atomic ();/* flush memory to make sure DOWN is seen by service task */ hclgevf_flush_link_update (hdev); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/168 hwmon: (corsair-cpro) Use a separate buffer for sending commands
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Savic <[email protected]>
[ Upstream commit e0cd85dc666cb08e1bd313d560cb4eff4d04219e ]
Introduce cmd_buffer, a separate buffer for storing only the command that is sent to the device. Before this separation, the existing buffer was shared for both the command and the report received in ccp_raw_event(), which was copied into it.
However, because of hidraw, the raw event parsing may be triggered in the middle of sending a command, resulting in outputting gibberish to the device. Using a separate buffer resolves this.
--- drivers/hwmon/corsair-cpro.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/hwmon/corsair-cpro.c +12 -7
@@ -79,6 +79,7 @@ struct ccp_device {struct device *hwmon_dev;struct completion wait_input_report;struct mutex mutex;/* whenever buffer is used, lock before send_usb_cmd */ +u8 *cmd_buffer;u8 *buffer;int target[6 ];DECLARE_BITMAP (temp_cnct,NUM_TEMP_SENSORS );
@@ -111,15 +112,15 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2,unsigned long t;int ret; -memset (ccp->buffer,0x00 ,OUT_BUFFER_SIZE ); - ccp->buffer[0 ] = command; - ccp->buffer[1 ] = byte1; - ccp->buffer[2 ] = byte2; - ccp->buffer[3 ] = byte3; +memset (ccp->cmd_buffer,0x00 ,OUT_BUFFER_SIZE ); + ccp->cmd_buffer[0 ] = command; + ccp->cmd_buffer[1 ] = byte1; + ccp->cmd_buffer[2 ] = byte2; + ccp->cmd_buffer[3 ] = byte3;reinit_completion (&ccp->wait_input_report); - ret =hid_hw_output_report (ccp->hdev, ccp->buffer,OUT_BUFFER_SIZE ); + ret =hid_hw_output_report (ccp->hdev, ccp->cmd_buffer,OUT_BUFFER_SIZE );if (ret <0 )return ret;
@@ -492,7 +493,11 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id)if (!ccp)return -ENOMEM ; - ccp->buffer =devm_kmalloc (&hdev->dev,OUT_BUFFER_SIZE ,GFP_KERNEL ); + ccp->cmd_buffer =devm_kmalloc (&hdev->dev,OUT_BUFFER_SIZE ,GFP_KERNEL ); +if (!ccp->cmd_buffer) +return -ENOMEM ; + + ccp->buffer =devm_kmalloc (&hdev->dev,IN_BUFFER_SIZE ,GFP_KERNEL );if (!ccp->buffer)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/168 net: hns3: split function hclge_init_vlan_config()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit b60f9d2ec479966383c7f2cdf3b1a3a66c25f212 ]
Currently the function hclge_init_vlan_config() is a bit long. Split it to several small functions, to simplify code and improve code readability.
Stable-dep-of: f5db7a3b65c8 ("net: hns3: fix port vlan filter not disabled issue")
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 97 +++++++++++-------- 1 file changed, 55 insertions(+), 42 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +55 -42
@@ -10102,67 +10102,80 @@ static int hclge_set_vlan_protocol_type(struct hclge_dev *hdev)return status; } -static int hclge_init_vlan_config (struct hclge_dev *hdev) +static int hclge_init_vlan_filter (struct hclge_dev *hdev) { -#define HCLGE_DEF_VLAN_TYPE 0x8100 - -struct hnae3_handle *handle = &hdev->vport[0 ].nic;struct hclge_vport *vport;int ret;int i; -if (hdev->ae_dev->dev_version >=HNAE3_DEVICE_VERSION_V2 ) { -/* for revision 0x21, vf vlan filter is per function */ -for (i =0 ; i < hdev->num_alloc_vport; i++) { - vport = &hdev->vport[i]; - ret =hclge_set_vlan_filter_ctrl (hdev, -HCLGE_FILTER_TYPE_VF , -HCLGE_FILTER_FE_EGRESS , - true, - vport->vport_id); -if (ret) -return ret; - vport->cur_vlan_fltr_en = true; - } +if (hdev->ae_dev->dev_version <HNAE3_DEVICE_VERSION_V2 ) +return hclge_set_vlan_filter_ctrl (hdev,HCLGE_FILTER_TYPE_VF , +HCLGE_FILTER_FE_EGRESS_V1_B , + true,0 ); - ret =hclge_set_vlan_filter_ctrl (hdev,HCLGE_FILTER_TYPE_PORT , -HCLGE_FILTER_FE_INGRESS , true, -0 ); -if (ret) -return ret; - }else { +/* for revision 0x21, vf vlan filter is per function */ +for (i =0 ; i < hdev->num_alloc_vport; i++) { + vport = &hdev->vport[i]; ret =hclge_set_vlan_filter_ctrl (hdev,HCLGE_FILTER_TYPE_VF , -HCLGE_FILTER_FE_EGRESS_V1_B , - true,0 ); +HCLGE_FILTER_FE_EGRESS , true, + vport->vport_id);if (ret)return ret; + vport->cur_vlan_fltr_en = true; } - hdev->vlan_type_cfg.rx_in_fst_vlan_type =HCLGE_DEF_VLAN_TYPE ; - hdev->vlan_type_cfg.rx_in_sec_vlan_type =HCLGE_DEF_VLAN_TYPE ; - hdev->vlan_type_cfg.rx_ot_fst_vlan_type =HCLGE_DEF_VLAN_TYPE ; - hdev->vlan_type_cfg.rx_ot_sec_vlan_type =HCLGE_DEF_VLAN_TYPE ; - hdev->vlan_type_cfg.tx_ot_vlan_type =HCLGE_DEF_VLAN_TYPE ; - hdev->vlan_type_cfg.tx_in_vlan_type =HCLGE_DEF_VLAN_TYPE ; +return hclge_set_vlan_filter_ctrl (hdev,HCLGE_FILTER_TYPE_PORT , +HCLGE_FILTER_FE_INGRESS , true,0 ); +} - ret =hclge_set_vlan_protocol_type (hdev); -if (ret) -return ret; +static int hclge_init_vlan_type (struct hclge_dev *hdev) +{ + hdev->vlan_type_cfg.rx_in_fst_vlan_type =ETH_P_8021Q ; + hdev->vlan_type_cfg.rx_in_sec_vlan_type =ETH_P_8021Q ; + hdev->vlan_type_cfg.rx_ot_fst_vlan_type =ETH_P_8021Q ; + hdev->vlan_type_cfg.rx_ot_sec_vlan_type =ETH_P_8021Q ; + hdev->vlan_type_cfg.tx_ot_vlan_type =ETH_P_8021Q ; + hdev->vlan_type_cfg.tx_in_vlan_type =ETH_P_8021Q ; -for (i =0 ; i < hdev->num_alloc_vport; i++) { -u16 vlan_tag; -u8 qos; +return hclge_set_vlan_protocol_type (hdev); +} +static int hclge_init_vport_vlan_offload (struct hclge_dev *hdev) +{ +struct hclge_port_base_vlan_config *cfg; +struct hclge_vport *vport; +int ret; +int i; + +for (i =0 ; i < hdev->num_alloc_vport; i++) { vport = &hdev->vport[i]; - vlan_tag = vport->port_base_vlan_cfg.vlan_info.vlan_tag; - qos = vport->port_base_vlan_cfg.vlan_info.qos; + cfg = &vport->port_base_vlan_cfg; - ret =hclge_vlan_offload_cfg (vport, - vport->port_base_vlan_cfg.state, - vlan_tag, qos); + ret =hclge_vlan_offload_cfg (vport, cfg->state, + cfg->vlan_info.vlan_tag, + cfg->vlan_info.qos);if (ret)return ret; } +return 0 ; +} + +static int hclge_init_vlan_config (struct hclge_dev *hdev) +{ +struct hnae3_handle *handle = &hdev->vport[0 ].nic; +int ret; + + ret =hclge_init_vlan_filter (hdev); +if (ret) +return ret; + + ret =hclge_init_vlan_type (hdev); +if (ret) +return ret; + + ret =hclge_init_vport_vlan_offload (hdev); +if (ret) +return ret;return hclge_set_vlan_filter (handle,htons (ETH_P_8021Q ),0 , false); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/168 net: hns3: fix port vlan filter not disabled issue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit f5db7a3b65c84d723ca5e2bb6e83115180ab6336 ]
According to hardware limitation, for device support modify VLAN filter state but not support bypass port VLAN filter, it should always disable the port VLAN filter. but the driver enables port VLAN filter when initializing, if there is no VLAN(except VLAN 0) id added, the driver will disable it in service task. In most time, it works fine. But there is a time window before the service task shceduled and net device being registered. So if user adds VLAN at this time, the driver will not update the VLAN filter state, and the port VLAN filter remains enabled.
To fix the problem, if support modify VLAN filter state but not support bypass port VLAN filter, set the port vlan filter to "off".
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +6 -1
@@ -10105,6 +10105,7 @@ static int hclge_set_vlan_protocol_type(struct hclge_dev *hdev)static int hclge_init_vlan_filter (struct hclge_dev *hdev) {struct hclge_vport *vport; +bool enable = true;int ret;int i;
@@ -10124,8 +10125,12 @@ static int hclge_init_vlan_filter(struct hclge_dev *hdev) vport->cur_vlan_fltr_en = true; } +if (test_bit (HNAE3_DEV_SUPPORT_VLAN_FLTR_MDF_B , hdev->ae_dev->caps) && + !test_bit (HNAE3_DEV_SUPPORT_PORT_VLAN_BYPASS_B , hdev->ae_dev->caps)) + enable = false; +return hclge_set_vlan_filter_ctrl (hdev,HCLGE_FILTER_TYPE_PORT , -HCLGE_FILTER_FE_INGRESS , true,0 ); +HCLGE_FILTER_FE_INGRESS , enable,0 ); }static int hclge_init_vlan_type (struct hclge_dev *hdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/168 drm/meson: dw-hdmi: power up phy on device init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 04703bfd7f99c016a823c74712b97f8b5590ce87 ]
The phy is not in a useful state right after init. It will become useful, including for auxiliary function such as CEC or ARC, after the first mode is set. This is a problem on systems where the display is using another interface like DSI or CVBS.
This change refactor the init and mode change callback to power up the PHY on init and leave only what is necessary for mode changes in the related function. This is enough to fix CEC operation when HDMI display is not enabled.
--- drivers/gpu/drm/meson/meson_dw_hdmi.c | 51 +++++++++------------------ 1 file changed, 17 insertions(+), 34 deletions(-)
drivers/gpu/drm/meson/meson_dw_hdmi.c +17 -34
@@ -384,26 +384,6 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data, drm_mode_is_420_also(display, mode))) mode_is_420 = true; -/* Enable clocks */ -regmap_update_bits (priv->hhi,HHI_HDMI_CLK_CNTL ,0xffff ,0x100 ); - -/* Bring HDMITX MEM output of power down */ -regmap_update_bits (priv->hhi,HHI_MEM_PD_REG0 ,0xff <<8 ,0 ); - -/* Bring out of reset */ - dw_hdmi->data->top_write (dw_hdmi,HDMITX_TOP_SW_RESET ,0 ); - -/* Enable internal pixclk, tmds_clk, spdif_clk, i2s_clk, cecclk */ -dw_hdmi_top_write_bits (dw_hdmi,HDMITX_TOP_CLK_CNTL , -0x3 ,0x3 ); - -/* Enable cec_clk and hdcp22_tmdsclk_en */ -dw_hdmi_top_write_bits (dw_hdmi,HDMITX_TOP_CLK_CNTL , -0x3 <<4 ,0x3 <<4 ); - -/* Enable normal output to PHY */ - dw_hdmi->data->top_write (dw_hdmi,HDMITX_TOP_BIST_CNTL ,BIT (12 )); -/* TMDS pattern setup */ if (mode->clock >340000 && !mode_is_420) { dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_01,
@@ -425,20 +405,6 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,/* Setup PHY parameters */ meson_hdmi_phy_setup_mode (dw_hdmi, mode, mode_is_420); -/* Setup PHY */ -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -0xffff <<16 ,0x0390 <<16 ); - -/* BIT_INVERT */ -if (dw_hdmi_is_compatible (dw_hdmi,"amlogic,meson-gxl-dw-hdmi" ) || -dw_hdmi_is_compatible (dw_hdmi,"amlogic,meson-gxm-dw-hdmi" ) || -dw_hdmi_is_compatible (dw_hdmi,"amlogic,meson-g12a-dw-hdmi" )) -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -BIT (17 ),0 ); -else -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -BIT (17 ),BIT (17 )); -/* Disable clock, fifo, fifo_wr */ regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 ,0xf ,0 );
@@ -656,6 +622,23 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi) meson_dw_hdmi->data->top_write (meson_dw_hdmi,HDMITX_TOP_CLK_CNTL ,0xff ); +/* Enable normal output to PHY */ + meson_dw_hdmi->data->top_write (meson_dw_hdmi,HDMITX_TOP_BIST_CNTL ,BIT (12 )); + +/* Setup PHY */ +regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , +0xffff <<16 ,0x0390 <<16 ); + +/* BIT_INVERT */ +if (dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-gxl-dw-hdmi" ) || +dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-gxm-dw-hdmi" ) || +dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-g12a-dw-hdmi" )) +regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , +BIT (17 ),0 ); +else +regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , +BIT (17 ),BIT (17 )); +/* Enable HDMI-TX Interrupt */ meson_dw_hdmi->data->top_write (meson_dw_hdmi,HDMITX_TOP_INTR_STAT_CLR ,HDMITX_TOP_INTR_CORE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/168 drm/meson: dw-hdmi: add bandgap setting for g12
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 08001033121dd92b8297a5b7333636b466c30f13 ]
When no mode is set, the utility pin appears to be grounded. No signal is getting through.
This is problematic because ARC and eARC use this line and may do so even if no display mode is set.
This change enable the bandgap setting on g12 chip, which fix the problem with the utility pin. This is done by restoring init values on PHY init and disable.
--- drivers/gpu/drm/meson/meson_dw_hdmi.c | 43 ++++++++++++++++----------- 1 file changed, 26 insertions(+), 17 deletions(-)
drivers/gpu/drm/meson/meson_dw_hdmi.c +26 -17
@@ -105,6 +105,8 @@#define HHI_HDMI_CLK_CNTL 0x1cc/* 0x73 */ #define HHI_HDMI_PHY_CNTL0 0x3a0/* 0xe8 */ #define HHI_HDMI_PHY_CNTL1 0x3a4/* 0xe9 */ +#define PHY_CNTL1_INIT 0x03900000 +#define PHY_INVERT BIT(17)#define HHI_HDMI_PHY_CNTL2 0x3a8/* 0xea */ #define HHI_HDMI_PHY_CNTL3 0x3ac/* 0xeb */ #define HHI_HDMI_PHY_CNTL4 0x3b0/* 0xec */
@@ -129,6 +131,8 @@ struct meson_dw_hdmi_data { unsigned int addr);void (*dwc_write)(struct meson_dw_hdmi *dw_hdmi,unsigned int addr,unsigned int data); +u32 cntl0_init; +u32 cntl1_init; };struct meson_dw_hdmi {
@@ -458,7 +462,9 @@ static void dw_hdmi_phy_disable(struct dw_hdmi *hdmi,DRM_DEBUG_DRIVER ("\n" ); -regmap_write (priv->hhi,HHI_HDMI_PHY_CNTL0 ,0 ); +/* Fallback to init mode */ +regmap_write (priv->hhi,HHI_HDMI_PHY_CNTL1 , dw_hdmi->data->cntl1_init); +regmap_write (priv->hhi,HHI_HDMI_PHY_CNTL0 , dw_hdmi->data->cntl0_init); } static enum drm_connector_status dw_hdmi_read_hpd(struct dw_hdmi *hdmi,
@@ -576,11 +582,22 @@ static const struct regmap_config meson_dw_hdmi_regmap_config = { .fast_io = true, }; -static const struct meson_dw_hdmi_data meson_dw_hdmi_gx_data = { +static const struct meson_dw_hdmi_data meson_dw_hdmi_gxbb_data = { .top_read = dw_hdmi_top_read, .top_write = dw_hdmi_top_write, .dwc_read = dw_hdmi_dwc_read, .dwc_write = dw_hdmi_dwc_write, + .cntl0_init =0x0 , + .cntl1_init =PHY_CNTL1_INIT |PHY_INVERT , +}; + +static const struct meson_dw_hdmi_data meson_dw_hdmi_gxl_data = { + .top_read = dw_hdmi_top_read, + .top_write = dw_hdmi_top_write, + .dwc_read = dw_hdmi_dwc_read, + .dwc_write = dw_hdmi_dwc_write, + .cntl0_init =0x0 , + .cntl1_init =PHY_CNTL1_INIT , };static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = {
@@ -588,6 +605,8 @@ static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = { .top_write = dw_hdmi_g12a_top_write, .dwc_read = dw_hdmi_g12a_dwc_read, .dwc_write = dw_hdmi_g12a_dwc_write, + .cntl0_init = 0x000b4242, /* Bandgap */ + .cntl1_init = PHY_CNTL1_INIT, };static void meson_dw_hdmi_init (struct meson_dw_hdmi *meson_dw_hdmi)
@@ -626,18 +645,8 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi) meson_dw_hdmi->data->top_write (meson_dw_hdmi,HDMITX_TOP_BIST_CNTL ,BIT (12 ));/* Setup PHY */ -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -0xffff <<16 ,0x0390 <<16 ); - -/* BIT_INVERT */ -if (dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-gxl-dw-hdmi" ) || -dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-gxm-dw-hdmi" ) || -dw_hdmi_is_compatible (meson_dw_hdmi,"amlogic,meson-g12a-dw-hdmi" )) -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -BIT (17 ),0 ); -else -regmap_update_bits (priv->hhi,HHI_HDMI_PHY_CNTL1 , -BIT (17 ),BIT (17 )); +regmap_write (priv->hhi,HHI_HDMI_PHY_CNTL1 , meson_dw_hdmi->data->cntl1_init); +regmap_write (priv->hhi,HHI_HDMI_PHY_CNTL0 , meson_dw_hdmi->data->cntl0_init);/* Enable HDMI-TX Interrupt */ meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_INTR_STAT_CLR,
@@ -866,11 +875,11 @@ static const struct dev_pm_ops meson_dw_hdmi_pm_ops = {static const struct of_device_id meson_dw_hdmi_of_table[] = { { .compatible ="amlogic,meson-gxbb-dw-hdmi" , - .data = &meson_dw_hdmi_gx_data }, + .data = &meson_dw_hdmi_gxbb_data }, { .compatible ="amlogic,meson-gxl-dw-hdmi" , - .data = &meson_dw_hdmi_gx_data }, + .data = &meson_dw_hdmi_gxl_data }, { .compatible ="amlogic,meson-gxm-dw-hdmi" , - .data = &meson_dw_hdmi_gx_data }, + .data = &meson_dw_hdmi_gxl_data }, { .compatible ="amlogic,meson-g12a-dw-hdmi" , .data = &meson_dw_hdmi_g12a_data }, { }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/168 drm/connector: Add \n to message about demoting connector force-probes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 6897204ea3df808d342c8e4613135728bc538bcd ]
The debug print clearly lacks a \n at the end. Add it.
--- drivers/gpu/drm/drm_connector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_connector.c +1 -1
@@ -2460,7 +2460,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data, dev->mode_config.max_width, dev->mode_config.max_height); else - drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe", + drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe\n", connector->base.id, connector->name); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/168 drm/amd/display: Atom Integrated System Info v2_2 for DCN35
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabe Teeger <[email protected]>
[ Upstream commit 9a35d205f466501dcfe5625ca313d944d0ac2d60 ]
New request from KMD/VBIOS in order to support new UMA carveout model. This fixes a null dereference from accessing Ctx->dc_bios->integrated_info while it was NULL.
DAL parses through the BIOS and extracts the necessary integrated_info but was missing a case for the new BIOS version 2.3.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +1 -0
@@ -2303,6 +2303,7 @@ static enum bp_result construct_integrated_info( result =get_integrated_info_v2_1 (bp, info);break ;case 2 : +case 3 : result =get_integrated_info_v2_2 (bp, info);break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/168 Revert "Revert "ACPI: CPPC: Use access_width over bit_width for system memory accesses""
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Easwar Hariharan <[email protected]>
This reverts commit b54c4632946ae42f2b39ed38abd909bbf78cbcc2 which was a revert of a backport of commit 2f4a4d63a193be6fd530d180bb13c3592052904c upstream to 5.15.y.
--- drivers/acpi/cppc_acpi.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)
drivers/acpi/cppc_acpi.c +24 -3
@@ -161,6 +161,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_perf_caps, nominal_freq);show_cppc_data (cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);show_cppc_data (cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); +/* Check for valid access_width, otherwise, fallback to using bit_width */ +#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) + +/* Shift and apply the mask for CPC reads/writes */ +#define MASK_VAL (reg, val) ((val) >> ((reg)->bit_offset & \ + GENMASK(((reg)->bit_width), 0))) +static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf) {
@@ -762,8 +769,10 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) }else if (gas_t->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) {if (gas_t->address) {void __iomem *addr; +size_t access_width; - addr =ioremap (gas_t->address, gas_t->bit_width/8 ); + access_width =GET_BIT_WIDTH (gas_t) /8 ; + addr =ioremap (gas_t->address, access_width);if (!addr) goto out_free; cpc_ptr->cpc_regs[i-2 ].sys_mem_vaddr = addr;
@@ -936,6 +945,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) {int ret_val =0 ;void __iomem *vaddr =NULL ; +int size;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg;
@@ -955,7 +965,9 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val)return acpi_os_read_memory ((acpi_physical_address )reg->address, val, reg->bit_width); -switch (reg->bit_width) { + size =GET_BIT_WIDTH (reg); + +switch (size) {case 8 : *val =readb_relaxed (vaddr);break ;
@@ -974,12 +986,16 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) ret_val = -EFAULT ; } +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) + *val =MASK_VAL (reg, *val); +return ret_val; }static int cpc_write (int cpu,struct cpc_register_resource *reg_res,u64 val) {int ret_val =0 ; +int size;void __iomem *vaddr =NULL ;int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg;
@@ -994,7 +1010,12 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)return acpi_os_write_memory ((acpi_physical_address )reg->address, val, reg->bit_width); -switch (reg->bit_width) { + size =GET_BIT_WIDTH (reg); + +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) + val =MASK_VAL (reg, val); + +switch (size) {case 8 :writeb_relaxed (val, vaddr);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/168 ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarred White <[email protected]>
commit 05d92ee782eeb7b939bdd0189e6efcab9195bf95 upstream
Commit 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses") neglected to properly wrap the bit_offset shift when it comes to applying the mask. This may cause incorrect values to be read and may cause the cpufreq module not be loaded.
[ 11.059751] cpu_capacity: CPU0 missing/invalid highest performance. [ 11.066005] cpu_capacity: partial information: fallback to 1024 for all CPUs
Also, corrected the bitmask generation in GENMASK (extra bit being added).
--- drivers/acpi/cppc_acpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/acpi/cppc_acpi.c +2 -2
@@ -165,8 +165,8 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);#define GET_BIT_WIDTH (reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)/* Shift and apply the mask for CPC reads/writes */ -#define MASK_VAL (reg, val) ((val) >> ((reg)->bit_offset & \ - GENMASK(((reg)->bit_width), 0))) +#define MASK_VAL (reg, val) (((val) >> (reg)->bit_offset) & \ + GENMASK(((reg)->bit_width) - 1, 0))static ssize_t show_feedback_ctrs (struct kobject *kobj,struct kobj_attribute *attr,char *buf)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/168 ACPI: CPPC: Fix access width used for PCC registers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanshidhar Konda <[email protected]>
commit f489c948028b69cea235d9c0de1cc10eeb26a172 upstream
commit 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses") modified cpc_read()/cpc_write() to use access_width to read CPC registers.
However, for PCC registers the access width field in the ACPI register macro specifies the PCC subspace ID. For non-zero PCC subspace ID it is incorrectly treated as access width. This causes errors when reading from PCC registers in the CPPC driver.
For PCC registers, base the size of read/write on the bit width field. The debug message in cpc_read()/cpc_write() is updated to print relevant information for the address space type used to read the register.
[ eahariha: Backport to v5.15 by dropping SystemIO bits as commit
a2c8f92bea5f is not present ]
--- drivers/acpi/cppc_acpi.c | 48 ++++++++++++++++++++++++++++++---------- 1 file changed, 36 insertions(+), 12 deletions(-)
drivers/acpi/cppc_acpi.c +36 -12
@@ -955,17 +955,24 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) } *val =0 ; -if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >=0 ) + size =GET_BIT_WIDTH (reg); + +if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >=0 ) { +/* +* For registers in PCC space, the register size is determined +* by the bit width field; the access size is used to indicate +* the PCC subspace id. +*/ + size = reg->bit_width; vaddr =GET_PCC_VADDR (reg->address, pcc_ss_id); + }else if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) vaddr = reg_res->sys_mem_vaddr;else if (reg->space_id ==ACPI_ADR_SPACE_FIXED_HARDWARE )return cpc_read_ffh (cpu, reg, val);else return acpi_os_read_memory ((acpi_physical_address )reg->address, - val, reg->bit_width); - - size =GET_BIT_WIDTH (reg); + val, size);switch (size) {case 8 :
@@ -981,8 +988,13 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val) *val =readq_relaxed (vaddr);break ;default : -pr_debug ("Error: Cannot read %u bit width from PCC for ss: %d\n" , - reg->bit_width, pcc_ss_id); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { +pr_debug ("Error: Cannot read %u bit width from system memory: 0x%llx\n" , + size, reg->address); + }else if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM ) { +pr_debug ("Error: Cannot read %u bit width from PCC for ss: %d\n" , + size, pcc_ss_id); + } ret_val = -EFAULT ; }
@@ -1000,17 +1012,24 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)int pcc_ss_id =per_cpu (cpu_pcc_subspace_idx, cpu);struct cpc_reg *reg = ®_res->cpc_entry.reg; -if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >=0 ) + size =GET_BIT_WIDTH (reg); + +if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >=0 ) { +/* +* For registers in PCC space, the register size is determined +* by the bit width field; the access size is used to indicate +* the PCC subspace id. +*/ + size = reg->bit_width; vaddr =GET_PCC_VADDR (reg->address, pcc_ss_id); + }else if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) vaddr = reg_res->sys_mem_vaddr;else if (reg->space_id ==ACPI_ADR_SPACE_FIXED_HARDWARE )return cpc_write_ffh (cpu, reg, val);else return acpi_os_write_memory ((acpi_physical_address )reg->address, - val, reg->bit_width); - - size =GET_BIT_WIDTH (reg); + val, size);if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) val =MASK_VAL (reg, val);
@@ -1029,8 +1048,13 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)writeq_relaxed (val, vaddr);break ;default : -pr_debug ("Error: Cannot write %u bit width to PCC for ss: %d\n" , - reg->bit_width, pcc_ss_id); +if (reg->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { +pr_debug ("Error: Cannot write %u bit width to system memory: 0x%llx\n" , + size, reg->address); + }else if (reg->space_id ==ACPI_ADR_SPACE_PLATFORM_COMM ) { +pr_debug ("Error: Cannot write %u bit width to PCC for ss: %d\n" , + size, pcc_ss_id); + } ret_val = -EFAULT ;break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/168 btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
commit 6ff09b6b8c2fb6b3edda4ffaa173153a40653067 upstream.
When compiling with gcc version 14.0.0 20231220 (experimental) and W=1, I've noticed the following warning:
fs/btrfs/send.c: In function 'btrfs_ioctl_send':fs/btrfs/send.c:8208:44: warning: 'kvcalloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Wcalloc-transposed-args]
8208 | sctx->clone_roots = kvcalloc(sizeof(*sctx->clone_roots),
| ^
Since 'n' and 'size' arguments of 'kvcalloc()' are multiplied to calculate the final size, their actual order doesn't affect the result and so this is not a bug. But it's still worth to fix it.
--- fs/btrfs/send.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/send.c +2 -2
@@ -7612,8 +7612,8 @@ long btrfs_ioctl_send(struct file *mnt_f sctx->waiting_dir_moves =RB_ROOT ; sctx->orphan_dirs =RB_ROOT ; - sctx->clone_roots =kvcalloc (sizeof (*sctx->clone_roots), - arg->clone_sources_count +1 , + sctx->clone_roots =kvcalloc (arg->clone_sources_count +1 , +sizeof (*sctx->clone_roots),GFP_KERNEL );if (!sctx->clone_roots) { ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 111/168 hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Savic <[email protected]>
[ Upstream commit 3a034a7b0715eb51124a5263890b1ed39978ed3a ]
In ccp_raw_event(), the ccp->wait_input_report completion is completed once. Since we're waiting for exactly one report in send_usb_cmd(), use complete_all() instead of complete() to mark the completion as spent.
--- drivers/hwmon/corsair-cpro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/corsair-cpro.c +1 -1
@@ -140,7 +140,7 @@ static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8return 0 ;memcpy (ccp->buffer, data,min (IN_BUFFER_SIZE , size)); -complete (&ccp->wait_input_report); +complete_all (&ccp->wait_input_report);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/168 firewire: nosy: ensure user_length is taken into account when fetching packet contents
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thanassis Avgerinos <[email protected]>
commit 38762a0763c10c24a4915feee722d7aa6e73eb98 upstream.
Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows.
--- drivers/firewire/nosy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/firewire/nosy.c +4 -2
@@ -148,10 +148,12 @@ packet_buffer_get(struct client *client,if (atomic_read (&buffer->size) ==0 )return -ENODEV ; -/* FIXME: Check length <= user_length. */ + length = buffer->head->length; + +if (length > user_length) +return 0 ; end = buffer->data + buffer->capacity; - length = buffer->head->length;if (&buffer->head->data[length] < end) {if (copy_to_user (data, buffer->head->data, length))
Greg Kroah-Hartman
maintainerPATCH 139/168 Reapply "drm/qxl: simplify qxl_fence_wait"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 3628e0383dd349f02f882e612ab6184e4bb3dc10 upstream.
This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea.
Stephen Rostedt reports:
"I went to run my tests on my VMs and the tests hung on boot up.
Unfortunately, the most I ever got out was:
[ 93.607888] Testing event system initcall: OK [ 93.667730] Running tests on all trace events: [ 93.669757] Testing all events: OK [ 95.631064] ------------[ cut here ]------------ Timed out after 60 seconds"
and further debugging points to a possible circular locking dependency between the console_owner locking and the worker pool locking.
Reverting the commit allows Steve's VM to boot to completion again.
[ This may obviously result in the "[TTM] Buffer eviction failed"
messages again, which was the reason for that original revert. But at this point this seems preferable to a non-booting system... ]
--- drivers/gpu/drm/qxl/qxl_release.c | 50 +++----------------------------------- include/linux/dma-fence.h | 7 ----- 2 files changed, 5 insertions(+), 52 deletions(-)
drivers/gpu/drm/qxl/qxl_release.c +5 -45
@@ -58,56 +58,16 @@ static long qxl_fence_wait(struct dma_fe signed long timeout) {struct qxl_device *qdev; -struct qxl_release *release; -int count =0 , sc =0 ; -bool have_drawable_releases;unsigned long cur, end = jiffies + timeout; qdev = container_of(fence->lock, struct qxl_device, release_lock); - release = container_of(fence, struct qxl_release, base); - have_drawable_releases = release->type ==QXL_RELEASE_DRAWABLE ; -retry: - sc++; - -if (dma_fence_is_signaled (fence)) - goto signaled; - -qxl_io_notify_oom (qdev); - -for (count =0 ; count <11 ; count++) { -if (!qxl_queue_garbage_collect (qdev, true)) -break ; - -if (dma_fence_is_signaled (fence)) - goto signaled; - } - -if (dma_fence_is_signaled (fence)) - goto signaled; - -if (have_drawable_releases || sc <4 ) { -if (sc >2 ) -/* back off */ -usleep_range (500 ,1000 ); - -if (time_after (jiffies, end)) -return 0 ; - -if (have_drawable_releases && sc >300 ) { -DMA_FENCE_WARN (fence, -"failed to wait on release %llu after spincount %d\n" , - fence->context & ~0xf0000000 , sc); - goto signaled; - } - goto retry; - } -/* -* yeah, original sync_obj_wait gave up after 3 spins when -* have_drawable_releases is not set. -*/ +if (!wait_event_timeout (qdev->release_event, + (dma_fence_is_signaled (fence) || + (qxl_io_notify_oom (qdev),0 )), + timeout)) +return 0 ; -signaled: cur = jiffies;if (time_after (cur, end))return 0 ;
include/linux/dma-fence.h +0 -7
@@ -631,11 +631,4 @@ u64 dma_fence_context_alloc(unsigned num ##args); \ } while (0) -#define DMA_FENCE_WARN(f, fmt, args...) \ - do { \ - struct dma_fence *__ff = (f); \ - pr_warn("f %llu#%llu: " fmt, __ff->context, __ff->seqno,\ - ##args); \ - } while (0) -#endif /* __LINUX_DMA_FENCE_H */
Greg Kroah-Hartman
maintainerPATCH 140/168 arm64: dts: qcom: Fix interrupt-map parent address cells
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
commit 0ac10b291bee84b00bf9fb2afda444e77e7f88f4 upstream.
The 'interrupt-map' in several QCom SoCs is malformed. The '#address-cells' size of the parent interrupt controller (the GIC) is not accounted for.
--- arch/arm64/boot/dts/qcom/msm8998.dtsi | 8 ++++---- arch/arm64/boot/dts/qcom/sdm845.dtsi | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-)
arch/arm64/boot/dts/qcom/msm8998.dtsi +4 -4
@@ -958,10 +958,10 @@ interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "msi"; interrupt-map-mask = <0 0 0 0x7>; - interrupt-map = <0 0 0 1 &intc 0 135 IRQ_TYPE_LEVEL_HIGH>, - <0 0 0 2 &intc 0 136 IRQ_TYPE_LEVEL_HIGH>, - <0 0 0 3 &intc 0 138 IRQ_TYPE_LEVEL_HIGH>, - <0 0 0 4 &intc 0 139 IRQ_TYPE_LEVEL_HIGH>; + interrupt-map = <0 0 0 1 &intc 0 0 135 IRQ_TYPE_LEVEL_HIGH>, + <0 0 0 2 &intc 0 0 136 IRQ_TYPE_LEVEL_HIGH>, + <0 0 0 3 &intc 0 0 138 IRQ_TYPE_LEVEL_HIGH>, + <0 0 0 4 &intc 0 0 139 IRQ_TYPE_LEVEL_HIGH>; clocks = <&gcc GCC_PCIE_0_PIPE_CLK>, <&gcc GCC_PCIE_0_MSTR_AXI_CLK>,
arch/arm64/boot/dts/qcom/sdm845.dtsi +8 -8
@@ -1996,10 +1996,10 @@ interrupt-names = "msi"; #interrupt-cells = <1>; interrupt-map-mask = <0 0 0 0x7>; - interrupt-map = <0 0 0 1 &intc 0 149 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ - <0 0 0 2 &intc 0 150 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ - <0 0 0 3 &intc 0 151 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ - <0 0 0 4 &intc 0 152 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + interrupt-map = <0 0 0 1 &intc 0 0 0 149 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ + <0 0 0 2 &intc 0 0 0 150 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ + <0 0 0 3 &intc 0 0 0 151 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + <0 0 0 4 &intc 0 0 0 152 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ clocks = <&gcc GCC_PCIE_0_PIPE_CLK>, <&gcc GCC_PCIE_0_AUX_CLK>,
@@ -2101,10 +2101,10 @@ interrupt-names = "msi"; #interrupt-cells = <1>; interrupt-map-mask = <0 0 0 0x7>; - interrupt-map = <0 0 0 1 &intc 0 434 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ - <0 0 0 2 &intc 0 435 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ - <0 0 0 3 &intc 0 438 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ - <0 0 0 4 &intc 0 439 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + interrupt-map = <0 0 0 1 &intc 0 0 0 434 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ + <0 0 0 2 &intc 0 0 0 435 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ + <0 0 0 3 &intc 0 0 0 438 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + <0 0 0 4 &intc 0 0 0 439 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ clocks = <&gcc GCC_PCIE_1_PIPE_CLK>, <&gcc GCC_PCIE_1_AUX_CLK>,
Greg Kroah-Hartman
maintainerPATCH 141/168 usb: typec: ucsi: Check for notifications after init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian A. Ehrhardt <[email protected]>
commit 808a8b9e0b87bbc72bcc1f7ddfe5d04746e7ce56 upstream.
The completion notification for the final SET_NOTIFICATION_ENABLE command during initialization can include a connector change notification. However, at the time this completion notification is processed, the ucsi struct is not ready to handle this notification. As a result the notification is ignored and the controller never sends an interrupt again.
Re-check CCI for a pending connector state change after initialization is complete. Adjust the corresponding debug message accordingly.
--- drivers/usb/typec/ucsi/ucsi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.c +9 -1
@@ -854,7 +854,7 @@ void ucsi_connector_change(struct ucsi *struct ucsi_connector *con = &ucsi->connector[num -1 ];if (!(ucsi->ntfy &UCSI_ENABLE_NTFY_CONNECTOR_CHANGE )) { -dev_dbg (ucsi->dev,"Bogus connector change event\n" ); +dev_dbg (ucsi->dev,"Early connector change event\n" );return ; }
@@ -1241,6 +1241,7 @@ static int ucsi_init(struct ucsi *ucsi) {struct ucsi_connector *con;u64 command, ntfy; +u32 cci;int ret;int i;
@@ -1292,6 +1293,13 @@ static int ucsi_init(struct ucsi *ucsi) goto err_unregister; ucsi->ntfy = ntfy; + + ret = ucsi->ops->read (ucsi,UCSI_CCI , &cci,sizeof (cci)); +if (ret) +return ret; +if (UCSI_CCI_CONNECTOR (READ_ONCE (cci))) +ucsi_connector_change (ucsi, cci); +return 0 ; err_unregister:
Greg Kroah-Hartman
maintainerPATCH 112/168 hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Savic <[email protected]>
[ Upstream commit d02abd57e79469a026213f7f5827a98d909f236a ]
Through hidraw, userspace can cause a status report to be sent from the device. The parsing in ccp_raw_event() may happen in parallel to a send_usb_cmd() call (which resets the completion for tracking the report) if it's running on a different CPU where bottom half interrupts are not disabled.
Add a spinlock around the complete_all() in ccp_raw_event() and reinit_completion() in send_usb_cmd() to prevent race issues.
--- drivers/hwmon/corsair-cpro.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/hwmon/corsair-cpro.c +19 -5
@@ -16,6 +16,7 @@#include <linux/module.h> #include <linux/mutex.h> #include <linux/slab.h> +#include <linux/spinlock.h> #include <linux/types.h> #define USB_VENDOR_ID_CORSAIR 0x1b1c
@@ -77,6 +78,8 @@struct ccp_device {struct hid_device *hdev;struct device *hwmon_dev; +/* For reinitializing the completion below */ +spinlock_t wait_input_report_lock;struct completion wait_input_report;struct mutex mutex;/* whenever buffer is used, lock before send_usb_cmd */ u8 *cmd_buffer;
@@ -118,7 +121,15 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2, ccp->cmd_buffer[2 ] = byte2; ccp->cmd_buffer[3 ] = byte3; +/* +* Disable raw event parsing for a moment to safely reinitialize the +* completion. Reinit is done because hidraw could have triggered +* the raw event parsing and marked the ccp->wait_input_report +* completion as done. +*/ +spin_lock_bh (&ccp->wait_input_report_lock);reinit_completion (&ccp->wait_input_report); +spin_unlock_bh (&ccp->wait_input_report_lock); ret =hid_hw_output_report (ccp->hdev, ccp->cmd_buffer,OUT_BUFFER_SIZE );if (ret <0 )
@@ -136,11 +147,12 @@ static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8struct ccp_device *ccp =hid_get_drvdata (hdev);/* only copy buffer when requested */ -if (completion_done (&ccp->wait_input_report)) -return 0 ; - -memcpy (ccp->buffer, data,min (IN_BUFFER_SIZE , size)); -complete_all (&ccp->wait_input_report); +spin_lock (&ccp->wait_input_report_lock); +if (!completion_done (&ccp->wait_input_report)) { +memcpy (ccp->buffer, data,min (IN_BUFFER_SIZE , size)); +complete_all (&ccp->wait_input_report); + } +spin_unlock (&ccp->wait_input_report_lock);return 0 ; }
@@ -515,7 +527,9 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) ccp->hdev = hdev;hid_set_drvdata (hdev, ccp); +mutex_init (&ccp->mutex); +spin_lock_init (&ccp->wait_input_report_lock);init_completion (&ccp->wait_input_report);hid_device_io_start (hdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/168 phonet: fix rtm_phonet_notify() skb allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d8cac8568618dcb8a51af3db1103e8d4cc4aeea7 ]
fill_route() stores three components in the skb:
- struct rtmsg
- RTA_DST (u8)
- RTA_OIF (u32)
Therefore, rtm_phonet_notify() should use
NLMSG_ALIGN(sizeof(struct rtmsg)) +nla_total_size(1) +nla_total_size(4)
--- net/phonet/pn_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/phonet/pn_netlink.c +1 -1
@@ -193,7 +193,7 @@ void rtm_phonet_notify(int event, struct net_device *dev, u8 dst)struct sk_buff *skb;int err = -ENOBUFS ; - skb =nlmsg_new (NLMSG_ALIGN (sizeof (struct ifaddrmsg )) + + skb =nlmsg_new (NLMSG_ALIGN (sizeof (struct rtmsg )) +nla_total_size (1 ) +nla_total_size (4 ),GFP_KERNEL );if (skb ==NULL ) goto errout;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/168 net: bridge: fix corrupted ethernet header on multicast-to-unicast
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 86b29d830ad69eecff25b22dc96c14c6573718e6 ]
The change from skb_copy to pskb_copy unfortunately changed the data copying to omit the ethernet header, since it was pulled before reaching this point. Fix this by calling __skb_push/pull around pskb_copy.
--- net/bridge/br_forward.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/bridge/br_forward.c +7 -2
@@ -253,6 +253,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb, {struct net_device *dev =BR_INPUT_SKB_CB (skb)->brdev;const unsigned char *src =eth_hdr (skb)->h_source; +struct sk_buff *nskb;if (!should_deliver (p, skb))return ;
@@ -261,12 +262,16 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,if (skb->dev == p->dev &ðer_addr_equal (src, addr))return ; - skb =pskb_copy (skb,GFP_ATOMIC ); -if (!skb) { +__skb_push (skb,ETH_HLEN ); + nskb =pskb_copy (skb,GFP_ATOMIC ); +__skb_pull (skb,ETH_HLEN ); +if (!nskb) {DEV_STATS_INC (dev, tx_dropped);return ; } + skb = nskb; +__skb_pull (skb,ETH_HLEN );if (!is_broadcast_ether_addr (addr))memcpy (eth_hdr (skb)->h_dest, addr,ETH_ALEN );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/168 ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d101291b2681e5ab938554e3e323f7a7ee33e3aa ]
syzbot is able to trigger the following crash [1], caused by unsafe ip6_dst_idev() use.
Indeed ip6_dst_idev() can return NULL, and must always be checked.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline] RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267 Code: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c RSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700 RDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760 RBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd R10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000 R13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00 FS: 00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317 fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108 ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline] ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649 ip6_route_output include/net/ip6_route.h:93 [inline] ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120 ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250 sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326 sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455 sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662 sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099 __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197 sctp_connect net/sctp/socket.c:4819 [inline] sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834 __sys_connect_file net/socket.c:2048 [inline] __sys_connect+0x2df/0x310 net/socket.c:2065 __do_sys_connect net/socket.c:2075 [inline] __se_sys_connect net/socket.c:2072 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2072 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv6/fib6_rules.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv6/fib6_rules.c +5 -1
@@ -232,8 +232,12 @@ static int __fib6_rule_action(struct fib_rule *rule, struct flowi *flp, rt =pol_lookup_func (lookup, net, table, flp6, arg->lookup_data, flags);if (rt != net->ipv6.ip6_null_entry) { +struct inet6_dev *idev =ip6_dst_idev (&rt->dst); + +if (!idev) + goto again; err =fib6_rule_saddr (net, rule, flags, flp6, -ip6_dst_idev (&rt->dst)->dev); + idev->dev);if (err == -EAGAIN ) goto again;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/168 net: hns3: PF support get unicast MAC address space assigned by firmware
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangbin Huang <[email protected]>
[ Upstream commit e435a6b5315a05a4e4e9f77679a57fd0d679e384 ]
Currently, there are two ways for PF to set the unicast MAC address space
size: specified by config parameters in firmware or set to default value.
That's mean if the config parameters in firmware is zero, driver will divide the whole unicast MAC address space equally to 8 PFs. However, in this case, the unicast MAC address space will be wasted a lot when the hardware actually has less then 8 PFs. And in the other hand, if one PF has much more VFs than other PFs, then each function of this PF will has much less address space than other PFs.
In order to ameliorate the above two situations, introduce the third way of unicast MAC address space assignment: firmware divides the whole unicast MAC address space equally to functions of all PFs, and calculates the space size of each PF according to its function number. PF queries the space size by the querying device specification command when in initialization process.
The third way assignment is lower priority than specified by config parameters, only if the config parameters is zero can be used, and if firmware does not support the third way assignment, then driver still divides the whole unicast MAC address space equally to 8 PFs.
Stable-dep-of: 05eb60e9648c ("net: hns3: using user configure after hardware reset")
--- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 2 ++ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 4 +++- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 11 ++++++++--- 4 files changed, 14 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hnae3.h +1 -0
@@ -341,6 +341,7 @@ struct hnae3_dev_specs {u8 max_non_tso_bd_num;/* max BD number of one non-TSO packet */ u16 max_frm_size;u16 max_qset_num; +u16 umv_size; };struct hnae3_client_ops {
drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +2 -0
@@ -924,6 +924,8 @@ hns3_dbg_dev_specs(struct hnae3_handle *h, char *buf, int len, int *pos) dev_specs->max_tm_rate); *pos +=scnprintf (buf + *pos, len - *pos,"MAX QSET number: %u\n" , dev_specs->max_qset_num); + *pos +=scnprintf (buf + *pos, len - *pos,"umv size: %u\n" , + dev_specs->umv_size); }static int hns3_dbg_dev_info (struct hnae3_handle *h,char *buf,int len)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +3 -1
@@ -1188,7 +1188,9 @@ struct hclge_dev_specs_1_cmd {__le16 max_frm_size;__le16 max_qset_num;__le16 max_int_gl; -u8 rsv1[18 ]; +u8 rsv0[2 ]; +__le16 umv_size; +u8 rsv1[14 ]; };/* mac speed type defined in firmware command */
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +8 -3
@@ -1343,8 +1343,6 @@ static void hclge_parse_cfg(struct hclge_cfg *cfg, struct hclge_desc *desc) cfg->umv_space =hnae3_get_field (__le32_to_cpu (req->param[1 ]),HCLGE_CFG_UMV_TBL_SPACE_M ,HCLGE_CFG_UMV_TBL_SPACE_S ); -if (!cfg->umv_space) - cfg->umv_space =HCLGE_DEFAULT_UMV_SPACE_PER_PF ; cfg->pf_rss_size_max = hnae3_get_field(__le32_to_cpu(req->param[2]), HCLGE_CFG_PF_RSS_SIZE_M,
@@ -1420,6 +1418,7 @@ static void hclge_set_default_dev_specs(struct hclge_dev *hdev) ae_dev->dev_specs.max_int_gl =HCLGE_DEF_MAX_INT_GL ; ae_dev->dev_specs.max_frm_size =HCLGE_MAC_MAX_FRAME ; ae_dev->dev_specs.max_qset_num =HCLGE_MAX_QSET_NUM ; + ae_dev->dev_specs.umv_size =HCLGE_DEFAULT_UMV_SPACE_PER_PF ; } static void hclge_parse_dev_specs(struct hclge_dev *hdev,
@@ -1441,6 +1440,7 @@ static void hclge_parse_dev_specs(struct hclge_dev *hdev, ae_dev->dev_specs.max_qset_num =le16_to_cpu (req1->max_qset_num); ae_dev->dev_specs.max_int_gl =le16_to_cpu (req1->max_int_gl); ae_dev->dev_specs.max_frm_size =le16_to_cpu (req1->max_frm_size); + ae_dev->dev_specs.umv_size =le16_to_cpu (req1->umv_size); }static void hclge_check_dev_specs (struct hclge_dev *hdev)
@@ -1461,6 +1461,8 @@ static void hclge_check_dev_specs(struct hclge_dev *hdev) dev_specs->max_int_gl =HCLGE_DEF_MAX_INT_GL ;if (!dev_specs->max_frm_size) dev_specs->max_frm_size =HCLGE_MAC_MAX_FRAME ; +if (!dev_specs->umv_size) + dev_specs->umv_size =HCLGE_DEFAULT_UMV_SPACE_PER_PF ; }static int hclge_query_dev_specs (struct hclge_dev *hdev)
@@ -1550,7 +1552,10 @@ static int hclge_configure(struct hclge_dev *hdev) hdev->tm_info.num_pg =1 ; hdev->tc_max = cfg.tc_num; hdev->tm_info.hw_pfc_map =0 ; - hdev->wanted_umv_size = cfg.umv_space; +if (cfg.umv_space) + hdev->wanted_umv_size = cfg.umv_space; +else + hdev->wanted_umv_size = hdev->ae_dev->dev_specs.umv_size; hdev->tx_spare_buf_size = cfg.tx_spare_buf_size; hdev->gro_en = true;if (cfg.vlan_fliter_cap ==HCLGE_VLAN_FLTR_CAN_MDF )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/168 net: hns3: using user configure after hardware reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peiyang Wang <[email protected]>
[ Upstream commit 05eb60e9648cca0beeebdbcd263b599fb58aee48 ]
When a reset occurring, it's supposed to recover user's configuration. Currently, the port info(speed, duplex and autoneg) is stored in hclge_mac and will be scheduled updated. Consider the case that reset was happened consecutively. During the first reset, the port info is configured with a temporary value cause the PHY is reset and looking for best link config. Second reset start and use pervious configuration which is not the user's. The specific process is as follows:
+------+ +----+ +----+
| USER | | PF | | HW |
+---+--+ +-+--+ +-+--+
| ethtool --reset | |
+------------------->| reset command |
| ethtool --reset +-------------------->|
+------------------->| +---+
| +---+ | |
| | |reset currently | | HW RESET
| | |and wait to do | |
| |<--+ | |
| | send pervious cfg |<--+
| | (1000M FULL AN_ON) |
| +-------------------->|
| | read cfg(time task) |
| | (10M HALF AN_OFF) +---+
| |<--------------------+ | cfg take effect
| | reset command |<--+
| +-------------------->|
| | +---+
| | send pervious cfg | | HW RESET
| | (10M HALF AN_OFF) |<--+
| +-------------------->|
| | read cfg(time task) |
| | (10M HALF AN_OFF) +---+
| |<--------------------+ | cfg take effect
| | | |
| | read cfg(time task) |<--+
| | (10M HALF AN_OFF) |
| |<--------------------+
| | |
v v vTo avoid aboved situation, this patch introduced req_speed, req_duplex, req_autoneg to store user's configuration and it only be used after hardware reset and to recover user's configuration
--- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 15 +++++++++------ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 3 +++ 2 files changed, 12 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +9 -6
@@ -1572,6 +1572,9 @@ static int hclge_configure(struct hclge_dev *hdev) cfg.default_speed, ret);return ret; } + hdev->hw.mac.req_speed = hdev->hw.mac.speed; + hdev->hw.mac.req_autoneg =AUTONEG_ENABLE ; + hdev->hw.mac.req_duplex =DUPLEX_FULL ;hclge_parse_link_mode (hdev, cfg.speed_ability);
@@ -3163,9 +3166,9 @@ hclge_set_phy_link_ksettings(struct hnae3_handle *handle,return ret; } - hdev->hw.mac.autoneg = cmd->base.autoneg; - hdev->hw.mac.speed = cmd->base.speed; - hdev->hw.mac.duplex = cmd->base.duplex; + hdev->hw.mac.req_autoneg = cmd->base.autoneg; + hdev->hw.mac.req_speed = cmd->base.speed; + hdev->hw.mac.req_duplex = cmd->base.duplex;linkmode_copy (hdev->hw.mac.advertising, cmd->link_modes.advertising);return 0 ;
@@ -3198,9 +3201,9 @@ static int hclge_tp_port_init(struct hclge_dev *hdev)if (!hnae3_dev_phy_imp_supported (hdev))return 0 ; - cmd.base.autoneg = hdev->hw.mac.autoneg; - cmd.base.speed = hdev->hw.mac.speed; - cmd.base.duplex = hdev->hw.mac.duplex; + cmd.base.autoneg = hdev->hw.mac.req_autoneg; + cmd.base.speed = hdev->hw.mac.req_speed; + cmd.base.duplex = hdev->hw.mac.req_duplex;linkmode_copy (cmd.link_modes.advertising, hdev->hw.mac.advertising);return hclge_set_phy_link_ksettings (&hdev->vport->nic, &cmd);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +3 -0
@@ -275,10 +275,13 @@ struct hclge_mac {u8 media_type;/* port media type, e.g. fibre/copper/backplane */ u8 mac_addr[ETH_ALEN ];u8 autoneg; +u8 req_autoneg;u8 duplex; +u8 req_duplex;u8 support_autoneg;u8 speed_type;/* 0: sfp speed, 1: active speed */ u32 speed; +u32 req_speed;u32 max_speed;u32 speed_ability;/* speed ability supported by current media */ u32 module_type;/* sub media type, e.g. kr/cr/sr/lr */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/168 Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit adf0398cee86643b8eacde95f17d073d022f782c ]
There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below:
[ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeout+0x181/0x300 [ 472.096136] process_one_work+0x5d2/0xe00 [ 472.096136] worker_thread+0xe1d/0x1660 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] kthread+0x2b7/0x350 [ 472.096136] ? pr_cont_work+0x5e0/0x5e0 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork+0x4d/0x80 [ 472.096136] ? kthread_blkcg+0xd0/0xd0 [ 472.096136] ret_from_fork_asm+0x11/0x20 [ 472.096136] </TASK> [ 472.096136] Modules linked in: [ 472.096136] CR2: 0000000000000158 [ 472.096136] ---[ end trace 0000000000000000 ]--- [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.132932] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.132932] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.132932] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.132932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.132932] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.132932] Kernel panic - not syncing: Fatal exception [ 472.132932] Kernel Offset: disabled [ 472.132932] ---[ end Kernel panic - not syncing: Fatal exception ]---
Add a check to judge whether the conn is null in l2cap_chan_timeout() in order to mitigate the bug.
--- net/bluetooth/l2cap_core.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/l2cap_core.c +3 -0
@@ -435,6 +435,9 @@ static void l2cap_chan_timeout(struct work_struct *work)BT_DBG ("chan %p state %s" , chan,state_to_string (chan->state)); +if (!conn) +return ; +mutex_lock (&conn->chan_lock);/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling * this work. No need to call l2cap_chan_hold(chan) here again.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/168 usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit c78c3644b772e356ca452ae733a3c4de0fb11dc8 upstream.
A virtual SuperSpeed device in the FreeBSD BVCP package
(https://bhyve.npulse.net/) presents an invalid ep0 maxpacket size of 256. It stopped working with Linux following a recent commit because now we check these sizes more carefully than before.
Fix this regression by using the bMaxpacketSize0 value in the device descriptor for SuperSpeed or faster devices, even if it is invalid. This is a very simple-minded change; we might want to check more carefully for values that actually make some sense (for instance, no smaller than 64).
--- drivers/usb/core/hub.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/core/hub.c +3 -2
@@ -5049,9 +5049,10 @@ hub_port_init(struct usb_hub *hub, struc }if (usb_endpoint_maxp (&udev->ep0.desc) == i) { ;/* Initial ep0 maxpacket guess is right */ - }else if ((udev->speed ==USB_SPEED_FULL || + }else if (((udev->speed ==USB_SPEED_FULL || udev->speed ==USB_SPEED_HIGH ) && - (i ==8 || i ==16 || i ==32 || i ==64 )) { + (i ==8 || i ==16 || i ==32 || i ==64 )) || + (udev->speed >=USB_SPEED_SUPER && i >0 )) {/* Initial guess is wrong; use the descriptor's value */ if (udev->speed ==USB_SPEED_FULL )dev_dbg (&udev->dev,"ep0 maxpacket = %d\n" , i);
Greg Kroah-Hartman
maintainerPATCH 152/168 dt-bindings: iio: health: maxim,max30102: fix compatible check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 89384a2b656b9dace4c965432a209d5c9c3a2a6f upstream.
The "maxim,green-led-current-microamp" property is only available for the max30105 part (it provides an extra green LED), and must be set to false for the max30102 part.
Instead, the max30100 part has been used for that, which is not supported by this binding (it has its own binding).
This error was introduced during the txt to yaml conversion.
--- Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/iio/health/maxim,max30102.yaml +1 -1
@@ -42,7 +42,7 @@ allOf: properties: compatible: contains: - const: maxim,max30100 + const: maxim,max30102 then: properties: maxim,green-led-current-microamp: false
Greg Kroah-Hartman
maintainerPATCH 153/168 iio:imu: adis16475: Fix sync mode setting
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramona Gradinariu <[email protected]>
commit 74a72baf204fd509bbe8b53eec35e39869d94341 upstream.
Fix sync mode setting by applying the necessary shift bits.
--- drivers/iio/imu/adis16475.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/imu/adis16475.c +3 -1
@@ -1145,6 +1145,7 @@ static int adis16475_config_sync_mode(ststruct device *dev = &st->adis.spi->dev;const struct adis16475_sync *sync;u32 sync_mode; +u16 val;/* default to internal clk */ st->clk_freq = st->info->int_clk *1000 ;
@@ -1214,8 +1215,9 @@ static int adis16475_config_sync_mode(st* I'm keeping this for simplicity and avoiding extra variables * in chip_info. */ + val =ADIS16475_SYNC_MODE (sync->sync_mode); ret =__adis_update_bits (&st->adis,ADIS16475_REG_MSG_CTRL , -ADIS16475_SYNC_MODE_MASK , sync->sync_mode); +ADIS16475_SYNC_MODE_MASK , val);if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 154/168 iio: accel: mxc4005: Interrupt handling fixes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 57a1592784d622ecee0b71940c65429173996b33 upstream.
There are 2 issues with interrupt handling in the mxc4005 driver:
1. mxc4005_set_trigger_state() writes MXC4005_REG_INT_MASK1_BIT_DRDYE (0x01) to INT_MASK1 to enable the interrupt, but to disable the interrupt it writes ~MXC4005_REG_INT_MASK1_BIT_DRDYE which is 0xfe, so it enables all other interrupt sources in the INT_SRC1 register. On the MXC4005 this is not an issue because only bit 0 of the register is used. On the MXC6655 OTOH this is a problem since bit7 is used as TC (Temperature Compensation) disable bit and writing 1 to this disables Temperature Compensation which should only be done when running self-tests on the chip.
Write 0 instead of ~MXC4005_REG_INT_MASK1_BIT_DRDYE to disable the interrupts to fix this.
2. The datasheets for the MXC4005 / MXC6655 do not state what the reset value for the INT_MASK0 and INT_MASK1 registers is and since these are write only we also cannot learn this from the hw. Presumably the reset value for both is all 0, which means all interrupts disabled.
Explicitly set both registers to 0 from mxc4005_chip_init() to ensure both masks are actually set to 0.
--- drivers/iio/accel/mxc4005.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/iio/accel/mxc4005.c +17 -7
@@ -27,9 +27,13 @@#define MXC4005_REG_ZOUT_UPPER 0x07#define MXC4005_REG_ZOUT_LOWER 0x08 +#define MXC4005_REG_INT_MASK0 0x0A +#define MXC4005_REG_INT_MASK1 0x0B#define MXC4005_REG_INT_MASK1_BIT_DRDYE 0x01 +#define MXC4005_REG_INT_CLR0 0x00 +#define MXC4005_REG_INT_CLR1 0x01#define MXC4005_REG_INT_CLR1_BIT_DRDYC 0x01
@@ -113,7 +117,9 @@ static bool mxc4005_is_readable_reg(strustatic bool mxc4005_is_writeable_reg (struct device *dev,unsigned int reg) {switch (reg) { +case MXC4005_REG_INT_CLR0 :case MXC4005_REG_INT_CLR1 : +case MXC4005_REG_INT_MASK0 :case MXC4005_REG_INT_MASK1 :case MXC4005_REG_CONTROL :return true;
@@ -330,17 +336,13 @@ static int mxc4005_set_trigger_state(str {struct iio_dev *indio_dev =iio_trigger_get_drvdata (trig);struct mxc4005_data *data =iio_priv (indio_dev); +unsigned int val;int ret;mutex_lock (&data->mutex); -if (state) { - ret =regmap_write (data->regmap,MXC4005_REG_INT_MASK1 , -MXC4005_REG_INT_MASK1_BIT_DRDYE ); - }else { - ret =regmap_write (data->regmap,MXC4005_REG_INT_MASK1 , - ~MXC4005_REG_INT_MASK1_BIT_DRDYE ); - } + val = state ?MXC4005_REG_INT_MASK1_BIT_DRDYE :0 ; + ret =regmap_write (data->regmap,MXC4005_REG_INT_MASK1 , val);if (ret <0 ) {mutex_unlock (&data->mutex);dev_err (data->dev,"failed to update reg_int_mask1" );
@@ -382,6 +384,14 @@ static int mxc4005_chip_init(struct mxc4dev_dbg (data->dev,"MXC4005 chip id %02x\n" , reg); + ret =regmap_write (data->regmap,MXC4005_REG_INT_MASK0 ,0 ); +if (ret <0 ) +return dev_err_probe (data->dev, ret,"writing INT_MASK0\n" ); + + ret =regmap_write (data->regmap,MXC4005_REG_INT_MASK1 ,0 ); +if (ret <0 ) +return dev_err_probe (data->dev, ret,"writing INT_MASK1\n" ); +return 0 ; }