6.1.96-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.1.96-rc1 review
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.96-rc1
Linus Torvalds <[email protected]>
Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default"
Andrew Ballance <[email protected]>
hid: asus: asus_report_fixup: fix potential read out of bounds
Davide Caratti <[email protected]>
net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
Martin Leung <[email protected]>
drm/amd/display: revert Exit idle optimizations before HDCP execution
Matthias Maennich <[email protected]>
kheaders: explicitly define file modes for archived headers
Masahiro Yamada <[email protected]>
Revert "kheaders: substituting --sort in archive creation"
Tony Luck <[email protected]>
x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
Tony Luck <[email protected]>
x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
Jeff Johnson <[email protected]>
tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
Tomi Valkeinen <[email protected]>
pmdomain: ti-sci: Fix duplicate PD referrals
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
Adrian Hunter <[email protected]>
perf script: Show also errors for --insn-trace option
Changbin Du <[email protected]>
perf: script: add raw|disasm arguments to --insn-trace option
Patrice Chotard <[email protected]>
spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
Frank Li <[email protected]>
arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
Patrice Chotard <[email protected]>
spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
Krzysztof Kozlowski <[email protected]>
dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
Grygorii Tertychnyi <[email protected]>
i2c: ocores: set IACK bit after core is enabled
Peter Xu <[email protected]>
mm/page_table_check: fix crash on ZONE_DEVICE
Eric Dumazet <[email protected]>
tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
Rafael Aquini <[email protected]>
mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default
Aleksandr Nogikh <[email protected]>
kcov: don't lose track of remote references during softirqs
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 14
Alex Deucher <[email protected]>
drm/amdgpu: fix UBSAN warning in kv_dpm.c
Alex Deucher <[email protected]>
drm/radeon: fix UBSAN warning in kv_dpm.c
Jani Nikula <[email protected]>
drm/i915/mso: using joiner is not possible with eDP MSO
Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Limit mic boost on N14AP7
Andy Chi <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook 445/465 G11.
Sean Christopherson <[email protected]>
KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
Marc Zyngier <[email protected]>
KVM: arm64: Disassociate vcpus from redistributor region on teardown
Breno Leitao <[email protected]>
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
Steve French <[email protected]>
cifs: fix typo in module parameter enable_gcm_256
Boris Burkov <[email protected]>
btrfs: retry block group reclaim without infinite loop
Ignat Korchagin <[email protected]>
net: do not leave a dangling sk pointer, when socket creation fails
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: improve reset check
Oleksij Rempel <[email protected]>
net: stmmac: Assign configured channel value to EXTTS event
Florian Fainelli <[email protected]>
MIPS: dts: bcm63268: Add missing properties to the TWD node
Nathan Chancellor <[email protected]>
kbuild: Remove support for Clang's ThinLTO caching
Patrisious Haddad <[email protected]>
RDMA/mlx5: Add check for srq max_sge attribute
Sudeep Holla <[email protected]>
firmware: psci: Fix return value from psci_system_suspend()
Raju Rangoju <[email protected]>
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
Max Krummenacher <[email protected]>
arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
Fabio Estevam <[email protected]>
arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property
Kalle Niemi <[email protected]>
regulator: bd71815: fix ramp values
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix missing kmem_cache_destroy()
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
Bjorn Helgaas <[email protected]>
dmaengine: ioat: use PCI core macros for PCIe Capability
Nikita Shubin <[email protected]>
dmaengine: ioatdma: Fix leaking on version mismatch
Bjorn Helgaas <[email protected]>
dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
Li RongQing <[email protected]>
dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
Biju Das <[email protected]>
regulator: core: Fix modpost error "regulator_get_regmap" undefined
Oliver Neukum <[email protected]>
net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
Pavan Chebbi <[email protected]>
bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
Marcin Szycik <[email protected]>
ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
Jianguo Wu <[email protected]>
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix suspicious rcu_dereference_protected()
Simon Horman <[email protected]>
octeontx2-pf: Add error handling to VLAN unoffload handling
Heng Qi <[email protected]>
virtio_net: checksum offloading handling fix
Xiaolei Wang <[email protected]>
net: stmmac: No need to calculate speed divider when offload is disabled
Dan Carpenter <[email protected]>
ptp: fix integer overflow in max_vclocks_store
Xin Long <[email protected]>
sched: act_ct: add netns into the key of tcf_ct_flow_table
Xin Long <[email protected]>
tipc: force a dst refcount before doing decryption
David Ruth <[email protected]>
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
Pedro Tammela <[email protected]>
net/sched: act_api: rely on rcu in tcf_idr_check_alloc
Raju Lakkaraju <[email protected]>
net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
Xu Liang <[email protected]>
net: phy: mxl-gpy: enhance delay time required by loopback disable function
Raju Lakkaraju <[email protected]>
net: lan743x: Support WOL at both the PHY and MAC appropriately
Raju Lakkaraju <[email protected]>
net: lan743x: disable WOL upon resume to restore full data path operation
Stefan Wahren <[email protected]>
qca_spi: Make interrupt remembering atomic
Yue Haibing <[email protected]>
netns: Make get_net_ns() handle zero refcount net
Eric Dumazet <[email protected]>
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
Eric Dumazet <[email protected]>
ipv6: prevent possible NULL dereference in rt6_probe()
Eric Dumazet <[email protected]>
ipv6: prevent possible NULL deref in fib6_nh_init()
Gavrilov Ilia <[email protected]>
netrom: Fix a memory leak in nr_heartbeat_expiry()
Ajrat Makhmutov <[email protected]>
ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
Florian Westphal <[email protected]>
bpf: Avoid splat in pskb_pull_reason
Ondrej Mosnacek <[email protected]>
cipso: fix total option length computation
En-Wei Wu <[email protected]>
ice: avoid IRQ collision to fix init failure on ACPI S3 resume
Michal Swiatkowski <[email protected]>
ice: move RDMA init to ice_idc.c
Peter Ujfalusi <[email protected]>
ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
Dustin L. Howett <[email protected]>
ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
Masami Hiramatsu (Google) <[email protected]>
tracing: Build event generation tests only as modules
Christian Marangi <[email protected]>
mips: bmips: BCM6358: make sure CBR is correctly set
Ilpo Järvinen <[email protected]>
MIPS: Routerboard 532: Fix vendor retry check code
Linus Torvalds <[email protected]>
tty: add the option to have a tty reject a new ldisc
Christophe JAILLET <[email protected]>
usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
Parker Newman <[email protected]>
serial: exar: adding missing CTI and Exar PCI ids
Esben Haabendal <[email protected]>
serial: imx: Introduce timeout when waiting on transmitter empty
Songyang Li <[email protected]>
MIPS: Octeon: Add PCIe link status check
Mario Limonciello <[email protected]>
PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
Roman Smirnov <[email protected]>
udf: udftime: prevent overflow in udf_disk_stamp_to_time()
Hans de Goede <[email protected]>
usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380
Joao Pinto <[email protected]>
Avoid hw_desc array overrun in dw-axi-dmac
Alex Henrie <[email protected]>
usb: misc: uss720: check for incompatible versions of the Belkin F5U002
Yunlei He <[email protected]>
f2fs: remove clear SB_INLINECRYPT flag in default_options
Aleksandr Aprelkov <[email protected]>
iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
Tzung-Bi Shih <[email protected]>
power: supply: cros_usbpd: provide ID table for avoiding fallback match
Ben Fradella <[email protected]>
platform/x86: p2sb: Don't init until unassigned resources have been assigned
Michael Ellerman <[email protected]>
powerpc/io: Avoid clang null pointer arithmetic warnings
Nathan Lynch <[email protected]>
powerpc/pseries: Enforce hcall result buffer validity and size
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for Lenovo 13X
Erico Nunes <[email protected]>
drm/lima: mask irqs in timeout path before hard reset
Erico Nunes <[email protected]>
drm/lima: add mask irq callback to gp and pp
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
Arvid Norlander <[email protected]>
platform/x86: toshiba_acpi: Add quirk for buttons on Z830
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Exit idle optimizations before HDCP execution
Uri Arev <[email protected]>
Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
Luke D. Jones <[email protected]>
HID: asus: fix more n-key report descriptors if n-key quirked
Sean O'Brien <[email protected]>
HID: Add quirk for Logitech Casa touchpad
Leon Yen <[email protected]>
wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
Breno Leitao <[email protected]>
netpoll: Fix race condition in netpoll_owner_active
Luiz Angelo Daros de Luca <[email protected]>
net: dsa: realtek: keep default LED state in rtl8366rb
Kunwu Chan <[email protected]>
kselftest: arm64: Add a null pointer check
Davide Caratti <[email protected]>
net/sched: fix false lockdep warning on qdisc root lock
Manish Rangankar <[email protected]>
scsi: qedi: Fix crash while reading debugfs attribute
Wander Lairson Costa <[email protected]>
drop_monitor: replace spin_lock by raw_spin_lock
Eric Dumazet <[email protected]>
af_packet: avoid a false positive warning in packet_setsockopt()
Arnd Bergmann <[email protected]>
wifi: ath9k: work around memset overflow warning
Eric Dumazet <[email protected]>
batman-adv: bypass empty buckets in batadv_purge_orig_ref()
Yonghong Song <[email protected]>
selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
Alessandro Carminati (Red Hat) <[email protected]>
selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
Justin Stitt <[email protected]>
block/ioctl: prefer different overflow check
Zqiang <[email protected]>
rcutorture: Fix invalid context warning when enable srcu barrier testing
Zqiang <[email protected]>
rcutorture: Make stall-tasks directly exit when rcutorture tests end
Paul E. McKenney <[email protected]>
rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
Jens Axboe <[email protected]>
io_uring/sqpoll: work around a potential audit memory leak
Chenghai Huang <[email protected]>
crypto: hisilicon/sec - Fix memory leak for sec resource release
Herbert Xu <[email protected]>
padata: Disable BH when taking works lock on MT path
-------------
Diffstat:
.../bindings/i2c/google,cros-ec-i2c-tunnel.yaml | 2 +- Makefile | 9 +- arch/arm/boot/dts/exynos4210-smdkv310.dts | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/exynos4412-smdk4412.dts | 2 +- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 2 +- arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 1 - arch/arm64/kvm/vgic/vgic-init.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 +++- arch/arm64/kvm/vgic/vgic.h | 2 +- arch/mips/bmips/setup.c | 3 +- arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 + arch/mips/pci/ops-rc32434.c | 4 +- arch/mips/pci/pcie-octeon.c | 6 ++ arch/powerpc/include/asm/hvcall.h | 8 +- arch/powerpc/include/asm/io.h | 24 +++--- arch/x86/include/asm/cpu_device_id.h | 98 ++++++++++++++++++++++ arch/x86/kernel/cpu/match.c | 4 +- arch/x86/kvm/x86.c | 9 +- block/ioctl.c | 2 +- drivers/acpi/acpica/exregion.c | 23 +---- drivers/bluetooth/ath3k.c | 25 +++--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 +- drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + drivers/dma/idxd/irq.c | 4 +- drivers/dma/ioat/init.c | 65 +++++++------- drivers/dma/ioat/registers.h | 7 -- drivers/firmware/psci/psci.c | 4 +- drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 4 + drivers/gpu/drm/lima/lima_bcast.c | 12 +++ drivers/gpu/drm/lima/lima_bcast.h | 3 + drivers/gpu/drm/lima/lima_gp.c | 8 ++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++ drivers/gpu/drm/lima/lima_sched.c | 7 ++ drivers/gpu/drm/lima/lima_sched.h | 1 + drivers/gpu/drm/radeon/sumo_dpm.c | 2 + drivers/hid/hid-asus.c | 49 +++++------ drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++ drivers/i2c/busses/i2c-ocores.c | 2 +- drivers/infiniband/hw/mlx5/srq.c | 13 +-- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- drivers/net/dsa/realtek/rtl8366rb.c | 87 +++++-------------- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_idc.c | 52 +++++++++++- drivers/net/ethernet/intel/ice/ice_main.c | 36 +++----- drivers/net/ethernet/intel/ice/ice_switch.c | 6 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 5 +- drivers/net/ethernet/microchip/lan743x_ethtool.c | 44 +++++++++- drivers/net/ethernet/microchip/lan743x_main.c | 48 +++++++++-- drivers/net/ethernet/microchip/lan743x_main.h | 28 +++++++ drivers/net/ethernet/qualcomm/qca_debug.c | 6 +- drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++-- drivers/net/ethernet/qualcomm/qca_spi.h | 3 +- .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 40 +++++---- drivers/net/phy/mxl-gpy.c | 97 ++++++++++++++------- drivers/net/usb/ax88179_178a.c | 18 ++-- drivers/net/usb/rtl8150.c | 3 +- drivers/net/virtio_net.c | 12 ++- drivers/net/wireless/ath/ath.h | 6 +- drivers/net/wireless/ath/ath9k/main.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 + .../net/wireless/mediatek/mt76/mt7921/pci_mac.c | 2 - .../net/wireless/mediatek/mt76/mt7921/sdio_mac.c | 2 - drivers/net/wireless/mediatek/mt76/sdio.c | 3 +- drivers/pci/pci.c | 12 +++ drivers/platform/x86/p2sb.c | 29 +++---- drivers/platform/x86/toshiba_acpi.c | 36 +++++++- drivers/power/supply/cros_usbpd-charger.c | 11 ++- drivers/ptp/ptp_sysfs.c | 3 +- drivers/regulator/bd71815-regulator.c | 2 +- drivers/regulator/core.c | 1 + drivers/scsi/qedi/qedi_debugfs.c | 12 +-- drivers/soc/ti/ti_sci_pm_domains.c | 20 ++++- drivers/spi/spi-stm32-qspi.c | 12 ++- drivers/tty/serial/8250/8250_exar.c | 42 ++++++++++ drivers/tty/serial/imx.c | 7 +- drivers/tty/tty_ldisc.c | 6 ++ drivers/tty/vt/vt.c | 10 +++ drivers/usb/dwc3/dwc3-pci.c | 8 +- drivers/usb/gadget/function/f_hid.c | 6 +- drivers/usb/gadget/function/f_printer.c | 6 +- drivers/usb/gadget/function/rndis.c | 4 +- drivers/usb/misc/uss720.c | 22 +++-- fs/btrfs/block-group.c | 11 ++- fs/f2fs/super.c | 2 - fs/smb/client/cifsfs.c | 2 +- fs/udf/udftime.c | 11 ++- include/linux/kcov.h | 2 + include/linux/mod_devicetable.h | 2 + include/linux/tty_driver.h | 8 ++ include/net/sch_generic.h | 1 + io_uring/sqpoll.c | 8 ++ kernel/gcov/gcc_4_7.c | 4 +- kernel/gen_kheaders.sh | 9 +- kernel/kcov.c | 1 + kernel/padata.c | 8 +- kernel/rcu/rcutorture.c | 16 ++-- kernel/trace/Kconfig | 4 +- kernel/trace/preemptirq_delay_test.c | 1 + mm/page_table_check.c | 11 ++- net/batman-adv/originator.c | 2 + net/core/drop_monitor.c | 20 ++--- net/core/filter.c | 5 ++ net/core/net_namespace.c | 9 +- net/core/netpoll.c | 2 +- net/core/sock.c | 3 + net/ipv4/cipso_ipv4.c | 12 ++- net/ipv4/tcp_input.c | 1 + net/ipv6/route.c | 4 +- net/ipv6/seg6_local.c | 8 +- net/ipv6/xfrm6_policy.c | 8 +- net/netfilter/ipset/ip_set_core.c | 11 +-- net/netrom/nr_timer.c | 3 +- net/packet/af_packet.c | 26 +++--- net/sched/act_api.c | 66 ++++++++++----- net/sched/act_ct.c | 16 ++-- net/sched/sch_api.c | 1 + net/sched/sch_generic.c | 4 + net/sched/sch_htb.c | 22 +---- net/tipc/node.c | 1 + sound/hda/intel-dsp-config.c | 2 +- sound/pci/hda/patch_realtek.c | 10 ++- sound/soc/intel/boards/sof_sdw.c | 9 ++ tools/perf/Documentation/perf-script.txt | 7 +- tools/perf/builtin-script.c | 24 ++++-- tools/testing/selftests/arm64/tags/tags_test.c | 4 + .../selftests/bpf/prog_tests/btf_map_in_map.c | 26 +----- tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 ++- virt/kvm/kvm_main.c | 5 +- 135 files changed, 1112 insertions(+), 563 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/131 padata: Disable BH when taking works lock on MT path
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 58329c4312031603bb1786b44265c26d5065fe72 ]
As the old padata code can execute in softirq context, disable softirqs for the new padata_do_mutithreaded code too as otherwise lockdep will get antsy.
--- kernel/padata.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/padata.c +4 -4
@@ -98,7 +98,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data, {int i; -spin_lock (&padata_works_lock); +spin_lock_bh (&padata_works_lock);/* Start at 1 because the current task participates in the job. */ for (i =1 ; i < nworks; ++i) {struct padata_work *pw =padata_work_alloc ();
@@ -108,7 +108,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data,padata_work_init (pw, padata_mt_helper, data,0 );list_add (&pw->pw_list, head); } -spin_unlock (&padata_works_lock); +spin_unlock_bh (&padata_works_lock);return i; }
@@ -126,12 +126,12 @@ static void __init padata_works_free(struct list_head *works)if (list_empty (works))return ; -spin_lock (&padata_works_lock); +spin_lock_bh (&padata_works_lock);list_for_each_entry_safe (cur, next, works, pw_list) {list_del (&cur->pw_list);padata_work_free (cur); } -spin_unlock (&padata_works_lock); +spin_unlock_bh (&padata_works_lock); }static void padata_parallel_worker (struct work_struct *parallel_work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/131 crypto: hisilicon/sec - Fix memory leak for sec resource release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
[ Upstream commit bba4250757b4ae1680fea435a358d8093f254094 ]
The AIV is one of the SEC resources. When releasing resources, it need to release the AIV resources at the same time. Otherwise, memory leakage occurs.
The aiv resource release is added to the sec resource release function.
--- drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/crypto/hisilicon/sec2/sec_crypto.c +3 -1
@@ -479,8 +479,10 @@ static void sec_alg_resource_free(struct sec_ctx *ctx,if (ctx->pbuf_supported)sec_free_pbuf_resource (dev, qp_ctx->res); -if (ctx->alg_type ==SEC_AEAD ) +if (ctx->alg_type ==SEC_AEAD ) {sec_free_mac_resource (dev, qp_ctx->res); +sec_free_aiv_resource (dev, qp_ctx->res); + } } static int sec_alloc_qp_ctx_resource(struct hisi_qm *qm, struct sec_ctx *ctx,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/131 io_uring/sqpoll: work around a potential audit memory leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit c4ce0ab27646f4206a9eb502d6fe45cb080e1cae ]
kmemleak complains that there's a memory leak related to connect handling:
unreferenced object 0xffff0001093bdf00 (size 128):
comm "iou-sqp-455", pid 457, jiffies 4294894164
hex dump (first 32 bytes):
02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2e481b1a):
[<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 [<000000009c30bb45>] kmalloc_trace+0x228/0x358 [<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 [<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 [<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 [<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 [<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 [<00000000d999b491>] ret_from_fork+0x10/0x20
which can can happen if:
1) The command type does something on the prep side that triggers an audit call.
2) The thread hasn't done any operations before this that triggered an audit call inside ->issue(), where we have audit_uring_entry() and audit_uring_exit().
Work around this by issuing a blanket NOP operation before the SQPOLL does anything.
--- io_uring/sqpoll.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/sqpoll.c +8 -0
@@ -235,6 +235,14 @@ static int io_sq_thread(void *data)set_cpus_allowed_ptr (current, cpu_online_mask); current->flags |=PF_NO_SETAFFINITY ; +/* +* Force audit context to get setup, in case we do prep side async +* operations that would trigger an audit call before any issue side +* audit has been done. +*/ +audit_uring_entry (IORING_OP_NOP ); +audit_uring_exit (true,0 ); +mutex_lock (&sqd->lock);while (1 ) {bool cap_entries, sqt_spin = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/131 rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 8b9b443fa860276822b25057cb3ff3b28734dec0 ]
The "pipe_count > RCU_TORTURE_PIPE_LEN" check has a comment saying "Should not happen, but...". This is only true when testing an RCU whose grace periods are always long enough. This commit therefore fixes this comment.
--- kernel/rcu/rcutorture.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/rcu/rcutorture.c +2 -1
@@ -1946,7 +1946,8 @@ static bool rcu_torture_one_read(struct torture_random_state *trsp, long myid)preempt_disable (); pipe_count =READ_ONCE (p->rtort_pipe_count);if (pipe_count >RCU_TORTURE_PIPE_LEN ) { -/* Should not happen, but... */ +// Should not happen in a correct RCU implementation, +// happens quite often for torture_type=busted. pipe_count =RCU_TORTURE_PIPE_LEN ; } completed = cur_ops->get_gp_seq ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/131 rcutorture: Make stall-tasks directly exit when rcutorture tests end
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 431315a563015f259b28e34c5842f6166439e969 ]
When the rcutorture tests start to exit, the rcu_torture_cleanup() is invoked to stop kthreads and release resources, if the stall-task kthreads exist, cpu-stall has started and the rcutorture.stall_cpu is set to a larger value, the rcu_torture_cleanup() will be blocked for a long time and the hung-task may occur, this commit therefore add kthread_should_stop() to the loop of cpu-stall operation, when rcutorture tests ends, no need to wait for cpu-stall to end, exit directly.
Use the following command to test:
insmod rcutorture.ko torture_type=srcu fwd_progress=0 stat_interval=4 stall_cpu_block=1 stall_cpu=200 stall_cpu_holdoff=10 read_exit_burst=0 object_debug=1
rmmod rcutorture
[15361.918610] INFO: task rmmod:878 blocked for more than 122 seconds. [15361.918613] Tainted: G W 6.8.0-rc2-yoctodev-standard+ #25 [15361.918615] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [15361.918616] task:rmmod state:D stack:0 pid:878 tgid:878 ppid:773 flags:0x00004002 [15361.918621] Call Trace: [15361.918623] <TASK> [15361.918626] __schedule+0xc0d/0x28f0 [15361.918631] ? __pfx___schedule+0x10/0x10 [15361.918635] ? rcu_is_watching+0x19/0xb0 [15361.918638] ? schedule+0x1f6/0x290 [15361.918642] ? __pfx_lock_release+0x10/0x10 [15361.918645] ? schedule+0xc9/0x290 [15361.918648] ? schedule+0xc9/0x290 [15361.918653] ? trace_preempt_off+0x54/0x100 [15361.918657] ? schedule+0xc9/0x290 [15361.918661] schedule+0xd0/0x290 [15361.918665] schedule_timeout+0x56d/0x7d0 [15361.918669] ? debug_smp_processor_id+0x1b/0x30 [15361.918672] ? rcu_is_watching+0x19/0xb0 [15361.918676] ? __pfx_schedule_timeout+0x10/0x10 [15361.918679] ? debug_smp_processor_id+0x1b/0x30 [15361.918683] ? rcu_is_watching+0x19/0xb0 [15361.918686] ? wait_for_completion+0x179/0x4c0 [15361.918690] ? __pfx_lock_release+0x10/0x10 [15361.918693] ? __kasan_check_write+0x18/0x20 [15361.918696] ? wait_for_completion+0x9d/0x4c0 [15361.918700] ? _raw_spin_unlock_irq+0x36/0x50 [15361.918703] ? wait_for_completion+0x179/0x4c0 [15361.918707] ? _raw_spin_unlock_irq+0x36/0x50 [15361.918710] ? wait_for_completion+0x179/0x4c0 [15361.918714] ? trace_preempt_on+0x54/0x100 [15361.918718] ? wait_for_completion+0x179/0x4c0 [15361.918723] wait_for_completion+0x181/0x4c0 [15361.918728] ? __pfx_wait_for_completion+0x10/0x10 [15361.918738] kthread_stop+0x152/0x470 [15361.918742] _torture_stop_kthread+0x44/0xc0 [torture 7af7f9cbba28271a10503b653f9e05d518fbc8c3] [15361.918752] rcu_torture_cleanup+0x2ac/0xe90 [rcutorture f2cb1f556ee7956270927183c4c2c7749a336529] [15361.918766] ? __pfx_rcu_torture_cleanup+0x10/0x10 [rcutorture f2cb1f556ee7956270927183c4c2c7749a336529] [15361.918777] ? __kasan_check_write+0x18/0x20 [15361.918781] ? __mutex_unlock_slowpath+0x17c/0x670 [15361.918789] ? __might_fault+0xcd/0x180 [15361.918793] ? find_module_all+0x104/0x1d0 [15361.918799] __x64_sys_delete_module+0x2a4/0x3f0 [15361.918803] ? __pfx___x64_sys_delete_module+0x10/0x10 [15361.918807] ? syscall_exit_to_user_mode+0x149/0x280
--- kernel/rcu/rcutorture.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/rcutorture.c +2 -2
@@ -2419,8 +2419,8 @@ static int rcu_torture_stall(void *args)preempt_disable ();pr_alert ("%s start on CPU %d.\n" , __func__,raw_smp_processor_id ()); -while (ULONG_CMP_LT ((unsigned long )ktime_get_seconds (), - stop_at)) +while (ULONG_CMP_LT ((unsigned long )ktime_get_seconds (), stop_at) && + !kthread_should_stop ())if (stall_cpu_block) {#ifdef CONFIG_PREEMPTION preempt_schedule ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/131 rcutorture: Fix invalid context warning when enable srcu barrier testing
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 668c0406d887467d53f8fe79261dda1d22d5b671 ]
When the torture_type is set srcu or srcud and cb_barrier is non-zero, running the rcutorture test will trigger the following warning:
[ 163.910989][ C1] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 163.910994][ C1] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 163.910999][ C1] preempt_count: 10001, expected: 0 [ 163.911002][ C1] RCU nest depth: 0, expected: 0 [ 163.911005][ C1] INFO: lockdep is turned off. [ 163.911007][ C1] irq event stamp: 30964 [ 163.911010][ C1] hardirqs last enabled at (30963): [<ffffffffabc7df52>] do_idle+0x362/0x500 [ 163.911018][ C1] hardirqs last disabled at (30964): [<ffffffffae616eff>] sysvec_call_function_single+0xf/0xd0 [ 163.911025][ C1] softirqs last enabled at (0): [<ffffffffabb6475f>] copy_process+0x16ff/0x6580 [ 163.911033][ C1] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 163.911038][ C1] Preemption disabled at: [ 163.911039][ C1] [<ffffffffacf1964b>] stack_depot_save_flags+0x24b/0x6c0 [ 163.911063][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 6.8.0-rc4-rt4-yocto-preempt-rt+ #3 1e39aa9a737dd024a3275c4f835a872f673a7d3a [ 163.911071][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [ 163.911075][ C1] Call Trace: [ 163.911078][ C1] <IRQ> [ 163.911080][ C1] dump_stack_lvl+0x88/0xd0 [ 163.911089][ C1] dump_stack+0x10/0x20 [ 163.911095][ C1] __might_resched+0x36f/0x530 [ 163.911105][ C1] rt_spin_lock+0x82/0x1c0 [ 163.911112][ C1] spin_lock_irqsave_ssp_contention+0xb8/0x100 [ 163.911121][ C1] srcu_gp_start_if_needed+0x782/0xf00 [ 163.911128][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x70 [ 163.911136][ C1] ? debug_object_active_state+0x336/0x470 [ 163.911148][ C1] ? __pfx_srcu_gp_start_if_needed+0x10/0x10 [ 163.911156][ C1] ? __pfx_lock_release+0x10/0x10 [ 163.911165][ C1] ? __pfx_rcu_torture_barrier_cbf+0x10/0x10 [ 163.911188][ C1] __call_srcu+0x9f/0xe0 [ 163.911196][ C1] call_srcu+0x13/0x20 [ 163.911201][ C1] srcu_torture_call+0x1b/0x30 [ 163.911224][ C1] rcu_torture_barrier1cb+0x4a/0x60 [ 163.911247][ C1] __flush_smp_call_function_queue+0x267/0xca0 [ 163.911256][ C1] ? __pfx_rcu_torture_barrier1cb+0x10/0x10 [ 163.911281][ C1] generic_smp_call_function_single_interrupt+0x13/0x20 [ 163.911288][ C1] __sysvec_call_function_single+0x7d/0x280 [ 163.911295][ C1] sysvec_call_function_single+0x93/0xd0 [ 163.911302][ C1] </IRQ> [ 163.911304][ C1] <TASK> [ 163.911308][ C1] asm_sysvec_call_function_single+0x1b/0x20 [ 163.911313][ C1] RIP: 0010:default_idle+0x17/0x20 [ 163.911326][ C1] RSP: 0018:ffff888001997dc8 EFLAGS: 00000246 [ 163.911333][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffae618b51 [ 163.911337][ C1] RDX: 0000000000000000 RSI: ffffffffaea80920 RDI: ffffffffaec2de80 [ 163.911342][ C1] RBP: ffff888001997dc8 R08: 0000000000000001 R09: ffffed100d740cad [ 163.911346][ C1] R10: ffffed100d740cac R11: ffff88806ba06563 R12: 0000000000000001 [ 163.911350][ C1] R13: ffffffffafe460c0 R14: ffffffffafe460c0 R15: 0000000000000000 [ 163.911358][ C1] ? ct_kernel_exit.constprop.3+0x121/0x160 [ 163.911369][ C1] ? lockdep_hardirqs_on+0xc4/0x150 [ 163.911376][ C1] arch_cpu_idle+0x9/0x10 [ 163.911383][ C1] default_idle_call+0x7a/0xb0 [ 163.911390][ C1] do_idle+0x362/0x500 [ 163.911398][ C1] ? __pfx_do_idle+0x10/0x10 [ 163.911404][ C1] ? complete_with_flags+0x8b/0xb0 [ 163.911416][ C1] cpu_startup_entry+0x58/0x70 [ 163.911423][ C1] start_secondary+0x221/0x280 [ 163.911430][ C1] ? __pfx_start_secondary+0x10/0x10 [ 163.911440][ C1] secondary_startup_64_no_verify+0x17f/0x18b [ 163.911455][ C1] </TASK>
This commit therefore use smp_call_on_cpu() instead of smp_call_function_single(), make rcu_torture_barrier1cb() invoked happens on task-context.
--- kernel/rcu/rcutorture.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
kernel/rcu/rcutorture.c +4 -5
@@ -2968,11 +2968,12 @@ static void rcu_torture_barrier_cbf(struct rcu_head *rcu) }/* IPI handler to get callback posted on desired CPU, if online. */ -static void rcu_torture_barrier1cb (void *rcu_void) +static int rcu_torture_barrier1cb (void *rcu_void) {struct rcu_head *rhp = rcu_void; cur_ops->call (rhp, rcu_torture_barrier_cbf); +return 0 ; }/* kthread function to register callbacks used to test RCU barriers. */
@@ -2998,11 +2999,9 @@ static int rcu_torture_barrier_cbs(void *arg)* The above smp_load_acquire() ensures barrier_phase load * is ordered before the following ->call(). */ -if (smp_call_function_single (myid, rcu_torture_barrier1cb, - &rcu,1 )) { -// IPI failed, so use direct call from current CPU. +if (smp_call_on_cpu (myid, rcu_torture_barrier1cb, &rcu,1 )) cur_ops->call (&rcu, rcu_torture_barrier_cbf); - } +if (atomic_dec_and_test (&barrier_cbs_count))wake_up (&barrier_wq); }while (!torture_must_stop ());
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/131 block/ioctl: prefer different overflow check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Stitt <[email protected]>
[ Upstream commit ccb326b5f9e623eb7f130fbbf2505ec0e2dcaff9 ]
Running syzkaller with the newly reintroduced signed integer overflow sanitizer shows this report:
[ 62.982337] ------------[ cut here ]------------ [ 62.985692] cgroup: Invalid name [ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 [ 62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1 [ 62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long' [ 62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1 [ 62.999369] random: crng reseeded on system resumption [ 63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000) [ 63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.000682] Call Trace: [ 63.000686] <TASK> [ 63.000731] dump_stack_lvl+0x93/0xd0 [ 63.000919] __get_user_pages+0x903/0xd30 [ 63.001030] __gup_longterm_locked+0x153e/0x1ba0 [ 63.001041] ? _raw_read_unlock_irqrestore+0x17/0x50 [ 63.001072] ? try_get_folio+0x29c/0x2d0 [ 63.001083] internal_get_user_pages_fast+0x1119/0x1530 [ 63.001109] iov_iter_extract_pages+0x23b/0x580 [ 63.001206] bio_iov_iter_get_pages+0x4de/0x1220 [ 63.001235] iomap_dio_bio_iter+0x9b6/0x1410 [ 63.001297] __iomap_dio_rw+0xab4/0x1810 [ 63.001316] iomap_dio_rw+0x45/0xa0 [ 63.001328] ext4_file_write_iter+0xdde/0x1390 [ 63.001372] vfs_write+0x599/0xbd0 [ 63.001394] ksys_write+0xc8/0x190 [ 63.001403] do_syscall_64+0xd4/0x1b0 [ 63.001421] ? arch_exit_to_user_mode_prepare+0x3a/0x60 [ 63.001479] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.001535] RIP: 0033:0x7f7fd3ebf539 [ 63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539 [ 63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004 [ 63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000 [ 63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8 ... [ 63.018142] ---[ end trace ]---
Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with -fwrapv but this has since been changed [1] in the newest version of Clang; It was re-enabled in the kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow sanitizer").
Let's rework this overflow checking logic to not actually perform an overflow during the check itself, thus avoiding the UBSAN splat.
[1]: https://github.com/llvm/llvm-project/pull/82432
--- block/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/ioctl.c +1 -1
@@ -33,7 +33,7 @@ static int blkpg_do_ioctl(struct block_device *bdev,if (op ==BLKPG_DEL_PARTITION )return bdev_del_partition (disk, p.pno); -if (p.start <0 || p.length <=0 || p.start + p.length <0 ) +if (p.start <0 || p.length <=0 ||LLONG_MAX - p.length < p.start)return -EINVAL ;/* Check that the partition is aligned to the block size */ if (!IS_ALIGNED (p.start | p.length,bdev_logical_block_size (bdev)))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/131 selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessandro Carminati (Red Hat) <[email protected]>
[ Upstream commit f803bcf9208a2540acb4c32bdc3616673169f490 ]
In some systems, the netcat server can incur in delay to start listening. When this happens, the test can randomly fail in various points. This is an example error message:
# ip gre none gso # encap 192.168.1.1 to 192.168.1.2, type gre, mac none len 2000 # test basic connectivity # Ncat: Connection refused.
The issue stems from a race condition between the netcat client and server. The test author had addressed this problem by implementing a sleep, which I have removed in this patch.
This patch introduces a function capable of sleeping for up to two seconds. However, it can terminate the waiting period early if the port is reported to be listening.
--- tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_tc_tunnel.sh +12 -1
@@ -72,7 +72,6 @@ cleanup() { server_listen() { ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" & server_pid=$! - sleep 0.2 } client_connect() {
@@ -93,6 +92,16 @@ verify_data() { fi } +wait_for_port() { + for i in $(seq 20); do + if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then + return 0 + fi + sleep 0.1 + done + return 1 +} + set -e # no arguments: automated test, run all
@@ -190,6 +199,7 @@ setup # basic communication works echo "test basic connectivity" server_listen +wait_for_port ${port} ${netcat_opt} client_connect verify_data
@@ -201,6 +211,7 @@ ip netns exec "${ns1}" tc filter add dev veth1 egress \ section "encap_${tuntype}_${mac}" echo "test bpf encap without decap (expect failure)" server_listen +wait_for_port ${port} ${netcat_opt} ! client_connect if [[ "$tuntype" =~ "udp" ]]; then
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/131 selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 14bb1e8c8d4ad5d9d2febb7d19c70a3cf536e1e5 ]
Recently, I frequently hit the following test failure:
[root@arch-fb-vm1 bpf]# ./test_progs -n 33/1 test_lookup_update:PASS:skel_open 0 nsec [...]
test_lookup_update:PASS:sync_rcu 0 nsec test_lookup_update:FAIL:map1_leak inner_map1 leaked!
#33/1 btf_map_in_map/lookup_update:FAIL
#33 btf_map_in_map:FAIL
In the test, after map is closed and then after two rcu grace periods, it is assumed that map_id is not available to user space.
But the above assumption cannot be guaranteed. After zero or one or two rcu grace periods in different siturations, the actual freeing-map-work is put into a workqueue. Later on, when the work is dequeued, the map will be actually freed.
See bpf_map_put() in kernel/bpf/syscall.c.
By using workqueue, there is no ganrantee that map will be actually freed after a couple of rcu grace periods. This patch removed such map leak detection and then the test can pass consistently.
--- .../selftests/bpf/prog_tests/btf_map_in_map.c | 26 +------------------ 1 file changed, 1 insertion(+), 25 deletions(-)
tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c +1 -25
@@ -25,7 +25,7 @@ static void test_lookup_update(void)int map1_fd, map2_fd, map3_fd, map4_fd, map5_fd, map1_id, map2_id;int outer_arr_fd, outer_hash_fd, outer_arr_dyn_fd;struct test_btf_map_in_map *skel; -int err, key =0 , val, i, fd; +int err, key =0 , val, i; skel =test_btf_map_in_map__open_and_load ();if (CHECK (!skel,"skel_open" ,"failed to open&load skeleton\n" ))
@@ -102,30 +102,6 @@ static void test_lookup_update(void)CHECK (map1_id ==0 ,"map1_id" ,"failed to get ID 1\n" );CHECK (map2_id ==0 ,"map2_id" ,"failed to get ID 2\n" ); -test_btf_map_in_map__destroy (skel); - skel =NULL ; - -/* we need to either wait for or force synchronize_rcu(), before -* checking for "still exists" condition, otherwise map could still be -* resolvable by ID, causing false positives. -* -* Older kernels (5.8 and earlier) freed map only after two -* synchronize_rcu()s, so trigger two, to be entirely sure. -*/ -CHECK (kern_sync_rcu (),"sync_rcu" ,"failed\n" ); -CHECK (kern_sync_rcu (),"sync_rcu" ,"failed\n" ); - - fd =bpf_map_get_fd_by_id (map1_id); -if (CHECK (fd >=0 ,"map1_leak" ,"inner_map1 leaked!\n" )) { -close (fd); - goto cleanup; - } - fd =bpf_map_get_fd_by_id (map2_id); -if (CHECK (fd >=0 ,"map2_leak" ,"inner_map2 leaked!\n" )) { -close (fd); - goto cleanup; - } - cleanup:test_btf_map_in_map__destroy (skel); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/131 batman-adv: bypass empty buckets in batadv_purge_orig_ref()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ]
Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1]
Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports.
[1]
watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386
sp : ffff800099007970
x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000
x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001
x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4
x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0
x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001
x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000
Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103
sp : ffff800093a17d30
x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4
x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002
x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000
x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396
x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001
x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000
Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404
--- net/batman-adv/originator.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/originator.c +2 -0
@@ -1238,6 +1238,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv)/* for all origins... */ for (i =0 ; i < hash->size; i++) { head = &hash->table[i]; +if (hlist_empty (head)) +continue ; list_lock = &hash->list_locks[i];spin_lock_bh (list_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/131 wifi: ath9k: work around memset overflow warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 61752ac69b69ed2e04444d090f6917c77ab36d42 ]
gcc-9 and some other older versions produce a false-positive warning for zeroing two fields
In file included from include/linux/string.h:369,
from drivers/net/wireless/ath/ath9k/main.c:18:
In function 'fortify_memset_chk',
inlined from 'ath9k_ps_wakeup' at drivers/net/wireless/ath/ath9k/main.c:140:3:include/linux/fortify-string.h:462:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
462 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Using a struct_group seems to reliably avoid the warning and not make the code much uglier. The combined memset() should even save a couple of cpu cycles.
--- drivers/net/wireless/ath/ath.h | 6 ++++-- drivers/net/wireless/ath/ath9k/main.c | 3 +-- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath.h +4 -2
@@ -171,8 +171,10 @@ struct ath_common {unsigned int clockrate;spinlock_t cc_lock; -struct ath_cycle_counters cc_ani; -struct ath_cycle_counters cc_survey; +struct_group (cc, + struct ath_cycle_counters cc_ani; + struct ath_cycle_counters cc_survey; + );struct ath_regulatory regulatory;struct ath_regulatory reg_world_copy;
drivers/net/wireless/ath/ath9k/main.c +1 -2
@@ -135,8 +135,7 @@ void ath9k_ps_wakeup(struct ath_softc *sc)if (power_mode !=ATH9K_PM_AWAKE ) {spin_lock (&common->cc_lock);ath_hw_cycle_counters_update (common); -memset (&common->cc_survey,0 ,sizeof (common->cc_survey)); -memset (&common->cc_ani,0 ,sizeof (common->cc_ani)); +memset (&common->cc,0 ,sizeof (common->cc));spin_unlock (&common->cc_lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/131 af_packet: avoid a false positive warning in packet_setsockopt()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 86d43e2bf93ccac88ef71cee36a23282ebd9e427 ]
Although the code is correct, the following line
copy_from_sockptr(&req_u.req, optval, len));
triggers this warning :
memcpy: detected field-spanning write (size 28) of single field "dst" at include/linux/sockptr.h:49 (size 16)
Refactor the code to be more explicit.
--- net/packet/af_packet.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-)
net/packet/af_packet.c +14 -12
@@ -3791,28 +3791,30 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,case PACKET_TX_RING : {union tpacket_req_u req_u; -int len; + ret = -EINVAL ;lock_sock (sk);switch (po->tp_version) {case TPACKET_V1 :case TPACKET_V2 : - len =sizeof (req_u.req); +if (optlen <sizeof (req_u.req)) +break ; + ret =copy_from_sockptr (&req_u.req, optval, +sizeof (req_u.req)) ? + -EINVAL :0 ;break ;case TPACKET_V3 :default : - len =sizeof (req_u.req3); +if (optlen <sizeof (req_u.req3)) +break ; + ret =copy_from_sockptr (&req_u.req3, optval, +sizeof (req_u.req3)) ? + -EINVAL :0 ;break ; } -if (optlen < len) { - ret = -EINVAL ; - }else { -if (copy_from_sockptr (&req_u.req, optval, len)) - ret = -EFAULT ; -else - ret =packet_set_ring (sk, &req_u,0 , - optname ==PACKET_TX_RING ); - } +if (!ret) + ret =packet_set_ring (sk, &req_u,0 , + optname ==PACKET_TX_RING );release_sock (sk);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/131 drop_monitor: replace spin_lock by raw_spin_lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <[email protected]>
[ Upstream commit f1e197a665c2148ebc25fe09c53689e60afea195 ]
trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47preempt_count: 1, expected: 0
RCU nest depth: 2, expected: 2
5 locks held by rcuc/47/449:
#0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290
irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ? _raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520
...
trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock.
Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context.
--- net/core/drop_monitor.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
net/core/drop_monitor.c +10 -10
@@ -72,7 +72,7 @@ struct net_dm_hw_entries { };struct per_cpu_dm_data { -spinlock_t lock;/* Protects 'skb', 'hw_entries' and +raw_spinlock_t lock;/* Protects 'skb', 'hw_entries' and * 'send_timer' */ union {
@@ -166,9 +166,9 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) err:mod_timer (&data->send_timer, jiffies +HZ /10 ); out: -spin_lock_irqsave (&data->lock, flags); +raw_spin_lock_irqsave (&data->lock, flags);swap (data->skb, skb); -spin_unlock_irqrestore (&data->lock, flags); +raw_spin_unlock_irqrestore (&data->lock, flags);if (skb) {struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
@@ -223,7 +223,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)local_irq_save (flags); data =this_cpu_ptr (&dm_cpu_data); -spin_lock (&data->lock); +raw_spin_lock (&data->lock); dskb = data->skb;if (!dskb)
@@ -257,7 +257,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) } out: -spin_unlock_irqrestore (&data->lock, flags); +raw_spin_unlock_irqrestore (&data->lock, flags); } static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb,
@@ -312,9 +312,9 @@ net_dm_hw_reset_per_cpu_data(struct per_cpu_dm_data *hw_data)mod_timer (&hw_data->send_timer, jiffies +HZ /10 ); } -spin_lock_irqsave (&hw_data->lock, flags); +raw_spin_lock_irqsave (&hw_data->lock, flags);swap (hw_data->hw_entries, hw_entries); -spin_unlock_irqrestore (&hw_data->lock, flags); +raw_spin_unlock_irqrestore (&hw_data->lock, flags);return hw_entries; }
@@ -446,7 +446,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink,return ; hw_data =this_cpu_ptr (&dm_hw_cpu_data); -spin_lock_irqsave (&hw_data->lock, flags); +raw_spin_lock_irqsave (&hw_data->lock, flags); hw_entries = hw_data->hw_entries;if (!hw_entries)
@@ -475,7 +475,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink, } out: -spin_unlock_irqrestore (&hw_data->lock, flags); +raw_spin_unlock_irqrestore (&hw_data->lock, flags); }static const struct net_dm_alert_ops net_dm_alert_summary_ops = {
@@ -1658,7 +1658,7 @@ static struct notifier_block dropmon_net_notifier = {static void __net_dm_cpu_data_init (struct per_cpu_dm_data *data) { -spin_lock_init (&data->lock); +raw_spin_lock_init (&data->lock);skb_queue_head_init (&data->drop_queue);u64_stats_init (&data->stats.syncp); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/131 scsi: qedi: Fix crash while reading debugfs attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <[email protected]>
[ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ]
The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash.
To fix this issue, use a small local stack buffer for sprintf() and then call simple_read_from_buffer(), which in turns make the copy_to_user() call.
BUG: unable to handle page fault for address: 00007f4801111000 PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 Oops: 0002 [#1] PREEMPT SMP PTI Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 RIP: 0010:memcpy_orig+0xcd/0x130 RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x183/0x510 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x22/0x30 ? memcpy_orig+0xcd/0x130 vsnprintf+0x102/0x4c0 sprintf+0x51/0x80 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] full_proxy_read+0x50/0x80 vfs_read+0xa5/0x2e0 ? folio_add_new_anon_rmap+0x44/0xa0 ? set_pte_at+0x15/0x30 ? do_pte_missing+0x426/0x7f0 ksys_read+0xa5/0xe0 do_syscall_64+0x58/0x80 ? __count_memcg_events+0x46/0x90 ? count_memcg_event_mm+0x3d/0x60 ? handle_mm_fault+0x196/0x2f0 ? do_user_addr_fault+0x267/0x890 ? exc_page_fault+0x69/0x150 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f4800f20b4d
--- drivers/scsi/qedi/qedi_debugfs.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/scsi/qedi/qedi_debugfs.c +4 -8
@@ -120,15 +120,11 @@ static ssize_t qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { - size_t cnt = 0; - -if (*ppos) -return 0 ; + char buf[64]; +int len; - cnt =sprintf (buffer,"do_not_recover=%d\n" , qedi_do_not_recover); - cnt =min_t (int, count, cnt - *ppos); - *ppos += cnt; -return cnt; + len =sprintf (buf,"do_not_recover=%d\n" , qedi_do_not_recover); +return simple_read_from_buffer (buffer, count, ppos, buf, len); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/131 net/sched: fix false lockdep warning on qdisc root lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
[ Upstream commit af0cb3fa3f9ed258d14abab0152e28a0f9593084 ]
Xiumei and Christoph reported the following lockdep splat, complaining of the qdisc root lock being taken twice:
============================================
WARNING: possible recursive locking detected
6.7.0-rc3+ #598 Not tainted
--------------------------------------------
swapper/2/0 is trying to acquire lock:
ffff888177190110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70
but task is already holding lock:
ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&sch->q.lock);
lock(&sch->q.lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
5 locks held by swapper/2/0:
#0: ffff888135a09d98 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x510 #1: ffffffffaaee5260 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x2c0/0x1ed0 #2: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70 #3: ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70 #4: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70
stack backtrace: CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.7.0-rc3+ #598 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x4a/0x80 __lock_acquire+0xfdd/0x3150 lock_acquire+0x1ca/0x540 _raw_spin_lock+0x34/0x80 __dev_queue_xmit+0x1560/0x2e70 tcf_mirred_act+0x82e/0x1260 [act_mirred] tcf_action_exec+0x161/0x480 tcf_classify+0x689/0x1170 prio_enqueue+0x316/0x660 [sch_prio] dev_qdisc_enqueue+0x46/0x220 __dev_queue_xmit+0x1615/0x2e70 ip_finish_output2+0x1218/0x1ed0 __ip_finish_output+0x8b3/0x1350 ip_output+0x163/0x4e0 igmp_ifc_timer_expire+0x44b/0x930 call_timer_fn+0x1a2/0x510 run_timer_softirq+0x54d/0x11a0 __do_softirq+0x1b3/0x88f irq_exit_rcu+0x18f/0x1e0 sysvec_apic_timer_interrupt+0x6f/0x90 </IRQ>
This happens when TC does a mirred egress redirect from the root qdisc of device A to the root qdisc of device B. As long as these two locks aren't protecting the same qdisc, they can be acquired in chain: add a per-qdisc lockdep key to silence false warnings.
This dynamic key should safely replace the static key we have in sch_htb:
it was added to allow enqueueing to the device "direct qdisc" while still holding the qdisc root lock.
v2: don't use static keys anymore in HTB direct qdiscs (thanks Eric Dumazet)
--- include/net/sch_generic.h | 1 + net/sched/sch_generic.c | 3 +++ net/sched/sch_htb.c | 22 +++------------------- 3 files changed, 7 insertions(+), 19 deletions(-)
include/net/sch_generic.h +1 -0
@@ -126,6 +126,7 @@ struct Qdisc {struct rcu_head rcu;netdevice_tracker dev_tracker; +struct lock_class_key root_lock_key;/* private data */ long privdata[]____cacheline_aligned ; };
net/sched/sch_generic.c +3 -0
@@ -942,7 +942,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,__skb_queue_head_init (&sch->gso_skb);__skb_queue_head_init (&sch->skb_bad_txq);gnet_stats_basic_sync_init (&sch->bstats); +lockdep_register_key (&sch->root_lock_key);spin_lock_init (&sch->q.lock); +lockdep_set_class (&sch->q.lock, &sch->root_lock_key);if (ops->static_flags &TCQ_F_CPUSTATS ) { sch->cpu_bstats =
@@ -1062,6 +1064,7 @@ static void __qdisc_destroy(struct Qdisc *qdisc)if (ops->destroy) ops->destroy (qdisc); +lockdep_unregister_key (&qdisc->root_lock_key);module_put (ops->owner);netdev_put (qdisc_dev (qdisc), &qdisc->dev_tracker);
net/sched/sch_htb.c +3 -19
@@ -1036,13 +1036,6 @@ static void htb_work_func(struct work_struct *work)rcu_read_unlock (); } -static void htb_set_lockdep_class_child (struct Qdisc *q) -{ -static struct lock_class_key child_key; - -lockdep_set_class (qdisc_lock (q), &child_key); -} -static int htb_offload (struct net_device *dev,struct tc_htb_qopt_offload *opt) {return dev->netdev_ops->ndo_setup_tc (dev,TC_SETUP_QDISC_HTB , opt);
@@ -1129,7 +1122,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt,return -ENOMEM ; } -htb_set_lockdep_class_child (qdisc); q->direct_qdiscs[ntx] = qdisc; qdisc->flags |=TCQ_F_ONETXQUEUE |TCQ_F_NOPARENT ; }
@@ -1465,7 +1457,6 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, }if (q->offload) { -htb_set_lockdep_class_child (new);/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ qdisc_refcount_inc (new); old_q =htb_graft_helper (dev_queue, new);
@@ -1728,11 +1719,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg, new_q =qdisc_create_dflt (dev_queue, &pfifo_qdisc_ops, cl->parent->common.classid,NULL ); -if (q->offload) { -if (new_q) -htb_set_lockdep_class_child (new_q); +if (q->offload)htb_parent_to_leaf_offload (sch, dev_queue, new_q); - } }sch_tree_lock (sch);
@@ -1946,13 +1934,9 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, new_q =qdisc_create_dflt (dev_queue, &pfifo_qdisc_ops, classid,NULL );if (q->offload) { -if (new_q) { -htb_set_lockdep_class_child (new_q); -/* One ref for cl->leaf.q, the other for -* dev_queue->qdisc. -*/ +/* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ +if (new_q)qdisc_refcount_inc (new_q); - } old_q =htb_graft_helper (dev_queue, new_q);/* No qdisc_put needed. */ WARN_ON (!(old_q->flags &TCQ_F_BUILTIN ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/131 kselftest: arm64: Add a null pointer check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 80164282b3620a3cb73de6ffda5592743e448d0e ]
There is a 'malloc' call, which can be unsuccessful. This patch will add the malloc failure checking
to avoid possible null dereference and give more information about test fail reasons.
--- tools/testing/selftests/arm64/tags/tags_test.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/arm64/tags/tags_test.c +4 -0
@@ -6,6 +6,7 @@#include <stdint.h> #include <sys/prctl.h> #include <sys/utsname.h> +#include "../../kselftest.h" #define SHIFT_TAG (tag) ((uint64_t)(tag) << 56)#define SET_TAG (ptr, tag) (((uint64_t)(ptr) & ~SHIFT_TAG(0xff)) | \
@@ -21,6 +22,9 @@ int main(void)if (prctl (PR_SET_TAGGED_ADDR_CTRL ,PR_TAGGED_ADDR_ENABLE ,0 ,0 ,0 ) ==0 ) tbi_enabled =1 ; ptr = (struct utsname *)malloc (sizeof (*ptr)); +if (!ptr) +ksft_exit_fail_msg ("Failed to allocate utsname buffer\n" ); +if (tbi_enabled) tag =0x42 ; ptr = (struct utsname *)SET_TAG (ptr, tag);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/131 net: dsa: realtek: keep default LED state in rtl8366rb
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Angelo Daros de Luca <[email protected]>
[ Upstream commit 5edc6585aafefa3d44fb8a84adf241d90227f7a3 ]
This switch family supports four LEDs for each of its six ports. Each LED group is composed of one of these four LEDs from all six ports. LED groups can be configured to display hardware information, such as link activity, or manually controlled through a bitmap in registers RTL8366RB_LED_0_1_CTRL_REG and RTL8366RB_LED_2_3_CTRL_REG.
After a reset, the default LED group configuration for groups 0 to 3 indicates, respectively, link activity, link at 1000M, 100M, and 10M, or RTL8366RB_LED_CTRL_REG as 0x5432. These configurations are commonly used for LED indications. However, the driver was replacing that configuration to use manually controlled LEDs (RTL8366RB_LED_FORCE) without providing a way for the OS to control them. The default configuration is deemed more useful than fixed, uncontrollable turned-on LEDs.
The driver was enabling/disabling LEDs during port_enable/disable. However, these events occur when the port is administratively controlled (up or down) and are not related to link presence. Additionally, when a port N was disabled, the driver was turning off all LEDs for group N, not only the corresponding LED for port N in any of those 4 groups. In such cases, if port 0 was brought down, the LEDs for all ports in LED group 0 would be turned off. As another side effect, the driver was wrongly warning that port 5 didn't have an LED ("no LED for port 5"). Since showing the administrative state of ports is not an orthodox way to use LEDs, it was not worth it to fix it and all this code was dropped.
The code to disable LEDs was simplified only changing each LED group to the RTL8366RB_LED_OFF state. Registers RTL8366RB_LED_0_1_CTRL_REG and RTL8366RB_LED_2_3_CTRL_REG are only used when the corresponding LED group is configured with RTL8366RB_LED_FORCE and they don't need to be cleaned. The code still references an LED controlled by RTL8366RB_INTERRUPT_CONTROL_REG, but as of now, no test device has actually used it. Also, some magic numbers were replaced by macros.
--- drivers/net/dsa/realtek/rtl8366rb.c | 87 +++++++---------------------- 1 file changed, 20 insertions(+), 67 deletions(-)
drivers/net/dsa/realtek/rtl8366rb.c +20 -67
@@ -186,7 +186,12 @@#define RTL8366RB_LED_BLINKRATE_222MS 0x0004#define RTL8366RB_LED_BLINKRATE_446MS 0x0005 +/* LED trigger event for each group */ #define RTL8366RB_LED_CTRL_REG 0x0431 +#define RTL8366RB_LED_CTRL_OFFSET (led_group) \ + (4 * (led_group)) +#define RTL8366RB_LED_CTRL_MASK (led_group) \ + (0xf << RTL8366RB_LED_CTRL_OFFSET(led_group))#define RTL8366RB_LED_OFF 0x0#define RTL8366RB_LED_DUP_COL 0x1#define RTL8366RB_LED_LINK_ACT 0x2
@@ -203,6 +208,11 @@#define RTL8366RB_LED_LINK_TX 0xd#define RTL8366RB_LED_MASTER 0xe#define RTL8366RB_LED_FORCE 0xf + +/* The RTL8366RB_LED_X_X registers are used to manually set the LED state only +* when the corresponding LED group in RTL8366RB_LED_CTRL_REG is +* RTL8366RB_LED_FORCE. Otherwise, it is ignored. +*/ #define RTL8366RB_LED_0_1_CTRL_REG 0x0432#define RTL8366RB_LED_1_OFFSET 6#define RTL8366RB_LED_2_3_CTRL_REG 0x0433
@@ -998,28 +1008,20 @@ static int rtl8366rb_setup(struct dsa_switch *ds)*/ if (priv->leds_disabled) {/* Turn everything off */ -regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x0FFF ,0 ); -regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x0FFF ,0 );regmap_update_bits (priv->map,RTL8366RB_INTERRUPT_CONTROL_REG ,RTL8366RB_P4_RGMII_LED ,0 ); - val =RTL8366RB_LED_OFF ; - }else { -/* TODO: make this configurable per LED */ - val =RTL8366RB_LED_FORCE ; - } -for (i =0 ; i <4 ; i++) { - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_CTRL_REG , -0xf << (i *4 ), - val << (i *4 )); -if (ret) -return ret; + +for (i =0 ; i <RTL8366RB_NUM_LEDGROUPS ; i++) { + val =RTL8366RB_LED_OFF <<RTL8366RB_LED_CTRL_OFFSET (i); + ret =regmap_update_bits (priv->map, +RTL8366RB_LED_CTRL_REG , +RTL8366RB_LED_CTRL_MASK (i), + val); +if (ret) +return ret; + } } ret =rtl8366_reset_vlan (priv);
@@ -1108,52 +1110,6 @@ rtl8366rb_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode, } } -static void rb8366rb_set_port_led (struct realtek_priv *priv, -int port,bool enable) -{ -u16 val = enable ?0x3f :0 ; -int ret; - -if (priv->leds_disabled) -return ; - -switch (port) { -case 0 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x3F , val); -break ; -case 1 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_0_1_CTRL_REG , -0x3F <<RTL8366RB_LED_1_OFFSET , - val <<RTL8366RB_LED_1_OFFSET ); -break ; -case 2 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x3F , val); -break ; -case 3 : - ret =regmap_update_bits (priv->map, -RTL8366RB_LED_2_3_CTRL_REG , -0x3F <<RTL8366RB_LED_3_OFFSET , - val <<RTL8366RB_LED_3_OFFSET ); -break ; -case 4 : - ret =regmap_update_bits (priv->map, -RTL8366RB_INTERRUPT_CONTROL_REG , -RTL8366RB_P4_RGMII_LED , - enable ?RTL8366RB_P4_RGMII_LED :0 ); -break ; -default : -dev_err (priv->dev,"no LED for port %d\n" , port); -return ; - } -if (ret) -dev_err (priv->dev,"error updating LED on port %d\n" , port); -} -static int rtl8366rb_port_enable (struct dsa_switch *ds,int port,struct phy_device *phy)
@@ -1167,7 +1123,6 @@ rtl8366rb_port_enable(struct dsa_switch *ds, int port,if (ret)return ret; -rb8366rb_set_port_led (priv, port, true);return 0 ; }
@@ -1182,8 +1137,6 @@ rtl8366rb_port_disable(struct dsa_switch *ds, int port) BIT(port));if (ret)return ; - -rb8366rb_set_port_led (priv, port, false); } static int
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/131 netpoll: Fix race condition in netpoll_owner_active
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit c2e6a872bde9912f1a7579639c5ca3adf1003916 ]
KCSAN detected a race condition in netpoll:
BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10: net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822) <snip> read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) netpoll_send_udp (net/core/netpoll.c:?) <snip> value changed: 0x0000000a -> 0xffffffff
This happens because netpoll_owner_active() needs to check if the current CPU is the owner of the lock, touching napi->poll_owner non atomically. The ->poll_owner field contains the current CPU holding the lock.
Use an atomic read to check if the poll owner is the current CPU.
--- net/core/netpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/netpoll.c +1 -1
@@ -316,7 +316,7 @@ static int netpoll_owner_active(struct net_device *dev)struct napi_struct *napi;list_for_each_entry_rcu (napi, &dev->napi_list, dev_list) { -if (napi->poll_owner ==smp_processor_id ()) +if (READ_ONCE (napi->poll_owner) ==smp_processor_id ())return 1 ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/131 wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Yen <[email protected]>
[ Upstream commit ecf0b2b8a37c8464186620bef37812a117ff6366 ]
During chip recovery (e.g. chip reset), there is a possible situation that kernel worker reset_work is holding the lock and waiting for kernel thread stat_worker to be parked, while stat_worker is waiting for the release of the same lock.
It causes a deadlock resulting in the dumping of hung tasks messages and possible rebooting of the device.
This patch prevents the execution of stat_worker during the chip recovery.
--- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c | 2 -- drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c | 2 -- drivers/net/wireless/mediatek/mt76/sdio.c | 3 ++- 4 files changed, 4 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/mac.c +2 -0
@@ -883,6 +883,7 @@ void mt7921_mac_reset_work(struct work_struct *work)int i, ret;dev_dbg (dev->mt76.dev,"chip reset\n" ); +set_bit (MT76_RESET , &dev->mphy.state); dev->hw_full_reset = true;ieee80211_stop_queues (hw);
@@ -911,6 +912,7 @@ void mt7921_mac_reset_work(struct work_struct *work) } dev->hw_full_reset = false; +clear_bit (MT76_RESET , &dev->mphy.state); pm->suspended = false;ieee80211_wake_queues (hw); ieee80211_iterate_active_interfaces(hw,
drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c +0 -2
@@ -78,7 +78,6 @@ int mt7921e_mac_reset(struct mt7921_dev *dev)mt76_wr (dev,MT_WFDMA0_HOST_INT_ENA ,0 );mt76_wr (dev,MT_PCIE_MAC_INT_ENABLE ,0x0 ); -set_bit (MT76_RESET , &dev->mphy.state);set_bit (MT76_MCU_RESET , &dev->mphy.state);wake_up (&dev->mt76.mcu.wait);skb_queue_purge (&dev->mt76.mcu.res_q);
@@ -129,7 +128,6 @@ int mt7921e_mac_reset(struct mt7921_dev *dev) err =__mt7921_start (&dev->phy); out: -clear_bit (MT76_RESET , &dev->mphy.state);local_bh_disable ();napi_enable (&dev->mt76.tx_napi);
drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +0 -2
@@ -98,7 +98,6 @@ int mt7921s_mac_reset(struct mt7921_dev *dev)mt76_connac_free_pending_tx_skbs (&dev->pm,NULL );mt76_txq_schedule_all (&dev->mphy);mt76_worker_disable (&dev->mt76.tx_worker); -set_bit (MT76_RESET , &dev->mphy.state);set_bit (MT76_MCU_RESET , &dev->mphy.state);wake_up (&dev->mt76.mcu.wait);skb_queue_purge (&dev->mt76.mcu.res_q);
@@ -135,7 +134,6 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) err =__mt7921_start (&dev->phy); out: -clear_bit (MT76_RESET , &dev->mphy.state);mt76_worker_enable (&dev->mt76.tx_worker);
drivers/net/wireless/mediatek/mt76/sdio.c +2 -1
@@ -499,7 +499,8 @@ static void mt76s_tx_status_data(struct mt76_worker *worker) dev = container_of(sdio, struct mt76_dev, sdio);while (true) { -if (test_bit (MT76_REMOVED , &dev->phy.state)) +if (test_bit (MT76_RESET , &dev->phy.state) || +test_bit (MT76_REMOVED , &dev->phy.state))break ;if (!dev->drv->tx_status_data (dev, &update))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/131 HID: Add quirk for Logitech Casa touchpad
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean O'Brien <[email protected]>
[ Upstream commit dd2c345a94cfa3873cc20db87387ee509c345c1b ]
This device sometimes doesn't send touch release signals when moving from >=4 fingers to <4 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck.
MT_QUIRK_FORCE_MULTI_INPUT is not necessary for this device, but does no harm.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -802,6 +802,7 @@#define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e#define USB_DEVICE_ID_LOGITECH_T651 0xb00c#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 +#define USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD 0xbb00#define USB_DEVICE_ID_LOGITECH_C007 0xc007#define USB_DEVICE_ID_LOGITECH_C077 0xc077#define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
drivers/hid/hid-multitouch.c +6 -0
@@ -2084,6 +2084,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, +/* Logitech devices */ + { .driver_data = MT_CLS_NSMU, +HID_DEVICE (BUS_BLUETOOTH ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LOGITECH , + USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) }, + /* MosArt panels */ { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE, MT_USB_DEVICE(USB_VENDOR_ID_ASUS,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/131 HID: asus: fix more n-key report descriptors if n-key quirked
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <[email protected]>
[ Upstream commit 59d2f5b7392e988a391e6924e177c1a68d50223d ]
Adjusts the report descriptor for N-Key devices to make the output count 0x01 which completely avoids the need for a block of filtering.
--- drivers/hid/hid-asus.c | 49 ++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 26 deletions(-)
drivers/hid/hid-asus.c +23 -26
@@ -334,36 +334,20 @@ static int asus_raw_event(struct hid_device *hdev,if (drvdata->quirks &QUIRK_MEDION_E1239T )return asus_e1239t_event (drvdata, data, size); -if (drvdata->quirks &QUIRK_USE_KBD_BACKLIGHT ) { +/* +* Skip these report ID, the device emits a continuous stream associated +* with the AURA mode it is in which looks like an 'echo'. +*/ +if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || report->id ==FEATURE_KBD_LED_REPORT_ID2 ) +return -1 ; +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) {/* -* Skip these report ID, the device emits a continuous stream associated -* with the AURA mode it is in which looks like an 'echo'. +* G713 and G733 send these codes on some keypresses, depending on +* the key pressed it can trigger a shutdown event if not caught. */ -if (report->id ==FEATURE_KBD_LED_REPORT_ID1 || - report->id ==FEATURE_KBD_LED_REPORT_ID2 ) { +if (data[0 ] ==0x02 && data[1 ] ==0x30 ) {return -1 ; -/* Additional report filtering */ - }else if (report->id ==FEATURE_KBD_REPORT_ID ) { -/* -* G14 and G15 send these codes on some keypresses with no -* discernable reason for doing so. We'll filter them out to avoid -* unmapped warning messages later. -*/ -if (data[1 ] ==0xea || data[1 ] ==0xec || data[1 ] ==0x02 || - data[1 ] ==0x8a || data[1 ] ==0x9e ) { -return -1 ; - } } -if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { -/* -* G713 and G733 send these codes on some keypresses, depending on -* the key pressed it can trigger a shutdown event if not caught. -*/ -if (data[0 ] ==0x02 && data[1 ] ==0x30 ) { -return -1 ; - } - } - }if (drvdata->quirks &QUIRK_ROG_CLAYMORE_II_KEYBOARD ) {
@@ -1262,6 +1246,19 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, rdesc[205 ] =0x01 ; } +/* match many more n-key devices */ +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { +for (int i =0 ; i < *rsize +1 ; i++) { +/* offset to the count from 0x5a report part always 14 */ +if (rdesc[i] ==0x85 && rdesc[i +1 ] ==0x5a && + rdesc[i +14 ] ==0x95 && rdesc[i +15 ] ==0x05 ) { +hid_info (hdev,"Fixing up Asus N-Key report descriptor\n" ); + rdesc[i +15 ] =0x01 ; +break ; + } + } + } +return rdesc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/131 Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uri Arev <[email protected]>
[ Upstream commit 68aa21054ec3a1a313af90a5f95ade16c3326d20 ]
This fixes some CHECKs reported by the checkpatch script.
Issues reported in ath3k.c:
-------ath3k.c
-------
CHECK: Please don't use multiple blank lines
+
+
CHECK: Blank lines aren't necessary after an open brace '{' +static const struct usb_device_id ath3k_blist_tbl[] = { +
CHECK: Alignment should match open parenthesis +static int ath3k_load_firmware(struct usb_device *udev,
+ const struct firmware *firmware)
CHECK: Alignment should match open parenthesis
+ err = usb_bulk_msg(udev, pipe, send_buf, size,
+ &len, 3000);
CHECK: Unnecessary parentheses around 'len != size'
+ if (err || (len != size)) {
CHECK: Alignment should match open parenthesis +static int ath3k_get_version(struct usb_device *udev,
+ struct ath3k_version *version)
CHECK: Alignment should match open parenthesis +static int ath3k_load_fwfile(struct usb_device *udev,
+ const struct firmware *firmware)
CHECK: Alignment should match open parenthesis
+ err = usb_bulk_msg(udev, pipe, send_buf, size,
+ &len, 3000);
CHECK: Unnecessary parentheses around 'len != size'
+ if (err || (len != size)) {
CHECK: Blank lines aren't necessary after an open brace '{'
+ switch (fw_version.ref_clock) {
+
CHECK: Alignment should match open parenthesis
+ snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s",
+ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
CHECK: Alignment should match open parenthesis +static int ath3k_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
CHECK: Alignment should match open parenthesis
+ BT_ERR("Firmware file \"%s\" not found",
+ ATH3K_FIRMWARE);
CHECK: Alignment should match open parenthesis
+ BT_ERR("Firmware file \"%s\" request failed (err=%d)",
+ ATH3K_FIRMWARE, ret);
total: 0 errors, 0 warnings, 14 checks, 540 lines checked
--- drivers/bluetooth/ath3k.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
drivers/bluetooth/ath3k.c +11 -14
@@ -3,7 +3,6 @@* Copyright (c) 2008-2009 Atheros Communications Inc. */ -#include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h>
@@ -128,7 +127,6 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);* for AR3012 */ static const struct usb_device_id ath3k_blist_tbl[] = { -/* Atheros AR3012 with sflash firmware*/ {USB_DEVICE (0x0489 ,0xe04e ), .driver_info =BTUSB_ATH3012 }, {USB_DEVICE (0x0489 ,0xe04d ), .driver_info =BTUSB_ATH3012 },
@@ -202,7 +200,7 @@ static inline void ath3k_log_failed_loading(int err, int len, int size,#define TIMEGAP_USEC_MAX 100static int ath3k_load_firmware (struct usb_device *udev, -const struct firmware *firmware) +const struct firmware *firmware) {u8 *send_buf;int len =0 ;
@@ -237,9 +235,9 @@ static int ath3k_load_firmware(struct usb_device *udev,memcpy (send_buf, firmware->data + sent, size); err =usb_bulk_msg (udev, pipe, send_buf, size, - &len,3000 ); + &len,3000 ); -if (err || (len != size)) { +if (err || len != size) {ath3k_log_failed_loading (err, len, size, count); goto error; }
@@ -262,7 +260,7 @@ static int ath3k_get_state(struct usb_device *udev, unsigned char *state) }static int ath3k_get_version (struct usb_device *udev, -struct ath3k_version *version) +struct ath3k_version *version) { return usb_control_msg_recv(udev, 0, ATH3K_GETVERSION, USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
@@ -271,7 +269,7 @@ static int ath3k_get_version(struct usb_device *udev, }static int ath3k_load_fwfile (struct usb_device *udev, -const struct firmware *firmware) +const struct firmware *firmware) {u8 *send_buf;int len =0 ;
@@ -310,8 +308,8 @@ static int ath3k_load_fwfile(struct usb_device *udev,memcpy (send_buf, firmware->data + sent, size); err =usb_bulk_msg (udev, pipe, send_buf, size, - &len,3000 ); -if (err || (len != size)) { + &len,3000 ); +if (err || len != size) {ath3k_log_failed_loading (err, len, size, count);kfree (send_buf);return err;
@@ -425,7 +423,6 @@ static int ath3k_load_syscfg(struct usb_device *udev) }switch (fw_version.ref_clock) { -case ATH3K_XTAL_FREQ_26M : clk_value =26 ;break ;
@@ -441,7 +438,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) }snprintf (filename,ATH3K_NAME_LEN ,"ar3k/ramps_0x%08x_%d%s" , -le32_to_cpu (fw_version.rom_version), clk_value,".dfu" ); +le32_to_cpu (fw_version.rom_version), clk_value,".dfu" ); ret =request_firmware (&firmware, filename, &udev->dev);if (ret <0 ) {
@@ -456,7 +453,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) }static int ath3k_probe (struct usb_interface *intf, -const struct usb_device_id *id) +const struct usb_device_id *id) {const struct firmware *firmware;struct usb_device *udev =interface_to_usbdev (intf);
@@ -505,10 +502,10 @@ static int ath3k_probe(struct usb_interface *intf,if (ret <0 ) {if (ret == -ENOENT )BT_ERR ("Firmware file \"%s\" not found" , -ATH3K_FIRMWARE ); +ATH3K_FIRMWARE );else BT_ERR ("Firmware file \"%s\" request failed (err=%d)" , -ATH3K_FIRMWARE , ret); +ATH3K_FIRMWARE , ret);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/131 drm/amd/display: Exit idle optimizations before HDCP execution
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Kazlauskas <[email protected]>
[ Upstream commit f30a3bea92bdab398531129d187629fb1d28f598 ]
[WHY]
PSP can access DCN registers during command submission and we need to ensure that DCN is not in PG before doing so.
[HOW]
Add a callback to DM to lock and notify DC for idle optimization exit. It can't be DC directly because of a potential race condition with the link protection thread and the rest of DM operation.
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 10 ++++++++++ drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h | 8 ++++++++ 2 files changed, 18 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +10 -0
@@ -88,6 +88,14 @@ static uint8_t is_cp_desired_hdcp2(struct mod_hdcp *hdcp) !hdcp->connection.is_hdcp2_revoked; } +static void exit_idle_optimizations (struct mod_hdcp *hdcp) +{ +struct mod_hdcp_dm *dm = &hdcp->config.dm; + +if (dm->funcs.exit_idle_optimizations) + dm->funcs.exit_idle_optimizations (dm->handle); +} +static enum mod_hdcp_status execution (struct mod_hdcp *hdcp,struct mod_hdcp_event_context *event_ctx,union mod_hdcp_transition_input *input)
@@ -543,6 +551,8 @@ enum mod_hdcp_status mod_hdcp_process_event(struct mod_hdcp *hdcp,memset (&event_ctx,0 ,sizeof (struct mod_hdcp_event_context )); event_ctx.event = event; +exit_idle_optimizations (hdcp); +/* execute and transition */ exec_status =execution (hdcp, &event_ctx, &hdcp->auth.trans_input); trans_status = transition(
drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +8 -0
@@ -155,6 +155,13 @@ struct mod_hdcp_ddc { } funcs; }; +struct mod_hdcp_dm { +void *handle; +struct { +void (*exit_idle_optimizations)(void *handle); + } funcs; +}; +struct mod_hdcp_psp {void *handle;void *funcs;
@@ -271,6 +278,7 @@ struct mod_hdcp_display_query {struct mod_hdcp_config {struct mod_hdcp_psp psp;struct mod_hdcp_ddc ddc; +struct mod_hdcp_dm dm;uint8_t index; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/131 platform/x86: toshiba_acpi: Add quirk for buttons on Z830
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvid Norlander <[email protected]>
[ Upstream commit 23f1d8b47d125dcd8c1ec62a91164e6bc5d691d0 ]
The Z830 has some buttons that will only work properly as "quickstart" buttons. To enable them in that mode, a value between 1 and 7 must be used for HCI_HOTKEY_EVENT. Windows uses 0x5 on this laptop so use that for maximum predictability and compatibility.
As there is not yet a known way of auto detection, this patch uses a DMI quirk table. A module parameter is exposed to allow setting this on other models for testing.
--- drivers/platform/x86/toshiba_acpi.c | 36 ++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-)
drivers/platform/x86/toshiba_acpi.c +33 -3
@@ -57,6 +57,11 @@ module_param(turn_on_panel_on_resume, int, 0644);MODULE_PARM_DESC (turn_on_panel_on_resume,"Call HCI_PANEL_POWER_ON on resume (-1 = auto, 0 = no, 1 = yes" ); +static int hci_hotkey_quickstart =-1 ; +module_param (hci_hotkey_quickstart, int,0644 ); +MODULE_PARM_DESC (hci_hotkey_quickstart, +"Call HCI_HOTKEY_EVENT with value 0x5 for quickstart button support (-1 = auto, 0 = no, 1 = yes" ); +#define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100"/* Scan code for Fn key on TOS1900 models */
@@ -136,6 +141,7 @@ MODULE_PARM_DESC(turn_on_panel_on_resume,#define HCI_ACCEL_MASK 0x7fff#define HCI_ACCEL_DIRECTION_MASK 0x8000#define HCI_HOTKEY_DISABLE 0x0b +#define HCI_HOTKEY_ENABLE_QUICKSTART 0x05#define HCI_HOTKEY_ENABLE 0x09#define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10#define HCI_LCD_BRIGHTNESS_BITS 3
@@ -2730,10 +2736,15 @@ static int toshiba_acpi_enable_hotkeys(struct toshiba_acpi_dev *dev)return -ENODEV ;/* +* Enable quickstart buttons if supported. +* * Enable the "Special Functions" mode only if they are * supported and if they are activated. */ -if (dev->kbd_function_keys_supported && dev->special_functions) +if (hci_hotkey_quickstart) + result =hci_write (dev,HCI_HOTKEY_EVENT , +HCI_HOTKEY_ENABLE_QUICKSTART ); +else if (dev->kbd_function_keys_supported && dev->special_functions) result =hci_write (dev,HCI_HOTKEY_EVENT ,HCI_HOTKEY_SPECIAL_FUNCTIONS );else
@@ -3259,7 +3270,14 @@ static const char *find_hci_method(acpi_handle handle)* works. toshiba_acpi_resume() uses HCI_PANEL_POWER_ON to avoid changing * the configured brightness level. */ -static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { +#define QUIRK_TURN_ON_PANEL_ON_RESUME BIT(0) +/* +* Some Toshibas use "quickstart" keys. On these, HCI_HOTKEY_EVENT must use +* the value HCI_HOTKEY_ENABLE_QUICKSTART. +*/ +#define QUIRK_HCI_HOTKEY_QUICKSTART BIT(1) + +static const struct dmi_system_id toshiba_dmi_quirks[] = { {/* Toshiba Portégé R700 */ /* https://bugzilla.kernel.org/show_bug.cgi?id=21012 */
@@ -3267,6 +3285,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = {DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE R700"), }, + .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, }, {/* Toshiba Satellite/Portégé R830 */
@@ -3276,6 +3295,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = {DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), DMI_MATCH(DMI_PRODUCT_NAME, "R830"), }, + .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, }, {/* Toshiba Satellite/Portégé Z830 */
@@ -3283,6 +3303,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), DMI_MATCH(DMI_PRODUCT_NAME, "Z830"), }, + .driver_data = (void *)(QUIRK_TURN_ON_PANEL_ON_RESUME | QUIRK_HCI_HOTKEY_QUICKSTART), }, };
@@ -3291,6 +3312,8 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev)struct toshiba_acpi_dev *dev;const char *hci_method;u32 dummy; +const struct dmi_system_id *dmi_id; +long quirks =0 ;int ret =0 ;if (toshiba_acpi)
@@ -3443,8 +3466,15 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev) }#endif + dmi_id =dmi_first_match (toshiba_dmi_quirks); +if (dmi_id) + quirks = (long )dmi_id->driver_data; +if (turn_on_panel_on_resume ==-1 ) - turn_on_panel_on_resume =dmi_check_system (turn_on_panel_on_resume_dmi_ids); + turn_on_panel_on_resume = !!(quirks &QUIRK_TURN_ON_PANEL_ON_RESUME ); + +if (hci_hotkey_quickstart ==-1 ) + hci_hotkey_quickstart = !!(quirks &QUIRK_HCI_HOTKEY_QUICKSTART );toshiba_wwan_available (dev);if (dev->wwan_supported)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/131 ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 4fee07fbf47d2a5f1065d985459e5ce7bf7969f0 ]
The default JD1 does not seem to work, use JD2 instead.
--- sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/intel/boards/sof_sdw.c +9 -0
@@ -413,6 +413,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { SOF_BT_OFFLOAD_SSP(1) | SOF_SSP_BT_OFFLOAD_PRESENT), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN Transcend Gaming Laptop"), + }, + .driver_data = (void *)(RT711_JD2), + }, +/* LunarLake devices */ { .callback = sof_sdw_quirk_cb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/131 drm/lima: add mask irq callback to gp and pp
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit 49c13b4d2dd4a831225746e758893673f6ae961c ]
This is needed because we want to reset those devices in device-agnostic code such as lima_sched.
In particular, masking irqs will be useful before a hard reset to prevent race conditions.
--- drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ drivers/gpu/drm/lima/lima_bcast.h | 3 +++ drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ drivers/gpu/drm/lima/lima_sched.h | 1 + 5 files changed, 42 insertions(+)
drivers/gpu/drm/lima/lima_bcast.c +12 -0
@@ -43,6 +43,18 @@ void lima_bcast_suspend(struct lima_ip *ip) } +int lima_bcast_mask_irq (struct lima_ip *ip) +{ +bcast_write (LIMA_BCAST_BROADCAST_MASK ,0 ); +bcast_write (LIMA_BCAST_INTERRUPT_MASK ,0 ); +return 0 ; +} + +int lima_bcast_reset (struct lima_ip *ip) +{ +return lima_bcast_hw_init (ip); +} +int lima_bcast_init (struct lima_ip *ip) {int i;
drivers/gpu/drm/lima/lima_bcast.h +3 -0
@@ -13,4 +13,7 @@ void lima_bcast_fini(struct lima_ip *ip);void lima_bcast_enable (struct lima_device *dev,int num_pp); +int lima_bcast_mask_irq (struct lima_ip *ip); +int lima_bcast_reset (struct lima_ip *ip); +#endif
drivers/gpu/drm/lima/lima_gp.c +8 -0
@@ -212,6 +212,13 @@ static void lima_gp_task_mmu_error(struct lima_sched_pipe *pipe)lima_sched_pipe_task_done (pipe); } +static void lima_gp_task_mask_irq (struct lima_sched_pipe *pipe) +{ +struct lima_ip *ip = pipe->processor[0 ]; + +gp_write (LIMA_GP_INT_MASK ,0 ); +} +static int lima_gp_task_recover (struct lima_sched_pipe *pipe) {struct lima_ip *ip = pipe->processor[0 ];
@@ -344,6 +351,7 @@ int lima_gp_pipe_init(struct lima_device *dev) pipe->task_error = lima_gp_task_error; pipe->task_mmu_error = lima_gp_task_mmu_error; pipe->task_recover = lima_gp_task_recover; + pipe->task_mask_irq = lima_gp_task_mask_irq;return 0 ; }
drivers/gpu/drm/lima/lima_pp.c +18 -0
@@ -408,6 +408,9 @@ static void lima_pp_task_error(struct lima_sched_pipe *pipe)lima_pp_hard_reset (ip); } + +if (pipe->bcast_processor) +lima_bcast_reset (pipe->bcast_processor); }static void lima_pp_task_mmu_error (struct lima_sched_pipe *pipe)
@@ -416,6 +419,20 @@ static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe)lima_sched_pipe_task_done (pipe); } +static void lima_pp_task_mask_irq (struct lima_sched_pipe *pipe) +{ +int i; + +for (i =0 ; i < pipe->num_processor; i++) { +struct lima_ip *ip = pipe->processor[i]; + +pp_write (LIMA_PP_INT_MASK ,0 ); + } + +if (pipe->bcast_processor) +lima_bcast_mask_irq (pipe->bcast_processor); +} +static struct kmem_cache *lima_pp_task_slab;static int lima_pp_task_slab_refcnt;
@@ -447,6 +464,7 @@ int lima_pp_pipe_init(struct lima_device *dev) pipe->task_fini = lima_pp_task_fini; pipe->task_error = lima_pp_task_error; pipe->task_mmu_error = lima_pp_task_mmu_error; + pipe->task_mask_irq = lima_pp_task_mask_irq;return 0 ; }
drivers/gpu/drm/lima/lima_sched.h +1 -0
@@ -80,6 +80,7 @@ struct lima_sched_pipe {void (*task_error)(struct lima_sched_pipe *pipe);void (*task_mmu_error)(struct lima_sched_pipe *pipe);int (*task_recover)(struct lima_sched_pipe *pipe); +void (*task_mask_irq)(struct lima_sched_pipe *pipe);struct work_struct recover_work; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/131 drm/lima: mask irqs in timeout path before hard reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erico Nunes <[email protected]>
[ Upstream commit a421cc7a6a001b70415aa4f66024fa6178885a14 ]
There is a race condition in which a rendering job might take just long enough to trigger the drm sched job timeout handler but also still complete before the hard reset is done by the timeout handler. This runs into race conditions not expected by the timeout handler. In some very specific cases it currently may result in a refcount imbalance on lima_pm_idle, with a stack dump such as:
[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0 ... [10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0 ... [10136.669628] Call trace: [10136.669634] lima_devfreq_record_idle+0xa0/0xb0 [10136.669646] lima_sched_pipe_task_done+0x5c/0xb0 [10136.669656] lima_gp_irq_handler+0xa8/0x120 [10136.669666] __handle_irq_event_percpu+0x48/0x160 [10136.669679] handle_irq_event+0x4c/0xc0
We can prevent that race condition entirely by masking the irqs at the beginning of the timeout handler, at which point we give up on waiting for that job entirely.
The irqs will be enabled again at the next hard reset which is already done as a recovery by the timeout handler.
--- drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/lima/lima_sched.c +7 -0
@@ -402,6 +402,13 @@ static enum drm_gpu_sched_stat lima_sched_timedout_job(struct drm_sched_job *jobstruct lima_sched_task *task =to_lima_task (job);struct lima_device *ldev = pipe->ldev; +/* +* The task might still finish while this timeout handler runs. +* To prevent a race condition on its completion, mask all irqs +* on the running core until the next hard reset completes. +*/ + pipe->task_mask_irq (pipe); +if (!pipe->error)DRM_ERROR ("lima job timeout\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/131 ALSA: hda/realtek: Add quirks for Lenovo 13X
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Binding <[email protected]>
[ Upstream commit 25f46354dca912c84f1f79468fd636a94b8d287a ]
Add laptop using CS35L41 HDA.
This laptop does not have _DSD, so require entries in property configuration table for cs35l41_hda driver.
Message-ID: <[email protected]>
--- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_realtek.c +2 -0
@@ -10090,6 +10090,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3852 ,"Lenovo Yoga 7 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3853 ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3855 ,"Legion 7 16ITHG6" ,ALC287_FIXUP_LEGION_16ITHG6 ), +SND_PCI_QUIRK (0x17aa ,0x3865 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x17aa ,0x3866 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3869 ,"Lenovo Yoga7 14IAL7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ), SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/131 powerpc/pseries: Enforce hcall result buffer validity and size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ]
plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea.
For example, if I write a bug like this:
long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
This compiles with no diagnostics emitted, but likely results in stack corruption at runtime when plpar_hcall9() stores results past the end of the array. (To be clear this is a contrived example and I have not found a real instance yet.)
To make this class of error less likely, we can use explicitly-sized array parameters instead of pointers in the declarations for the hcall APIs. When compiled with -Warray-bounds[1], the code above now provokes a diagnostic like this:
error: array argument is too small;
is of size 32, callee requires at least 72 [-Werror,-Warray-bounds]
60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,
| ^ ~~~~~~[1] Enabled for LLVM builds but not GCC for now. See commit
0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and
related changes.--- arch/powerpc/include/asm/hvcall.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/hvcall.h +4 -4
@@ -493,7 +493,7 @@ long plpar_hcall_norets_notrace(unsigned long opcode, ...);* Used for all but the craziest of phyp interfaces (see plpar_hcall9) */ #define PLPAR_HCALL_BUFSIZE 4 -long plpar_hcall (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL_BUFSIZE ], ...);/** * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats
@@ -507,7 +507,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...);* plpar_hcall, but plpar_hcall_raw works in real mode and does not * calculate hypervisor call statistics. */ -long plpar_hcall_raw (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall_raw (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL_BUFSIZE ], ...);/** * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments
@@ -518,8 +518,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...);* PLPAR_HCALL9_BUFSIZE to size the return argument buffer. */ #define PLPAR_HCALL9_BUFSIZE 9 -long plpar_hcall9 (unsigned long opcode,unsigned long *retbuf, ...); -long plpar_hcall9_raw (unsigned long opcode,unsigned long *retbuf, ...); +long plpar_hcall9 (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE ], ...); +long plpar_hcall9_raw (unsigned long opcode,unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE ], ...);/* pseries hcall tracing */ extern struct static_key hcall_tracepoint_key;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/131 powerpc/io: Avoid clang null pointer arithmetic warnings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 03c0f2c2b2220fc9cf8785cd7b61d3e71e24a366 ]
With -Wextra clang warns about pointer arithmetic using a null pointer. When building with CONFIG_PCI=n, that triggers a warning in the IO accessors, eg:
In file included from linux/arch/powerpc/include/asm/io.h:672:
linux/arch/powerpc/include/asm/io-defs.h:23:1: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
23 | DEF_PCI_AC_RET(inb, u8, (unsigned long port), (port), pio, port)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
linux/arch/powerpc/include/asm/io.h:591:53: note: expanded from macro '__do_inb'
591 | #define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port);
| ~~~~~~~~~~~~~~~~~~~~~ ^That is because when CONFIG_PCI=n, _IO_BASE is defined as 0.
Although _IO_BASE is defined as plain 0, the cast (PCI_IO_ADDR) converts it to void * before the addition with port happens.
Instead the addition can be done first, and then the cast. The resulting value will be the same, but avoids the warning, and also avoids void pointer arithmetic which is apparently non-standard.
--- arch/powerpc/include/asm/io.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/powerpc/include/asm/io.h +12 -12
@@ -553,12 +553,12 @@ __do_out_asm(_rec_outl, "stwbrx")#define __do_inw (port) _rec_inw(port)#define __do_inl (port) _rec_inl(port)#else /* CONFIG_PPC32 */ -#define __do_outb (val, port) writeb(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_outw (val, port) writew(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_outl (val, port) writel(val,(PCI_IO_ADDR)_IO_BASE+port); -#define __do_inb (port) readb((PCI_IO_ADDR)_IO_BASE + port); -#define __do_inw (port) readw((PCI_IO_ADDR)_IO_BASE + port); -#define __do_inl (port) readl((PCI_IO_ADDR)_IO_BASE + port); +#define __do_outb (val, port) writeb(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_outw (val, port) writew(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_outl (val, port) writel(val,(PCI_IO_ADDR)(_IO_BASE+port)); +#define __do_inb (port) readb((PCI_IO_ADDR)(_IO_BASE + port)); +#define __do_inw (port) readw((PCI_IO_ADDR)(_IO_BASE + port)); +#define __do_inl (port) readl((PCI_IO_ADDR)(_IO_BASE + port));#endif /* !CONFIG_PPC32 */ #ifdef CONFIG_EEH
@@ -574,12 +574,12 @@ __do_out_asm(_rec_outl, "stwbrx")#define __do_writesw (a, b, n) _outsw(PCI_FIX_ADDR(a),(b),(n))#define __do_writesl (a, b, n) _outsl(PCI_FIX_ADDR(a),(b),(n)) -#define __do_insb (p, b, n) readsb((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_insw (p, b, n) readsw((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_insl (p, b, n) readsl((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) -#define __do_outsb (p, b, n) writesb((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) -#define __do_outsw (p, b, n) writesw((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) -#define __do_outsl (p, b, n) writesl((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +#define __do_insb (p, b, n) readsb((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_insw (p, b, n) readsw((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_insl (p, b, n) readsl((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) +#define __do_outsb (p, b, n) writesb((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) +#define __do_outsw (p, b, n) writesw((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) +#define __do_outsl (p, b, n) writesl((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n))#define __do_memset_io (addr, c, n) \ _memset_io(PCI_FIX_ADDR(addr), c, n)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/131 platform/x86: p2sb: Dont init until unassigned resources have been assigned
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Fradella <[email protected]>
[ Upstream commit 2c6370e6607663fc5fa0fd9ed58e2e01014898c7 ]
The P2SB could get an invalid BAR from the BIOS, and that won't be fixed up until pcibios_assign_resources(), which is an fs_initcall().
- Move p2sb_fs_init() to an fs_initcall_sync(). This is still early enough to avoid a race with any dependent drivers.
- Add a check for IORESOURCE_UNSET in p2sb_valid_resource() to catch unset BARs going forward.
- Return error values from p2sb_fs_init() so that the 'initcall_debug' cmdline arg provides useful data.
--- drivers/platform/x86/p2sb.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-)
drivers/platform/x86/p2sb.c +15 -14
@@ -56,12 +56,9 @@ static int p2sb_get_devfn(unsigned int *devfn)return 0 ; } -static bool p2sb_valid_resource (struct resource *res) +static bool p2sb_valid_resource (const struct resource *res) { -if (res->flags) -return true; - -return false; +return res->flags & ~IORESOURCE_UNSET ; }/* Copy resource from the first BAR of the device in question */
@@ -220,16 +217,20 @@ EXPORT_SYMBOL_GPL(p2sb_bar);static int __init p2sb_fs_init (void ) { -p2sb_cache_resources (); -return 0 ; +return p2sb_cache_resources (); }/* -* pci_rescan_remove_lock to avoid access to unhidden P2SB devices can -* not be locked in sysfs pci bus rescan path because of deadlock. To -* avoid the deadlock, access to P2SB devices with the lock at an early -* step in kernel initialization and cache required resources. This -* should happen after subsys_initcall which initializes PCI subsystem -* and before device_initcall which requires P2SB resources. +* pci_rescan_remove_lock() can not be locked in sysfs PCI bus rescan path +* because of deadlock. To avoid the deadlock, access P2SB devices with the lock +* at an early step in kernel initialization and cache required resources. +* +* We want to run as early as possible. If the P2SB was assigned a bad BAR, +* we'll need to wait on pcibios_assign_resources() to fix it. So, our list of +* initcall dependencies looks something like this: +* +* ... +* subsys_initcall (pci_subsys_init) +* fs_initcall (pcibios_assign_resources) */ -fs_initcall (p2sb_fs_init); +fs_initcall_sync (p2sb_fs_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/131 power: supply: cros_usbpd: provide ID table for avoiding fallback match
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 0f8678c34cbfdc63569a9b0ede1fe235ec6ec693 ]
Instead of using fallback driver name match, provide ID table[1] for the primary match.
[1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353
--- drivers/power/supply/cros_usbpd-charger.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/power/supply/cros_usbpd-charger.c +9 -2
@@ -5,6 +5,7 @@* Copyright (c) 2014 - 2018 Google, Inc */ +#include <linux/mod_devicetable.h> #include <linux/module.h> #include <linux/platform_data/cros_ec_commands.h> #include <linux/platform_data/cros_ec_proto.h>
@@ -711,16 +712,22 @@ static int cros_usbpd_charger_resume(struct device *dev) static SIMPLE_DEV_PM_OPS(cros_usbpd_charger_pm_ops, NULL, cros_usbpd_charger_resume); +static const struct platform_device_id cros_usbpd_charger_id[] = { + {DRV_NAME ,0 }, + {} +}; +MODULE_DEVICE_TABLE (platform, cros_usbpd_charger_id); +static struct platform_driver cros_usbpd_charger_driver = { .driver = { .name =DRV_NAME , .pm = &cros_usbpd_charger_pm_ops, }, - .probe = cros_usbpd_charger_probe + .probe = cros_usbpd_charger_probe, + .id_table = cros_usbpd_charger_id, };module_platform_driver (cros_usbpd_charger_driver);MODULE_LICENSE ("GPL" );MODULE_DESCRIPTION ("ChromeOS EC USBPD charger" ); -MODULE_ALIAS ("platform:" DRV_NAME );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/131 iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Aprelkov <[email protected]>
[ Upstream commit 80fea979dd9d48d67c5b48d2f690c5da3e543ebd ]
If devm_add_action() returns -ENOMEM, then MSIs are allocated but not not freed on teardown. Use devm_add_action_or_reset() instead to keep the static analyser happy.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +1 -1
@@ -3199,7 +3199,7 @@ static void arm_smmu_setup_msis(struct arm_smmu_device *smmu) smmu->priq.q.irq =msi_get_virq (dev,PRIQ_MSI_INDEX );/* Add callback to free MSIs on teardown */ -devm_add_action (dev, arm_smmu_free_msis, dev); +devm_add_action_or_reset (dev, arm_smmu_free_msis, dev); }static void arm_smmu_setup_unique_irqs (struct arm_smmu_device *smmu)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/131 f2fs: remove clear SB_INLINECRYPT flag in default_options
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunlei He <[email protected]>
[ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ]
In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable.
Thread A: Thread B:
-f2fs_remount -f2fs_file_open or f2fs_new_inode
-default_options
<- clear SB_INLINECRYPT flag
-fscrypt_select_encryption_impl
-parse_options
<- set SB_INLINECRYPT again
--- fs/f2fs/super.c | 2 -- 1 file changed, 2 deletions(-)
fs/f2fs/super.c +0 -2
@@ -2092,8 +2092,6 @@ static void default_options(struct f2fs_sb_info *sbi)F2FS_OPTION (sbi).bggc_mode =BGGC_MODE_ON ;F2FS_OPTION (sbi).memory_mode =MEMORY_MODE_NORMAL ; - sbi->sb->s_flags &= ~SB_INLINECRYPT ; -set_opt (sbi,INLINE_XATTR );set_opt (sbi,INLINE_DATA );set_opt (sbi,INLINE_DENTRY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/131 usb: misc: uss720: check for incompatible versions of the Belkin F5U002
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Henrie <[email protected]>
[ Upstream commit 3295f1b866bfbcabd625511968e8a5c541f9ab32 ]
The incompatible device in my possession has a sticker that says "F5U002 Rev 2" and "P80453-B", and lsusb identifies it as "050d:0002 Belkin Components IEEE-1284 Controller". There is a bug report from 2007 from Michael Trausch who was seeing the exact same errors that I saw in 2024 trying to use this cable.
--- drivers/usb/misc/uss720.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/usb/misc/uss720.c +13 -7
@@ -677,7 +677,7 @@ static int uss720_probe(struct usb_interface *intf,struct parport_uss720_private *priv;struct parport *pp;unsigned char reg; -int i; +int ret; dev_dbg(&intf->dev, "probe: vendor id 0x%x, device id 0x%x\n", le16_to_cpu(usbdev->descriptor.idVendor),
@@ -688,8 +688,8 @@ static int uss720_probe(struct usb_interface *intf,usb_put_dev (usbdev);return -ENODEV ; } - i =usb_set_interface (usbdev, intf->altsetting->desc.bInterfaceNumber,2 ); -dev_dbg (&intf->dev,"set interface result %d\n" , i); + ret =usb_set_interface (usbdev, intf->altsetting->desc.bInterfaceNumber,2 ); +dev_dbg (&intf->dev,"set interface result %d\n" , ret); interface = intf->cur_altsetting;
@@ -725,12 +725,18 @@ static int uss720_probe(struct usb_interface *intf,set_1284_register (pp,7 ,0x00 ,GFP_KERNEL );set_1284_register (pp,6 ,0x30 ,GFP_KERNEL );/* PS/2 mode */ set_1284_register (pp,2 ,0x0c ,GFP_KERNEL ); -/* debugging */ -get_1284_register (pp,0 , ®,GFP_KERNEL ); + +/* The Belkin F5U002 Rev 2 P80453-B USB parallel port adapter shares the +* device ID 050d:0002 with some other device that works with this +* driver, but it itself does not. Detect and handle the bad cable +* here. */ + ret =get_1284_register (pp,0 , ®,GFP_KERNEL );dev_dbg (&intf->dev,"reg: %7ph\n" , priv->reg); +if (ret <0 ) +return ret; - i =usb_find_last_int_in_endpoint (interface, &epd); -if (!i) { + ret =usb_find_last_int_in_endpoint (interface, &epd); +if (!ret) {dev_dbg (&intf->dev,"epaddr %d interval %d\n" , epd->bEndpointAddress, epd->bInterval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/131 Avoid hw_desc array overrun in dw-axi-dmac
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joao Pinto <[email protected]>
[ Upstream commit 333e11bf47fa8d477db90e2900b1ed3c9ae9b697 ]
I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() handles the hw_desc considering the descs_allocated, this scenario would result in a kernel panic (hw_desc array will be overrun).
To fix this, the proposal is to add a new member to the axi_dma_desc structure, where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in axi_desc_put() to handle the hw_desc array correctly.
Additionally I propose to remove the axi_chan_start_first_queued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++---- drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +2 -4
@@ -250,6 +250,7 @@ static struct axi_dma_desc *axi_desc_alloc(u32 num)kfree (desc);return NULL ; } + desc->nr_hw_descs = num;return desc; }
@@ -276,7 +277,7 @@ static struct axi_dma_lli *axi_desc_get(struct axi_dma_chan *chan,static void axi_desc_put (struct axi_dma_desc *desc) {struct axi_dma_chan *chan = desc->chan; -int count =atomic_read (&chan->descs_allocated); +int count = desc->nr_hw_descs;struct axi_dma_hw_desc *hw_desc;int descs_put;
@@ -1087,9 +1088,6 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)/* Remove the completed descriptor from issued list before completing */ list_del (&vd->node);vchan_cookie_complete (vd); - -/* Submit queued descriptors after processing the completed ones */ -axi_chan_start_first_queued (chan); } out:
drivers/dma/dw-axi-dmac/dw-axi-dmac.h +1 -0
@@ -103,6 +103,7 @@ struct axi_dma_desc {u32 completed_blocks;u32 length;u32 period_len; +u32 nr_hw_descs; };struct axi_dma_chan_config {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/131 usb: dwc3: pci: Dont set "linux,phy_charger_detect" property on Lenovo Yoga Tab2 1380
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 0fb782b5d5c462b2518b3b4fe7d652114c28d613 ]
The Lenovo Yoga Tablet 2 Pro 1380 model is the exception to the rule that devices which use the Crystal Cove PMIC without using ACPI for battery and AC power_supply class support use the USB-phy for charger detection.
Unlike the Lenovo Yoga Tablet 2 830 / 1050 models this model has an extra LC824206XA Micro USB switch which does the charger detection.
Add a DMI quirk to not set the "linux,phy_charger_detect" property on the 1380 model. This quirk matches on the BIOS version to differentiate the 1380 model from the 830 and 1050 models which otherwise have the same DMI strings.
--- drivers/usb/dwc3/dwc3-pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-pci.c +7 -1
@@ -8,6 +8,7 @@* Sebastian Andrzej Siewior <[email protected]> */ +#include <linux/dmi.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/slab.h>
@@ -219,6 +220,7 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc,if (pdev->device ==PCI_DEVICE_ID_INTEL_BYT ) {struct gpio_desc *gpio; +const char *bios_ver;int ret;/* On BYT the FW does not always enable the refclock */
@@ -276,8 +278,12 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc,* detection. These can be identified by them _not_ * using the standard ACPI battery and ac drivers. */ + bios_ver =dmi_get_system_info (DMI_BIOS_VERSION );if (acpi_dev_present ("INT33FD" ,"1" ,2 ) && -acpi_quirk_skip_acpi_ac_and_battery ()) { +acpi_quirk_skip_acpi_ac_and_battery () && +/* Lenovo Yoga Tablet 2 Pro 1380 uses LC824206XA instead */ + !(bios_ver && +strstarts (bios_ver,"BLADE_21.X64.0005.R00.1504101516" ))) {dev_info (&pdev->dev,"Using TUSB1211 phy for charger detection\n" ); swnode = &dwc3_pci_intel_phy_charger_detect_swnode; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/131 udf: udftime: prevent overflow in udf_disk_stamp_to_time()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
[ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ]
An overflow can occur in a situation where src.centiseconds takes the value of 255. This situation is unlikely, but there is no validation check anywere in the code.
Found by Linux Verification Center (linuxtesting.org) with Svace.
Message-Id: <[email protected]>
--- fs/udf/udftime.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/udf/udftime.c +8 -3
@@ -60,13 +60,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) dest->tv_sec =mktime64 (year, src.month, src.day, src.hour, src.minute, src.second); dest->tv_sec -= offset *60 ; - dest->tv_nsec =1000 * (src.centiseconds *10000 + - src.hundredsOfMicroseconds *100 + src.microseconds); +/* * Sanitize nanosecond field since reportedly some filesystems are * recorded with bogus sub-second values. */ - dest->tv_nsec %=NSEC_PER_SEC ; +if (src.centiseconds <100 && src.hundredsOfMicroseconds <100 && + src.microseconds <100 ) { + dest->tv_nsec =1000 * (src.centiseconds *10000 + + src.hundredsOfMicroseconds *100 + src.microseconds); + }else { + dest->tv_nsec =0 ; + } }void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/131 PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 256df20c590bf0e4d63ac69330cf23faddac3e08 ]
Hewlett-Packard HP Pavilion 17 Notebook PC/1972 is an Intel Ivy Bridge system with a muxless AMD Radeon dGPU. Attempting to use the dGPU fails with the following sequence:
ACPI Error: Aborting method \AMD3._ON due to previous error (AE_AML_LOOP_TIMEOUT) (20230628/psparse-529) radeon 0000:01:00.0: not ready 1023ms after resume; waiting
radeon 0000:01:00.0: not ready 2047ms after resume; waiting
radeon 0000:01:00.0: not ready 4095ms after resume; waiting
radeon 0000:01:00.0: not ready 8191ms after resume; waiting
radeon 0000:01:00.0: not ready 16383ms after resume; waiting
radeon 0000:01:00.0: not ready 32767ms after resume; waiting
radeon 0000:01:00.0: not ready 65535ms after resume; giving up
radeon 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
The issue is that the Root Port the dGPU is connected to can't handle the transition from D3cold to D0 so the dGPU can't properly exit runtime PM.
The existing logic in pci_bridge_d3_possible() checks for systems that are newer than 2015 to decide that D3 is safe. This would nominally work for an Ivy Bridge system (which was discontinued in 2015), but this system appears to have continued to receive BIOS updates until 2017 and so this existing logic doesn't appropriately capture it.
Add the system to bridge_d3_blacklist to prevent D3cold from being used.
--- drivers/pci/pci.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/pci.c +12 -0
@@ -2991,6 +2991,18 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"), }, }, + { +/* +* Changing power state of root port dGPU is connected fails +* https://gitlab.freedesktop.org/drm/amd/-/issues/3229 +*/ + .ident = "Hewlett-Packard HP Pavilion 17 Notebook PC/1972", + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_BOARD_NAME ,"1972" ), + DMI_MATCH(DMI_BOARD_VERSION, "95.33"), + }, + }, #endif { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/131 MIPS: Octeon: Add PCIe link status check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Songyang Li <[email protected]>
[ Upstream commit 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 ]
The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it can generate kernel panic caused by "Data bus error". So it is necessary to add PCIe link status check for system protection. When the PCIe link is down or in training, assigning a value of 0 to the configuration address can prevent read-write behavior to the configuration space of peripheral PCIe devices, thereby preventing kernel panic.
--- arch/mips/pci/pcie-octeon.c | 6 ++++++ 1 file changed, 6 insertions(+) mode change 100644 => 100755 arch/mips/pci/pcie-octeon.c
arch/mips/pci/pcie-octeon.c +6 -0
@@ -230,12 +230,18 @@ static inline uint64_t __cvmx_pcie_build_config_addr(int pcie_port, int bus, {union cvmx_pcie_address pcie_addr;union cvmx_pciercx_cfg006 pciercx_cfg006; +union cvmx_pciercx_cfg032 pciercx_cfg032; pciercx_cfg006.u32 =cvmx_pcie_cfgx_read (pcie_port,CVMX_PCIERCX_CFG006 (pcie_port));if ((bus <= pciercx_cfg006.s.pbnum) && (dev !=0 ))return 0 ; + pciercx_cfg032.u32 = +cvmx_pcie_cfgx_read (pcie_port,CVMX_PCIERCX_CFG032 (pcie_port)); +if ((pciercx_cfg032.s.dlla ==0 ) || (pciercx_cfg032.s.lt ==1 )) +return 0 ; + pcie_addr.u64 =0 ; pcie_addr.config.upper =2 ; pcie_addr.config.io =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/131 serial: imx: Introduce timeout when waiting on transmitter empty
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
[ Upstream commit e533e4c62e9993e62e947ae9bbec34e4c7ae81c2 ]
By waiting at most 1 second for USR2_TXDC to be set, we avoid a potential deadlock.
In case of the timeout, there is not much we can do, so we simply ignore the transmitter state and optimistically try to continue.
--- drivers/tty/serial/imx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/tty/serial/imx.c +4 -3
@@ -27,6 +27,7 @@#include <linux/of.h> #include <linux/of_device.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/dma-mapping.h> #include <asm/irq.h>
@@ -2028,7 +2029,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)struct imx_port *sport = imx_uart_ports[co->index];struct imx_port_ucrs old_ucr;unsigned long flags; -unsigned int ucr1; +unsigned int ucr1, usr2;int locked =1 ;if (sport->port.sysrq)
@@ -2059,8 +2060,8 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)* Finally, wait for transmitter to become empty * and restore UCR1/2/3 */ -while (!(imx_uart_readl (sport,USR2 ) &USR2_TXDC )); - +read_poll_timeout_atomic (imx_uart_readl, usr2, usr2 &USR2_TXDC , +0 ,USEC_PER_SEC , false, sport,USR2 );imx_uart_ucrs_restore (sport, &old_ucr);if (locked)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/131 serial: exar: adding missing CTI and Exar PCI ids
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parker Newman <[email protected]>
[ Upstream commit b86ae40ffcf5a16b9569b1016da4a08c4f352ca2 ]
- Added Connect Tech and Exar IDs not already in pci_ids.h
--- drivers/tty/serial/8250/8250_exar.c | 42 +++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+)
drivers/tty/serial/8250/8250_exar.c +42 -0
@@ -41,8 +41,50 @@#define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021#define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022 +#define PCI_VENDOR_ID_CONNECT_TECH 0x12c4 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_SP_OPTO 0x0340 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_A 0x0341 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_B 0x0342 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS 0x0350 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_A 0x0351 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_B 0x0352 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS 0x0353 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_A 0x0354 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_B 0x0355 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS_OPTO 0x0360 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_A 0x0361 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_B 0x0362 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP 0x0370 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232 0x0371 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_485 0x0372 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_SP 0x0373 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_6_2_SP 0x0374 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_6_SP 0x0375 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232_NS 0x0376 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_LEFT 0x0380 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_RIGHT 0x0381 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XP_OPTO 0x0382 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_XPRS_OPTO 0x0392 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP 0x03A0 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232 0x03A1 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_485 0x03A2 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232_NS 0x03A3 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XEG001 0x0602 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_BASE 0x1000 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_2 0x1002 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_4 0x1004 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_8 0x1008 +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_12 0x100C +#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_16 0x1010 +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG00X 0x110c +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG01X 0x110d +#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_16 0x1110 +#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 +#define PCI_DEVICE_ID_EXAR_XR17V252 0x0252 +#define PCI_DEVICE_ID_EXAR_XR17V254 0x0254 +#define PCI_DEVICE_ID_EXAR_XR17V258 0x0258#define PCI_SUBDEVICE_ID_USR_2980 0x0128#define PCI_SUBDEVICE_ID_USR_2981 0x0129
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/131 usb: gadget: function: Remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 920e7522e3bab5ebc2fb0cc1a034f4470c87fa97 ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
Note that the upper limit of ida_simple_get() is exclusive, but the one of ida_alloc_max() is inclusive. So a -1 has been added when needed.
--- drivers/usb/gadget/function/f_hid.c | 6 +++--- drivers/usb/gadget/function/f_printer.c | 6 +++--- drivers/usb/gadget/function/rndis.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-)
drivers/usb/gadget/function/f_hid.c +3 -3
@@ -1025,9 +1025,9 @@ static inline int hidg_get_minor(void) {int ret; - ret =ida_simple_get (&hidg_ida,0 ,0 ,GFP_KERNEL ); + ret =ida_alloc (&hidg_ida,GFP_KERNEL );if (ret >=HIDG_MINORS ) { -ida_simple_remove (&hidg_ida, ret); +ida_free (&hidg_ida, ret); ret = -ENODEV ; }
@@ -1172,7 +1172,7 @@ static const struct config_item_type hid_func_type = {static inline void hidg_put_minor (int minor) { -ida_simple_remove (&hidg_ida, minor); +ida_free (&hidg_ida, minor); }static void hidg_free_inst (struct usb_function_instance *f)
drivers/usb/gadget/function/f_printer.c +3 -3
@@ -1316,9 +1316,9 @@ static inline int gprinter_get_minor(void) {int ret; - ret =ida_simple_get (&printer_ida,0 ,0 ,GFP_KERNEL ); + ret =ida_alloc (&printer_ida,GFP_KERNEL );if (ret >=PRINTER_MINORS ) { -ida_simple_remove (&printer_ida, ret); +ida_free (&printer_ida, ret); ret = -ENODEV ; }
@@ -1327,7 +1327,7 @@ static inline int gprinter_get_minor(void)static inline void gprinter_put_minor (int minor) { -ida_simple_remove (&printer_ida, minor); +ida_free (&printer_ida, minor); }static int gprinter_setup (int );
drivers/usb/gadget/function/rndis.c +2 -2
@@ -869,12 +869,12 @@ EXPORT_SYMBOL_GPL(rndis_msg_parser);static inline int rndis_get_nr (void ) { -return ida_simple_get (&rndis_ida,0 ,1000 ,GFP_KERNEL ); +return ida_alloc_max (&rndis_ida,999 ,GFP_KERNEL ); }static inline void rndis_put_nr (int nr) { -ida_simple_remove (&rndis_ida, nr); +ida_free (&rndis_ida, nr); }struct rndis_params *rndis_register (void (*resp_avail)(void *v),void *v)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/131 tty: add the option to have a tty reject a new ldisc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b ]
... and use it to limit the virtual terminals to just N_TTY. They are kind of special, and in particular, the "con_write()" routine violates the "writes cannot sleep" rule that some ldiscs rely on.
This avoids the
BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659
when N_GSM has been attached to a virtual console, and gsmld_write() calls con_write() while holding a spinlock, and con_write() then tries to get the console lock.
--- drivers/tty/tty_ldisc.c | 6 ++++++ drivers/tty/vt/vt.c | 10 ++++++++++ include/linux/tty_driver.h | 8 ++++++++ 3 files changed, 24 insertions(+)
drivers/tty/tty_ldisc.c +6 -0
@@ -546,6 +546,12 @@ int tty_set_ldisc(struct tty_struct *tty, int disc) goto out; } +if (tty->ops->ldisc_ok) { + retval = tty->ops->ldisc_ok (tty, disc); +if (retval) + goto out; + } + old_ldisc = tty->ldisc;/* Shutdown the old discipline. */
drivers/tty/vt/vt.c +10 -0
@@ -3440,6 +3440,15 @@ static void con_cleanup(struct tty_struct *tty)tty_port_put (&vc->port); } +/* +* We can't deal with anything but the N_TTY ldisc, +* because we can sleep in our write() routine. +*/ +static int con_ldisc_ok (struct tty_struct *tty,int ldisc) +{ +return ldisc ==N_TTY ?0 : -EINVAL ; +} +static int default_color =7 ;/* white */ static int default_italic_color =2 ;// green (ASCII) static int default_underline_color =3 ;// cyan (ASCII)
@@ -3566,6 +3575,7 @@ static const struct tty_operations con_ops = { .resize = vt_resize, .shutdown = con_shutdown, .cleanup = con_cleanup, + .ldisc_ok = con_ldisc_ok, };static struct cdev vc0_cdev;
include/linux/tty_driver.h +8 -0
@@ -155,6 +155,13 @@ struct serial_struct;* * Optional. Called under the @tty->termios_rwsem. May sleep. * +* @ldisc_ok: ``int ()(struct tty_struct *tty, int ldisc)`` +* +* This routine allows the @tty driver to decide if it can deal +* with a particular @ldisc. +* +* Optional. Called under the @tty->ldisc_sem and @tty->termios_rwsem. +* * @set_ldisc: ``void ()(struct tty_struct *tty)`` * * This routine allows the @tty driver to be notified when the device's
@@ -374,6 +381,7 @@ struct tty_operations {void (*hangup)(struct tty_struct *tty);int (*break_ctl)(struct tty_struct *tty,int state);void (*flush_buffer)(struct tty_struct *tty); +int (*ldisc_ok)(struct tty_struct *tty,int ldisc);void (*set_ldisc)(struct tty_struct *tty);void (*wait_until_sent)(struct tty_struct *tty,int timeout);void (*send_xchar)(struct tty_struct *tty,char ch);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/131 MIPS: Routerboard 532: Fix vendor retry check code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ae9daffd9028f2500c9ac1517e46d4f2b57efb80 ]
read_config_dword() contains strange condition checking ret for a number of values. The ret variable, however, is always zero because config_access() never returns anything else. Thus, the retry is always taken until number of tries is exceeded.
The code looks like it wants to check *val instead of ret to see if the read gave an error response.
--- arch/mips/pci/ops-rc32434.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/pci/ops-rc32434.c +2 -2
@@ -112,8 +112,8 @@ static int read_config_dword(struct pci_bus *bus, unsigned int devfn,* gives them time to settle */ if (where ==PCI_VENDOR_ID ) { -if (ret ==0xffffffff || ret ==0x00000000 || - ret ==0x0000ffff || ret ==0xffff0000 ) { +if (*val ==0xffffffff || *val ==0x00000000 || + *val ==0x0000ffff || *val ==0xffff0000 ) {if (delay >4 )return 0 ; delay *=2 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/131 mips: bmips: BCM6358: make sure CBR is correctly set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <[email protected]>
[ Upstream commit ce5cdd3b05216b704a704f466fb4c2dff3778caf ]
It was discovered that some device have CBR address set to 0 causing kernel panic when arch_sync_dma_for_cpu_all is called.
This was notice in situation where the system is booted from TP1 and BMIPS_GET_CBR() returns 0 instead of a valid address and !!(read_c0_brcm_cmt_local() & (1 << 31)); not failing.
The current check whether RAC flush should be disabled or not are not enough hence lets check if CBR is a valid address or not.
--- arch/mips/bmips/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/mips/bmips/setup.c +2 -1
@@ -111,7 +111,8 @@ static void bcm6358_quirks(void)* RAC flush causes kernel panics on BCM6358 when booting from TP1 * because the bootloader is not initializing it properly. */ - bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local () & (1 <<31 )); + bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local () & (1 <<31 )) || + !!BMIPS_GET_CBR (); }static void bcm6368_quirks (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/131 tracing: Build event generation tests only as modules
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 3572bd5689b0812b161b40279e39ca5b66d73e88 ]
The kprobes and synth event generation test modules add events and lock (get a reference) those event file reference in module init function, and unlock and delete it in module exit function. This is because those are designed for playing as modules.
If we make those modules as built-in, those events are left locked in the kernel, and never be removed. This causes kprobe event self-test failure as below.
[ 97.349708] ------------[ cut here ]------------ [ 97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.357106] Modules linked in: [ 97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14 [ 97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 97.363880] RIP: 0010:kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.365538] Code: a8 24 08 82 e9 ae fd ff ff 90 0f 0b 90 48 c7 c7 e5 aa 0b 82 e9 ee fc ff ff 90 0f 0b 90 48 c7 c7 2d 61 06 82 e9 8e fd ff ff 90 <0f> 0b 90 48 c7 c7 33 0b 0c 82 89 c6 e8 6e 03 1f ff 41 ff c7 e9 90 [ 97.370429] RSP: 0000:ffffc90000013b50 EFLAGS: 00010286 [ 97.371852] RAX: 00000000fffffff0 RBX: ffff888005919c00 RCX: 0000000000000000 [ 97.373829] RDX: ffff888003f40000 RSI: ffffffff8236a598 RDI: ffff888003f40a68 [ 97.375715] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 97.377675] R10: ffffffff811c9ae5 R11: ffffffff8120c4e0 R12: 0000000000000000 [ 97.379591] R13: 0000000000000001 R14: 0000000000000015 R15: 0000000000000000 [ 97.381536] FS: 0000000000000000(0000) GS:ffff88807dcc0000(0000) knlGS:0000000000000000 [ 97.383813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.385449] CR2: 0000000000000000 CR3: 0000000002244000 CR4: 00000000000006b0 [ 97.387347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 97.389277] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 97.391196] Call Trace: [ 97.391967] <TASK> [ 97.392647] ? __warn+0xcc/0x180 [ 97.393640] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.395181] ? report_bug+0xbd/0x150 [ 97.396234] ? handle_bug+0x3e/0x60 [ 97.397311] ? exc_invalid_op+0x1a/0x50 [ 97.398434] ? asm_exc_invalid_op+0x1a/0x20 [ 97.399652] ? trace_kprobe_is_busy+0x20/0x20 [ 97.400904] ? tracing_reset_all_online_cpus+0x15/0x90 [ 97.402304] ? kprobe_trace_self_tests_init+0x3f1/0x480 [ 97.403773] ? init_kprobe_trace+0x50/0x50 [ 97.404972] do_one_initcall+0x112/0x240 [ 97.406113] do_initcall_level+0x95/0xb0 [ 97.407286] ? kernel_init+0x1a/0x1a0 [ 97.408401] do_initcalls+0x3f/0x70 [ 97.409452] kernel_init_freeable+0x16f/0x1e0 [ 97.410662] ? rest_init+0x1f0/0x1f0 [ 97.411738] kernel_init+0x1a/0x1a0 [ 97.412788] ret_from_fork+0x39/0x50 [ 97.413817] ? rest_init+0x1f0/0x1f0 [ 97.414844] ret_from_fork_asm+0x11/0x20 [ 97.416285] </TASK> [ 97.417134] irq event stamp: 13437323 [ 97.418376] hardirqs last enabled at (13437337): [<ffffffff8110bc0c>] console_unlock+0x11c/0x150 [ 97.421285] hardirqs last disabled at (13437370): [<ffffffff8110bbf1>] console_unlock+0x101/0x150 [ 97.423838] softirqs last enabled at (13437366): [<ffffffff8108e17f>] handle_softirqs+0x23f/0x2a0 [ 97.426450] softirqs last disabled at (13437393): [<ffffffff8108e346>] __irq_exit_rcu+0x66/0xd0 [ 97.428850] ---[ end trace 0000000000000000 ]---
And also, since we can not cleanup dynamic_event file, ftracetest are failed too.
To avoid these issues, build these tests only as modules.
--- kernel/trace/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/Kconfig +2 -2
@@ -1068,7 +1068,7 @@ config PREEMPTIRQ_DELAY_TEST config SYNTH_EVENT_GEN_TEST tristate "Test module for in-kernel synthetic event generation" - depends on SYNTH_EVENTS + depends on SYNTH_EVENTS && m help This option creates a test module to check the base functionality of in-kernel synthetic event definition and
@@ -1081,7 +1081,7 @@ config SYNTH_EVENT_GEN_TEST config KPROBE_EVENT_GEN_TEST tristate "Test module for in-kernel kprobe event generation" - depends on KPROBE_EVENTS + depends on KPROBE_EVENTS && m help This option creates a test module to check the base functionality of in-kernel kprobe event definition.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/131 ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dustin L. Howett <[email protected]>
[ Upstream commit e799bdf51d54bebaf939fdb655aad424e624c1b1 ]
The Framework Laptop 16 does not have a combination headphone/headset 3.5mm jack; however, applying the pincfg from the Laptop 13 (nid=0x19) erroneously informs hda that the node is present.
--- sound/pci/hda/patch_realtek.c | 1 - 1 file changed, 1 deletion(-)
sound/pci/hda/patch_realtek.c +0 -1
@@ -10152,7 +10152,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x8086 ,0x2081 ,"Intel NUC 10" ,ALC256_FIXUP_INTEL_NUC10 ),SND_PCI_QUIRK (0x8086 ,0x3038 ,"Intel NUC 13" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0xf111 ,0x0001 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0xf111 ,0x0005 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0xf111 ,0x0006 ,"Framework Laptop" ,ALC295_FIXUP_FRAMEWORK_LAPTOP_MIC_NO_PRESENCE ), #if 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/131 ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 2646b43910c0e6d7f4ad535919b44b88f98c688d ]
dsp_driver=4 will force the AVS driver stack to be used, it is better to docuement this.
--- sound/hda/intel-dsp-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/hda/intel-dsp-config.c +1 -1
@@ -16,7 +16,7 @@static int dsp_driver;module_param (dsp_driver, int,0444 ); -MODULE_PARM_DESC (dsp_driver,"Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF)" ); +MODULE_PARM_DESC (dsp_driver,"Force the DSP driver for Intel DSP (0=auto, 1=legacy, 2=SST, 3=SOF, 4=AVS)" );#define FLAG_SST BIT(0)#define FLAG_SOF BIT(1)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/131 ice: move RDMA init to ice_idc.c
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Swiatkowski <[email protected]>
[ Upstream commit 2b8db6afbc95258175da69f31c9bfbea539aaa74 ]
Simplify probe flow by moving all RDMA related code to ice_init_rdma(). Unroll irq allocation if RDMA initialization fails.
Implement ice_deinit_rdma() and use it in remove flow.
Stable-dep-of: bc69ad74867d ("ice: avoid IRQ collision to fix init failure on ACPI S3 resume")
--- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_idc.c | 52 ++++++++++++++++++++++- drivers/net/ethernet/intel/ice/ice_main.c | 29 +++---------- 3 files changed, 57 insertions(+), 25 deletions(-)
drivers/net/ethernet/intel/ice/ice.h +1 -0
@@ -901,6 +901,7 @@ void ice_print_link_msg(struct ice_vsi *vsi, bool isup);int ice_plug_aux_dev (struct ice_pf *pf);void ice_unplug_aux_dev (struct ice_pf *pf);int ice_init_rdma (struct ice_pf *pf); +void ice_deinit_rdma (struct ice_pf *pf);const char *ice_aq_str (enum ice_aq_err aq_err);bool ice_is_wol_supported (struct ice_hw *hw);void ice_fdir_del_all_fltrs (struct ice_vsi *vsi);
drivers/net/ethernet/intel/ice/ice_idc.c +50 -2
74 lines not on this page · raw message
drivers/net/ethernet/intel/ice/ice_main.c +6 -23
@@ -45,7 +45,6 @@ MODULE_PARM_DESC(debug, "netif level (0=none,...,16=all), hw debug_mask (0x8XXXXMODULE_PARM_DESC (debug,"netif level (0=none,...,16=all)" );#endif /* !CONFIG_DYNAMIC_DEBUG */ -static DEFINE_IDA (ice_aux_ida);DEFINE_STATIC_KEY_FALSE (ice_xdp_locking_key);EXPORT_SYMBOL (ice_xdp_locking_key);
@@ -4971,30 +4970,16 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)/* ready to go, so clear down state bit */ clear_bit (ICE_DOWN , pf->state); -if (ice_is_rdma_ena (pf)) { - pf->aux_idx =ida_alloc (&ice_aux_ida,GFP_KERNEL ); -if (pf->aux_idx <0 ) { -dev_err (dev,"Failed to allocate device ID for AUX driver\n" ); - err = -ENOMEM ; - goto err_devlink_reg_param; - } - - err =ice_init_rdma (pf); -if (err) { -dev_err (dev,"Failed to initialize RDMA: %d\n" , err); - err = -EIO ; - goto err_init_aux_unroll; - } - }else { -dev_warn (dev,"RDMA is not supported on this device\n" ); + err =ice_init_rdma (pf); +if (err) { +dev_err (dev,"Failed to initialize RDMA: %d\n" , err); + err = -EIO ; + goto err_devlink_reg_param; }ice_devlink_register (pf);return 0 ; -err_init_aux_unroll: - pf->adev =NULL ; -ida_free (&ice_aux_ida, pf->aux_idx); err_devlink_reg_param:ice_devlink_unregister_params (pf); err_netdev_reg:
@@ -5106,9 +5091,7 @@ static void ice_remove(struct pci_dev *pdev)ice_service_task_stop (pf);ice_aq_cancel_waiting_tasks (pf); -ice_unplug_aux_dev (pf); -if (pf->aux_idx >=0 ) -ida_free (&ice_aux_ida, pf->aux_idx); +ice_deinit_rdma (pf);ice_devlink_unregister_params (pf);set_bit (ICE_DOWN , pf->state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/131 ice: avoid IRQ collision to fix init failure on ACPI S3 resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit bc69ad74867dba1377abe14356c94a946d9837a3 ]
A bug in https://bugzilla.kernel.org/show_bug.cgi?id=218906 describes that irdma would break and report hardware initialization failed after suspend/resume with Intel E810 NIC (tested on 6.9.0-rc5).
The problem is caused due to the collision between the irq numbers requested in irdma and the irq numbers requested in other drivers after suspend/resume.
The irq numbers used by irdma are derived from ice's ice_pf->msix_entries which stores mappings between MSI-X index and Linux interrupt number. It's supposed to be cleaned up when suspend and rebuilt in resume but it's not, causing irdma using the old irq numbers stored in the old ice_pf->msix_entries to request_irq() when resume. And eventually collide with other drivers.
This patch fixes this problem. On suspend, we call ice_deinit_rdma() to clean up the ice_pf->msix_entries (and free the MSI-X vectors used by irdma if we've dynamically allocated them). On resume, we call ice_init_rdma() to rebuild the ice_pf->msix_entries (and allocate the MSI-X vectors if we would like to dynamically allocate them).
--- drivers/net/ethernet/intel/ice/ice_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +6 -1
@@ -5251,7 +5251,7 @@ static int __maybe_unused ice_suspend(struct device *dev)*/ disabled =ice_service_task_stop (pf); -ice_unplug_aux_dev (pf); +ice_deinit_rdma (pf);/* Already suspended?, then there is nothing to do */ if (test_and_set_bit (ICE_SUSPENDED , pf->state)) {
@@ -5331,6 +5331,11 @@ static int __maybe_unused ice_resume(struct device *dev)if (ret)dev_err (dev,"Cannot restore interrupt scheme: %d\n" , ret); + ret =ice_init_rdma (pf); +if (ret) +dev_err (dev,"Reinitialize RDMA during resume failed: %d\n" , + ret); +clear_bit (ICE_DOWN , pf->state);/* Now perform PF reset and rebuild */ reset_type =ICE_RESET_PFR ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/131 cipso: fix total option length computation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Mosnacek <[email protected]>
[ Upstream commit 9f36169912331fa035d7b73a91252d7c2512eb1a ]
As evident from the definition of ip_options_get(), the IP option IPOPT_END is used to pad the IP option data array, not IPOPT_NOP. Yet the loop that walks the IP options to determine the total IP options length in cipso_v4_delopt() doesn't take IPOPT_END into account.
Fix it by recognizing the IPOPT_END value as the end of actual options.
--- net/ipv4/cipso_ipv4.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/ipv4/cipso_ipv4.c +8 -4
@@ -2015,12 +2015,16 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)* from there we can determine the new total option length */ iter =0 ; optlen_new =0 ; -while (iter < opt->opt.optlen) -if (opt->opt.__data[iter] !=IPOPT_NOP ) { +while (iter < opt->opt.optlen) { +if (opt->opt.__data[iter] ==IPOPT_END ) { +break ; + }else if (opt->opt.__data[iter] ==IPOPT_NOP ) { + iter++; + }else { iter += opt->opt.__data[iter +1 ]; optlen_new = iter; - }else - iter++; + } + } hdr_delta = opt->opt.optlen; opt->opt.optlen = (optlen_new +3 ) & ~3 ; hdr_delta -= opt->opt.optlen;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/131 bpf: Avoid splat in pskb_pull_reason
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 2bbe3e5a2f4ef69d13be54f1cf895b4658287080 ]
syzkaller builds (CONFIG_DEBUG_NET=y) frequently trigger a debug hint in pskb_may_pull.
We'd like to retain this debug check because it might hint at integer overflows and other issues (kernel code should pull headers, not huge value).
In bpf case, this splat isn't interesting at all: such (nonsensical) bpf programs are typically generated by a fuzzer anyway.
Do what Eric suggested and suppress such warning.
For CONFIG_DEBUG_NET=n we don't need the extra check because pskb_may_pull will do the right thing: return an error without the WARN() backtrace.
--- net/core/filter.c | 5 +++++ 1 file changed, 5 insertions(+)
net/core/filter.c +5 -0
@@ -1655,6 +1655,11 @@ static DEFINE_PER_CPU(struct bpf_scratchpad, bpf_sp);static inline int __bpf_try_make_writable (struct sk_buff *skb,unsigned int write_len) { +#ifdef CONFIG_DEBUG_NET +/* Avoid a splat in pskb_may_pull_reason() */ +if (write_len >INT_MAX ) +return -EINVAL ; +#endif return skb_ensure_writable (skb, write_len); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/131 ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajrat Makhmutov <[email protected]>
[ Upstream commit b1fd0d1285b1eae8b99af36fb26ed2512b809af6 ]
Headset microphone do not work out of the box with this laptop. This quirk fixes it. Zihao Wang specified the wrong subsystem id in his patch.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -10079,7 +10079,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940 / Yoga Duet 7" ,ALC298_FIXUP_LENOVO_C940_DUET7 ),SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ), -SND_PCI_QUIRK (0x17aa ,0x3820 ,"Yoga Duet 7 13ITL6" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3820 ,"IdeaPad 330-17IKB 81DM" ,ALC269_FIXUP_ASPIRE_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x3824 ,"Legion Y9000X 2020" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ), SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/131 netrom: Fix a memory leak in nr_heartbeat_expiry()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <[email protected]>
[ Upstream commit 0b9130247f3b6a1122478471ff0e014ea96bb735 ]
syzbot reported a memory leak in nr_create() [0].
Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where
a) a socket has a SOCK_DESTROY flag or
b) a listening socket has a SOCK_DEAD flag.
But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b."
nr_connect
nr_establish_data_link
nr_start_heartbeat
nr_release
switch (nr->state)
case NR_STATE_3
nr->state = NR_STATE_2
sock_set_flag(sk, SOCK_DESTROY);
nr_rx_frame
nr_process_rx_frame
switch (nr->state)
case NR_STATE_2
nr_state2_machine()
nr_disconnect()
nr_sk(sk)->state = NR_STATE_0
sock_set_flag(sk, SOCK_DEAD)
nr_heartbeat_expiry
switch (nr->state)
case NR_STATE_0
if (sock_flag(sk, SOCK_DESTROY) ||
(sk->sk_state == TCP_LISTEN
&& sock_flag(sk, SOCK_DEAD)))
sock_hold() // ( !!! )
nr_destroy_socket()To fix the memory leak, let's call sock_hold() only for a listening socket.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.
[0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
--- net/netrom/nr_timer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netrom/nr_timer.c +2 -1
@@ -121,7 +121,8 @@ static void nr_heartbeat_expiry(struct timer_list *t)is accepted() it isn't 'dead' so doesn't get removed. */ if (sock_flag (sk,SOCK_DESTROY ) || (sk->sk_state ==TCP_LISTEN &&sock_flag (sk,SOCK_DEAD ))) { -sock_hold (sk); +if (sk->sk_state ==TCP_LISTEN ) +sock_hold (sk);bh_unlock_sock (sk);nr_destroy_socket (sk); goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/131 ipv6: prevent possible NULL deref in fib6_nh_init()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2eab4543a2204092c3a7af81d7d6c506e59a03a6 ]
syzbot reminds us that in6_dev_get() can return NULL.
fib6_nh_init()
ip6_validate_gw( &idev )
ip6_route_check_nh( idev )
*idev = in6_dev_get(dev); // can be NULL
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7] CPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606 Code: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b RSP: 0018:ffffc900032775a0 EFLAGS: 00010202 RAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000 RDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8 RBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000 R10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8 R13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000 FS: 00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809 ip6_route_add+0x28/0x160 net/ipv6/route.c:3853 ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483 inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f940f07cea9
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -3592,7 +3592,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,if (!dev) goto out; -if (idev->cnf.disable_ipv6) { +if (!idev || idev->cnf.disable_ipv6) {NL_SET_ERR_MSG (extack,"IPv6 is disabled on nexthop device" ); err = -EACCES ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/131 ipv6: prevent possible NULL dereference in rt6_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b86762dbe19a62e785c189f313cda5b989931f37 ]
syzbot caught a NULL dereference in rt6_probe() [1]
Bail out if __in6_dev_get() returns NULL.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f] CPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline] RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758 Code: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19 RSP: 0018:ffffc900034af070 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000 RDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c RBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a R13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000 FS: 00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784 nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496 __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825 find_rr_leaf net/ipv6/route.c:853 [inline] rt6_select net/ipv6/route.c:897 [inline] fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195 ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231 pol_lookup_func include/net/ip6_fib.h:616 [inline] fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121 ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline] ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651 ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147 ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250 rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898 inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_write_iter+0x4b8/0x5c0 net/socket.c:1160 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x6b6/0x1140 fs/read_write.c:590 ksys_write+0x1f8/0x260 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/ipv6/route.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv6/route.c +2 -0
@@ -640,6 +640,8 @@ static void rt6_probe(struct fib6_nh *fib6_nh)rcu_read_lock (); last_probe =READ_ONCE (fib6_nh->last_probe); idev =__in6_dev_get (dev); +if (!idev) + goto out; neigh =__ipv6_neigh_lookup_noref (dev, nh_gw);if (neigh) {if (READ_ONCE (neigh->nud_state) &NUD_VALID )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/131 xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d46401052c2d5614da8efea5788532f0401cb164 ]
ip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64 Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00 RSP: 0018:ffffc90000117378 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7 RDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98 RBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000 R10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline] xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline] xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541 xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline] xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201 xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline] xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309 ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256 send6+0x611/0xd20 drivers/net/wireguard/socket.c:139 wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178 wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200 wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40 wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/ipv6/xfrm6_policy.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/ipv6/xfrm6_policy.c +7 -1
@@ -56,12 +56,18 @@ static int xfrm6_get_saddr(struct net *net, int oif, {struct dst_entry *dst;struct net_device *dev; +struct inet6_dev *idev; dst =xfrm6_dst_lookup (net,0 , oif,NULL , daddr, mark);if (IS_ERR (dst))return -EHOSTUNREACH ; - dev =ip6_dst_idev (dst)->dev; + idev =ip6_dst_idev (dst); +if (!idev) { +dst_release (dst); +return -EHOSTUNREACH ; + } + dev = idev->dev;ipv6_dev_get_saddr (dev_net (dev), dev, &daddr->in6,0 , &saddr->in6);dst_release (dst);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/131 netns: Make get_net_ns() handle zero refcount net
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit ff960f9d3edbe08a736b5a224d91a305ccc946b0 ]
Syzkaller hit a warning:refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0xdf/0x1d0 Code: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1 RSP: 0018:ffff8881067b7da0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac RDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001 RBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139 R10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4 R13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040 FS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0xa3/0xc0 ? __warn+0xa5/0x1c0 ? refcount_warn_saturate+0xdf/0x1d0 ? report_bug+0x1fc/0x2d0 ? refcount_warn_saturate+0xdf/0x1d0 ? handle_bug+0xa1/0x110 ? exc_invalid_op+0x3c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? __warn_printk+0xcc/0x140 ? __warn_printk+0xd5/0x140 ? refcount_warn_saturate+0xdf/0x1d0 get_net_ns+0xa4/0xc0 ? __pfx_get_net_ns+0x10/0x10 open_related_ns+0x5a/0x130 __tun_chr_ioctl+0x1616/0x2370 ? __sanitizer_cov_trace_switch+0x58/0xa0 ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30 ? __pfx_tun_chr_ioctl+0x10/0x10 tun_chr_ioctl+0x2f/0x40 __x64_sys_ioctl+0x11b/0x160 x64_sys_call+0x1211/0x20d0 do_syscall_64+0x9e/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b28f165d7 Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8 RSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7 RDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003 RBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0 R10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730 R13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...
This is trigger as below:
ns0 ns1tun_set_iff() //dev is tun0
tun->dev = dev
//ip link set tun0 netns ns1
put_net() //ref is 0
__tun_chr_ioctl() //TUNGETDEVNETNS
net = dev_net(tun->dev);
open_related_ns(&net->ns, get_net_ns); //ns1
get_net_ns()
get_net() //addition on 0
Use maybe_get_net() in get_net_ns in case net's ref is zero to fix this
--- net/core/net_namespace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/core/net_namespace.c +7 -2
@@ -657,11 +657,16 @@ EXPORT_SYMBOL_GPL(__put_net);* get_net_ns - increment the refcount of the network namespace * @ns: common namespace (net) * -* Returns the net's common namespace. +* Returns the net's common namespace or ERR_PTR() if ref is zero. */ struct ns_common *get_net_ns (struct ns_common *ns) { - return &get_net(container_of(ns, struct net, ns))->ns; +struct net *net; + + net = maybe_get_net(container_of(ns, struct net, ns)); +if (net) +return &net->ns; +return ERR_PTR (-EINVAL ); }EXPORT_SYMBOL_GPL (get_net_ns);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/131 qca_spi: Make interrupt remembering atomic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 2d7198278ece01818cd95a3beffbdf8b2a353fa0 ]
The whole mechanism to remember occurred SPI interrupts is not atomic, which could lead to unexpected behavior. So fix this by using atomic bit operations instead.
--- drivers/net/ethernet/qualcomm/qca_debug.c | 6 ++---- drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++-------- drivers/net/ethernet/qualcomm/qca_spi.h | 3 +-- 3 files changed, 11 insertions(+), 14 deletions(-)
drivers/net/ethernet/qualcomm/qca_debug.c +2 -4
@@ -111,10 +111,8 @@ qcaspi_info_show(struct seq_file *s, void *what)seq_printf (s,"IRQ : %d\n" , qca->spi_dev->irq); -seq_printf (s,"INTR REQ : %u\n" , - qca->intr_req); -seq_printf (s,"INTR SVC : %u\n" , - qca->intr_svc); +seq_printf (s,"INTR : %lx\n" , + qca->intr);seq_printf (s,"SPI max speed : %lu\n" , (unsigned long )qca->spi_dev->max_speed_hz);
drivers/net/ethernet/qualcomm/qca_spi.c +8 -8
@@ -49,6 +49,8 @@#define MAX_DMA_BURST_LEN 5000 +#define SPI_INTR 0 +/* Modules parameters */ #define QCASPI_CLK_SPEED_MIN 1000000#define QCASPI_CLK_SPEED_MAX 16000000
@@ -593,14 +595,14 @@ qcaspi_spi_thread(void *data)continue ; } -if ((qca->intr_req == qca->intr_svc) && +if (!test_bit (SPI_INTR , &qca->intr) && !qca->txr.skb[qca->txr.head])schedule ();set_current_state (TASK_RUNNING ); -netdev_dbg (qca->net_dev,"have work to do. int: %d, tx_skb: %p\n" , - qca->intr_req - qca->intr_svc, +netdev_dbg (qca->net_dev,"have work to do. int: %lu, tx_skb: %p\n" , + qca->intr, qca->txr.skb[qca->txr.head]);qcaspi_qca7k_sync (qca,QCASPI_EVENT_UPDATE );
@@ -614,8 +616,7 @@ qcaspi_spi_thread(void *data)msleep (QCASPI_QCA7K_REBOOT_TIME_MS ); } -if (qca->intr_svc != qca->intr_req) { - qca->intr_svc = qca->intr_req; +if (test_and_clear_bit (SPI_INTR , &qca->intr)) {start_spi_intr_handling (qca, &intr_cause);if (intr_cause &SPI_INT_CPU_ON ) {
@@ -677,7 +678,7 @@ qcaspi_intr_handler(int irq, void *data) {struct qcaspi *qca = data; - qca->intr_req++; +set_bit (SPI_INTR , &qca->intr);if (qca->spi_thread)wake_up_process (qca->spi_thread);
@@ -693,8 +694,7 @@ qcaspi_netdev_open(struct net_device *dev)if (!qca)return -EINVAL ; - qca->intr_req =1 ; - qca->intr_svc =0 ; +set_bit (SPI_INTR , &qca->intr); qca->sync =QCASPI_SYNC_UNKNOWN ;qcafrm_fsm_init_spi (&qca->frm_handle);
drivers/net/ethernet/qualcomm/qca_spi.h +1 -2
@@ -93,8 +93,7 @@ struct qcaspi {struct qcafrm_handle frm_handle;struct sk_buff *rx_skb; -unsigned int intr_req; -unsigned int intr_svc; +unsigned long intr;u16 reset_count;#ifdef CONFIG_DEBUG_FS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/131 net: lan743x: disable WOL upon resume to restore full data path operation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit 7725363936a88351b71495774c1e0e852ae4cdca ]
When Wake-on-LAN (WoL) is active and the system is in suspend mode, triggering a system event can wake the system from sleep, which may block the data path. To restore normal data path functionality after waking, disable all wake-up events. Furthermore, clear all Write 1 to Clear (W1C) status bits by writing 1's to them.
--- drivers/net/ethernet/microchip/lan743x_main.c | 30 ++++++++++++++++--- drivers/net/ethernet/microchip/lan743x_main.h | 24 +++++++++++++++ 2 files changed, 50 insertions(+), 4 deletions(-)
drivers/net/ethernet/microchip/lan743x_main.c +26 -4
@@ -3513,7 +3513,7 @@ static void lan743x_pm_set_wol(struct lan743x_adapter *adapter)/* clear wake settings */ pmtctl =lan743x_csr_read (adapter,PMT_CTL ); - pmtctl |=PMT_CTL_WUPS_MASK_ ; + pmtctl |=PMT_CTL_WUPS_MASK_ |PMT_CTL_RES_CLR_WKP_MASK_ ; pmtctl &= ~(PMT_CTL_GPIO_WAKEUP_EN_ |PMT_CTL_EEE_WAKEUP_EN_ |PMT_CTL_WOL_EN_ |PMT_CTL_MAC_D3_RX_CLK_OVR_ |PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_ |PMT_CTL_ETH_PHY_WAKE_EN_ );
@@ -3648,6 +3648,7 @@ static int lan743x_pm_resume(struct device *dev)struct pci_dev *pdev =to_pci_dev (dev);struct net_device *netdev =pci_get_drvdata (pdev);struct lan743x_adapter *adapter =netdev_priv (netdev); +u32 data;int ret;pci_set_power_state (pdev,PCI_D0 );
@@ -3666,6 +3667,30 @@ static int lan743x_pm_resume(struct device *dev)return ret; } + ret =lan743x_csr_read (adapter,MAC_WK_SRC ); +netif_dbg (adapter, drv, adapter->netdev, +"Wakeup source : 0x%08X\n" , ret); + +/* Clear the wol configuration and status bits. Note that +* the status bits are "Write One to Clear (W1C)" +*/ + data =MAC_WUCSR_EEE_TX_WAKE_ |MAC_WUCSR_EEE_RX_WAKE_ | +MAC_WUCSR_RFE_WAKE_FR_ |MAC_WUCSR_PFDA_FR_ |MAC_WUCSR_WUFR_ | +MAC_WUCSR_MPR_ |MAC_WUCSR_BCAST_FR_ ; +lan743x_csr_write (adapter,MAC_WUCSR , data); + + data =MAC_WUCSR2_NS_RCD_ |MAC_WUCSR2_ARP_RCD_ | +MAC_WUCSR2_IPV6_TCPSYN_RCD_ |MAC_WUCSR2_IPV4_TCPSYN_RCD_ ; +lan743x_csr_write (adapter,MAC_WUCSR2 , data); + + data =MAC_WK_SRC_ETH_PHY_WK_ |MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_ | +MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_ |MAC_WK_SRC_EEE_TX_WK_ | +MAC_WK_SRC_EEE_RX_WK_ |MAC_WK_SRC_RFE_FR_WK_ | +MAC_WK_SRC_PFDA_FR_WK_ |MAC_WK_SRC_MP_FR_WK_ | +MAC_WK_SRC_BCAST_FR_WK_ |MAC_WK_SRC_WU_FR_WK_ | +MAC_WK_SRC_WK_FR_SAVED_ ; +lan743x_csr_write (adapter,MAC_WK_SRC , data); +/* open netdev when netdev is at running state while resume. * For instance, it is true when system wakesup after pm-suspend * However, it is false when system wakes up after suspend GUI menu
@@ -3674,9 +3699,6 @@ static int lan743x_pm_resume(struct device *dev)lan743x_netdev_open (netdev);netif_device_attach (netdev); - ret =lan743x_csr_read (adapter,MAC_WK_SRC ); -netif_info (adapter, drv, adapter->netdev, -"Wakeup source : 0x%08X\n" , ret);return 0 ; }
drivers/net/ethernet/microchip/lan743x_main.h +24 -0
@@ -61,6 +61,7 @@#define PMT_CTL_RX_FCT_RFE_D3_CLK_OVR_ BIT(18)#define PMT_CTL_GPIO_WAKEUP_EN_ BIT(15)#define PMT_CTL_EEE_WAKEUP_EN_ BIT(13) +#define PMT_CTL_RES_CLR_WKP_MASK_ GENMASK(9, 8)#define PMT_CTL_READY_ BIT(7)#define PMT_CTL_ETH_PHY_RST_ BIT(4)#define PMT_CTL_WOL_EN_ BIT(3)
@@ -227,12 +228,31 @@#define MAC_WUCSR (0x140)#define MAC_MP_SO_EN_ BIT(21)#define MAC_WUCSR_RFE_WAKE_EN_ BIT(14) +#define MAC_WUCSR_EEE_TX_WAKE_ BIT(13) +#define MAC_WUCSR_EEE_RX_WAKE_ BIT(11) +#define MAC_WUCSR_RFE_WAKE_FR_ BIT(9) +#define MAC_WUCSR_PFDA_FR_ BIT(7) +#define MAC_WUCSR_WUFR_ BIT(6) +#define MAC_WUCSR_MPR_ BIT(5) +#define MAC_WUCSR_BCAST_FR_ BIT(4)#define MAC_WUCSR_PFDA_EN_ BIT(3)#define MAC_WUCSR_WAKE_EN_ BIT(2)#define MAC_WUCSR_MPEN_ BIT(1)#define MAC_WUCSR_BCST_EN_ BIT(0)#define MAC_WK_SRC (0x144) +#define MAC_WK_SRC_ETH_PHY_WK_ BIT(17) +#define MAC_WK_SRC_IPV6_TCPSYN_RCD_WK_ BIT(16) +#define MAC_WK_SRC_IPV4_TCPSYN_RCD_WK_ BIT(15) +#define MAC_WK_SRC_EEE_TX_WK_ BIT(14) +#define MAC_WK_SRC_EEE_RX_WK_ BIT(13) +#define MAC_WK_SRC_RFE_FR_WK_ BIT(12) +#define MAC_WK_SRC_PFDA_FR_WK_ BIT(11) +#define MAC_WK_SRC_MP_FR_WK_ BIT(10) +#define MAC_WK_SRC_BCAST_FR_WK_ BIT(9) +#define MAC_WK_SRC_WU_FR_WK_ BIT(8) +#define MAC_WK_SRC_WK_FR_SAVED_ BIT(7) +#define MAC_MP_SO_HI (0x148)#define MAC_MP_SO_LO (0x14C)
@@ -295,6 +315,10 @@#define RFE_INDX (index) (0x580 + (index << 2))#define MAC_WUCSR2 (0x600) +#define MAC_WUCSR2_NS_RCD_ BIT(7) +#define MAC_WUCSR2_ARP_RCD_ BIT(6) +#define MAC_WUCSR2_IPV6_TCPSYN_RCD_ BIT(5) +#define MAC_WUCSR2_IPV4_TCPSYN_RCD_ BIT(4)#define SGMII_ACC (0x720)#define SGMII_ACC_SGMII_BZY_ BIT(31)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/131 net: lan743x: Support WOL at both the PHY and MAC appropriately
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit 8c248cd836014339498486f14f435c0e344183a7 ]
Prevent options not supported by the PHY from being requested to it by the MAC Whenever a WOL option is supported by both, the PHY is given priority since that usually leads to better power savings.
--- .../net/ethernet/microchip/lan743x_ethtool.c | 44 +++++++++++++++++-- drivers/net/ethernet/microchip/lan743x_main.c | 18 ++++++-- drivers/net/ethernet/microchip/lan743x_main.h | 4 ++ 3 files changed, 58 insertions(+), 8 deletions(-)
drivers/net/ethernet/microchip/lan743x_ethtool.c +40 -4
@@ -1146,8 +1146,12 @@ static void lan743x_ethtool_get_wol(struct net_device *netdev,if (netdev->phydev)phy_ethtool_get_wol (netdev->phydev, wol); - wol->supported |=WAKE_BCAST |WAKE_UCAST |WAKE_MCAST | -WAKE_MAGIC |WAKE_PHY |WAKE_ARP ; +if (wol->supported != adapter->phy_wol_supported) +netif_warn (adapter, drv, adapter->netdev, +"PHY changed its supported WOL! old=%x, new=%x\n" , + adapter->phy_wol_supported, wol->supported); + + wol->supported |=MAC_SUPPORTED_WAKES ;if (adapter->is_pci11x1x) wol->supported |=WAKE_MAGICSECURE ;
@@ -1162,7 +1166,39 @@ static int lan743x_ethtool_set_wol(struct net_device *netdev, {struct lan743x_adapter *adapter =netdev_priv (netdev); +/* WAKE_MAGICSEGURE is a modifier of and only valid together with +* WAKE_MAGIC +*/ +if ((wol->wolopts &WAKE_MAGICSECURE ) && !(wol->wolopts &WAKE_MAGIC )) +return -EINVAL ; + +if (netdev->phydev) { +struct ethtool_wolinfo phy_wol; +int ret; + + phy_wol.wolopts = wol->wolopts & adapter->phy_wol_supported; + +/* If WAKE_MAGICSECURE was requested, filter out WAKE_MAGIC +* for PHYs that do not support WAKE_MAGICSECURE +*/ +if (wol->wolopts &WAKE_MAGICSECURE && + !(adapter->phy_wol_supported &WAKE_MAGICSECURE )) + phy_wol.wolopts &= ~WAKE_MAGIC ; + + ret =phy_ethtool_set_wol (netdev->phydev, &phy_wol); +if (ret && (ret != -EOPNOTSUPP )) +return ret; + +if (ret == -EOPNOTSUPP ) + adapter->phy_wolopts =0 ; +else + adapter->phy_wolopts = phy_wol.wolopts; + }else { + adapter->phy_wolopts =0 ; + } + adapter->wolopts =0 ; + wol->wolopts &= ~adapter->phy_wolopts;if (wol->wolopts &WAKE_UCAST ) adapter->wolopts |=WAKE_UCAST ;if (wol->wolopts &WAKE_MCAST )
@@ -1183,10 +1219,10 @@ static int lan743x_ethtool_set_wol(struct net_device *netdev, memset(adapter->sopass, 0, sizeof(u8) * SOPASS_MAX); } + wol->wolopts = adapter->wolopts | adapter->phy_wolopts;device_set_wakeup_enable (&adapter->pdev->dev, (bool )wol->wolopts); -return netdev->phydev ?phy_ethtool_set_wol (netdev->phydev, wol) - : -ENETDOWN ; +return 0 ; }#endif /* CONFIG_PM */
drivers/net/ethernet/microchip/lan743x_main.c +14 -4
@@ -3056,6 +3056,17 @@ static int lan743x_netdev_open(struct net_device *netdev)if (ret) goto close_tx; } + +#ifdef CONFIG_PM +if (adapter->netdev->phydev) { +struct ethtool_wolinfo wol = { .cmd =ETHTOOL_GWOL }; + +phy_ethtool_get_wol (netdev->phydev, &wol); + adapter->phy_wol_supported = wol.supported; + adapter->phy_wolopts = wol.wolopts; + } +#endif +return 0 ; close_tx:
@@ -3525,10 +3536,9 @@ static void lan743x_pm_set_wol(struct lan743x_adapter *adapter) pmtctl |=PMT_CTL_ETH_PHY_D3_COLD_OVR_ |PMT_CTL_ETH_PHY_D3_OVR_ ; -if (adapter->wolopts &WAKE_PHY ) { - pmtctl |=PMT_CTL_ETH_PHY_EDPD_PLL_CTL_ ; +if (adapter->phy_wolopts) pmtctl |=PMT_CTL_ETH_PHY_WAKE_EN_ ; - } +if (adapter->wolopts &WAKE_MAGIC ) { wucsr |=MAC_WUCSR_MPEN_ ; macrx |=MAC_RX_RXEN_ ;
@@ -3624,7 +3634,7 @@ static int lan743x_pm_suspend(struct device *dev)lan743x_csr_write (adapter,MAC_WUCSR2 ,0 );lan743x_csr_write (adapter,MAC_WK_SRC ,0xFFFFFFFF ); -if (adapter->wolopts) +if (adapter->wolopts || adapter->phy_wolopts)lan743x_pm_set_wol (adapter);if (adapter->is_pci11x1x) {
drivers/net/ethernet/microchip/lan743x_main.h +4 -0
@@ -1034,6 +1034,8 @@ enum lan743x_sgmii_lsd {LINK_2500_SLAVE }; +#define MAC_SUPPORTED_WAKES (WAKE_BCAST | WAKE_UCAST | WAKE_MCAST | \ + WAKE_MAGIC | WAKE_ARP)struct lan743x_adapter {struct net_device *netdev;struct mii_bus *mdiobus;
@@ -1041,6 +1043,8 @@ struct lan743x_adapter {#ifdef CONFIG_PM u32 wolopts;u8 sopass[SOPASS_MAX ]; +u32 phy_wolopts; +u32 phy_wol_supported;#endif struct pci_dev *pdev;struct lan743x_csr csr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/131 net: phy: mxl-gpy: enhance delay time required by loopback disable function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Liang <[email protected]>
[ Upstream commit 0ba13995be9b416ea1d3daaf3ba871a67f45899b ]
GPY2xx devices need 3 seconds to fully switch out of loopback mode before it can safely re-enter loopback mode. Implement timeout mechanism to guarantee 3 seconds waited before re-enter loopback mode.
Stable-dep-of: c44d3ffd85db ("net: phy: mxl-gpy: Remove interrupt mask clearing from config_init")
--- drivers/net/phy/mxl-gpy.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)
drivers/net/phy/mxl-gpy.c +29 -6
@@ -95,6 +95,13 @@ struct gpy_priv {u8 fw_major;u8 fw_minor; + +/* It takes 3 seconds to fully switch out of loopback mode before +* it can safely re-enter loopback mode. Record the time when +* loopback is disabled. Check and wait if necessary before loopback +* is enabled. +*/ +u64 lb_dis_to; }; static const struct {
@@ -682,18 +689,34 @@ static void gpy_get_wol(struct phy_device *phydev,static int gpy_loopback (struct phy_device *phydev,bool enable) { +struct gpy_priv *priv = phydev->priv; +u16 set =0 ;int ret; - ret =phy_modify (phydev,MII_BMCR ,BMCR_LOOPBACK , - enable ?BMCR_LOOPBACK :0 ); -if (!ret) { -/* It takes some time for PHY device to switch -* into/out-of loopback mode. +if (enable) { +u64 now =get_jiffies_64 (); + +/* wait until 3 seconds from last disable */ +if (time_before64 (now, priv->lb_dis_to)) +msleep (jiffies64_to_msecs (priv->lb_dis_to - now)); + + set =BMCR_LOOPBACK ; + } + + ret =phy_modify (phydev,MII_BMCR ,BMCR_LOOPBACK , set); +if (ret <=0 ) +return ret; + +if (enable) { +/* It takes some time for PHY device to switch into +* loopback mode. */ msleep (100 ); + }else { + priv->lb_dis_to =get_jiffies_64 () +HZ *3 ; } -return ret; +return 0 ; }static int gpy115_loopback (struct phy_device *phydev,bool enable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/131 net: phy: mxl-gpy: Remove interrupt mask clearing from config_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Lakkaraju <[email protected]>
[ Upstream commit c44d3ffd85db03ebcc3090e55589e10d5af9f3a9 ]
When the system resumes from sleep, the phy_init_hw() function invokes config_init(), which clears all interrupt masks and causes wake events to be lost in subsequent wake sequences. Remove interrupt mask clearing from config_init() and preserve relevant masks in config_intr().
--- drivers/net/phy/mxl-gpy.c | 58 +++++++++++++++++++++++++-------------- 1 file changed, 38 insertions(+), 20 deletions(-)
drivers/net/phy/mxl-gpy.c +38 -20
@@ -95,6 +95,7 @@ struct gpy_priv {u8 fw_major;u8 fw_minor; +u32 wolopts;/* It takes 3 seconds to fully switch out of loopback mode before * it can safely re-enter loopback mode. Record the time when
@@ -209,6 +210,15 @@ static int gpy_hwmon_register(struct phy_device *phydev) }#endif +static int gpy_ack_interrupt (struct phy_device *phydev) +{ +int ret; + +/* Clear all pending interrupts */ + ret =phy_read (phydev,PHY_ISTAT ); +return ret <0 ? ret :0 ; +} +static int gpy_mbox_read (struct phy_device *phydev,u32 addr) {struct gpy_priv *priv = phydev->priv;
@@ -250,16 +260,8 @@ static int gpy_mbox_read(struct phy_device *phydev, u32 addr)static int gpy_config_init (struct phy_device *phydev) { -int ret; - -/* Mask all interrupts */ - ret =phy_write (phydev,PHY_IMASK ,0 ); -if (ret) -return ret; - -/* Clear all pending interrupts */ - ret =phy_read (phydev,PHY_ISTAT ); -return ret <0 ? ret :0 ; +/* Nothing to configure. Configuration Requirement Placeholder */ +return 0 ; }static bool gpy_has_broken_mdint (struct phy_device *phydev)
@@ -540,11 +542,23 @@ static int gpy_read_status(struct phy_device *phydev)static int gpy_config_intr (struct phy_device *phydev) { +struct gpy_priv *priv = phydev->priv;u16 mask =0 ; +int ret; + + ret =gpy_ack_interrupt (phydev); +if (ret) +return ret;if (phydev->interrupts ==PHY_INTERRUPT_ENABLED ) mask =PHY_IMASK_MASK ; +if (priv->wolopts &WAKE_MAGIC ) + mask |=PHY_IMASK_WOL ; + +if (priv->wolopts &WAKE_PHY ) + mask |=PHY_IMASK_LSTC ; +return phy_write (phydev,PHY_IMASK , mask); }
@@ -593,6 +607,7 @@ static int gpy_set_wol(struct phy_device *phydev, struct ethtool_wolinfo *wol) {struct net_device *attach_dev = phydev->attached_dev; +struct gpy_priv *priv = phydev->priv;int ret;if (wol->wolopts &WAKE_MAGIC ) {
@@ -640,6 +655,8 @@ static int gpy_set_wol(struct phy_device *phydev, ret =phy_read (phydev,PHY_ISTAT );if (ret <0 )return ret; + + priv->wolopts |=WAKE_MAGIC ; }else {/* Disable magic packet matching */ ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2,
@@ -647,6 +664,13 @@ static int gpy_set_wol(struct phy_device *phydev, WOL_EN);if (ret <0 )return ret; + +/* Disable the WOL interrupt */ + ret =phy_clear_bits (phydev,PHY_IMASK ,PHY_IMASK_WOL ); +if (ret <0 ) +return ret; + + priv->wolopts &= ~WAKE_MAGIC ; }if (wol->wolopts &WAKE_PHY ) {
@@ -663,9 +687,11 @@ static int gpy_set_wol(struct phy_device *phydev,if (ret & (PHY_IMASK_MASK & ~PHY_IMASK_LSTC ))phy_trigger_machine (phydev); + priv->wolopts |=WAKE_PHY ;return 0 ; } + priv->wolopts &= ~WAKE_PHY ;/* Disable the link state change interrupt */ return phy_clear_bits (phydev,PHY_IMASK ,PHY_IMASK_LSTC ); }
@@ -673,18 +699,10 @@ static int gpy_set_wol(struct phy_device *phydev,static void gpy_get_wol (struct phy_device *phydev,struct ethtool_wolinfo *wol) { -int ret; +struct gpy_priv *priv = phydev->priv; wol->supported =WAKE_MAGIC |WAKE_PHY ; - wol->wolopts =0 ; - - ret =phy_read_mmd (phydev,MDIO_MMD_VEND2 ,VPSPEC2_WOL_CTL ); -if (ret &WOL_EN ) - wol->wolopts |=WAKE_MAGIC ; - - ret =phy_read (phydev,PHY_IMASK ); -if (ret &PHY_IMASK_LSTC ) - wol->wolopts |=WAKE_PHY ; + wol->wolopts = priv->wolopts; }static int gpy_loopback (struct phy_device *phydev,bool enable)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/131 net/sched: act_api: rely on rcu in tcf_idr_check_alloc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Tammela <[email protected]>
[ Upstream commit 4b55e86736d5b492cf689125da2600f59c7d2c39 ]
Instead of relying only on the idrinfo->lock mutex for bind/alloc logic, rely on a combination of rcu + mutex + atomics to better scale the case where multiple rtnl-less filters are binding to the same action object.
Action binding happens when an action index is specified explicitly and
an action exists which such index exists. Example:
tc actions add action drop index 1
tc filter add ... matchall action drop index 1
tc filter add ... matchall action drop index 1
tc filter add ... matchall action drop index 1
tc filter ls ...
filter protocol all pref 49150 matchall chain 0 filter protocol all pref 49150 matchall chain 0 handle 0x1 not_in_hw
action order 1: gact action drop
random type none pass val 0
index 1 ref 4 bind 3
filter protocol all pref 49151 matchall chain 0 filter protocol all pref 49151 matchall chain 0 handle 0x1
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 1 ref 4 bind 3
filter protocol all pref 49152 matchall chain 0 filter protocol all pref 49152 matchall chain 0 handle 0x1
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 1 ref 4 bind 3
When no index is specified, as before, grab the mutex and allocate in the idr the next available id. In this version, as opposed to before, it's simplified to store the -EBUSY pointer instead of the previous alloc + replace combination.
When an index is specified, rely on rcu to find if there's an object in such index. If there's none, fallback to the above, serializing on the mutex and reserving the specified id. If there's one, it can be an -EBUSY pointer, in which case we just try again until it's an action, or an action. Given the rcu guarantees, the action found could be dead and therefore we need to bump the refcount if it's not 0, handling the case it's in fact 0.
As bind and the action refcount are already atomics, these increments can happen without the mutex protection while many tcf_idr_check_alloc race to bind to the same action instance.
In case binding encounters a parallel delete or add, it will return -EAGAIN in order to try again. Both filter and action apis already have the retry machinery in-place. In case it's an unlocked filter it retries under the rtnl lock.
Stable-dep-of: d864319871b0 ("net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()")
--- net/sched/act_api.c | 65 ++++++++++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 22 deletions(-)
net/sched/act_api.c +43 -22
@@ -820,6 +820,9 @@ EXPORT_SYMBOL(tcf_idr_cleanup);* its reference and bind counters, and return 1. Otherwise insert temporary * error pointer (to prevent concurrent users from inserting actions with same * index) and return 0. +* +* May return -EAGAIN for binding actions in case of a parallel add/delete on +* the requested index. */ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,
@@ -828,43 +831,61 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,struct tcf_idrinfo *idrinfo = tn->idrinfo;struct tc_action *p;int ret; +u32 max; -again: -mutex_lock (&idrinfo->lock);if (*index) { +again: +rcu_read_lock (); p =idr_find (&idrinfo->action_idr, *index); +if (IS_ERR (p)) {/* This means that another process allocated * index but did not assign the pointer yet. */ -mutex_unlock (&idrinfo->lock); +rcu_read_unlock (); goto again; } -if (p) { -refcount_inc (&p->tcfa_refcnt); -if (bind) -atomic_inc (&p->tcfa_bindcnt); - *a = p; - ret =1 ; - }else { - *a =NULL ; - ret =idr_alloc_u32 (&idrinfo->action_idr,NULL , index, - *index,GFP_KERNEL ); -if (!ret) -idr_replace (&idrinfo->action_idr, -ERR_PTR (-EBUSY ), *index); +if (!p) { +/* Empty slot, try to allocate it */ + max = *index; +rcu_read_unlock (); + goto new; + } + +if (!refcount_inc_not_zero (&p->tcfa_refcnt)) { +/* Action was deleted in parallel */ +rcu_read_unlock (); +return -EAGAIN ; } + +if (bind) +atomic_inc (&p->tcfa_bindcnt); + *a = p; + +rcu_read_unlock (); + +return 1 ; }else { +/* Find a slot */ *index =1 ; - *a =NULL ; - ret =idr_alloc_u32 (&idrinfo->action_idr,NULL , index, -UINT_MAX ,GFP_KERNEL ); -if (!ret) -idr_replace (&idrinfo->action_idr,ERR_PTR (-EBUSY ), - *index); + max =UINT_MAX ; } + +new: + *a =NULL ; + +mutex_lock (&idrinfo->lock); + ret =idr_alloc_u32 (&idrinfo->action_idr,ERR_PTR (-EBUSY ), index, max, +GFP_KERNEL );mutex_unlock (&idrinfo->lock); + +/* N binds raced for action allocation, +* retry for all the ones that failed. +*/ +if (ret == -ENOSPC && *index == max) + ret = -EAGAIN ; +return ret; }EXPORT_SYMBOL (tcf_idr_check_alloc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/131 net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ruth <[email protected]>
[ Upstream commit d864319871b05fadd153e0aede4811ca7008f5d6 ]
syzbot found hanging tasks waiting on rtnl_lock [1]
A reproducer is available in the syzbot bug.
When a request to add multiple actions with the same index is sent, the second request will block forever on the first request. This holds rtnl_lock, and causes tasks to hang.
Return -EAGAIN to prevent infinite looping, while keeping documented behavior.
[1]
INFO: task kworker/1:0:5088 blocked for more than 143 seconds. Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: <TASK> context_switch kernel/sched/core.c:5409 [inline] __schedule+0xf15/0x5d00 kernel/sched/core.c:6746 __schedule_loop kernel/sched/core.c:6823 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6838 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 wiphy_lock include/net/cfg80211.h:5953 [inline] reg_leave_invalid_chans net/wireless/reg.c:2466 [inline] reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481
--- net/sched/act_api.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/sched/act_api.c +1 -2
@@ -834,7 +834,6 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,u32 max;if (*index) { -again:rcu_read_lock (); p =idr_find (&idrinfo->action_idr, *index);
@@ -843,7 +842,7 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,* index but did not assign the pointer yet. */ rcu_read_unlock (); - goto again; +return -EAGAIN ; }if (!p) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/131 tipc: force a dst refcount before doing decryption
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ]
As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"):
"Crypto requests might return asynchronous. In this case we leave the
rcu protected region, so force a refcount on the skb's destination entry before we enter the xfrm type input/output handlers."
On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a possible crash.
Shuang reported this issue when this warning is triggered:
[] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug [] Workqueue: crypto cryptd_queue_worker
[] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc]
[] Call Trace:
[] tipc_sk_mcast_rcv+0x548/0xea0 [tipc]
[] tipc_rcv+0xcf5/0x1060 [tipc]
[] tipc_aead_decrypt_done+0x215/0x2e0 [tipc]
[] cryptd_aead_crypt+0xdb/0x190
[] cryptd_queue_worker+0xed/0x190
[] process_one_work+0x93d/0x17e0
--- net/tipc/node.c | 1 + 1 file changed, 1 insertion(+)
net/tipc/node.c +1 -0
@@ -2107,6 +2107,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b) }else { n =tipc_node_find_by_id (net, ehdr->id); } +skb_dst_force (skb);tipc_crypto_rcv (net, (n) ? n->crypto_rx :NULL , &skb, b);if (!skb)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/131 sched: act_ct: add netns into the key of tcf_ct_flow_table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 88c67aeb14070bab61d3dd8be96c8b42ebcaf53a ]
zones_ht is a global hashtable for flow_table with zone as key. However, it does not consider netns when getting a flow_table from zones_ht in tcf_ct_init(), and it means an act_ct action in netns A may get a flow_table that belongs to netns B if it has the same zone value.
In Shuang's test with the TOPO:
tcf2_c <---> tcf2_sw1 <---> tcf2_sw2 <---> tcf2_s
tcf2_sw1 and tcf2_sw2 saw the same flow and used the same flow table, which caused their ct entries entering unexpected states and the TCP connection not able to end normally.
This patch fixes the issue simply by adding netns into the key of tcf_ct_flow_table so that an act_ct action gets a flow_table that belongs to its own netns in tcf_ct_init().
Note that for easy coding we don't use tcf_ct_flow_table.nf_ft.net, as the ct_ft is initialized after inserting it to the hashtable in tcf_ct_flow_table_get() and also it requires to implement several functions in rhashtable_params including hashfn, obj_hashfn and obj_cmpfn.
--- net/sched/act_ct.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/sched/act_ct.c +11 -5
@@ -39,21 +39,26 @@ static struct workqueue_struct *act_ct_wq;static struct rhashtable zones_ht;static DEFINE_MUTEX (zones_mutex); +struct zones_ht_key { +struct net *net; +u16 zone; +}; +struct tcf_ct_flow_table {struct rhash_head node;/* In zones tables */ struct rcu_work rwork;struct nf_flowtable nf_ft;refcount_t ref; -u16 zone; +struct zones_ht_key key;bool dying; };static const struct rhashtable_params zones_params = { .head_offset = offsetof(struct tcf_ct_flow_table , node), - .key_offset = offsetof(struct tcf_ct_flow_table , zone), - .key_len = sizeof_field(struct tcf_ct_flow_table, zone), + .key_offset = offsetof(struct tcf_ct_flow_table , key), + .key_len = sizeof_field(struct tcf_ct_flow_table, key), .automatic_shrinking = true, };
@@ -312,11 +317,12 @@ static struct nf_flowtable_type flowtable_ct = {static int tcf_ct_flow_table_get (struct net *net,struct tcf_ct_params *params) { +struct zones_ht_key key = { .net = net, .zone = params->zone };struct tcf_ct_flow_table *ct_ft;int err = -ENOMEM ;mutex_lock (&zones_mutex); - ct_ft =rhashtable_lookup_fast (&zones_ht, ¶ms->zone, zones_params); + ct_ft =rhashtable_lookup_fast (&zones_ht, &key, zones_params);if (ct_ft &&refcount_inc_not_zero (&ct_ft->ref)) goto out_unlock;
@@ -325,7 +331,7 @@ static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) goto err_alloc;refcount_set (&ct_ft->ref,1 ); - ct_ft->zone = params->zone; + ct_ft->key = key; err =rhashtable_insert_fast (&zones_ht, &ct_ft->node, zones_params);if (err) goto err_insert;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/131 ptp: fix integer overflow in max_vclocks_store
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 81d23d2a24012e448f651e007fac2cfd20a45ce0 ]
On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() to do the allocation to prevent this.
--- drivers/ptp/ptp_sysfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/ptp/ptp_sysfs.c +1 -2
@@ -283,8 +283,7 @@ static ssize_t max_vclocks_store(struct device *dev,if (max < ptp->n_vclocks) goto out; - size =sizeof (int ) * max; - vclock_index =kzalloc (size,GFP_KERNEL ); + vclock_index =kcalloc (max,sizeof (int ),GFP_KERNEL );if (!vclock_index) { err = -ENOMEM ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/131 net: stmmac: No need to calculate speed divider when offload is disabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit b8c43360f6e424131fa81d3ba8792ad8ff25a09e ]
commit be27b8965297 ("net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters") introduced a problem. When deleting, it prompts "Invalid portTransmitRate 0 (idleSlope - sendSlope)" and exits. Add judgment on cbs.enable. Only when offload is enabled, speed divider needs to be calculated.
--- .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 40 ++++++++++--------- 1 file changed, 22 insertions(+), 18 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +22 -18
@@ -358,24 +358,28 @@ static int tc_setup_cbs(struct stmmac_priv *priv, port_transmit_rate_kbps = qopt->idleslope - qopt->sendslope; -/* Port Transmit Rate and Speed Divider */ -switch (div_s64 (port_transmit_rate_kbps,1000 )) { -case SPEED_10000 : -case SPEED_5000 : - ptr =32 ; -break ; -case SPEED_2500 : -case SPEED_1000 : - ptr =8 ; -break ; -case SPEED_100 : - ptr =4 ; -break ; -default : -netdev_err (priv->dev, -"Invalid portTransmitRate %lld (idleSlope - sendSlope)\n" , - port_transmit_rate_kbps); -return -EINVAL ; +if (qopt->enable) { +/* Port Transmit Rate and Speed Divider */ +switch (div_s64 (port_transmit_rate_kbps,1000 )) { +case SPEED_10000 : +case SPEED_5000 : + ptr =32 ; +break ; +case SPEED_2500 : +case SPEED_1000 : + ptr =8 ; +break ; +case SPEED_100 : + ptr =4 ; +break ; +default : +netdev_err (priv->dev, +"Invalid portTransmitRate %lld (idleSlope - sendSlope)\n" , + port_transmit_rate_kbps); +return -EINVAL ; + } + }else { + ptr =0 ; } mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/131 virtio_net: checksum offloading handling fix
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heng Qi <[email protected]>
[ Upstream commit 604141c036e1b636e2a71cf6e1aa09d1e45f40c2 ]
In virtio spec 0.95, VIRTIO_NET_F_GUEST_CSUM was designed to handle partially checksummed packets, and the validation of fully checksummed packets by the device is independent of VIRTIO_NET_F_GUEST_CSUM negotiation. However, the specification erroneously stated:
"If VIRTIO_NET_F_GUEST_CSUM is not negotiated, the device MUST set flags
to zero and SHOULD supply a fully checksummed packet to the driver."
This statement is inaccurate because even without VIRTIO_NET_F_GUEST_CSUM negotiation, the device can still set the VIRTIO_NET_HDR_F_DATA_VALID flag. Essentially, the device can facilitate the validation of these packets' checksums - a process known as RX checksum offloading - removing the need for the driver to do so.
This scenario is currently not implemented in the driver and requires correction. The necessary specification correction[1] has been made and approved in the virtio TC vote.
[1] https://lists.oasis-open.org/archives/virtio-comment/202401/msg00011.html
--- drivers/net/virtio_net.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +10 -2
@@ -3818,8 +3818,16 @@ static int virtnet_probe(struct virtio_device *vdev) dev->features |= dev->hw_features &NETIF_F_ALL_TSO ;/* (!csum && gso) case will be fixed by register_netdev() */ } -if (virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_CSUM )) - dev->features |=NETIF_F_RXCSUM ; + +/* 1. With VIRTIO_NET_F_GUEST_CSUM negotiation, the driver doesn't +* need to calculate checksums for partially checksummed packets, +* as they're considered valid by the upper layer. +* 2. Without VIRTIO_NET_F_GUEST_CSUM negotiation, the driver only +* receives fully checksummed packets. The device may assist in +* validating these packets' checksums, so the driver won't have to. +*/ + dev->features |=NETIF_F_RXCSUM ; +if (virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_TSO4 ) ||virtio_has_feature (vdev,VIRTIO_NET_F_GUEST_TSO6 )) dev->features |=NETIF_F_GRO_HW ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/131 octeontx2-pf: Add error handling to VLAN unoffload handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit b95a4afe2defd6f46891985f9436a568cd35a31c ]
otx2_sq_append_skb makes used of __vlan_hwaccel_push_inside() to unoffload VLANs - push them from skb meta data into skb data. However, it omitts a check for __vlan_hwaccel_push_inside() returning NULL.
Found by inspection based on [1] and [2].
Compile tested only.
[1] Re: [PATCH net-next v1] net: stmmac: Enable TSO on VLANs
https://lore.kernel.org/all/[email protected]/ [2] Re: [PATCH net-next v2] net: stmmac: Enable TSO on VLANs https://lore.kernel.org/all/CANn89i+11L5=tKsa7V7Aeyxaj6nYGRwy35PAbCRYJ73G+b25sg@mail.gmail.com/
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +4 -1
@@ -1152,8 +1152,11 @@ bool otx2_sq_append_skb(struct net_device *netdev, struct otx2_snd_queue *sq,if (skb_shinfo (skb)->gso_size && !is_hw_tso_supported (pfvf, skb)) {/* Insert vlan tag before giving pkt to tso */ -if (skb_vlan_tag_present (skb)) +if (skb_vlan_tag_present (skb)) { skb =__vlan_hwaccel_push_inside (skb); +if (!skb) +return true; + }otx2_sq_append_tso (pfvf, sq, skb, qidx);return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/131 netfilter: ipset: Fix suspicious rcu_dereference_protected()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 8ecd06277a7664f4ef018abae3abd3451d64e7a6 ]
When destroying all sets, we are either in pernet exit phase or are executing a "destroy all sets command" from userspace. The latter was taken into account in ip_set_dereference() (nfnetlink mutex is held), but the former was not. The patch adds the required check to rcu_dereference_protected() in ip_set_dereference().
--- net/netfilter/ipset/ip_set_core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/netfilter/ipset/ip_set_core.c +6 -5
@@ -53,12 +53,13 @@ MODULE_DESCRIPTION("core IP set support");MODULE_ALIAS_NFNL_SUBSYS (NFNL_SUBSYS_IPSET );/* When the nfnl mutex or ip_set_ref_lock is held: */ -#define ip_set_dereference (p) \ - rcu_dereference_protected(p, \ +#define ip_set_dereference (inst) \ + rcu_dereference_protected((inst)->ip_set_list, \ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \ - lockdep_is_held(&ip_set_ref_lock)) + lockdep_is_held(&ip_set_ref_lock) || \ + (inst)->is_deleted)#define ip_set (inst, id) \ - ip_set_dereference((inst)->ip_set_list)[id] + ip_set_dereference(inst)[id]#define ip_set_ref_netlink (inst,id) \ rcu_dereference_raw((inst)->ip_set_list)[id]#define ip_set_dereference_nfnl (p) \
@@ -1135,7 +1136,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,if (!list) goto cleanup;/* nfnl mutex is held, both lists are valid */ - tmp =ip_set_dereference (inst->ip_set_list); + tmp =ip_set_dereference (inst);memcpy (list, tmp,sizeof (struct ip_set *) * inst->ip_set_max);rcu_assign_pointer (inst->ip_set_list, list);/* Make sure all current packets have passed through */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/131 seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
[ Upstream commit 9a3bc8d16e0aacd65c31aaf23a2bced3288a7779 ]
input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING hook, we should passing a valid indev, and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer dereference, as below:
[74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090
[74830.655633] #PF: supervisor read access in kernel mode
[74830.657888] #PF: error_code(0x0000) - not-present page
[74830.659500] PGD 0 P4D 0
[74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI
...
[74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]
...
[74830.689725] Call Trace:
[74830.690402] <IRQ>
[74830.690953] ? show_trace_log_lvl+0x1c4/0x2df
[74830.692020] ? show_trace_log_lvl+0x1c4/0x2df
[74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables]
[74830.694275] ? __die_body.cold+0x8/0xd
[74830.695205] ? page_fault_oops+0xac/0x140
[74830.696244] ? exc_page_fault+0x62/0x150
[74830.697225] ? asm_exc_page_fault+0x22/0x30
[74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]
[74830.699540] ipt_do_table+0x286/0x710 [ip_tables]
[74830.700758] ? ip6_route_input+0x19d/0x240
[74830.701752] nf_hook_slow+0x3f/0xb0
[74830.702678] input_action_end_dx4+0x19b/0x1e0
[74830.703735] ? input_action_end_t+0xe0/0xe0
[74830.704734] seg6_local_input_core+0x2d/0x60
[74830.705782] lwtunnel_input+0x5b/0xb0
[74830.706690] __netif_receive_skb_one_core+0x63/0xa0
[74830.707825] process_backlog+0x99/0x140
[74830.709538] __napi_poll+0x2c/0x160
[74830.710673] net_rx_action+0x296/0x350
[74830.711860] __do_softirq+0xcb/0x2ac
[74830.713049] do_softirq+0x63/0x90input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():
static bool
rpfilter_is_loopback(const struct sk_buff *skb,
const struct net_device *in)
{
// in is NULL
return skb->pkt_type == PACKET_LOOPBACK ||
in->flags & IFF_LOOPBACK;
}--- net/ipv6/seg6_local.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/seg6_local.c +4 -4
@@ -554,8 +554,8 @@ static int input_action_end_dx6(struct sk_buff *skb,if (static_branch_unlikely (&nf_hooks_lwtunnel_enabled))return NF_HOOK (NFPROTO_IPV6 ,NF_INET_PRE_ROUTING , -dev_net (skb->dev),NULL , skb,NULL , -skb_dst (skb)->dev, input_action_end_dx6_finish); +dev_net (skb->dev),NULL , skb, skb->dev, +NULL , input_action_end_dx6_finish);return input_action_end_dx6_finish (dev_net (skb->dev),NULL , skb); drop:
@@ -604,8 +604,8 @@ static int input_action_end_dx4(struct sk_buff *skb,if (static_branch_unlikely (&nf_hooks_lwtunnel_enabled))return NF_HOOK (NFPROTO_IPV4 ,NF_INET_PRE_ROUTING , -dev_net (skb->dev),NULL , skb,NULL , -skb_dst (skb)->dev, input_action_end_dx4_finish); +dev_net (skb->dev),NULL , skb, skb->dev, +NULL , input_action_end_dx4_finish);return input_action_end_dx4_finish (dev_net (skb->dev),NULL , skb); drop:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/131 ice: Fix VSI list rule with ICE_SW_LKUP_LAST type
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Szycik <[email protected]>
[ Upstream commit 74382aebc9035470ec4c789bdb0d09d8c14f261e ]
Adding/updating VSI list rule, as well as allocating/freeing VSI list resource are called several times with type ICE_SW_LKUP_LAST, which fails because ice_update_vsi_list_rule() and ice_aq_alloc_free_vsi_list() consider it invalid. Allow calling these functions with ICE_SW_LKUP_LAST.
This fixes at least one issue in switchdev mode, where the same rule with different action cannot be added, e.g.:
tc filter add dev $PF1 ingress protocol arp prio 0 flower skip_sw \
dst_mac ff:ff:ff:ff:ff:ff action mirred egress redirect dev $VF1_PR
tc filter add dev $PF1 ingress protocol arp prio 0 flower skip_sw \
dst_mac ff:ff:ff:ff:ff:ff action mirred egress redirect dev $VF2_PR
--- drivers/net/ethernet/intel/ice/ice_switch.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_switch.c +4 -2
@@ -1838,7 +1838,8 @@ ice_aq_alloc_free_vsi_list(struct ice_hw *hw, u16 *vsi_list_id, lkup_type ==ICE_SW_LKUP_ETHERTYPE_MAC || lkup_type ==ICE_SW_LKUP_PROMISC || lkup_type ==ICE_SW_LKUP_PROMISC_VLAN || - lkup_type == ICE_SW_LKUP_DFLT) { + lkup_type ==ICE_SW_LKUP_DFLT || + lkup_type == ICE_SW_LKUP_LAST) { sw_buf->res_type = cpu_to_le16(ICE_AQC_RES_TYPE_VSI_LIST_REP); } else if (lkup_type == ICE_SW_LKUP_VLAN) { sw_buf->res_type =
@@ -2764,7 +2765,8 @@ ice_update_vsi_list_rule(struct ice_hw *hw, u16 *vsi_handle_arr, u16 num_vsi, lkup_type ==ICE_SW_LKUP_ETHERTYPE_MAC || lkup_type ==ICE_SW_LKUP_PROMISC || lkup_type ==ICE_SW_LKUP_PROMISC_VLAN || - lkup_type == ICE_SW_LKUP_DFLT) + lkup_type ==ICE_SW_LKUP_DFLT || + lkup_type == ICE_SW_LKUP_LAST) rule_type = remove ? ICE_AQC_SW_RULES_T_VSI_LIST_CLEAR :ICE_AQC_SW_RULES_T_VSI_LIST_SET ; else if (lkup_type == ICE_SW_LKUP_VLAN)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/131 bnxt_en: Restore PTP tx_avail count in case of skb_pad() error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 1e7962114c10957fe4d10a15eb714578a394e90b ]
The current code only restores PTP tx_avail count when we get DMA mapping errors. Fix it so that the PTP tx_avail count will be restored for both DMA mapping errors and skb_pad() errors. Otherwise PTP TX timestamp will not be available after a PTP packet hits the skb_pad() error.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -3
@@ -617,9 +617,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)return NETDEV_TX_OK ; tx_dma_error: -if (BNXT_TX_PTP_IS_SET (lflags)) -atomic_inc (&bp->ptp_cfg->tx_avail); - last_frag = i;/* start back at beginning and unmap skb */
@@ -641,6 +638,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) tx_free:dev_kfree_skb_any (skb); tx_kick_pending: +if (BNXT_TX_PTP_IS_SET (lflags)) +atomic_inc (&bp->ptp_cfg->tx_avail);if (txr->kick_pending)bnxt_txr_db_kick (bp, txr, txr->tx_prod); txr->tx_buf_ring[txr->tx_prod].skb =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/131 net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit fba383985354e83474f95f36d7c65feb75dba19d ]
This functions retrieves values by passing a pointer. As the function that retrieves them can fail before touching the pointers, the variables must be initialized.
--- drivers/net/usb/rtl8150.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/rtl8150.c +2 -1
@@ -778,7 +778,8 @@ static int rtl8150_get_link_ksettings(struct net_device *netdev, struct ethtool_link_ksettings *ecmd) {rtl8150_t *dev =netdev_priv (netdev); -short lpa, bmcr; +short lpa =0 ; +short bmcr =0 ;u32 supported; supported = (SUPPORTED_10baseT_Half |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/131 regulator: core: Fix modpost error "regulator_get_regmap" undefined
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 3f60497c658d2072714d097a177612d34b34aa3d ]
Fix the modpost error "regulator_get_regmap" undefined by adding export symbol.
--- drivers/regulator/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/core.c +1 -0
@@ -3341,6 +3341,7 @@ struct regmap *regulator_get_regmap(struct regulator *regulator)return map ? map :ERR_PTR (-EOPNOTSUPP ); } +EXPORT_SYMBOL_GPL (regulator_get_regmap);/** * regulator_get_hardware_vsel_register - get the HW voltage selector register
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/131 dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ]
Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list.
--- drivers/dma/idxd/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/idxd/irq.c +3 -1
@@ -454,11 +454,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry)spin_unlock (&irq_entry->list_lock); -list_for_each_entry (desc, &flist, list) { +list_for_each_entry_safe (desc, n, &flist, list) {/* * Check against the original status as ABORT is software defined * and 0xff, which DSA_COMP_STATUS_MASK can mask out. */ +list_del (&desc->list); +if (unlikely (desc->completion->status ==IDXD_COMP_DESC_ABORT )) {idxd_dma_complete_txd (desc,IDXD_COMPLETE_ABORT , true);continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/131 dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit e32622f84ae289dc7a04e9f01cd62cb914fdc5c6 ]
pci_enable_pcie_error_reporting() enables the device to send ERR_* Messages. Since f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native"), the PCI core does this for all devices during enumeration, so the driver doesn't need to do it itself.
Remove the redundant pci_enable_pcie_error_reporting() call from the driver. Also remove the corresponding pci_disable_pcie_error_reporting() from the driver .remove() path.
Note that this only controls ERR_* Messages from the device. An ERR_* Message may cause the Root Port to generate an interrupt, depending on the AER Root Error Command register managed by the AER service driver.
Stable-dep-of: 1b11b4ef6bd6 ("dmaengine: ioatdma: Fix leaking on version mismatch")
--- drivers/dma/ioat/init.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/dma/ioat/init.c +0 -6
@@ -15,7 +15,6 @@#include <linux/workqueue.h> #include <linux/prefetch.h> #include <linux/dca.h> -#include <linux/aer.h> #include <linux/sizes.h> #include "dma.h" #include "registers.h"
@@ -1380,15 +1379,11 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (is_skx_ioat (pdev)) device->version =IOAT_VER_3_2 ; err =ioat3_dma_probe (device, ioat_dca_enabled); - -if (device->version >=IOAT_VER_3_3 ) -pci_enable_pcie_error_reporting (pdev); }else return -ENODEV ;if (err) {dev_err (dev,"Intel(R) I/OAT DMA Engine init failed\n" ); -pci_disable_pcie_error_reporting (pdev);return -ENODEV ; }
@@ -1411,7 +1406,6 @@ static void ioat_remove(struct pci_dev *pdev) device->dca =NULL ; } -pci_disable_pcie_error_reporting (pdev);ioat_dma_remove (device); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/131 dmaengine: ioatdma: Fix leaking on version mismatch
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 1b11b4ef6bd68591dcaf8423c7d05e794e6aec6f ]
Fix leaking ioatdma_device if I/OAT version is less than IOAT_VER_3_0.
--- drivers/dma/ioat/init.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/dma/ioat/init.c +10 -7
@@ -1349,6 +1349,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)void __iomem *const *iomap;struct device *dev = &pdev->dev;struct ioatdma_device *device; +u8 version;int err; err =pcim_enable_device (pdev);
@@ -1362,6 +1363,10 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)if (!iomap)return -ENOMEM ; + version =readb (iomap[IOAT_MMIO_BAR ] +IOAT_VER_OFFSET ); +if (version <IOAT_VER_3_0 ) +return -ENODEV ; + err =dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (64 ));if (err)return err;
@@ -1372,16 +1377,14 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)pci_set_master (pdev);pci_set_drvdata (pdev, device); - device->version =readb (device->reg_base +IOAT_VER_OFFSET ); + device->version = version;if (device->version >=IOAT_VER_3_4 ) ioat_dca_enabled =0 ; -if (device->version >=IOAT_VER_3_0 ) { -if (is_skx_ioat (pdev)) - device->version =IOAT_VER_3_2 ; - err =ioat3_dma_probe (device, ioat_dca_enabled); - }else -return -ENODEV ; +if (is_skx_ioat (pdev)) + device->version =IOAT_VER_3_2 ; + + err =ioat3_dma_probe (device, ioat_dca_enabled);if (err) {dev_err (dev,"Intel(R) I/OAT DMA Engine init failed\n" );return -ENODEV ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/131 dmaengine: ioat: use PCI core macros for PCIe Capability
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 8f6707d0773be31972768abd6e0bf7b8515b5b1a ]
The PCIe Capability is defined by the PCIe spec, so use the PCI_EXP_DEVCTL macros defined by the PCI core instead of defining copies in IOAT. This makes it easier to find all uses of the PCIe Device Control register. No functional change intended.
Stable-dep-of: f0dc9fda2e0e ("dmaengine: ioatdma: Fix error path in ioat3_dma_probe()")
--- drivers/dma/ioat/init.c | 6 +++--- drivers/dma/ioat/registers.h | 7 ------- 2 files changed, 3 insertions(+), 10 deletions(-)
drivers/dma/ioat/init.c +3 -3
@@ -1190,13 +1190,13 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) ioat_dma->dca =ioat_dca_init (pdev, ioat_dma->reg_base);/* disable relaxed ordering */ - err =pcie_capability_read_word (pdev,IOAT_DEVCTRL_OFFSET , &val16); + err =pcie_capability_read_word (pdev,PCI_EXP_DEVCTL , &val16);if (err)return pcibios_err_to_errno (err);/* clear relaxed ordering enable */ - val16 &= ~IOAT_DEVCTRL_ROE ; - err =pcie_capability_write_word (pdev,IOAT_DEVCTRL_OFFSET , val16); + val16 &= ~PCI_EXP_DEVCTL_RELAX_EN ; + err =pcie_capability_write_word (pdev,PCI_EXP_DEVCTL , val16);if (err)return pcibios_err_to_errno (err);
drivers/dma/ioat/registers.h +0 -7
@@ -14,13 +14,6 @@#define IOAT_PCI_CHANERR_INT_OFFSET 0x180#define IOAT_PCI_CHANERRMASK_INT_OFFSET 0x184 -/* PCIe config registers */ - -/* EXPCAPID + N */ -#define IOAT_DEVCTRL_OFFSET 0x8 -/* relaxed ordering enable */ -#define IOAT_DEVCTRL_ROE 0x10 -/* MMIO Device Registers */ #define IOAT_CHANCNT_OFFSET 0x00/* 8-bit */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/131 dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit f0dc9fda2e0ee9e01496c2f5aca3a831131fad79 ]
Make sure we are disabling interrupts and destroying DMA pool if pcie_capability_read/write_word() call failed.
--- drivers/dma/ioat/init.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-)
drivers/dma/ioat/init.c +15 -18
@@ -534,18 +534,6 @@ static int ioat_probe(struct ioatdma_device *ioat_dma)return err; } -static int ioat_register (struct ioatdma_device *ioat_dma) -{ -int err =dma_async_device_register (&ioat_dma->dma_dev); - -if (err) { -ioat_disable_interrupts (ioat_dma); -dma_pool_destroy (ioat_dma->completion_pool); - } - -return err; -} -static void ioat_dma_remove (struct ioatdma_device *ioat_dma) {struct dma_device *dma = &ioat_dma->dma_dev;
@@ -1180,9 +1168,9 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } - err =ioat_register (ioat_dma); + err =dma_async_device_register (&ioat_dma->dma_dev);if (err) -return err; + goto err_disable_interrupts;ioat_kobject_add (ioat_dma, &ioat_ktype);
@@ -1191,20 +1179,29 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca)/* disable relaxed ordering */ err =pcie_capability_read_word (pdev,PCI_EXP_DEVCTL , &val16); -if (err) -return pcibios_err_to_errno (err); +if (err) { + err =pcibios_err_to_errno (err); + goto err_disable_interrupts; + }/* clear relaxed ordering enable */ val16 &= ~PCI_EXP_DEVCTL_RELAX_EN ; err =pcie_capability_write_word (pdev,PCI_EXP_DEVCTL , val16); -if (err) -return pcibios_err_to_errno (err); +if (err) { + err =pcibios_err_to_errno (err); + goto err_disable_interrupts; + }if (ioat_dma->cap &IOAT_CAP_DPS )writeb (ioat_pending_level +1 , ioat_dma->reg_base +IOAT_PREFETCH_LIMIT_OFFSET );return 0 ; + +err_disable_interrupts: +ioat_disable_interrupts (ioat_dma); +dma_pool_destroy (ioat_dma->completion_pool); +return err; }static void ioat_shutdown (struct pci_dev *pdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/131 dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 29b7cd255f3628e0d65be33a939d8b5bba10aa62 ]
If probing fails we end up with leaking ioatdma_device and each allocated channel.
Following kmemleak easy to reproduce by injecting an error in ioat_alloc_chan_resources() when doing ioat_dma_self_test().
unreferenced object 0xffff888014ad5800 (size 1024): [..]
[<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
[<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
[<ffffffffa000b7d1>] ioat_pci_probe+0xc1/0x1c0 [ioatdma][..]
repeated for each ioatdma channel:
unreferenced object 0xffff8880148e5c00 (size 512): [..]
[<ffffffff827692ca>] kmemleak_alloc+0x4a/0x80
[<ffffffff81430600>] kmalloc_trace+0x270/0x2f0
[<ffffffffa0009641>] ioat_enumerate_channels+0x101/0x2d0 [ioatdma]
[<ffffffffa000b266>] ioat3_dma_probe+0x4d6/0x970 [ioatdma]
[<ffffffffa000b891>] ioat_pci_probe+0x181/0x1c0 [ioatdma][..]
--- drivers/dma/ioat/init.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/dma/ioat/init.c +4 -0
@@ -1346,6 +1346,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)void __iomem *const *iomap;struct device *dev = &pdev->dev;struct ioatdma_device *device; +unsigned int i;u8 version;int err;
@@ -1383,6 +1384,9 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) err =ioat3_dma_probe (device, ioat_dca_enabled);if (err) { +for (i =0 ; i <IOAT_MAX_CHANS ; i++) +kfree (device->idx[i]); +kfree (device);dev_err (dev,"Intel(R) I/OAT DMA Engine init failed\n" );return -ENODEV ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/131 dmaengine: ioatdma: Fix missing kmem_cache_destroy()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Shubin <[email protected]>
[ Upstream commit 5422145d0b749ad554ada772133b9b20f9fb0ec8 ]
Fix missing kmem_cache_destroy() for ioat_sed_cache in ioat_exit_module().
Noticed via:
``` modprobe ioatdma rmmod ioatdma modprobe ioatdma debugfs: Directory 'ioat_sed_ent' with parent 'slab' already present! ```
--- drivers/dma/ioat/init.c | 1 + 1 file changed, 1 insertion(+)
drivers/dma/ioat/init.c +1 -0
@@ -1448,6 +1448,7 @@ module_init(ioat_init_module); static void __exit ioat_exit_module(void) {pci_unregister_driver (&ioat_pci_driver); +kmem_cache_destroy (ioat_sed_cache);kmem_cache_destroy (ioat_cache); }module_exit (ioat_exit_module);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/131 regulator: bd71815: fix ramp values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Niemi <[email protected]>
[ Upstream commit 4cac29b846f38d5f0654cdfff5c5bfc37305081c ]
Ramp values are inverted. This caused wrong values written to register when ramp values were defined in device tree.
Invert values in table to fix this.
--- drivers/regulator/bd71815-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/bd71815-regulator.c +1 -1
@@ -257,7 +257,7 @@ static int buck12_set_hw_dvs_levels(struct device_node *np,* 10: 2.50mV/usec 10mV 4uS * 11: 1.25mV/usec 10mV 8uS */ -static const unsigned int bd7181x_ramp_table[] = {1250 ,2500 ,5000 ,10000 }; +static const unsigned int bd7181x_ramp_table[] = {10000 ,5000 ,2500 ,1250 };static int bd7181x_led_set_current_limit (struct regulator_dev *rdev,int min_uA,int max_uA)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/131 arm64: dts: imx93-11x11-evk: Remove the no-sdio property
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
[ Upstream commit a5d400b6439ac734a5c0dbb641e26a38736abc17 ]
The usdhc2 port is connected to the microSD slot. The presence of the 'no-sdio' property prevents Wifi SDIO cards, such as CMP9010-X-EVB [1] to be detected.
Remove the 'no-sdio' property so that SDIO cards could also work.
--- arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +0 -1
@@ -60,7 +60,6 @@ vmmc-supply = <®_usdhc2_vmmc>; bus-width = <4>; status = "okay"; - no-sdio; no-mmc; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/131 arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input pin
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Krummenacher <[email protected]>
[ Upstream commit 67cc6125fb39902169707cb6277f010e56d4a40a ]
SODIMM 17 can be used as an edge triggered interrupt supplied from an off board source.
Enable hysteresis on the pinmuxing to increase immunity against noise on the signal.
--- arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +1 -1
@@ -930,7 +930,7 @@ /* Verdin GPIO_9_DSI (pulled-up as active-low) */ pinctrl_gpio_9_dsi: gpio9dsigrp { fsl,pins = - <MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15 0x146>; /* SODIMM 17 */ + <MX8MM_IOMUXC_NAND_RE_B_GPIO3_IO15 0x1c6>; /* SODIMM 17 */ }; /* Verdin GPIO_10_DSI (pulled-up as active-low) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/131 ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit a83e1385b780d41307433ddbc86e3c528db031f0 ]
Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present.
However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference.
Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions.
--- drivers/acpi/acpica/exregion.c | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-)
drivers/acpi/acpica/exregion.c +2 -21
@@ -44,7 +44,6 @@ acpi_ex_system_memory_space_handler(u32 function,struct acpi_mem_mapping *mm = mem_info->cur_mm;u32 length;acpi_size map_length; -acpi_size page_boundary_map_length;#ifdef ACPI_MISALIGNMENT_NOT_SUPPORTED u32 remainder;#endif
@@ -138,26 +137,8 @@ acpi_ex_system_memory_space_handler(u32 function, map_length = (acpi_size) ((mem_info->address + mem_info->length) - address); -/* -* If mapping the entire remaining portion of the region will cross -* a page boundary, just map up to the page boundary, do not cross. -* On some systems, crossing a page boundary while mapping regions -* can cause warnings if the pages have different attributes -* due to resource management. -* -* This has the added benefit of constraining a single mapping to -* one page, which is similar to the original code that used a 4k -* maximum window. -*/ - page_boundary_map_length = (acpi_size) - (ACPI_ROUND_UP (address,ACPI_DEFAULT_PAGE_SIZE ) - address); -if (page_boundary_map_length ==0 ) { - page_boundary_map_length =ACPI_DEFAULT_PAGE_SIZE ; - } - -if (map_length > page_boundary_map_length) { - map_length = page_boundary_map_length; - } +if (map_length >ACPI_DEFAULT_PAGE_SIZE ) + map_length =ACPI_DEFAULT_PAGE_SIZE ;/* Create a new mapping starting at the address given */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/131 firmware: psci: Fix return value from psci_system_suspend()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
[ Upstream commit e7c3696d4692e8046d25f6e63f983e934e12f2c5 ]
Currently we return the value from invoke_psci_fn() directly as return value from psci_system_suspend(). It is wrong to send the PSCI interface return value directly. psci_to_linux_errno() provide the mapping from PSCI return value to the one that can be returned to the callers within the kernel.
Use psci_to_linux_errno() to convert and return the correct value from psci_system_suspend().
--- drivers/firmware/psci/psci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firmware/psci/psci.c +3 -1
@@ -485,10 +485,12 @@ int psci_cpu_suspend_enter(u32 state)static int psci_system_suspend (unsigned long unused) { +int err;phys_addr_t pa_cpu_resume =__pa_symbol (cpu_resume); - return invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), + err = invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), pa_cpu_resume,0 ,0 ); +return psci_to_linux_errno (err); }static int psci_system_suspend_enter (suspend_state_t state)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/131 RDMA/mlx5: Add check for srq max_sge attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 36ab7ada64caf08f10ee5a114d39964d1f91e81d ]
max_sge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it.
--- drivers/infiniband/hw/mlx5/srq.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/infiniband/hw/mlx5/srq.c +8 -5
@@ -199,17 +199,20 @@ int mlx5_ib_create_srq(struct ib_srq *ib_srq,int err;struct mlx5_srq_attr in = {};__u32 max_srq_wqes =1 <<MLX5_CAP_GEN (dev->mdev, log_max_srq_sz); +__u32 max_sge_sz =MLX5_CAP_GEN (dev->mdev, max_wqe_sz_rq) / +sizeof (struct mlx5_wqe_data_seg );if (init_attr->srq_type !=IB_SRQT_BASIC && init_attr->srq_type !=IB_SRQT_XRC && init_attr->srq_type !=IB_SRQT_TM )return -EOPNOTSUPP ; -/* Sanity check SRQ size before proceeding */ -if (init_attr->attr.max_wr >= max_srq_wqes) { -mlx5_ib_dbg (dev,"max_wr %d, cap %d\n" , - init_attr->attr.max_wr, - max_srq_wqes); +/* Sanity check SRQ and sge size before proceeding */ +if (init_attr->attr.max_wr >= max_srq_wqes || + init_attr->attr.max_sge > max_sge_sz) { +mlx5_ib_dbg (dev,"max_wr %d,wr_cap %d,max_sge %d, sge_cap:%d\n" , + init_attr->attr.max_wr, max_srq_wqes, + init_attr->attr.max_sge, max_sge_sz);return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/131 kbuild: Remove support for Clangs ThinLTO caching
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit aba091547ef6159d52471f42a3ef531b7b660ed8 upstream.
There is an issue in clang's ThinLTO caching (enabled for the kernel via '--thinlto-cache-dir') with .incbin, which the kernel occasionally uses to include data within the kernel, such as the .config file for /proc/config.gz. For example, when changing the .config and rebuilding vmlinux, the copy of .config in vmlinux does not match the copy of .config in the build folder:
$ echo 'CONFIG_LTO_NONE=n CONFIG_LTO_CLANG_THIN=y CONFIG_IKCONFIG=y CONFIG_HEADERS_INSTALL=y' >kernel/configs/repro.config
$ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 clean defconfig repro.config vmlinux ...
$ grep CONFIG_HEADERS_INSTALL .config CONFIG_HEADERS_INSTALL=y
$ scripts/extract-ikconfig vmlinux | grep CONFIG_HEADERS_INSTALL CONFIG_HEADERS_INSTALL=y
$ scripts/config -d HEADERS_INSTALL
$ make -kj"$(nproc)" ARCH=x86_64 LLVM=1 vmlinux
...
UPD kernel/config_data
GZIP kernel/config_data.gz
CC kernel/configs.o
...
LD vmlinux
...$ grep CONFIG_HEADERS_INSTALL .config # CONFIG_HEADERS_INSTALL is not set
$ scripts/extract-ikconfig vmlinux | grep CONFIG_HEADERS_INSTALL CONFIG_HEADERS_INSTALL=y
Without '--thinlto-cache-dir' or when using full LTO, this issue does not occur.
Benchmarking incremental builds on a few different machines with and without the cache shows a 20% increase in incremental build time without the cache when measured by touching init/main.c and running 'make all'.
ARCH=arm64 defconfig + CONFIG_LTO_CLANG_THIN=y on an arm64 host:
Benchmark 1: With ThinLTO cache
Time (mean ± σ): 56.347 s ± 0.163 s [User: 83.768 s, System: 24.661 s]
Range (min … max): 56.109 s … 56.594 s 10 runsBenchmark 2: Without ThinLTO cache
Time (mean ± σ): 67.740 s ± 0.479 s [User: 718.458 s, System: 31.797 s]
Range (min … max): 67.059 s … 68.556 s 10 runs Summary
With ThinLTO cache ran
1.20 ± 0.01 times faster than Without ThinLTO cache
ARCH=x86_64 defconfig + CONFIG_LTO_CLANG_THIN=y on an x86_64 host:
Benchmark 1: With ThinLTO cache
Time (mean ± σ): 85.772 s ± 0.252 s [User: 91.505 s, System: 8.408 s]
Range (min … max): 85.447 s … 86.244 s 10 runsBenchmark 2: Without ThinLTO cache
Time (mean ± σ): 103.833 s ± 0.288 s [User: 232.058 s, System: 8.569 s]
Range (min … max): 103.286 s … 104.124 s 10 runs Summary
With ThinLTO cache ran
1.21 ± 0.00 times faster than Without ThinLTO cache
While it is unfortunate to take this performance improvement off the table, correctness is more important. If/when this is fixed in LLVM, it can potentially be brought back in a conditional manner. Alternatively, a developer can just disable LTO if doing incremental compiles quickly is important, as a full compile cycle can still take over a minute even with the cache and it is unlikely that LTO will result in functional differences for a kernel change.
--- Makefile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
Makefile +2 -3
@@ -980,7 +980,6 @@ endif ifdef CONFIG_LTO_CLANG ifdef CONFIG_LTO_CLANG_THIN CC_FLAGS_LTO := -flto=thin -fsplit-lto-unit -KBUILD_LDFLAGS += --thinlto-cache-dir=$(extmod_prefix).thinlto-cache else CC_FLAGS_LTO := -flto endif
@@ -1588,7 +1587,7 @@ endif # CONFIG_MODULES # Directories & files removed with 'make clean' CLEAN_FILES += include/ksym vmlinux.symvers modules-only.symvers \ modules.builtin modules.builtin.modinfo modules.nsdeps \ - compile_commands.json .thinlto-cache rust/test rust/doc \ + compile_commands.json rust/test rust/doc \ .vmlinux.objs .vmlinux.export.c # Directories & files removed with 'make mrproper'
@@ -1884,7 +1883,7 @@ PHONY += compile_commands.json clean-dirs := $(KBUILD_EXTMOD) clean: rm-files := $(KBUILD_EXTMOD)/Module.symvers $(KBUILD_EXTMOD)/modules.nsdeps \ - $(KBUILD_EXTMOD)/compile_commands.json $(KBUILD_EXTMOD)/.thinlto-cache + $(KBUILD_EXTMOD)/compile_commands.json PHONY += prepare # now expand this into a simple variable to reduce the cost of shell evaluations
Greg Kroah-Hartman
maintainerPATCH 93/131 MIPS: dts: bcm63268: Add missing properties to the TWD node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit 24b333a866a10d4be47b9968b9c05a3e9f326ff5 upstream.
We currently have a DTC warning with the current DTS due to the lack of a suitable #address-cells and #size-cells property:
DTC arch/mips/boot/dts/brcm/bcm63268-comtrend-vr-3032u.dtb
arch/mips/boot/dts/brcm/bcm63268.dtsi:115.5-22: Warning (reg_format): /ubus/timer-mfd@10000080/timer@0:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) arch/mips/boot/dts/brcm/bcm63268.dtsi:120.5-22: Warning (reg_format): /ubus/timer-mfd@10000080/watchdog@1c:reg: property has invalid length (8 bytes) (#address-cells == 2, #size-cells == 1) arch/mips/boot/dts/brcm/bcm63268.dtsi:111.4-35: Warning (ranges_format): /ubus/timer-mfd@10000080:ranges: "ranges" property has invalid length (12 bytes) (parent #address-cells == 1, child #address-cells == 2, #size-cells == 1)
--- arch/mips/boot/dts/brcm/bcm63268.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/boot/dts/brcm/bcm63268.dtsi +2 -0
@@ -109,6 +109,8 @@ compatible = "brcm,bcm7038-twd", "simple-mfd", "syscon"; reg = <0x10000080 0x30>; ranges = <0x0 0x10000080 0x30>; + #address-cells = <1>; + #size-cells = <1>; wdt: watchdog@1c { compatible = "brcm,bcm7038-wdt";
Greg Kroah-Hartman
maintainerPATCH 94/131 net: stmmac: Assign configured channel value to EXTTS event
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 8851346912a1fa33e7a5966fe51f07313b274627 upstream.
Assign the configured channel value to the EXTTS event in the timestamp interrupt handler. Without assigning the correct channel, applications like ts2phc will refuse to accept the event, resulting in errors such as:
...
ts2phc[656.834]: config item end1.ts2phc.pin_index is 0 ts2phc[656.834]: config item end1.ts2phc.channel is 3 ts2phc[656.834]: config item end1.ts2phc.extts_polarity is 2 ts2phc[656.834]: config item end1.ts2phc.extts_correction is 0
...
ts2phc[656.862]: extts on unexpected channel ts2phc[658.141]: extts on unexpected channel ts2phc[659.140]: extts on unexpected channel
--- drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +5 -1
@@ -176,6 +176,7 @@ static void timestamp_interrupt(struct s {u32 num_snapshot, ts_status, tsync_int;struct ptp_clock_event event; +u32 acr_value, channel;unsigned long flags;u64 ptp_time;int i;
@@ -201,12 +202,15 @@ static void timestamp_interrupt(struct s num_snapshot = (ts_status &GMAC_TIMESTAMP_ATSNS_MASK ) >>GMAC_TIMESTAMP_ATSNS_SHIFT ; + acr_value =readl (priv->ptpaddr +PTP_ACR ); + channel =ilog2 (FIELD_GET (PTP_ACR_MASK , acr_value)); +for (i =0 ; i < num_snapshot; i++) {read_lock_irqsave (&priv->ptp_lock, flags);get_ptptime (priv->ptpaddr, &ptp_time);read_unlock_irqrestore (&priv->ptp_lock, flags); event.type =PTP_CLOCK_EXTTS ; - event.index =0 ; + event.index = channel; event.timestamp = ptp_time;ptp_clock_event (priv->ptp_clock, &event); }
Greg Kroah-Hartman
maintainerPATCH 95/131 net: usb: ax88179_178a: improve reset check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 7be4cb7189f747b4e5b6977d0e4387bde3204e62 upstream.
After ecf848eb934b ("net: usb: ax88179_178a: fix link status when link is set to down/up") to not reset from usbnet_open after the reset from usbnet_probe at initialization stage to speed up this, some issues have been reported.
It seems to happen that if the initialization is slower, and some time passes between the probe operation and the open operation, the second reset from open is necessary too to have the device working. The reason is that if there is no activity with the phy, this is "disconnected".
In order to improve this, the solution is to detect when the phy is "disconnected", and we can use the phy status register for this. So we will only reset the device from reset operation in this situation, that is, only if necessary.
The same bahavior is happening when the device is stopped (link set to down) and later is restarted (link set to up), so if the phy keeps working we only need to enable the mac again, but if enough time passes between the device stop and restart, reset is necessary, and we can detect the situation checking the phy status register too.
--- drivers/net/usb/ax88179_178a.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/net/usb/ax88179_178a.c +13 -5
@@ -174,7 +174,6 @@ struct ax88179_data {u32 wol_supported;u32 wolopts;u8 disconnecting; -u8 initialized; };struct ax88179_int_data {
@@ -1676,12 +1675,21 @@ static int ax88179_reset(struct usbnet *static int ax88179_net_reset (struct usbnet *dev) { -struct ax88179_data *ax179_data = dev->driver_priv; +u16 tmp16; -if (ax179_data->initialized) +ax88179_read_cmd (dev,AX_ACCESS_PHY ,AX88179_PHY_ID ,GMII_PHY_PHYSR , +2 , &tmp16); +if (tmp16) { +ax88179_read_cmd (dev,AX_ACCESS_MAC ,AX_MEDIUM_STATUS_MODE , +2 ,2 , &tmp16); +if (!(tmp16 &AX_MEDIUM_RECEIVE_EN )) { + tmp16 |=AX_MEDIUM_RECEIVE_EN ; +ax88179_write_cmd (dev,AX_ACCESS_MAC ,AX_MEDIUM_STATUS_MODE , +2 ,2 , &tmp16); + } + }else {ax88179_reset (dev); -else - ax179_data->initialized =1 ; + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 96/131 net: do not leave a dangling sk pointer, when socket creation fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
commit 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 upstream.
It is possible to trigger a use-after-free by:
* attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper
* running traceroute -I 1.1.1.1 on a freshly booted VM
A KASAN enabled kernel will log something like below (decoded and stripped):
==================================================================
BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Read of size 8 at addr ffff888007110dd8 by task traceroute/299 CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __sock_release (net/socket.c:652) __sock_create (net/socket.c:1601) ... Allocated by task 299 on cpu 2 at 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)
sk_prot_alloc (net/core/sock.c:2075)sk_alloc (net/core/sock.c:2134)inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572)__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718)do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Freed by task 299 on cpu 2 at 78.328502s:
kasan_save_stack (mm/kasan/common.c:48)kasan_save_track (mm/kasan/common.c:68)kasan_save_free_info (mm/kasan/generic.c:582)poison_slab_object (mm/kasan/common.c:242)__kasan_slab_free (mm/kasan/common.c:256)
kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)
__sock_create (net/socket.c:1572)__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718)do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Fix this by clearing the struct socket reference in sk_common_release() to cover all protocol families create functions, which may already attached the reference to the sk object with sock_init_data().
--- net/core/sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/sock.c +3 -0
@@ -3695,6 +3695,9 @@ void sk_common_release(struct sock *sk) sk->sk_prot->unhash (sk); +if (sk->sk_socket) + sk->sk_socket->sk =NULL ; +/* * In this point socket cannot receive new packets, but it is possible * that some packets are in flight because some CPU runs receiver and
Greg Kroah-Hartman
maintainerPATCH 97/131 btrfs: retry block group reclaim without infinite loop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
commit 4eb4e85c4f818491efc67e9373aa16b123c3f522 upstream.
If inc_block_group_ro systematically fails (e.g. due to ETXTBUSY from swap) or btrfs_relocate_chunk systematically fails (from lack of space), then this worker becomes an infinite loop.
At the very least, this strands the cleaner thread, but can also result in hung tasks/RCU stalls on PREEMPT_NONE kernels and if the reclaim_bgs_lock mutex is not contended.
I believe the best long term fix is to manage reclaim via work queue, where we queue up a relocation on the triggering condition and re-queue on failure. In the meantime, this is an easy fix to apply to avoid the immediate pain.
--- fs/btrfs/block-group.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/btrfs/block-group.c +9 -2
@@ -1615,6 +1615,7 @@ void btrfs_reclaim_bgs_work(struct work_ container_of(work, struct btrfs_fs_info, reclaim_bgs_work);struct btrfs_block_group *bg;struct btrfs_space_info *space_info; +LIST_HEAD (retry_list);if (!test_bit (BTRFS_FS_OPEN , &fs_info->flags))return ;
@@ -1717,8 +1718,11 @@ void btrfs_reclaim_bgs_work(struct work_ } next: -if (ret) -btrfs_mark_bg_to_reclaim (bg); +if (ret) { +/* Refcount held by the reclaim_bgs list after splice. */ +btrfs_get_block_group (bg); +list_add_tail (&bg->bg_list, &retry_list); + }btrfs_put_block_group (bg);mutex_unlock (&fs_info->reclaim_bgs_lock);
@@ -1738,6 +1742,9 @@ next:spin_unlock (&fs_info->unused_bgs_lock);mutex_unlock (&fs_info->reclaim_bgs_lock); end: +spin_lock (&fs_info->unused_bgs_lock); +list_splice_tail (&retry_list, &fs_info->reclaim_bgs); +spin_unlock (&fs_info->unused_bgs_lock);btrfs_exclop_finish (fs_info);sb_end_write (fs_info->sb); }
Greg Kroah-Hartman
maintainerPATCH 98/131 cifs: fix typo in module parameter enable_gcm_256
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 8bf0287528da1992c5e49d757b99ad6bbc34b522 upstream.
enable_gcm_256 (which allows the server to require the strongest encryption) is enabled by default, but the modinfo description incorrectly showed it disabled by default. Fix the typo.
--- fs/smb/client/cifsfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/cifsfs.c +1 -1
@@ -128,7 +128,7 @@ module_param(enable_oplocks, bool, 0644)MODULE_PARM_DESC (enable_oplocks,"Enable or disable oplocks. Default: y/Y/1" );module_param (enable_gcm_256, bool,0644 ); -MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: n/N/0" ); +MODULE_PARM_DESC (enable_gcm_256,"Enable requesting strongest (256 bit) GCM encryption. Default: y/Y/0" );module_param (require_gcm_256, bool,0644 );MODULE_PARM_DESC (require_gcm_256,"Require strongest (256 bit) GCM encryption. Default: n/N/0" );
Greg Kroah-Hartman
maintainerPATCH 99/131 KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 49f683b41f28918df3e51ddc0d928cb2e934ccdb upstream.
Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compiler tears the stores, it's theoretically possible for KVM to attempt to get a vCPU using an out-of-bounds index, e.g. if the write is split into multiple 8-bit stores, and is paired with a 32-bit load on a VM with 257 vCPUs:
CPU0 CPU1 last_boosted_vcpu = 0xff;
(last_boosted_vcpu = 0x100)
last_boosted_vcpu[15:8] = 0x01;
i = (last_boosted_vcpu = 0x1ff)
last_boosted_vcpu[7:0] = 0x00;vcpu = kvm->vcpu_array[0x1ff];
As detected by KCSAN:
BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]
write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
value changed: 0x00000012 -> 0x00000000
--- virt/kvm/kvm_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +3 -2
@@ -3742,12 +3742,13 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m {struct kvm *kvm = me->kvm;struct kvm_vcpu *vcpu; -int last_boosted_vcpu = me->kvm->last_boosted_vcpu; +int last_boosted_vcpu;unsigned long i;int yielded =0 ;int try =3 ;int pass; + last_boosted_vcpu =READ_ONCE (kvm->last_boosted_vcpu);kvm_vcpu_set_in_spin_loop (me, true);/* * We boost the priority of a VCPU that is runnable but not
@@ -3778,7 +3779,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m yielded =kvm_vcpu_yield_to (vcpu);if (yielded >0 ) { - kvm->last_boosted_vcpu = i; +WRITE_ONCE (kvm->last_boosted_vcpu, i);break ; }else if (yielded <0 ) { try--;
Greg Kroah-Hartman
maintainerPATCH 100/131 KVM: arm64: Disassociate vcpus from redistributor region on teardown
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 upstream.
When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu.
--- arch/arm64/kvm/vgic/vgic-init.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 15 +++++++++++++-- arch/arm64/kvm/vgic/vgic.h | 2 +- 3 files changed, 15 insertions(+), 4 deletions(-)
arch/arm64/kvm/vgic/vgic-init.c +1 -1
@@ -355,7 +355,7 @@ static void kvm_vgic_dist_destroy(structif (dist->vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 ) {list_for_each_entry_safe (rdreg, next, &dist->rd_regions, list) -vgic_v3_free_redist_region (rdreg); +vgic_v3_free_redist_region (kvm, rdreg);INIT_LIST_HEAD (&dist->rd_regions); }else { dist->vgic_cpu_base =VGIC_ADDR_UNDEF ;
arch/arm64/kvm/vgic/vgic-mmio-v3.c +13 -2
@@ -942,8 +942,19 @@ free:return ret; } -void vgic_v3_free_redist_region (struct vgic_redist_region *rdreg) +void vgic_v3_free_redist_region (struct kvm *kvm,struct vgic_redist_region *rdreg) { +struct kvm_vcpu *vcpu; +unsigned long c; + +lockdep_assert_held (&kvm->arch.config_lock); + +/* Garbage collect the region */ +kvm_for_each_vcpu (c, vcpu, kvm) { +if (vcpu->arch.vgic_cpu.rdreg == rdreg) + vcpu->arch.vgic_cpu.rdreg =NULL ; + } +list_del (&rdreg->list);kfree (rdreg); }
@@ -968,7 +979,7 @@ int vgic_v3_set_redist_base(struct kvm *mutex_lock (&kvm->arch.config_lock); rdreg =vgic_v3_rdist_region_from_index (kvm, index); -vgic_v3_free_redist_region (rdreg); +vgic_v3_free_redist_region (kvm, rdreg);mutex_unlock (&kvm->arch.config_lock);return ret; }
arch/arm64/kvm/vgic/vgic.h +1 -1
@@ -301,7 +301,7 @@ vgic_v3_rd_region_size(struct kvm *kvm,struct vgic_redist_region *vgic_v3_rdist_region_from_index (struct kvm *kvm,u32 index); -void vgic_v3_free_redist_region (struct vgic_redist_region *rdreg); +void vgic_v3_free_redist_region (struct kvm *kvm,struct vgic_redist_region *rdreg);bool vgic_v3_rdist_overlap (struct kvm *kvm,gpa_t base,size_t size);
Greg Kroah-Hartman
maintainerPATCH 101/131 KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC routes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit f3ced000a2df53f4b12849e121769045a81a3b22 upstream.
Sync pending posted interrupts to the IRR prior to re-scanning I/O APIC routes, irrespective of whether the I/O APIC is emulated by userspace or by KVM. If a level-triggered interrupt routed through the I/O APIC is pending or in-service for a vCPU, KVM needs to intercept EOIs on said vCPU even if the vCPU isn't the destination for the new routing, e.g. if servicing an interrupt using the old routing races with I/O APIC reconfiguration.
Commit fceb3a36c29a ("KVM: x86: ioapic: Fix level-triggered EOI and userspace I/OAPIC reconfigure race") fixed the common cases, but kvm_apic_pending_eoi() only checks if an interrupt is in the local APIC's IRR or ISR, i.e. misses the uncommon case where an interrupt is pending in the PIR.
Failure to intercept EOI can manifest as guest hangs with Windows 11 if the guest uses the RTC as its timekeeping source, e.g. if the VMM doesn't expose a more modern form of time to the guest.
Message-ID: <[email protected]>
--- arch/x86/kvm/x86.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/x86/kvm/x86.c +4 -5
@@ -10523,13 +10523,12 @@ static void vcpu_scan_ioapic(struct kvm_bitmap_zero (vcpu->arch.ioapic_handled_vectors,256 ); +static_call_cond (kvm_x86_sync_pir_to_irr)(vcpu); +if (irqchip_split (vcpu->kvm))kvm_scan_ioapic_routes (vcpu, vcpu->arch.ioapic_handled_vectors); -else { -static_call_cond (kvm_x86_sync_pir_to_irr)(vcpu); -if (ioapic_in_kernel (vcpu->kvm)) -kvm_ioapic_scan_entry (vcpu, vcpu->arch.ioapic_handled_vectors); - } +else if (ioapic_in_kernel (vcpu->kvm)) +kvm_ioapic_scan_entry (vcpu, vcpu->arch.ioapic_handled_vectors);if (is_guest_mode (vcpu)) vcpu->arch.load_eoi_exitmap_pending = true;
Greg Kroah-Hartman
maintainerPATCH 102/131 ALSA: hda/realtek: fix mute/micmute LEDs dont work for ProBook 445/465 G11.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Chi <[email protected]>
commit ea5f8c4cffcd8a6b62b3a3bd5008275218c9d02a upstream.
HP ProBook 445/465 G11 needs ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mic-mute/audio-mute working.
--- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/patch_realtek.c +4 -0
@@ -9803,6 +9803,10 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8c70 ,"HP EliteBook 835 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c71 ,"HP EliteBook 845 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c72 ,"HP EliteBook 865 G11" ,ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8c7b ,"HP ProBook 445 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7c ,"HP ProBook 445 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7d ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7e ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8c89 ,"HP ProBook 460 G11" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c8a ,"HP EliteBook 630" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 103/131 ALSA: hda/realtek: Limit mic boost on N14AP7
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <[email protected]>
commit 86a433862912f52597263aa224a9ed82bcd533bf upstream.
The internal mic boost on the N14AP7 is too high. Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10132,6 +10132,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1b7d ,0xa831 ,"Ordissimo EVE2 " ,ALC269VB_FIXUP_ORDISSIMO_EVE2 ),/* Also known as Malata PC-B1303 */ SND_PCI_QUIRK (0x1c06 ,0x2013 ,"Lemote A1802" ,ALC269_FIXUP_LEMOTE_A1802 ),SND_PCI_QUIRK (0x1c06 ,0x2015 ,"Lemote A190X" ,ALC269_FIXUP_LEMOTE_A190X ), +SND_PCI_QUIRK (0x1c6c ,0x122a ,"Positivo N14AP7" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x1c6c ,0x1251 ,"Positivo N14KP6-TG" ,ALC288_FIXUP_DELL1_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1d05 ,0x1132 ,"TongFang PHxTxX1" ,ALC256_FIXUP_SET_COEF_DEFAULTS ), SND_PCI_QUIRK(0x1d05, 0x1096, "TongFang GMxMRxx", ALC269_FIXUP_NO_SHUTUP),
Greg Kroah-Hartman
maintainerPATCH 104/131 drm/i915/mso: using joiner is not possible with eDP MSO
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
commit 49cc17967be95d64606d5684416ee51eec35e84a upstream.
It's not possible to use the joiner at the same time with eDP MSO. When a panel needs MSO, it's not optional, so MSO trumps joiner.
v3: Only change intel_dp_has_joiner(), leave debugfs alone (Ville)
--- drivers/gpu/drm/i915/display/intel_dp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/i915/display/intel_dp.c +4 -0
@@ -390,6 +390,10 @@ bool intel_dp_can_bigjoiner(struct intelstruct intel_encoder *encoder = &intel_dig_port->base;struct drm_i915_private *dev_priv =to_i915 (encoder->base.dev); +/* eDP MSO is not compatible with joiner */ +if (intel_dp->mso_link_count) +return false; +return DISPLAY_VER (dev_priv) >=12 || (DISPLAY_VER (dev_priv) ==11 && encoder->port !=PORT_A );
Greg Kroah-Hartman
maintainerPATCH 105/131 drm/radeon: fix UBSAN warning in kv_dpm.c
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit a498df5421fd737d11bfd152428ba6b1c8538321 upstream.
Adds bounds check for sumo_vid_mapping_entry.
--- drivers/gpu/drm/radeon/sumo_dpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/radeon/sumo_dpm.c +2 -0
@@ -1621,6 +1621,8 @@ void sumo_construct_vid_mapping_table(stfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) {if (table[i].ulSupportedSCLK !=0 ) { +if (table[i].usVoltageIndex >=SUMO_MAX_NUMBER_VOLTAGES ) +continue ; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
Greg Kroah-Hartman
maintainerPATCH 106/131 drm/amdgpu: fix UBSAN warning in kv_dpm.c
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit f0d576f840153392d04b2d52cf3adab8f62e8cb6 upstream.
Adds bounds check for sumo_vid_mapping_entry.
--- drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +2 -0
@@ -164,6 +164,8 @@ static void sumo_construct_vid_mapping_tfor (i =0 ; i <SUMO_MAX_HARDWARE_POWERLEVELS ; i++) {if (table[i].ulSupportedSCLK !=0 ) { +if (table[i].usVoltageIndex >=SUMO_MAX_NUMBER_VOLTAGES ) +continue ; vid_mapping_table->entries[table[i].usVoltageIndex].vid_7bit = table[i].usVoltageID; vid_mapping_table->entries[table[i].usVoltageIndex].vid_2bit =
Greg Kroah-Hartman
maintainerPATCH 107/131 gcov: add support for GCC 14
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <[email protected]>
commit c1558bc57b8e5b4da5d821537cd30e2e660861d8 upstream.
Using gcov on kernels compiled with GCC 14 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 14.
Tested with GCC versions 14.1.0 and 13.2.0.
--- kernel/gcov/gcc_4_7.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/gcov/gcc_4_7.c +3 -1
@@ -18,7 +18,9 @@#include <linux/mm.h> #include "gcov.h" -#if (__GNUC__ >=10 ) +#if (__GNUC__ >=14 ) +#define GCOV_COUNTERS 9 +#elif (__GNUC__ >=10 )#define GCOV_COUNTERS 8#elif (__GNUC__ >=7 )#define GCOV_COUNTERS 9
Greg Kroah-Hartman
maintainerPATCH 108/131 kcov: dont lose track of remote references during softirqs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
commit 01c8f9806bde438ca1c8cbbc439f0a14a6694f6c upstream.
In kcov_remote_start()/kcov_remote_stop(), we swap the previous KCOV metadata of the current task into a per-CPU variable. However, the kcov_mode_enabled(mode) check is not sufficient in the case of remote KCOV
coverage: current->kcov_mode always remains KCOV_MODE_DISABLED for remote KCOV objects.
If the original task that has invoked the KCOV_REMOTE_ENABLE ioctl happens to get interrupted and kcov_remote_start() is called, it ultimately leads to kcov_remote_stop() NOT restoring the original KCOV reference. So when the task exits, all registered remote KCOV handles remain active forever.
The most uncomfortable effect (at least for syzkaller) is that the bug prevents the reuse of the same /sys/kernel/debug/kcov descriptor. If we obtain it in the parent process and then e.g. drop some capabilities and continuously fork to execute individual programs, at some point current->kcov of the forked process is lost, kcov_task_exit() takes no action, and all KCOV_REMOTE_ENABLE ioctls calls from subsequent forks fail.
And, yes, the efficiency is also affected if we keep on losing remote kcov objects.
a) kcov_remote_map keeps on growing forever.
b) (If I'm not mistaken), we're also not freeing the memory referenced by kcov->area.
Fix it by introducing a special kcov_mode that is assigned to the task that owns a KCOV remote object. It makes kcov_mode_enabled() return true and yet does not trigger coverage collection in __sanitizer_cov_trace_pc() and write_comp_data().
--- include/linux/kcov.h | 2 ++ kernel/kcov.c | 1 + 2 files changed, 3 insertions(+)
include/linux/kcov.h +2 -0
@@ -21,6 +21,8 @@ enum kcov_mode {KCOV_MODE_TRACE_PC =2 ,/* Collecting comparison operands mode. */ KCOV_MODE_TRACE_CMP =3 , +/* The process owns a KCOV remote reference. */ + KCOV_MODE_REMOTE = 4, };#define KCOV_IN_CTXSW (1 << 30)
kernel/kcov.c +1 -0
@@ -630,6 +630,7 @@ static int kcov_ioctl_locked(struct kcovreturn -EINVAL ; kcov->mode = mode; t->kcov = kcov; + t->kcov_mode =KCOV_MODE_REMOTE ; kcov->t = t; kcov->remote = true; kcov->remote_size = remote_arg->area_size;
Greg Kroah-Hartman
maintainerPATCH 109/131 mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Aquini <[email protected]>
commit 3afb76a66b5559a7b595155803ce23801558a7a9 upstream.
An ASLR regression was noticed [1] and tracked down to file-mapped areas being backed by THP in recent kernels. The 21-bit alignment constraint for such mappings reduces the entropy for randomizing the placement of 64-bit library mappings and breaks ASLR completely for 32-bit libraries.
The reported issue is easily addressed by increasing vm.mmap_rnd_bits and vm.mmap_rnd_compat_bits. This patch just provides a simple way to set ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS to their maximum values allowed by the architecture at build time.
[1] https://zolutal.github.io/aslrnt/
--- arch/Kconfig | 12 ++++++++++++ 1 file changed, 12 insertions(+)
arch/Kconfig +12 -0
@@ -981,10 +981,21 @@ config ARCH_MMAP_RND_BITS_MAX config ARCH_MMAP_RND_BITS_DEFAULT int +config FORCE_MAX_MMAP_RND_BITS + bool "Force maximum number of bits to use for ASLR of mmap base address" + default y if !64BIT + help + ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS represent the number + of bits to use for ASLR and if no custom value is assigned (EXPERT) + then the architecture's lower bound (minimum) value is assumed. + This toggle changes that default assumption to assume the arch upper + bound (maximum) value instead. + config ARCH_MMAP_RND_BITS int "Number of bits to use for ASLR of mmap base address" if EXPERT range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT + default ARCH_MMAP_RND_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_BITS_MIN depends on HAVE_ARCH_MMAP_RND_BITS help
@@ -1019,6 +1030,7 @@ config ARCH_MMAP_RND_COMPAT_BITS int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT + default ARCH_MMAP_RND_COMPAT_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_COMPAT_BITS_MIN depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS help
Greg Kroah-Hartman
maintainerPATCH 110/131 tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 9e046bb111f13461d3f9331e24e974324245140e upstream.
Some applications were reporting ETIMEDOUT errors on apparently good looking flows, according to packet dumps.
We were able to root cause the issue to an accidental setting of tp->retrans_stamp in the following scenario:
- client sends TFO SYN with data.
- server has TFO disabled, ACKs only SYN but not payload.
- client receives SYNACK covering only SYN.
- tcp_ack() eats SYN and sets tp->retrans_stamp to 0.
- tcp_rcv_fastopen_synack() calls tcp_xmit_retransmit_queue() to retransmit TFO payload w/o SYN, sets tp->retrans_stamp to "now", but we are not in any loss recovery state.
- TFO payload is ACKed.
- we are not in any loss recovery state, and don't see any dupacks, so we don't get to any code path that clears tp->retrans_stamp.
- tp->retrans_stamp stays non-zero for the lifetime of the connection.
- after first RTO, tcp_clamp_rto_to_user_timeout() clamps second RTO to 1 jiffy due to bogus tp->retrans_stamp.
- on clamped RTO with non-zero icsk_retransmits, retransmits_timed_out() sets start_ts from tp->retrans_stamp from TFO payload retransmit hours/days ago, and computes bogus long elapsed time for loss recovery, and suffers ETIMEDOUT early.
--- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/tcp_input.c +1 -0
@@ -6146,6 +6146,7 @@ static bool tcp_rcv_fastopen_synack(struskb_rbtree_walk_from (data)tcp_mark_skb_lost (sk, data);tcp_xmit_retransmit_queue (sk); + tp->retrans_stamp =0 ;NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPFASTOPENACTIVEFAIL );return true;
Greg Kroah-Hartman
maintainerPATCH 111/131 mm/page_table_check: fix crash on ZONE_DEVICE
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <[email protected]>
commit 8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 upstream.
Not all pages may apply to pgtable check. One example is ZONE_DEVICE
pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages().
When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device:
kernel BUG at mm/page_table_check.c:55!
While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more.
--- mm/page_table_check.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
mm/page_table_check.c +10 -1
@@ -70,6 +70,9 @@ static void page_table_check_clear(struc page =pfn_to_page (pfn); page_ext =page_ext_get (page); +if (!page_ext) +return ; +BUG_ON (PageSlab (page)); anon =PageAnon (page);
@@ -108,6 +111,9 @@ static void page_table_check_set(struct page =pfn_to_page (pfn); page_ext =page_ext_get (page); +if (!page_ext) +return ; +BUG_ON (PageSlab (page)); anon =PageAnon (page);
@@ -138,7 +144,10 @@ void __page_table_check_zero(struct pageBUG_ON (PageSlab (page)); page_ext =page_ext_get (page); -BUG_ON (!page_ext); + +if (!page_ext) +return ; +for (i =0 ; i < (1ul << order); i++) {struct page_table_check *ptc =get_page_table_check (page_ext);
Greg Kroah-Hartman
maintainerPATCH 112/131 i2c: ocores: set IACK bit after core is enabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grygorii Tertychnyi <[email protected]>
commit 5a72477273066b5b357801ab2d315ef14949d402 upstream.
Setting IACK bit when core is disabled does not clear the "Interrupt Flag" bit in the status register, and the interrupt remains pending.
Sometimes it causes failure for the very first message transfer, that is usually a device probe.
Hence, set IACK bit after core is enabled to clear pending interrupt.
--- drivers/i2c/busses/i2c-ocores.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-ocores.c +1 -1
@@ -442,8 +442,8 @@ static int ocores_init(struct device *deoc_setreg (i2c,OCI2C_PREHIGH , prescale >>8 );/* Init the device */ -oc_setreg (i2c,OCI2C_CMD ,OCI2C_CMD_IACK );oc_setreg (i2c,OCI2C_CONTROL , ctrl |OCI2C_CTRL_EN ); +oc_setreg (i2c,OCI2C_CMD ,OCI2C_CMD_IACK );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 113/131 dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 5c8cfd592bb7632200b4edac8f2c7ec892ed9d81 upstream.
The referenced i2c-controller.yaml schema is provided by dtschema package (outside of Linux kernel), so use full path to reference it.
--- Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/i2c/google,cros-ec-i2c-tunnel.yaml +1 -1
@@ -21,7 +21,7 @@ description: | google,cros-ec-spi or google,cros-ec-i2c. allOf: - - $ref: i2c-controller.yaml# + - $ref: /schemas/i2c/i2c-controller.yaml# properties: compatible:
Greg Kroah-Hartman
maintainerPATCH 114/131 spi: stm32: qspi: Fix dual flash mode sanity test in stm32_qspi_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrice Chotard <[email protected]>
commit c2bd0791c5f02e964402624dfff45ca8995f5397 upstream.
Misplaced parenthesis make test of mode wrong in case mode is equal to SPI_TX_OCTAL or SPI_RX_OCTAL.
Simplify this sanity test, if one of this bit is set, property cs-gpio must be present in DT.
--- drivers/spi/spi-stm32-qspi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/spi/spi-stm32-qspi.c +4 -6
@@ -654,9 +654,7 @@ static int stm32_qspi_setup(struct spi_dreturn -EINVAL ; mode = spi->mode & (SPI_TX_OCTAL |SPI_RX_OCTAL ); -if ((mode ==SPI_TX_OCTAL || mode ==SPI_RX_OCTAL ) || - ((mode == (SPI_TX_OCTAL |SPI_RX_OCTAL )) && -gpiod_count (qspi->dev,"cs" ) == -ENOENT )) { +if (mode &&gpiod_count (qspi->dev,"cs" ) == -ENOENT ) {dev_err (qspi->dev,"spi-rx-bus-width\\/spi-tx-bus-width\\/cs-gpios\n" );dev_err (qspi->dev,"configuration not supported\n" );
@@ -677,10 +675,10 @@ static int stm32_qspi_setup(struct spi_d qspi->cr_reg =CR_APMS |3 <<CR_FTHRES_SHIFT |CR_SSHIFT |CR_EN ;/* -* Dual flash mode is only enable in case SPI_TX_OCTAL and SPI_TX_OCTAL -* are both set in spi->mode and "cs-gpios" properties is found in DT +* Dual flash mode is only enable in case SPI_TX_OCTAL or SPI_RX_OCTAL +* is set in spi->mode and "cs-gpios" properties is found in DT */ -if (mode == (SPI_TX_OCTAL |SPI_RX_OCTAL )) { +if (mode) { qspi->cr_reg |=CR_DFM ;dev_dbg (qspi->dev,"Dual flash mode enable" ); }
Greg Kroah-Hartman
maintainerPATCH 115/131 arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <[email protected]>
commit dfd239a039b3581ca25f932e66b6e2c2bf77c798 upstream.
The gpio in "reg_usdhc2_vmmc" should be 7 instead of 19.
--- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8qm-mek.dts +1 -1
@@ -32,7 +32,7 @@ regulator-name = "SD1_SPWR"; regulator-min-microvolt = <3000000>; regulator-max-microvolt = <3000000>; - gpio = <&lsio_gpio4 19 GPIO_ACTIVE_HIGH>; + gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>; enable-active-high; }; };
Greg Kroah-Hartman
maintainerPATCH 116/131 spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to CCR_BUSWIDTH_4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrice Chotard <[email protected]>
commit 63deee52811b2f84ed2da55ad47252f0e8145d62 upstream.
In case usage of OCTAL mode, buswidth parameter can take the value 8. As return value of stm32_qspi_get_mode() is used to configure fields of CCR registers that are 2 bits only (fields IMODE, ADMODE, ADSIZE,
DMODE), clamp return value of stm32_qspi_get_mode() to 4.
--- drivers/spi/spi-stm32-qspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32-qspi.c +1 -1
@@ -350,7 +350,7 @@ static int stm32_qspi_wait_poll_status(sstatic int stm32_qspi_get_mode (u8 buswidth) { -if (buswidth ==4 ) +if (buswidth >=4 )return CCR_BUSWIDTH_4 ;return buswidth;
Greg Kroah-Hartman
maintainerPATCH 117/131 perf: script: add raw|disasm arguments to --insn-trace option
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Changbin Du <[email protected]>
[ Upstream commit 6750ba4b6442fa5ea4bf5c0e4b4ff8b0249ef71d ]
Now '--insn-trace' accept a argument to specify the output format:
- raw: display raw instructions.
- disasm: display mnemonic instructions (if capstone is installed).
$ sudo perf script --insn-trace=raw
ls 1443864 [006] 2275506.209908875: 7f216b426100 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: 48 89 e7
ls 1443864 [006] 2275506.209908875: 7f216b426103 _start+0x3 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: e8 e8 0c 00 00
ls 1443864 [006] 2275506.209908875: 7f216b426df0 _dl_start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: f3 0f 1e fa$ sudo perf script --insn-trace=disasm
ls 1443864 [006] 2275506.209908875: 7f216b426100 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) movq %rsp, %rdi
ls 1443864 [006] 2275506.209908875: 7f216b426103 _start+0x3 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) callq _dl_start+0x0
ls 1443864 [006] 2275506.209908875: 7f216b426df0 _dl_start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) illegal instruction
ls 1443864 [006] 2275506.209908875: 7f216b426df4 _dl_start+0x4 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) pushq %rbp
ls 1443864 [006] 2275506.209908875: 7f216b426df5 _dl_start+0x5 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) movq %rsp, %rbp
ls 1443864 [006] 2275506.209908875: 7f216b426df8 _dl_start+0x8 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) pushq %r15Stable-dep-of: d4a98b45fbe6 ("perf script: Show also errors for --insn-trace option")
--- tools/perf/Documentation/perf-script.txt | 7 ++++--- tools/perf/builtin-script.c | 22 ++++++++++++++++++---- 2 files changed, 22 insertions(+), 7 deletions(-)
tools/perf/Documentation/perf-script.txt +4 -3
@@ -438,9 +438,10 @@ include::itrace.txt[] will be printed. Each entry has function name and file/line. Enabled by default, disable with --no-inline. ---insn-trace:: - Show instruction stream for intel_pt traces. Combine with --xed to - show disassembly. +--insn-trace[=<raw|disasm>]:: + Show instruction stream in bytes (raw) or disassembled (disasm) + for intel_pt traces. The default is 'raw'. To use xed, combine + 'raw' with --xed to show disassembly done by xed. --xed:: Run xed disassembler on output. Requires installing the xed disassembler.
tools/perf/builtin-script.c +18 -4
@@ -3712,10 +3712,24 @@ static int perf_script__process_auxtrace_info(struct perf_session *session,#endif static int parse_insn_trace (const struct option *opt__maybe_unused , -const char *str__maybe_unused , -int unset__maybe_unused ) +const char *str,int unset__maybe_unused ) { -parse_output_fields (NULL ,"+insn,-event,-period" ,0 ); +const char *fields ="+insn,-event,-period" ; +int ret; + +if (str) { +if (strcmp (str,"disasm" ) ==0 ) + fields ="+disasm,-event,-period" ; +else if (strlen (str) !=0 &&strcmp (str,"raw" ) !=0 ) { +fprintf (stderr,"Only accept raw|disasm\n" ); +return -EINVAL ; + } + } + + ret =parse_output_fields (NULL , fields,0 ); +if (ret <0 ) +return ret; +itrace_parse_synth_opts (opt,"i0ns" ,0 ); symbol_conf.nanosecs = true;return 0 ;
@@ -3859,7 +3873,7 @@ int cmd_script(int argc, const char **argv) "only consider these symbols"),OPT_INTEGER (0 ,"addr-range" , &symbol_conf.addr_range,"Use with -S to list traced records within address range" ), -OPT_CALLBACK_OPTARG (0 ,"insn-trace" , &itrace_synth_opts,NULL ,NULL , +OPT_CALLBACK_OPTARG (0 ,"insn-trace" , &itrace_synth_opts,NULL ,"raw|disasm" ,"Decode instructions from itrace" , parse_insn_trace),OPT_CALLBACK_OPTARG (0 ,"xed" ,NULL ,NULL ,NULL , "Run xed disassembler on output", parse_xed),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/131 perf script: Show also errors for --insn-trace option
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit d4a98b45fbe6d06f4b79ed90d0bb05ced8674c23 ]
The trace could be misleading if trace errors are not taken into account, so display them also by adding the itrace "e" option.
Note --call-trace and --call-ret-trace already add the itrace "e" option.
--- tools/perf/builtin-script.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/builtin-script.c +1 -1
@@ -3730,7 +3730,7 @@ static int parse_insn_trace(const struct option *opt __maybe_unused,if (ret <0 )return ret; -itrace_parse_synth_opts (opt,"i0ns" ,0 ); +itrace_parse_synth_opts (opt,"i0nse" ,0 ); symbol_conf.nanosecs = true;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/131 ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 87d8e522d6f5a004f0aa06c0def302df65aff296 ]
Although the Samsung SoC keypad binding defined linux,keypad-no-autorepeat property, Linux driver never implemented it and always used linux,input-no-autorepeat. Correct the DTS to use property actually implemented.
This also fixes dtbs_check errors like:
exynos4210-smdkv310.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos4210-smdkv310.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4210-smdkv310.dts +1 -1
@@ -84,7 +84,7 @@ &keypad { samsung,keypad-num-rows = <2>; samsung,keypad-num-columns = <8>; - linux,keypad-no-autorepeat; + linux,input-no-autorepeat; wakeup-source; pinctrl-names = "default"; pinctrl-0 = <&keypad_rows &keypad_cols>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/131 ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 88208d3cd79821117fd3fb80d9bcab618467d37b ]
Although the Samsung SoC keypad binding defined linux,keypad-no-autorepeat property, Linux driver never implemented it and always used linux,input-no-autorepeat. Correct the DTS to use property actually implemented.
This also fixes dtbs_check errors like:
exynos4412-origen.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-origen.dts +1 -1
@@ -448,7 +448,7 @@ &keypad { samsung,keypad-num-rows = <3>; samsung,keypad-num-columns = <2>; - linux,keypad-no-autorepeat; + linux,input-no-autorepeat; wakeup-source; pinctrl-0 = <&keypad_rows &keypad_cols>; pinctrl-names = "default";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/131 ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4ac4c1d794e7ff454d191bbdab7585ed8dbf3758 ]
Although the Samsung SoC keypad binding defined linux,keypad-no-autorepeat property, Linux driver never implemented it and always used linux,input-no-autorepeat. Correct the DTS to use property actually implemented.
This also fixes dtbs_check errors like:
exynos4412-smdk4412.dtb: keypad@100a0000: 'key-A', 'key-B', 'key-C', 'key-D', 'key-E', 'linux,keypad-no-autorepeat' do not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos4412-smdk4412.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-smdk4412.dts +1 -1
@@ -65,7 +65,7 @@ &keypad { samsung,keypad-num-rows = <3>; samsung,keypad-num-columns = <8>; - linux,keypad-no-autorepeat; + linux,input-no-autorepeat; wakeup-source; pinctrl-0 = <&keypad_rows &keypad_cols>; pinctrl-names = "default";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/131 pmdomain: ti-sci: Fix duplicate PD referrals
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 670c900f69645db394efb38934b3344d8804171a ]
When the dts file has multiple referrers to a single PD (e.g. simple-framebuffer and dss nodes both point to the DSS power-domain) the ti-sci driver will create two power domains, both with the same ID, and that will cause problems as one of the power domains will hide the other one.
Fix this checking if a PD with the ID has already been created, and only create a PD for new IDs.
--- drivers/soc/ti/ti_sci_pm_domains.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/soc/ti/ti_sci_pm_domains.c +19 -1
@@ -114,6 +114,18 @@ static const struct of_device_id ti_sci_pm_domain_matches[] = { };MODULE_DEVICE_TABLE (of, ti_sci_pm_domain_matches); +static bool ti_sci_pm_idx_exists (struct ti_sci_genpd_provider *pd_provider,u32 idx) +{ +struct ti_sci_pm_domain *pd; + +list_for_each_entry (pd, &pd_provider->pd_list, node) { +if (pd->idx == idx) +return true; + } + +return false; +} +static int ti_sci_pm_domain_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -153,8 +165,14 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)break ;if (args.args_count >=1 && args.np == dev->of_node) { -if (args.args[0 ] > max_id) +if (args.args[0 ] > max_id) { max_id = args.args[0 ]; + }else { +if (ti_sci_pm_idx_exists (pd_provider, args.args[0 ])) { + index++; +continue ; + } + } pd =devm_kzalloc (dev,sizeof (*pd),GFP_KERNEL );if (!pd)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/131 tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 23748e3e0fbfe471eff5ce439921629f6a427828 ]
Fix the 'make W=1' warning:
WARNING: modpost: missing MODULE_DESCRIPTION() in kernel/trace/preemptirq_delay_test.o
--- kernel/trace/preemptirq_delay_test.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/preemptirq_delay_test.c +1 -0
@@ -215,4 +215,5 @@ static void __exit preemptirq_delay_exit(void) module_init(preemptirq_delay_init) module_exit(preemptirq_delay_exit) +MODULE_DESCRIPTION("Preempt / IRQ disable delay thread to test latency tracers");MODULE_LICENSE ("GPL v2" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/131 x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit e6dfdc2e89a0adedf455814c91b977d6a584cc88 ]
To avoid adding a slew of new macros for each new Intel CPU family switch over from providing CPU model number #defines to a new scheme that encodes vendor, family, and model in a single number.
[ bp: s/casted/cast/g ]
Stable-dep-of: 93022482b294 ("x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL")
--- arch/x86/include/asm/cpu_device_id.h | 93 ++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+)
arch/x86/include/asm/cpu_device_id.h +93 -0
@@ -2,6 +2,39 @@#ifndef _ASM_X86_CPU_DEVICE_ID#define _ASM_X86_CPU_DEVICE_ID +/* +* Can't use <linux/bitfield.h> because it generates expressions that +* cannot be used in structure initializers. Bitfield construction +* here must match the union in struct cpuinfo_86: +* union { +* struct { +* __u8 x86_model; +* __u8 x86; +* __u8 x86_vendor; +* __u8 x86_reserved; +* }; +* __u32 x86_vfm; +* }; +*/ +#define VFM_MODEL_BIT 0 +#define VFM_FAMILY_BIT 8 +#define VFM_VENDOR_BIT 16 +#define VFM_RSVD_BIT 24 + +#define VFM_MODEL_MASK GENMASK(VFM_FAMILY_BIT - 1, VFM_MODEL_BIT) +#define VFM_FAMILY_MASK GENMASK(VFM_VENDOR_BIT - 1, VFM_FAMILY_BIT) +#define VFM_VENDOR_MASK GENMASK(VFM_RSVD_BIT - 1, VFM_VENDOR_BIT) + +#define VFM_MODEL (vfm) (((vfm) & VFM_MODEL_MASK) >> VFM_MODEL_BIT) +#define VFM_FAMILY (vfm) (((vfm) & VFM_FAMILY_MASK) >> VFM_FAMILY_BIT) +#define VFM_VENDOR (vfm) (((vfm) & VFM_VENDOR_MASK) >> VFM_VENDOR_BIT) + +#define VFM_MAKE (_vendor, _family, _model) ( \ + ((_model) << VFM_MODEL_BIT) | \ + ((_family) << VFM_FAMILY_BIT) | \ + ((_vendor) << VFM_VENDOR_BIT) \ +) +/* * Declare drivers belonging to specific x86 CPUs * Similar in spirit to pci_device_id and related PCI functions
@@ -49,6 +82,16 @@ .driver_data = (unsigned long) _data \ } +#define X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE (_vendor, _family, _model, \ + _steppings, _feature, _data) { \ + .vendor = _vendor, \ + .family = _family, \ + .model = _model, \ + .steppings = _steppings, \ + .feature = _feature, \ + .driver_data = (unsigned long) _data \ +} +/** * X86_MATCH_VENDOR_FAM_MODEL_FEATURE - Macro for CPU matching * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
@@ -164,6 +207,56 @@ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, INTEL_FAM6_##model, \ steppings,X86_FEATURE_ANY , data) +/** +* X86_MATCH_VFM - Match encoded vendor/family/model +* @vfm: Encoded 8-bits each for vendor, family, model +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* Stepping and feature are set to wildcards + */ +#define X86_MATCH_VFM (vfm, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + X86_STEPPING_ANY, X86_FEATURE_ANY, data) + +/** +* X86_MATCH_VFM_STEPPINGS - Match encoded vendor/family/model/stepping +* @vfm: Encoded 8-bits each for vendor, family, model +* @steppings: Bitmask of steppings to match +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* feature is set to wildcard +*/ +#define X86_MATCH_VFM_STEPPINGS (vfm, steppings, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + steppings, X86_FEATURE_ANY, data) + +/** +* X86_MATCH_VFM_FEATURE - Match encoded vendor/family/model/feature +* @vfm: Encoded 8-bits each for vendor, family, model +* @feature: A X86_FEATURE bit +* @data: Driver specific data or NULL. The internal storage +* format is unsigned long. The supplied value, pointer +* etc. is cast to unsigned long internally. +* +* Steppings is set to wildcard +*/ +#define X86_MATCH_VFM_FEATURE (vfm, feature, data) \ + X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ + VFM_VENDOR(vfm), \ + VFM_FAMILY(vfm), \ + VFM_MODEL(vfm), \ + X86_STEPPING_ANY, feature, data) +/* * Match specific microcode revisions. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/131 x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit 93022482b2948a9a7e9b5a2bb685f2e1cb4c3348 ]
Code in v6.9 arch/x86/kernel/smpboot.c was changed by commit
4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") from:
static const struct x86_cpu_id intel_cod_cpu[] = {
X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0), /* COD */
X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0), /* COD */
X86_MATCH_INTEL_FAM6_MODEL(ANY, 1), /* SNC */ <--- 443
{}
};
static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
{
const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);to:
static const struct x86_cpu_id intel_cod_cpu[] = {
X86_MATCH_VFM(INTEL_HASWELL_X, 0), /* COD */
X86_MATCH_VFM(INTEL_BROADWELL_X, 0), /* COD */
X86_MATCH_VFM(INTEL_ANY, 1), /* SNC */
{}
};
static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
{
const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);On an Intel CPU with SNC enabled this code previously matched the rule on line 443 to avoid printing messages about insane cache configuration. The new code did not match any rules.
Expanding the macros for the intel_cod_cpu[] array shows that the old is equivalent to:
static const struct x86_cpu_id intel_cod_cpu[] = {
[0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
[1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
[2] = { .vendor = 0, .family = 6, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
[3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } }
while the new code expands to:
static const struct x86_cpu_id intel_cod_cpu[] = {
[0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
[1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
[2] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
[3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } }
Looking at the code for x86_match_cpu():
const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
{
const struct x86_cpu_id *m;
struct cpuinfo_x86 *c = &boot_cpu_data; for (m = match;
m->vendor | m->family | m->model | m->steppings | m->feature;
m++) {
...
}
return NULL;it is clear that there was no match because the ANY entry in the table (array index 2) is now the loop termination condition (all of vendor, family, model, steppings, and feature are zero).
So this code was working before because the "ANY" check was looking for any Intel CPU in family 6. But fails now because the family is a wild card. So the root cause is that x86_match_cpu() has never been able to match on a rule with just X86_VENDOR_INTEL and all other fields set to wildcards.
Add a new flags field to struct x86_cpu_id that has a bit set to indicate that this entry in the array is valid. Update X86_MATCH*() macros to set that bit. Change the end-marker check in x86_match_cpu() to just check the flags field for this bit.
Backporter notes: The commit in Fixes is really the one that is broken:
you can't have m->vendor as part of the loop termination conditional in x86_match_cpu() because it can happen - as it has happened above
- that that whole conditional is 0 albeit vendor == 0 is a valid case
- X86_VENDOR_INTEL is 0.
However, the only case where the above happens is the SNC check added by 4db64279bc2b1 so you only need this fix if you have backported that other commit
4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines")
--- arch/x86/include/asm/cpu_device_id.h | 5 +++++ arch/x86/kernel/cpu/match.c | 4 +--- include/linux/mod_devicetable.h | 2 ++ 3 files changed, 8 insertions(+), 3 deletions(-)
arch/x86/include/asm/cpu_device_id.h +5 -0
@@ -53,6 +53,9 @@#define X86_CENTAUR_FAM6_C7_D 0xd#define X86_CENTAUR_FAM6_NANO 0xf +/* x86_cpu_id::flags */ +#define X86_CPU_ID_FLAG_ENTRY_VALID BIT(0) +#define X86_STEPPINGS (mins, maxs) GENMASK(maxs, mins)/** * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
@@ -79,6 +82,7 @@ .model = _model, \ .steppings = _steppings, \ .feature = _feature, \ + .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ .driver_data = (unsigned long) _data \ }
@@ -89,6 +93,7 @@ .model = _model, \ .steppings = _steppings, \ .feature = _feature, \ + .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ .driver_data = (unsigned long) _data \ }
arch/x86/kernel/cpu/match.c +1 -3
@@ -39,9 +39,7 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)const struct x86_cpu_id *m;struct cpuinfo_x86 *c = &boot_cpu_data; -for (m = match; - m->vendor | m->family | m->model | m->steppings | m->feature; - m++) { +for (m = match; m->flags &X86_CPU_ID_FLAG_ENTRY_VALID ; m++) {if (m->vendor !=X86_VENDOR_ANY && c->x86_vendor != m->vendor)continue ;if (m->family !=X86_FAMILY_ANY && c->x86 != m->family)
include/linux/mod_devicetable.h +2 -0
@@ -676,6 +676,8 @@ struct x86_cpu_id {__u16 model;__u16 steppings;__u16 feature;/* bit index */ +/* Solely for kernel-internal use: DO NOT EXPORT to userspace! */ +__u16 flags;kernel_ulong_t driver_data; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/131 Revert "kheaders: substituting --sort in archive creation"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 49c386ebbb43394ff4773ce24f726f6afc4c30c8 ]
This reverts commit 700dea5a0bea9f64eba89fae7cb2540326fdfdc1.
The reason for that commit was --sort=ORDER introduced in tar 1.28 (2014). More than 3 years have passed since then.
Requiring GNU tar 1.28 should be fine now because we require GCC 5.1 (2015).
Stable-dep-of: 3bd27a847a3a ("kheaders: explicitly define file modes for archived headers")
--- kernel/gen_kheaders.sh | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
kernel/gen_kheaders.sh +3 -6
@@ -81,12 +81,9 @@ find $cpio_dir -type f -print0 | xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;' # Create archive and try to normalize metadata for reproducibility. -# For compatibility with older versions of tar, files are fed to tar -# pre-sorted, as --sort=name might not be available. -find $cpio_dir -printf "./%P\n" | LC_ALL=C sort | \ - tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ - --owner=0 --group=0 --numeric-owner --no-recursion \ - -I $XZ -cf $tarfile -C $cpio_dir/ -T - > /dev/null +tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ + --owner=0 --group=0 --sort=name --numeric-owner \ + -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null echo $headers_md5 > kernel/kheaders.md5 echo "$this_file_md5" >> kernel/kheaders.md5
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/131 kheaders: explicitly define file modes for archived headers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Maennich <[email protected]>
[ Upstream commit 3bd27a847a3a4827a948387cc8f0dbc9fa5931d5 ]
Build environments might be running with different umask settings resulting in indeterministic file modes for the files contained in kheaders.tar.xz. The file itself is served with 444, i.e. world readable. Archive the files explicitly with 744,a+X to improve reproducibility across build environments.
--mode=0444 is not suitable as directories need to be executable. Also, 444 makes it hard to delete all the readonly files after extraction.
--- kernel/gen_kheaders.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/gen_kheaders.sh +1 -1
@@ -82,7 +82,7 @@ find $cpio_dir -type f -print0 | # Create archive and try to normalize metadata for reproducibility. tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ - --owner=0 --group=0 --sort=name --numeric-owner \ + --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \ -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null echo $headers_md5 > kernel/kheaders.md5
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/131 drm/amd/display: revert Exit idle optimizations before HDCP execution
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Leung <[email protected]>
commit f2703a3596a279b0be6eeed4c500bdbaa8dc3ce4 upstream.
why and how:
causes black screen on PNP on DCN 3.5
This reverts commit f30a3bea92bd ("drm/amd/display: Exit idle optimizations before HDCP execution")
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 10 ---------- drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h | 8 -------- 2 files changed, 18 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +0 -10
@@ -88,14 +88,6 @@ static uint8_t is_cp_desired_hdcp2(struc !hdcp->connection.is_hdcp2_revoked; } -static void exit_idle_optimizations (struct mod_hdcp *hdcp) -{ -struct mod_hdcp_dm *dm = &hdcp->config.dm; - -if (dm->funcs.exit_idle_optimizations) - dm->funcs.exit_idle_optimizations (dm->handle); -} -static enum mod_hdcp_status execution (struct mod_hdcp *hdcp,struct mod_hdcp_event_context *event_ctx,union mod_hdcp_transition_input *input)
@@ -551,8 +543,6 @@ enum mod_hdcp_status mod_hdcp_process_evmemset (&event_ctx,0 ,sizeof (struct mod_hdcp_event_context )); event_ctx.event = event; -exit_idle_optimizations (hdcp); -/* execute and transition */ exec_status =execution (hdcp, &event_ctx, &hdcp->auth.trans_input); trans_status = transition(
drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +0 -8
@@ -155,13 +155,6 @@ struct mod_hdcp_ddc { } funcs; }; -struct mod_hdcp_dm { -void *handle; -struct { -void (*exit_idle_optimizations)(void *handle); - } funcs; -}; -struct mod_hdcp_psp {void *handle;void *funcs;
@@ -278,7 +271,6 @@ struct mod_hdcp_display_query {struct mod_hdcp_config {struct mod_hdcp_psp psp;struct mod_hdcp_ddc ddc; -struct mod_hdcp_dm dm;uint8_t index; };
Greg Kroah-Hartman
maintainerPATCH 129/131 net/sched: unregister lockdep keys in qdisc_create/qdisc_alloc error path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
commit 86735b57c905e775f05de995df35379366b72168 upstream.
Naresh and Eric report several errors (corrupted elements in the dynamic key hash list), when running tdc.py or syzbot. The error path of qdisc_alloc() and qdisc_create() frees the qdisc memory, but it forgets to unregister the lockdep key, thus causing use-after-free like the following one:
==================================================================
BUG: KASAN: slab-use-after-free in lockdep_register_key+0x5f2/0x700 Read of size 8 at addr ffff88811236f2a8 by task ip/7925 CPU: 26 PID: 7925 Comm: ip Kdump: loaded Not tainted 6.9.0-rc2+ #648 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <TASK> dump_stack_lvl+0x7c/0xc0 print_report+0xc9/0x610 kasan_report+0x89/0xc0 lockdep_register_key+0x5f2/0x700 qdisc_alloc+0x21d/0xb60 qdisc_create_dflt+0x63/0x3c0 attach_one_default_qdisc.constprop.37+0x8e/0x170 dev_activate+0x4bd/0xc30 __dev_open+0x275/0x380 __dev_change_flags+0x3f1/0x570 dev_change_flags+0x7c/0x160 do_setlink+0x1ea1/0x34b0 __rtnl_newlink+0x8c9/0x1510 rtnl_newlink+0x61/0x90 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7f9503f4fa07 Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007fff6c729068 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000006630c681 RCX: 00007f9503f4fa07 RDX: 0000000000000000 RSI: 00007fff6c7290d0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000078 R10: 000000000000009b R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff6c729180 R14: 0000000000000000 R15: 000055bf67dd9040 </TASK> Allocated by task 7745: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_node+0x1ff/0x460 qdisc_alloc+0xae/0xb60 qdisc_create+0xdd/0xfb0 tc_modify_qdisc+0x37e/0x1960 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79 Freed by task 7745: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0xfe/0x180 kfree+0x113/0x380 qdisc_create+0xafb/0xfb0 tc_modify_qdisc+0x37e/0x1960 rtnetlink_rcv_msg+0x2f0/0xbc0 netlink_rcv_skb+0x120/0x380 netlink_unicast+0x420/0x630 netlink_sendmsg+0x732/0xbc0 __sock_sendmsg+0x1ea/0x280 ____sys_sendmsg+0x5a9/0x990 ___sys_sendmsg+0xf1/0x180 __sys_sendmsg+0xd3/0x180 do_syscall_64+0x96/0x180 entry_SYSCALL_64_after_hwframe+0x71/0x79
Fix this ensuring that lockdep_unregister_key() is called before the qdisc struct is freed, also in the error path of qdisc_create() and qdisc_alloc().
--- net/sched/sch_api.c | 1 + net/sched/sch_generic.c | 1 + 2 files changed, 2 insertions(+)
net/sched/sch_api.c +1 -0
@@ -1353,6 +1353,7 @@ err_out5:if (ops->destroy) ops->destroy (sch); err_out3: +lockdep_unregister_key (&sch->root_lock_key);netdev_put (dev, &sch->dev_tracker);qdisc_free (sch); err_out2:
net/sched/sch_generic.c +1 -0
@@ -978,6 +978,7 @@ struct Qdisc *qdisc_alloc(struct netdev_return sch; errout1: +lockdep_unregister_key (&sch->root_lock_key);kfree (sch); errout:return ERR_PTR (err);
Greg Kroah-Hartman
maintainerPATCH 130/131 hid: asus: asus_report_fixup: fix potential read out of bounds
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Ballance <[email protected]>
commit 89e1ee118d6f0ee6bd6e80d8fe08839875daa241 upstream.
syzbot reported a potential read out of bounds in asus_report_fixup.
this patch adds checks so that a read out of bounds will not occur
--- drivers/hid/hid-asus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/hid-asus.c +2 -2
@@ -1247,8 +1247,8 @@ static __u8 *asus_report_fixup(struct hi }/* match many more n-key devices */ -if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD ) { -for (int i =0 ; i < *rsize +1 ; i++) { +if (drvdata->quirks &QUIRK_ROG_NKEY_KEYBOARD && *rsize >15 ) { +for (int i =0 ; i < *rsize -15 ; i++) {/* offset to the count from 0x5a report part always 14 */ if (rdesc[i] ==0x85 && rdesc[i +1 ] ==0x5a && rdesc[i +14 ] ==0x95 && rdesc[i +15 ] ==0x05 ) {
Greg Kroah-Hartman
maintainerPATCH 131/131 Revert "mm: mmap: allow for the maximum number of bits for randomizing mmap_base by default"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit 14d7c92f8df9c0964ae6f8b813c1b3ac38120825 upstream.
This reverts commit 3afb76a66b5559a7b595155803ce23801558a7a9.
This was a wrongheaded workaround for an issue that had already been fixed much better by commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit").
Asking users questions at kernel compile time that they can't make sense of is not a viable strategy. And the fact that even the kernel VM maintainers apparently didn't catch that this "fix" is not a fix any more pretty much proves the point that people can't be expected to understand the implications of the question.
It may well be the case that we could improve things further, and that __thp_get_unmapped_area() should take the mapping randomization into account even for 64-bit kernels. Maybe we should not be so eager to use THP mappings.
But in no case should this be a kernel config option.
--- arch/Kconfig | 12 ------------ 1 file changed, 12 deletions(-)
arch/Kconfig +0 -12
@@ -981,21 +981,10 @@ config ARCH_MMAP_RND_BITS_MAX config ARCH_MMAP_RND_BITS_DEFAULT int -config FORCE_MAX_MMAP_RND_BITS - bool "Force maximum number of bits to use for ASLR of mmap base address" - default y if !64BIT - help - ARCH_MMAP_RND_BITS and ARCH_MMAP_RND_COMPAT_BITS represent the number - of bits to use for ASLR and if no custom value is assigned (EXPERT) - then the architecture's lower bound (minimum) value is assumed. - This toggle changes that default assumption to assume the arch upper - bound (maximum) value instead. - config ARCH_MMAP_RND_BITS int "Number of bits to use for ASLR of mmap base address" if EXPERT range ARCH_MMAP_RND_BITS_MIN ARCH_MMAP_RND_BITS_MAX default ARCH_MMAP_RND_BITS_DEFAULT if ARCH_MMAP_RND_BITS_DEFAULT - default ARCH_MMAP_RND_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_BITS_MIN depends on HAVE_ARCH_MMAP_RND_BITS help
@@ -1030,7 +1019,6 @@ config ARCH_MMAP_RND_COMPAT_BITS int "Number of bits to use for ASLR of mmap base address for compatible applications" if EXPERT range ARCH_MMAP_RND_COMPAT_BITS_MIN ARCH_MMAP_RND_COMPAT_BITS_MAX default ARCH_MMAP_RND_COMPAT_BITS_DEFAULT if ARCH_MMAP_RND_COMPAT_BITS_DEFAULT - default ARCH_MMAP_RND_COMPAT_BITS_MAX if FORCE_MAX_MMAP_RND_BITS default ARCH_MMAP_RND_COMPAT_BITS_MIN depends on HAVE_ARCH_MMAP_RND_COMPAT_BITS help
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Am 25.06.2024 um 11:32 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No regressions on my 2-socket Ivy Bridge Xeon E5-2697 v2 machine. Builds, boots, works, nothing odd in dmesg output.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Hello,
Quoted 5 lines · On Tue, 25 Jun 2024 11:32:35 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 80ee32f97e81 ("Linux 6.1.96-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: sysfs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.1.96-rc1-g80ee32f97e81
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
KernelCI report for stable-rc/linux-6.1.y for this week :-
Date: 2024-06-25
## Build failures:
No **new** build failures seen for the stable-rc/linux-6.1.y commit head \o/
Thanks,
Shreeya Patel
Quoted 9 lines
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
W dniu 25.06.2024 o 11:32, Greg Kroah-Hartman pisze:
Quoted 9 lines
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Hello,
Tested on a HP 17-by0001nw laptop with an Intel Kaby Lake CPU and Ubuntu 20.04.
Issues found:
- NVMe drive failed shortly after resume from suspend:
pcieport 0000:00:1d.0: AER: Corrected error message received from 0000:00:1d.0 pcieport 0000:00:1d.0: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID) pcieport 0000:00:1d.0: device [8086:9d18] error status/mask=00000001/00002000 pcieport 0000:00:1d.0: [ 0] RxErr
[... repeats around 20 times ]
nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0x10 nvme nvme0: Does your device have a faulty power saving mode enabled? nvme nvme0: Try "nvme_core.default_ps_max_latency_us=0 pcie_aspm=off" and report a bug nvme 0000:03:00.0: enabling device (0000 -> 0002)
nvme nvme0: Removing after probe failure status: -19
nvme0n1: detected capacity change from 1000215216 to 0
[...]
md/raid1:md1: Disk failure on nvme0n1p3, disabling device. md/raid1:md1: Operation continuing on 1 devices.
After a cold reboot, the drive is visible again and functioning apparently normally. SMART data claims it is healthy. Previously this happened 3 weeks ago, on Linux 5.15.0-107-generic from Ubuntu, also shortly after a resume from suspend. As no recent patches in Linux stable appear to touch NVMe / PCIe, I'm giving a Tested-by: nonetheless.
Stack:
- amd64,
- ext4 on top of LVM on top of LUKS on top of mdraid on top of NVMe and SATA drives (the SATA drive in a write-mostly mode).
Tested (lightly):
- suspend to RAM,
- suspend to disk,
- virtual machines in QEMU (both i386 and amd64 guests),
- Bluetooth (Realtek RTL8822BE),
- GPU (Intel HD Graphics 620, tested with two Unigine benchmarks)
- WiFi (Realtek RTL8822BE),
- webcam.
Filesystems tested with fsstress:
- ext4,
- NFS client,
- exFAT,
- NTFS via FUSE (ntfs3g).
Greetings,
Mateusz
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.96-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.1.96-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 80ee32f97e81cdbd2585b8b81e943f50e8078a08
* git describe: v6.1.95-132-g80ee32f97e81
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.95-132-g80ee32f97e81
## Test Regressions (compared to v6.1.94-218-g0891d95b9db3)
## Metric Regressions (compared to v6.1.94-218-g0891d95b9db3)
## Test Fixes (compared to v6.1.94-218-g0891d95b9db3)
## Metric Fixes (compared to v6.1.94-218-g0891d95b9db3)
## Test result summary
total: 237419, pass: 204833, fail: 2499, skip: 29697, xfail: 390
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 133 total, 133 passed, 0 failed
* arm64: 37 total, 37 passed, 0 failed
* i386: 27 total, 27 passed, 0 failed
* mips: 24 total, 24 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 34 total, 34 passed, 0 failed
* riscv: 9 total, 9 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 31 total, 31 passed, 0 failed
## Test suites summary
* boot
* kselft[
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-timesync-off
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-smoketest
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
No regressions found on WSL (x86 and arm64).
Built, booted, and reviewed dmesg.
Thank you. :)
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 6.1.96 release. There are 131 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jun 2024 08:54:55 +0000. Anything received after that time might be too late.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.1.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany