6.6.37-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 1/163 iio: pressure: fix some word spelling errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li peiyu <[email protected]>
[ Upstream commit a2d43f44628fe4fa9c17f0e09548cb385e772f7e ]
They are appear to be spelling mistakes,
drivers/iio/pressure/bmp280.h:413 endianess->endianness drivers/iio/pressure/bmp280-core.c:923 dregrees->degrees drivers/iio/pressure/bmp280-core.c:1388 reescale->rescale drivers/iio/pressure/bmp280-core.c:1415 reescale->rescale
Stable-dep-of: 0f0f6306617c ("iio: pressure: bmp280: Fix BMP580 temperature reading")
--- drivers/iio/pressure/bmp280-core.c | 6 +++--- drivers/iio/pressure/bmp280.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/iio/pressure/bmp280-core.c +3 -3
@@ -920,7 +920,7 @@ static int bmp380_cmd(struct bmp280_data *data, u8 cmd) }/* -* Returns temperature in Celsius dregrees, resolution is 0.01º C. Output value of +* Returns temperature in Celsius degrees, resolution is 0.01º C. Output value of * "5123" equals 51.2º C. t_fine carries fine temperature as global value. * * Taken from datasheet, Section Appendix 9, "Compensation formula" and repo
@@ -1385,7 +1385,7 @@ static int bmp580_read_temp(struct bmp280_data *data, int *val, int *val2)/* * Temperature is returned in Celsius degrees in fractional -* form down 2^16. We reescale by x1000 to return milli Celsius +* form down 2^16. We rescale by x1000 to return milli Celsius * to respect IIO ABI. */ *val = raw_temp *1000 ;
@@ -1412,7 +1412,7 @@ static int bmp580_read_press(struct bmp280_data *data, int *val, int *val2) }/* * Pressure is returned in Pascals in fractional form down 2^16. -* We reescale /1000 to convert to kilopascal to respect IIO ABI. +* We rescale /1000 to convert to kilopascal to respect IIO ABI. */ *val = raw_press; *val2 =64000 ;/* 2^6 * 1000 */
drivers/iio/pressure/bmp280.h +1 -1
@@ -410,7 +410,7 @@ struct bmp280_data {__le16 bmp280_cal_buf[BMP280_CONTIGUOUS_CALIB_REGS /2 ];__be16 bmp180_cal_buf[BMP180_REG_CALIB_COUNT /2 ];u8 bmp380_cal_buf[BMP380_CALIB_REG_COUNT ]; -/* Miscellaneous, endianess-aware data buffers */ +/* Miscellaneous, endianness-aware data buffers */ __le16 le16;__be16 be16; }__aligned(IIO_DMA_MINALIGN) ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainercover 6.6.37-rc1 review
This is the start of the stable review cycle for the 6.6.37 release. There are 163 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Jul 2024 17:01:55 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.37-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.6.37-rc1
Yao Xingtao <[email protected]>
cxl/region: check interleave capability
Alison Schofield <[email protected]>
cxl/region: Avoid null pointer dereference in region lookup
Alison Schofield <[email protected]>
cxl/region: Move cxl_dpa_to_region() work to the region driver
Alex Bee <[email protected]>
arm64: dts: rockchip: Add sound-dai-cells for RK3368
FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E
FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: make poweroff(8) work on Radxa ROCK 5A
Johan Jonker <[email protected]>
ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
Hsin-Te Yuan <[email protected]>
arm64: dts: rockchip: Fix the value of dlg,jack-det-rate mismatch on rk3399-gru
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Rename LED related pinctrl nodes on rk3308-rock-pi-s
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
yangge <[email protected]>
mm/page_alloc: Separate THP PCP into movable and non-movable categories
Greg Kroah-Hartman <[email protected]>
Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
Uwe Kleine-König <[email protected]>
pwm: stm32: Refuse too small period requests
Jingbo Xu <[email protected]>
erofs: fix NULL dereference of dif->bdev_handle in fscache mode
Arnd Bergmann <[email protected]>
syscalls: fix sys_fanotify_mark prototype
Arnd Bergmann <[email protected]>
syscalls: fix compat_sys_io_pgetevents_time64 usage
Arnd Bergmann <[email protected]>
ftruncate: pass a signed offset
Niklas Cassel <[email protected]>
ata: libata-core: Fix double free on error
Niklas Cassel <[email protected]>
ata: ahci: Clean up sysfs file on error
Vitor Soares <[email protected]>
can: mcp251xfd: fix infinite loop when xmit fails
Sven Eckelmann <[email protected]>
batman-adv: Don't accept TT entries for out-of-spec VIDs
Alex Deucher <[email protected]>
drm/amdgpu/atomfirmware: fix parsing of vram_info
Michael Strauss <[email protected]>
drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if LTTPR is present
Ma Ke <[email protected]>
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
Janusz Krzysztofik <[email protected]>
drm/i915/gt: Fix potential UAF by revoke of fence registers
Julia Zhang <[email protected]>
drm/amdgpu: avoid using null object of framebuffer
Thomas Zimmermann <[email protected]>
drm/fbdev-dma: Only set smem_start is enable per module option
Ma Ke <[email protected]>
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
Jann Horn <[email protected]>
drm/drm_file: Fix pid refcounting race
Arnd Bergmann <[email protected]>
hexagon: fix fadvise64_64 calling conventions
Arnd Bergmann <[email protected]>
csky, hexagon: fix broken sys_sync_file_range
Naohiro Aota <[email protected]>
btrfs: zoned: fix initial free space detection
Arnd Bergmann <[email protected]>
sh: rework sync_file_range ABI
Dragan Simic <[email protected]>
kbuild: Install dtb files as 0644 in Makefile.dtbinst
Huacai Chen <[email protected]>
irqchip/loongson-liointc: Set different ISRs for different cores
Yuntao Wang <[email protected]>
cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
Huacai Chen <[email protected]>
irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
Mostafa Saleh <[email protected]>
PCI/MSI: Fix UAF in msi_capability_init
Oleksij Rempel <[email protected]>
net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
Oleksij Rempel <[email protected]>
net: can: j1939: recover socket queue on CAN bus error during BAM transmission
Shigeru Yoshida <[email protected]>
net: can: j1939: Initialize unused data in j1939_send_one()
Jean-Michel Hautbois <[email protected]>
tty: mcf: MCF54418 has 10 UARTS
Dirk Su <[email protected]>
ALSA: hda/realtek: fix mute/micmute LEDs don't work for EliteBook 645/665 G11.
Jonas Gorski <[email protected]>
serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
Jonas Gorski <[email protected]>
serial: core: introduce uart_port_tx_limited_flags()
Stefan Eichenberger <[email protected]>
serial: imx: set receiver level before starting uart
Udit Kumar <[email protected]>
serial: 8250_omap: Implementation of Errata i2310
Doug Brown <[email protected]>
Revert "serial: core: only stop transmit when HW fifo is empty"
Jos Wang <[email protected]>
usb: dwc3: core: Workaround for CSR read timeout
Wesley Cheng <[email protected]>
usb: dwc3: core: Add DWC31 version 2.00a controller
Fabrice Gasnier <[email protected]>
usb: ucsi: stm32: fix command completion handling
Javier Carrasco <[email protected]>
usb: typec: ucsi: glink: fix child node release in probe function
Jeremy Kerr <[email protected]>
usb: gadget: aspeed_udc: fix device address configuration
Meng Li <[email protected]>
usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
Nikita Zhandarovich <[email protected]>
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
Dan Carpenter <[email protected]>
usb: musb: da8xx: fix a resource leak in probe()
Oliver Neukum <[email protected]>
usb: gadget: printer: fix races against disable
Oliver Neukum <[email protected]>
usb: gadget: printer: SS+ support
Jose Ignacio Tornos Martinez <[email protected]>
net: usb: ax88179_178a: improve link status logs
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix sensor data read operation
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix overflows in compensate() functions
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix calibration data variable
Vasileios Amoiridis <[email protected]>
iio: chemical: bme680: Fix pressure value output
Alexander Sverdlin <[email protected]>
iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
Fernando Yang <[email protected]>
iio: adc: ad7266: Fix variable checking bug
Niklas Cassel <[email protected]>
ata,scsi: libata-core: Do not leak memory for ata_port struct members
Niklas Cassel <[email protected]>
ata: libata-core: Fix null pointer dereference on error
Wolfram Sang <[email protected]>
i2c: testunit: discard write requests while old command is running
Wolfram Sang <[email protected]>
i2c: testunit: don't erase registers after STOP
Thayne Harbaugh <[email protected]>
kbuild: Fix build target deb-pkg: ln: failed to create hard link
Mark-PK Tsai <[email protected]>
kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
David Lechner <[email protected]>
counter: ti-eqep: enable clock at probe
Sean Anderson <[email protected]>
iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
Adrian Hunter <[email protected]>
mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
Adrian Hunter <[email protected]>
mmc: sdhci: Do not invert write-protect twice
Ilpo Järvinen <[email protected]>
mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
Kamal Dasu <[email protected]>
mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
Ilpo Järvinen <[email protected]>
mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
Zhaoyang Huang <[email protected]>
mm: fix incorrect vbq reference in purge_fragmented_block
Christoph Hellwig <[email protected]>
nfs: drop the incorrect assertion in nfs_swap_rw()
Jan Kara <[email protected]>
ocfs2: fix DIO failure due to insufficient transaction credits
Johan Hovold <[email protected]>
pinctrl: qcom: spmi-gpio: drop broken pm8008 support
Thomas Bogendoerfer <[email protected]>
Revert "MIPS: pci: lantiq: restore reset gpio polarity"
Arnd Bergmann <[email protected]>
parisc: use generic sys_fanotify_mark implementation
Linus Torvalds <[email protected]>
x86: stop playing stack games in profile_pc()
Kees Cook <[email protected]>
randomize_kstack: Remove non-functional per-arch entropy filtering
Kent Gibson <[email protected]>
gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
Andy Chiu <[email protected]>
riscv: stacktrace: convert arch_stack_walk() to noinstr
Lijo Lazar <[email protected]>
drm/amdgpu: Fix pci state save during mode-1 reset
Jesse Taube <[email protected]>
RISC-V: fix vector insn load/store width mask
Aleksandr Mishin <[email protected]>
gpio: davinci: Validate the obtained number of IRQs
Liu Ying <[email protected]>
drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
Hannes Reinecke <[email protected]>
nvme: fixup comment for nvme RDMA Provider Type
Erick Archer <[email protected]>
drm/radeon/radeon_display: Decrease the size of allocated memory
Andreas Gruenbacher <[email protected]>
gfs2: Fix NULL pointer dereference in gfs2_log_flush
Andrew Davis <[email protected]>
soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
Tiezhu Yang <[email protected]>
irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for IRQ_LOONGARCH_CPU
Ricardo Ribalda <[email protected]>
media: dvbdev: Initialize sbuf
Oswald Buddenhagen <[email protected]>
ALSA: emux: improve patch ioctl data validation
Joachim Vandersmissen <[email protected]>
crypto: ecdh - explicitly zeroize private_key
Dawei Li <[email protected]>
net/dpaa2: Avoid explicit cpumask var allocation on stack
Dawei Li <[email protected]>
net/iucv: Avoid explicit cpumask var allocation on stack
Wenchao Hao <[email protected]>
RDMA/restrack: Fix potential invalid address access
Martin KaFai Lau <[email protected]>
bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
Johannes Berg <[email protected]>
wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
Denis Arefev <[email protected]>
mtd: partitions: redboot: Added conversion of operands to a larger type
Uros Bizjak <[email protected]>
x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
Maxime Coquelin <[email protected]>
vduse: Temporarily fail if control queue feature requested
Maxime Coquelin <[email protected]>
vduse: validate block features only with block devices
Laurent Pinchart <[email protected]>
drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
Christophe Leroy <[email protected]>
bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
Christophe Leroy <[email protected]>
bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
Ma Ke <[email protected]>
net: mana: Fix possible double free in error handling path
Yunseong Kim <[email protected]>
tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
Takashi Iwai <[email protected]>
ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
Neal Cardwell <[email protected]>
tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
Arnd Bergmann <[email protected]>
powerpc: restore some missing spu syscalls
Arnd Bergmann <[email protected]>
parisc: use correct compat recv/recvfrom syscalls
Arnd Bergmann <[email protected]>
sparc: fix compat recv/recvfrom syscalls
Arnd Bergmann <[email protected]>
sparc: fix old compat_sys_select()
Tristram Ha <[email protected]>
net: dsa: microchip: fix wrong register write when masking interrupt
Takashi Iwai <[email protected]>
ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
luoxuanqiang <[email protected]>
Fix race for duplicate reqsk on identical SYN
Filipe Manana <[email protected]>
btrfs: use NOFS context when getting inodes during logging and log replay
Jianguo Wu <[email protected]>
netfilter: fix undefined reference to 'netfilter_lwtunnel_*' when CONFIG_SYSCTL=n
Daniil Dulov <[email protected]>
xdp: Remove WARN() from __xdp_reg_mem_model()
Jan Sokolowski <[email protected]>
ice: Rebuild TC queues on VSI queue reconfiguration
Enguerrand de Ribaucourt <[email protected]>
net: dsa: microchip: use collision based back pressure mode
Enguerrand de Ribaucourt <[email protected]>
net: phy: micrel: add Microchip KSZ 9477 to the device table
Nick Child <[email protected]>
ibmvnic: Free any outstanding tx skbs during scrq reset
Daniel Borkmann <[email protected]>
bpf: Fix overrunning reservations in ringbuf
Ido Schimmel <[email protected]>
mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
Xin Long <[email protected]>
openvswitch: get related ct labels from its master if it is not confirmed
Tristram Ha <[email protected]>
net: dsa: microchip: fix initial port flush problem
Elinor Montmasson <[email protected]>
ASoC: fsl-asoc-card: set priv->pdev before using it
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: add a null check for chip_pdev structure
Niklas Schnelle <[email protected]>
s390/pci: Add missing virt_to_phys() for directed DIBV
Yonghong Song <[email protected]>
bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
Yonghong Song <[email protected]>
bpf: Add missed var_off setting in set_sext32_default_val()
Srinivas Kandagatla <[email protected]>
ASoC: q6apm-lpass-dai: close graph on prepare errors
Wenchao Hao <[email protected]>
workqueue: Increase worker desc's length to 32
Andrei Simion <[email protected]>
ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
Kuninori Morimoto <[email protected]>
ASoC: atmel: convert not to use asoc_xxx()
Hsin-Te Yuan <[email protected]>
ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
Alibek Omarov <[email protected]>
ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
Jeff Johnson <[email protected]>
wifi: mac80211: Use flexible array in struct ieee80211_tim_ie
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: userspace_pm: fixed subtest names
Geliang Tang <[email protected]>
selftests: mptcp: print_test out of verify_listener_events
Martin Schiller <[email protected]>
MIPS: pci: lantiq: restore reset gpio polarity
Huang-Huang Bao <[email protected]>
pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
Huang-Huang Bao <[email protected]>
pinctrl: rockchip: use dedicated pinctrl type for RK3328
Huang-Huang Bao <[email protected]>
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
Huang-Huang Bao <[email protected]>
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
Hagar Hemdan <[email protected]>
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
John Keeping <[email protected]>
Input: ili210x - fix ili251x_read_touch_data() return value
Jan Beulich <[email protected]>
x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Ack also failed Get Error commands
Christian A. Ehrhardt <[email protected]>
usb: typec: ucsi: Never send a lone connector change ack
Adam Rizkalla <[email protected]>
iio: pressure: bmp280: Fix BMP580 temperature reading
Li peiyu <[email protected]>
iio: pressure: fix some word spelling errors
-------------
Diffstat:
Documentation/kbuild/modules.rst | 8 +- Makefile | 4 +- arch/arm/boot/dts/rockchip/rk3066a.dtsi | 1 + arch/arm/net/bpf_jit_32.c | 25 ++- arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 18 +- arch/arm64/boot/dts/rockchip/rk3328-rock-pi-e.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3368.dtsi | 3 + arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 1 + arch/arm64/include/asm/unistd32.h | 2 +- arch/arm64/kernel/syscall.c | 16 +- arch/csky/include/uapi/asm/unistd.h | 1 + arch/hexagon/include/asm/syscalls.h | 6 + arch/hexagon/include/uapi/asm/unistd.h | 1 + arch/hexagon/kernel/syscalltab.c | 7 + arch/loongarch/net/bpf_jit.c | 22 +- arch/mips/kernel/syscalls/syscall_n32.tbl | 2 +- arch/mips/kernel/syscalls/syscall_o32.tbl | 2 +- arch/mips/net/bpf_jit_comp.c | 3 +- arch/parisc/Kconfig | 1 + arch/parisc/kernel/sys_parisc32.c | 9 - arch/parisc/kernel/syscalls/syscall.tbl | 6 +- arch/parisc/net/bpf_jit_core.c | 8 +- arch/powerpc/kernel/syscalls/syscall.tbl | 6 +- arch/riscv/include/asm/insn.h | 2 +- arch/riscv/kernel/stacktrace.c | 2 +- arch/s390/include/asm/entry-common.h | 2 +- arch/s390/kernel/syscalls/syscall.tbl | 2 +- arch/s390/net/bpf_jit_comp.c | 6 +- arch/s390/pci/pci_irq.c | 2 +- arch/sh/kernel/sys_sh32.c | 11 + arch/sh/kernel/syscalls/syscall.tbl | 3 +- arch/sparc/kernel/sys32.S | 221 --------------------- arch/sparc/kernel/syscalls/syscall.tbl | 8 +- arch/sparc/net/bpf_jit_comp_64.c | 6 +- arch/x86/entry/syscalls/syscall_32.tbl | 2 +- arch/x86/include/asm/entry-common.h | 15 +- arch/x86/kernel/fpu/core.c | 4 +- arch/x86/kernel/time.c | 20 +- arch/x86/mm/numa.c | 6 +- arch/x86/net/bpf_jit_comp32.c | 3 +- crypto/ecdh.c | 2 + drivers/ata/ahci.c | 17 +- drivers/ata/libata-core.c | 29 ++- drivers/counter/ti-eqep.c | 6 + drivers/cpufreq/amd-pstate.c | 2 +- drivers/cpufreq/intel_pstate.c | 13 +- drivers/cxl/core/core.h | 7 + drivers/cxl/core/hdm.c | 13 ++ drivers/cxl/core/memdev.c | 44 ---- drivers/cxl/core/region.c | 137 +++++++++++++ drivers/cxl/cxl.h | 2 + drivers/cxl/cxlmem.h | 10 + drivers/gpio/gpio-davinci.c | 5 + drivers/gpio/gpiolib-cdev.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 18 +- .../display/dc/link/protocols/link_dp_capability.c | 10 +- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 5 + drivers/gpu/drm/drm_fb_helper.c | 6 +- drivers/gpu/drm/drm_fbdev_dma.c | 5 +- drivers/gpu/drm/drm_file.c | 8 +- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 1 + drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 6 + drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 1 + drivers/gpu/drm/radeon/radeon.h | 1 - drivers/gpu/drm/radeon/radeon_display.c | 8 +- drivers/i2c/i2c-slave-testunit.c | 5 +- drivers/iio/accel/Kconfig | 2 + drivers/iio/adc/ad7266.c | 2 + drivers/iio/adc/xilinx-ams.c | 8 +- drivers/iio/chemical/bme680.h | 2 + drivers/iio/chemical/bme680_core.c | 62 +++++- drivers/iio/pressure/bmp280-core.c | 14 +- drivers/iio/pressure/bmp280.h | 2 +- drivers/infiniband/core/restrack.c | 51 +---- drivers/input/touchscreen/ili210x.c | 4 +- drivers/irqchip/Kconfig | 2 +- drivers/irqchip/irq-loongson-eiointc.c | 5 +- drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/mmc/host/sdhci-brcmstb.c | 4 + drivers/mmc/host/sdhci-pci-core.c | 11 +- drivers/mmc/host/sdhci-pci-o2micro.c | 41 ++-- drivers/mmc/host/sdhci.c | 25 ++- drivers/mtd/parsers/redboot.c | 2 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 14 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c | 55 ++++- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 5 + drivers/net/dsa/microchip/ksz9477.c | 10 +- drivers/net/dsa/microchip/ksz9477_reg.h | 1 + drivers/net/dsa/microchip/ksz_common.c | 2 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 +- drivers/net/ethernet/ibm/ibmvnic.c | 6 + drivers/net/ethernet/intel/ice/ice_main.c | 10 +- .../net/ethernet/mellanox/mlxsw/spectrum_buffers.c | 20 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 2 + drivers/net/phy/micrel.c | 1 + drivers/net/usb/ax88179_178a.c | 6 +- drivers/pci/msi/msi.c | 10 +- drivers/pinctrl/core.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 68 ++++++- drivers/pinctrl/pinctrl-rockchip.h | 1 + drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 1 - drivers/pwm/pwm-stm32.c | 3 + drivers/scsi/libsas/sas_ata.c | 6 +- drivers/scsi/libsas/sas_discover.c | 2 +- drivers/soc/ti/wkup_m3_ipc.c | 7 +- drivers/tty/serial/8250/8250_omap.c | 25 ++- drivers/tty/serial/bcm63xx_uart.c | 7 +- drivers/tty/serial/imx.c | 4 +- drivers/tty/serial/mcf.c | 2 +- drivers/usb/atm/cxacru.c | 14 ++ drivers/usb/dwc3/core.c | 26 ++- drivers/usb/dwc3/core.h | 1 + drivers/usb/gadget/function/f_printer.c | 40 +++- drivers/usb/gadget/udc/aspeed_udc.c | 4 +- drivers/usb/musb/da8xx.c | 8 +- drivers/usb/typec/ucsi/ucsi.c | 55 +++-- drivers/usb/typec/ucsi/ucsi_glink.c | 5 +- drivers/usb/typec/ucsi/ucsi_stm32g0.c | 19 +- drivers/vdpa/vdpa_user/vduse_dev.c | 14 +- fs/btrfs/free-space-cache.c | 2 +- fs/btrfs/tree-log.c | 43 ++-- fs/erofs/data.c | 5 +- fs/gfs2/log.c | 3 +- fs/gfs2/super.c | 4 + fs/nfs/direct.c | 2 - fs/ocfs2/aops.c | 5 + fs/ocfs2/journal.c | 17 ++ fs/ocfs2/journal.h | 2 + fs/ocfs2/ocfs2_trace.h | 2 + fs/open.c | 4 +- include/linux/compat.h | 2 +- include/linux/filter.h | 10 +- include/linux/ieee80211.h | 15 +- include/linux/libata.h | 1 + include/linux/mmzone.h | 9 +- include/linux/nvme.h | 4 +- include/linux/serial_core.h | 21 +- include/linux/syscalls.h | 8 +- include/linux/workqueue.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/netfilter/nf_tables.h | 5 + include/trace/events/qdisc.h | 2 +- include/uapi/asm-generic/unistd.h | 2 +- kernel/bpf/core.c | 6 +- kernel/bpf/ringbuf.c | 31 ++- kernel/bpf/verifier.c | 10 +- kernel/cpu.c | 8 +- kernel/sys_ni.c | 2 +- mm/page_alloc.c | 9 +- mm/vmalloc.c | 21 +- net/batman-adv/originator.c | 27 +++ net/can/j1939/main.c | 6 +- net/can/j1939/transport.c | 21 +- net/core/xdp.c | 4 +- net/dccp/ipv4.c | 7 +- net/dccp/ipv6.c | 7 +- net/ipv4/inet_connection_sock.c | 17 +- net/ipv4/tcp_input.c | 45 +++-- net/iucv/iucv.c | 26 ++- net/netfilter/nf_hooks_lwtunnel.c | 3 + net/netfilter/nf_tables_api.c | 8 +- net/netfilter/nft_lookup.c | 3 +- net/openvswitch/conntrack.c | 7 +- scripts/Makefile.dtbinst | 2 +- scripts/Makefile.package | 2 +- sound/core/seq/seq_ump_convert.c | 10 +- sound/pci/hda/patch_realtek.c | 3 + sound/soc/amd/acp/acp-i2s.c | 8 - sound/soc/amd/acp/acp-pci.c | 10 +- sound/soc/atmel/atmel-classd.c | 17 +- sound/soc/atmel/atmel-pcm-dma.c | 8 +- sound/soc/atmel/atmel-pcm-pdc.c | 4 +- sound/soc/atmel/atmel-pdmic.c | 12 +- sound/soc/atmel/atmel_wm8904.c | 4 +- sound/soc/atmel/mikroe-proto.c | 2 +- sound/soc/atmel/sam9g20_wm8731.c | 2 +- sound/soc/atmel/sam9x5_wm8731.c | 2 +- sound/soc/fsl/fsl-asoc-card.c | 3 +- sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 10 +- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 32 +-- sound/soc/rockchip/rockchip_i2s_tdm.c | 13 +- sound/synth/emux/soundfont.c | 17 +- tools/testing/cxl/test/cxl.c | 4 + tools/testing/selftests/net/mptcp/userspace_pm.sh | 50 +++-- 189 files changed, 1374 insertions(+), 859 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 3/163 usb: typec: ucsi: Never send a lone connector change ack
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian A. Ehrhardt <[email protected]>
[ Upstream commit de52aca4d9d56c3b2f00b638d457075914b1a227 ]
Some PPM implementation do not like UCSI_ACK_CONNECTOR_CHANGE without UCSI_ACK_COMMAND_COMPLETE. Moreover, doing this is racy as it requires sending two UCSI_ACK_CC_CI commands in a row and the second one will be started with UCSI_CCI_ACK_COMPLETE already set in CCI.
Bundle the UCSI_ACK_CONNECTOR_CHANGE with the UCSI_ACK_COMMAND_COMPLETE for the UCSI_GET_CONNECTOR_STATUS command that is sent while handling a connector change event.
Stable-dep-of: 8bdf8a42bca4 ("usb: typec: ucsi: Ack also failed Get Error commands")
--- drivers/usb/typec/ucsi/ucsi.c | 48 +++++++++++++++-------------------- 1 file changed, 21 insertions(+), 27 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +21 -27
@@ -49,22 +49,16 @@ static int ucsi_read_message_in(struct ucsi *ucsi, void *buf,return ucsi->ops->read (ucsi,UCSI_MESSAGE_IN , buf, buf_size); } -static int ucsi_acknowledge_command (struct ucsi *ucsi) +static int ucsi_acknowledge (struct ucsi *ucsi,bool conn_ack) {u64 ctrl; ctrl =UCSI_ACK_CC_CI ; ctrl |=UCSI_ACK_COMMAND_COMPLETE ; - -return ucsi->ops->sync_write (ucsi,UCSI_CONTROL , &ctrl,sizeof (ctrl)); -} - -static int ucsi_acknowledge_connector_change (struct ucsi *ucsi) -{ -u64 ctrl; - - ctrl =UCSI_ACK_CC_CI ; - ctrl |=UCSI_ACK_CONNECTOR_CHANGE ; +if (conn_ack) { +clear_bit (EVENT_PENDING , &ucsi->flags); + ctrl |=UCSI_ACK_CONNECTOR_CHANGE ; + }return ucsi->ops->sync_write (ucsi,UCSI_CONTROL , &ctrl,sizeof (ctrl)); }
@@ -77,7 +71,7 @@ static int ucsi_read_error(struct ucsi *ucsi)int ret;/* Acknowledge the command that failed */ - ret =ucsi_acknowledge_command (ucsi); + ret =ucsi_acknowledge (ucsi, false);if (ret)return ret;
@@ -89,7 +83,7 @@ static int ucsi_read_error(struct ucsi *ucsi)if (ret)return ret; - ret =ucsi_acknowledge_command (ucsi); + ret =ucsi_acknowledge (ucsi, false);if (ret)return ret;
@@ -152,7 +146,7 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd)return -EIO ;if (cci &UCSI_CCI_NOT_SUPPORTED ) { -if (ucsi_acknowledge_command (ucsi) <0 ) +if (ucsi_acknowledge (ucsi, false) <0 )dev_err (ucsi->dev,"ACK of unsupported command failed\n" );return -EOPNOTSUPP ;
@@ -165,15 +159,15 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) }if (cmd ==UCSI_CANCEL && cci &UCSI_CCI_CANCEL_COMPLETE ) { - ret =ucsi_acknowledge_command (ucsi); + ret =ucsi_acknowledge (ucsi, false);return ret ? ret : -EBUSY ; }return UCSI_CCI_LENGTH (cci); } -int ucsi_send_command (struct ucsi *ucsi,u64 command, -void *data,size_t size) +static int ucsi_send_command_common (struct ucsi *ucsi,u64 command, +void *data,size_t size,bool conn_ack) {u8 length;int ret;
@@ -192,7 +186,7 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command, goto out; } - ret =ucsi_acknowledge_command (ucsi); + ret =ucsi_acknowledge (ucsi, conn_ack);if (ret) goto out;
@@ -201,6 +195,12 @@ int ucsi_send_command(struct ucsi *ucsi, u64 command,mutex_unlock (&ucsi->ppm_lock);return ret; } + +int ucsi_send_command (struct ucsi *ucsi,u64 command, +void *data,size_t size) +{ +return ucsi_send_command_common (ucsi, command, data, size, false); +}EXPORT_SYMBOL_GPL (ucsi_send_command);/* -------------------------------------------------------------------------- */
@@ -886,7 +886,9 @@ static void ucsi_handle_connector_change(struct work_struct *work)mutex_lock (&con->lock); command =UCSI_GET_CONNECTOR_STATUS |UCSI_CONNECTOR_NUMBER (con->num); - ret =ucsi_send_command (ucsi, command, &con->status,sizeof (con->status)); + + ret =ucsi_send_command_common (ucsi, command, &con->status, +sizeof (con->status), true);if (ret <0 ) {dev_err (ucsi->dev,"%s: GET_CONNECTOR_STATUS failed (%d)\n" , __func__, ret);
@@ -938,14 +940,6 @@ static void ucsi_handle_connector_change(struct work_struct *work)if (con->status.change &UCSI_CONSTAT_CAM_CHANGE )ucsi_partner_task (con, ucsi_check_altmodes,1 ,0 ); -mutex_lock (&ucsi->ppm_lock); -clear_bit (EVENT_PENDING , &con->ucsi->flags); - ret =ucsi_acknowledge_connector_change (ucsi); -mutex_unlock (&ucsi->ppm_lock); - -if (ret) -dev_err (ucsi->dev,"%s: ACK failed (%d)" , __func__, ret); - out_unlock:mutex_unlock (&con->lock); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/163 MIPS: pci: lantiq: restore reset gpio polarity
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schiller <[email protected]>
[ Upstream commit 277a0363120276645ae598d8d5fea7265e076ae9 ]
Commit 90c2d2eb7ab5 ("MIPS: pci: lantiq: switch to using gpiod API") not only switched to the gpiod API, but also inverted / changed the polarity of the GPIO.
According to the PCI specification, the RST# pin is an active-low signal. However, most of the device trees that have been widely used for a long time (mainly in the openWrt project) define this GPIO as active-high and the old driver code inverted the signal internally.
Apparently there are actually boards where the reset gpio must be operated inverted. For this reason, we cannot use the GPIOD_OUT_LOW/HIGH flag for initialization. Instead, we must explicitly set the gpio to value 1 in order to take into account any "GPIO_ACTIVE_LOW" flag that may have been set.
In order to remain compatible with all these existing device trees, we should therefore keep the logic as it was before the commit.
--- arch/mips/pci/pci-lantiq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/mips/pci/pci-lantiq.c +4 -4
@@ -124,14 +124,14 @@ static int ltq_pci_startup(struct platform_device *pdev)clk_disable (clk_external);/* setup reset gpio used by pci */ - reset_gpio =devm_gpiod_get_optional (&pdev->dev,"reset" , -GPIOD_OUT_LOW ); + reset_gpio =devm_gpiod_get_optional (&pdev->dev,"reset" ,GPIOD_ASIS ); error =PTR_ERR_OR_ZERO (reset_gpio);if (error) {dev_err (&pdev->dev,"failed to request gpio: %d\n" , error);return error; }gpiod_set_consumer_name (reset_gpio,"pci_reset" ); +gpiod_direction_output (reset_gpio,1 );/* enable auto-switching between PCI and EBU */ ltq_pci_w32 (0xa ,PCI_CR_CLK_CTRL );
@@ -194,10 +194,10 @@ static int ltq_pci_startup(struct platform_device *pdev)/* toggle reset pin */ if (reset_gpio) { -gpiod_set_value_cansleep (reset_gpio,1 ); +gpiod_set_value_cansleep (reset_gpio,0 );wmb ();mdelay (1 ); -gpiod_set_value_cansleep (reset_gpio,0 ); +gpiod_set_value_cansleep (reset_gpio,1 ); }return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/163 selftests: mptcp: print_test out of verify_listener_events
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit 8ebb44196585d3c9405fba1e409cf2312bca30ac ]
verify_listener_events() helper will be exported into mptcp_lib.sh as a public function, but print_test() is invoked in it, which is a private function in userspace_pm.sh only. So this patch moves print_test() out of verify_listener_events().
Stable-dep-of: e874557fce1b ("selftests: mptcp: userspace_pm: fixed subtest names")
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
tools/testing/selftests/net/mptcp/userspace_pm.sh +2 -6
@@ -917,12 +917,6 @@ verify_listener_events() local saddr local sport - if [ $e_type = $LISTENER_CREATED ]; then - print_test "CREATE_LISTENER $e_saddr:$e_sport" - elif [ $e_type = $LISTENER_CLOSED ]; then - print_test "CLOSE_LISTENER $e_saddr:$e_sport" - fi - type=$(mptcp_lib_evts_get_info type $evt $e_type) family=$(mptcp_lib_evts_get_info family $evt $e_type) sport=$(mptcp_lib_evts_get_info sport $evt $e_type)
@@ -954,6 +948,7 @@ test_listener() local listener_pid=$! sleep 0.5 + print_test "CREATE_LISTENER 10.0.2.2:$client4_port" verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port # ADD_ADDR from client to server machine reusing the subflow port
@@ -970,6 +965,7 @@ test_listener() mptcp_lib_kill_wait $listener_pid sleep 0.5 + print_test "CLOSE_LISTENER 10.0.2.2:$client4_port" verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/163 selftests: mptcp: userspace_pm: fixed subtest names
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit e874557fce1b6023efafd523aee0c347bf7f1694 ]
It is important to have fixed (sub)test names in TAP, because these names are used to identify them. If they are not fixed, tracking cannot be done.
Some subtests from the userspace_pm selftest were using random numbers in their names: the client and server address IDs from $RANDOM, and the client port number randomly picked by the kernel when creating the connection. These values have been replaced by 'client' and 'server'
words: that's even more helpful than showing random numbers. Note that the addresses IDs are incremented and decremented in the test: +1 or -1 are then displayed in these cases.
Not to loose info that can be useful for debugging in case of issues, these random numbers are now displayed at the beginning of the test.
--- .../selftests/net/mptcp/userspace_pm.sh | 46 +++++++++++-------- 1 file changed, 28 insertions(+), 18 deletions(-)
tools/testing/selftests/net/mptcp/userspace_pm.sh +28 -18
@@ -184,10 +184,12 @@ make_connection() local is_v6=$1 local app_port=$app4_port local connect_addr="10.0.1.1" + local client_addr="10.0.1.2" local listen_addr="0.0.0.0" if [ "$is_v6" = "v6" ] then connect_addr="dead:beef:1::1" + client_addr="dead:beef:1::2" listen_addr="::" app_port=$app6_port else
@@ -249,6 +251,7 @@ make_connection() [ "$server_serverside" = 1 ] then test_pass + print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}" else test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})" mptcp_lib_result_print_all_tap
@@ -369,7 +372,7 @@ test_announce() ip netns exec "$ns2"\ ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id $client_addr_id dev\ ns2eth1 - print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, reuse port" + print_test "ADD_ADDR id:client 10.0.2.2 (ns2) => ns1, reuse port" sleep 0.5 verify_announce_event $server_evts $ANNOUNCED $server4_token "10.0.2.2" $client_addr_id \ "$client4_port"
@@ -378,7 +381,7 @@ test_announce() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl ann\ dead:beef:2::2 token "$client6_token" id $client_addr_id dev ns2eth1 - print_test "ADD_ADDR6 id:${client_addr_id} dead:beef:2::2 (ns2) => ns1, reuse port" + print_test "ADD_ADDR6 id:client dead:beef:2::2 (ns2) => ns1, reuse port" sleep 0.5 verify_announce_event "$server_evts" "$ANNOUNCED" "$server6_token" "dead:beef:2::2"\ "$client_addr_id" "$client6_port" "v6"
@@ -388,7 +391,7 @@ test_announce() client_addr_id=$((client_addr_id+1)) ip netns exec "$ns2" ./pm_nl_ctl ann 10.0.2.2 token "$client4_token" id\ $client_addr_id dev ns2eth1 port $new4_port - print_test "ADD_ADDR id:${client_addr_id} 10.0.2.2 (ns2) => ns1, new port" + print_test "ADD_ADDR id:client+1 10.0.2.2 (ns2) => ns1, new port" sleep 0.5 verify_announce_event "$server_evts" "$ANNOUNCED" "$server4_token" "10.0.2.2"\ "$client_addr_id" "$new4_port"
@@ -399,7 +402,7 @@ test_announce() # ADD_ADDR from the server to client machine reusing the subflow port ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR id:server 10.0.2.1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ "$server_addr_id" "$app4_port"
@@ -408,7 +411,7 @@ test_announce() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl ann dead:beef:2::1 token "$server6_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR6 id:${server_addr_id} dead:beef:2::1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR6 id:server dead:beef:2::1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "dead:beef:2::1"\ "$server_addr_id" "$app6_port" "v6"
@@ -418,7 +421,7 @@ test_announce() server_addr_id=$((server_addr_id+1)) ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server4_token" id\ $server_addr_id dev ns1eth2 port $new4_port - print_test "ADD_ADDR id:${server_addr_id} 10.0.2.1 (ns1) => ns2, new port" + print_test "ADD_ADDR id:server+1 10.0.2.1 (ns1) => ns2, new port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client4_token" "10.0.2.1"\ "$server_addr_id" "$new4_port"
@@ -452,7 +455,7 @@ test_remove() local invalid_token=$(( client4_token - 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token $invalid_token id\ $client_addr_id > /dev/null 2>&1 - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1, invalid token" + print_test "RM_ADDR id:client ns2 => ns1, invalid token" local type type=$(mptcp_lib_evts_get_info type "$server_evts") if [ "$type" = "" ]
@@ -466,7 +469,7 @@ test_remove() local invalid_id=$(( client_addr_id + 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $invalid_id > /dev/null 2>&1 - print_test "RM_ADDR id:${invalid_id} ns2 => ns1, invalid id" + print_test "RM_ADDR id:client+1 ns2 => ns1, invalid id" type=$(mptcp_lib_evts_get_info type "$server_evts") if [ "$type" = "" ] then
@@ -479,7 +482,7 @@ test_remove() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $client_addr_id - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR id:client ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
@@ -488,7 +491,7 @@ test_remove() client_addr_id=$(( client_addr_id - 1 )) ip netns exec "$ns2" ./pm_nl_ctl rem token "$client4_token" id\ $client_addr_id - print_test "RM_ADDR id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR id:client-1 ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server4_token" "$client_addr_id"
@@ -496,7 +499,7 @@ test_remove() :>"$server_evts" ip netns exec "$ns2" ./pm_nl_ctl rem token "$client6_token" id\ $client_addr_id - print_test "RM_ADDR6 id:${client_addr_id} ns2 => ns1" + print_test "RM_ADDR6 id:client-1 ns2 => ns1" sleep 0.5 verify_remove_event "$server_evts" "$REMOVED" "$server6_token" "$client_addr_id"
@@ -506,7 +509,7 @@ test_remove() # RM_ADDR from the server to client machine ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ $server_addr_id - print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR id:server ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
@@ -515,7 +518,7 @@ test_remove() server_addr_id=$(( server_addr_id - 1 )) ip netns exec "$ns1" ./pm_nl_ctl rem token "$server4_token" id\ $server_addr_id - print_test "RM_ADDR id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR id:server-1 ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client4_token" "$server_addr_id"
@@ -523,7 +526,7 @@ test_remove() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl rem token "$server6_token" id\ $server_addr_id - print_test "RM_ADDR6 id:${server_addr_id} ns1 => ns2" + print_test "RM_ADDR6 id:server-1 ns1 => ns2" sleep 0.5 verify_remove_event "$client_evts" "$REMOVED" "$client6_token" "$server_addr_id" }
@@ -551,8 +554,14 @@ verify_subflow_events() local locid local remid local info + local e_dport_txt - info="${e_saddr} (${e_from}) => ${e_daddr}:${e_dport} (${e_to})" + # only display the fixed ports + if [ "${e_dport}" -ge "${app4_port}" ] && [ "${e_dport}" -le "${app6_port}" ]; then + e_dport_txt=":${e_dport}" + fi + + info="${e_saddr} (${e_from}) => ${e_daddr}${e_dport_txt} (${e_to})" if [ "$e_type" = "$SUB_ESTABLISHED" ] then
@@ -838,7 +847,7 @@ test_subflows_v4_v6_mix() :>"$client_evts" ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\ $server_addr_id dev ns1eth2 - print_test "ADD_ADDR4 id:${server_addr_id} 10.0.2.1 (ns1) => ns2, reuse port" + print_test "ADD_ADDR4 id:server 10.0.2.1 (ns1) => ns2, reuse port" sleep 0.5 verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\ "$server_addr_id" "$app6_port"
@@ -948,7 +957,7 @@ test_listener() local listener_pid=$! sleep 0.5 - print_test "CREATE_LISTENER 10.0.2.2:$client4_port" + print_test "CREATE_LISTENER 10.0.2.2 (client port)" verify_listener_events $client_evts $LISTENER_CREATED $AF_INET 10.0.2.2 $client4_port # ADD_ADDR from client to server machine reusing the subflow port
@@ -965,13 +974,14 @@ test_listener() mptcp_lib_kill_wait $listener_pid sleep 0.5 - print_test "CLOSE_LISTENER 10.0.2.2:$client4_port" + print_test "CLOSE_LISTENER 10.0.2.2 (client port)" verify_listener_events $client_evts $LISTENER_CLOSED $AF_INET 10.0.2.2 $client4_port } print_title "Make connections" make_connection make_connection "v6" +print_title "Will be using address IDs ${client_addr_id} (client) and ${server_addr_id} (server)" test_announce test_remove
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/163 wifi: mac80211: Use flexible array in struct ieee80211_tim_ie
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 2ae5c9248e06dac2c2360be26b4e25f673238337 ]
Currently struct ieee80211_tim_ie defines:
u8 virtual_map[1];
Per the guidance in [1] change this to be a flexible array.
Per the discussion in [2] wrap the virtual_map in a union with a u8 item in order to preserve the existing expectation that the virtual_map must contain at least one octet (at least when used in a non-S1G PPDU). This means that no driver changes are required.
[1] https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays
[2] https://lore.kernel.org/linux-wireless/202308301529.AC90A9EF98@keescook/
--- include/linux/ieee80211.h | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
include/linux/ieee80211.h +10 -3
@@ -951,17 +951,24 @@ struct ieee80211_wide_bw_chansw_ie {* @dtim_count: DTIM Count * @dtim_period: DTIM Period * @bitmap_ctrl: Bitmap Control +* @required_octet: "Syntatic sugar" to force the struct size to the +* minimum valid size when carried in a non-S1G PPDU * @virtual_map: Partial Virtual Bitmap * * This structure represents the payload of the "TIM element" as -* described in IEEE Std 802.11-2020 section 9.4.2.5. +* described in IEEE Std 802.11-2020 section 9.4.2.5. Note that this +* definition is only applicable when the element is carried in a +* non-S1G PPDU. When the TIM is carried in an S1G PPDU, the Bitmap +* Control and Partial Virtual Bitmap may not be present. */ struct ieee80211_tim_ie {u8 dtim_count;u8 dtim_period;u8 bitmap_ctrl; -/* variable size: 1 - 251 bytes */ -u8 virtual_map[1 ]; +union { +u8 required_octet; + DECLARE_FLEX_ARRAY(u8, virtual_map); + }; } __packed;/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/163 ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on right mclk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alibek Omarov <[email protected]>
[ Upstream commit ccd8d753f0fe8f16745fa2b6be5946349731d901 ]
When TRCM mode is enabled, I2S RX and TX clocks are synchronized through selected clock source. Without this fix BCLK and LRCK might get parented to an uninitialized MCLK and the DAI will receive data at wrong pace.
However, unlike in original i2s-tdm driver, there is no need to manually synchronize mclk_rx and mclk_tx, as only one gets used anyway.
Tested on a board with RK3568 SoC and Silergy SY24145S codec with enabled and disabled TRCM mode.
--- sound/soc/rockchip/rockchip_i2s_tdm.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/rockchip/rockchip_i2s_tdm.c +11 -2
@@ -657,8 +657,17 @@ static int rockchip_i2s_tdm_hw_params(struct snd_pcm_substream *substream,int err;if (i2s_tdm->is_master_mode) { -struct clk *mclk = (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) ? - i2s_tdm->mclk_tx : i2s_tdm->mclk_rx; +struct clk *mclk; + +if (i2s_tdm->clk_trcm ==TRCM_TX ) { + mclk = i2s_tdm->mclk_tx; + }else if (i2s_tdm->clk_trcm ==TRCM_RX ) { + mclk = i2s_tdm->mclk_rx; + }else if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) { + mclk = i2s_tdm->mclk_tx; + }else { + mclk = i2s_tdm->mclk_rx; + } err =clk_set_rate (mclk,DEFAULT_MCLK_FS *params_rate (params));if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/163 ASoC: mediatek: mt8183-da7219-max98357: Fix kcontrol name collision
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Te Yuan <[email protected]>
[ Upstream commit 97d8613679eb53bd0c07d0fbd3d8471e46ba46c1 ]
Since "Headphone Switch" kcontrol name has already been used by da7219, rename the control name from "Headphone" to "Headphones" to prevent the colision. Also, this change makes kcontrol name align with the one in mt8186-mt6366-da7219-max98357.c.
--- sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +5 -5
@@ -31,7 +31,7 @@ struct mt8183_da7219_max98357_priv {static struct snd_soc_jack_pin mt8183_da7219_max98357_jack_pins[] = { { - .pin ="Headphone" , + .pin ="Headphones" , .mask =SND_JACK_HEADPHONE , }, {
@@ -626,7 +626,7 @@ static struct snd_soc_codec_conf mt6358_codec_conf[] = { };static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = { -SOC_DAPM_PIN_SWITCH ("Headphone" ), +SOC_DAPM_PIN_SWITCH ("Headphones" ),SOC_DAPM_PIN_SWITCH ("Headset Mic" ),SOC_DAPM_PIN_SWITCH ("Speakers" ),SOC_DAPM_PIN_SWITCH ("Line Out" ),
@@ -634,7 +634,7 @@ static const struct snd_kcontrol_new mt8183_da7219_max98357_snd_controls[] = {static const struct snd_soc_dapm_widget mt8183_da7219_max98357_dapm_widgets[] = { -SND_SOC_DAPM_HP ("Headphone" ,NULL ), +SND_SOC_DAPM_HP ("Headphones" ,NULL ),SND_SOC_DAPM_MIC ("Headset Mic" ,NULL ),SND_SOC_DAPM_SPK ("Speakers" ,NULL ),SND_SOC_DAPM_SPK ("Line Out" ,NULL ),
@@ -680,7 +680,7 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { };static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { -SOC_DAPM_PIN_SWITCH ("Headphone" ), +SOC_DAPM_PIN_SWITCH ("Headphones" ),SOC_DAPM_PIN_SWITCH ("Headset Mic" ),SOC_DAPM_PIN_SWITCH ("Left Spk" ),SOC_DAPM_PIN_SWITCH ("Right Spk" ),
@@ -689,7 +689,7 @@ static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = {static const struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { -SND_SOC_DAPM_HP ("Headphone" ,NULL ), +SND_SOC_DAPM_HP ("Headphones" ,NULL ),SND_SOC_DAPM_MIC ("Headset Mic" ,NULL ),SND_SOC_DAPM_SPK ("Left Spk" ,NULL ),SND_SOC_DAPM_SPK ("Right Spk" ,NULL ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/163 ASoC: atmel: convert not to use asoc_xxx()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <[email protected]>
[ Upstream commit 6547effc3aea50cc3c60874f9a65a19f4919ef9d ]
ASoC is now unified asoc_xxx() into snd_soc_xxx(). This patch convert asoc_xxx() to snd_soc_xxx().
Stable-dep-of: 2ed22161b19b ("ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init")
--- sound/soc/atmel/atmel-classd.c | 10 +++++----- sound/soc/atmel/atmel-pcm-dma.c | 8 ++++---- sound/soc/atmel/atmel-pcm-pdc.c | 4 ++-- sound/soc/atmel/atmel-pdmic.c | 12 ++++++------ sound/soc/atmel/atmel_wm8904.c | 4 ++-- sound/soc/atmel/mikroe-proto.c | 2 +- sound/soc/atmel/sam9g20_wm8731.c | 2 +- sound/soc/atmel/sam9x5_wm8731.c | 2 +- 8 files changed, 22 insertions(+), 22 deletions(-)
sound/soc/atmel/atmel-classd.c +5 -5
@@ -118,7 +118,7 @@ static const struct snd_pcm_hardware atmel_classd_hw = {static int atmel_classd_cpu_dai_startup (struct snd_pcm_substream *substream,struct snd_soc_dai *cpu_dai) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_classd *dd =snd_soc_card_get_drvdata (rtd->card);int err;
@@ -141,7 +141,7 @@ atmel_classd_platform_configure_dma(struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params, struct dma_slave_config *slave_config) { - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);struct atmel_classd *dd =snd_soc_card_get_drvdata (rtd->card);if (params_physical_width (params) !=16 ) {
@@ -338,7 +338,7 @@ atmel_classd_cpu_dai_hw_params(struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params, struct snd_soc_dai *cpu_dai) { - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);struct atmel_classd *dd =snd_soc_card_get_drvdata (rtd->card);struct snd_soc_component *component = cpu_dai->component;int fs;
@@ -381,7 +381,7 @@ static void atmel_classd_cpu_dai_shutdown(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) { - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);struct atmel_classd *dd =snd_soc_card_get_drvdata (rtd->card);clk_disable_unprepare (dd->gclk);
@@ -478,7 +478,7 @@ static int atmel_classd_asoc_card_init(struct device *dev,return -ENOMEM ; dai_link->cpus = comp; - dai_link->codecs = &asoc_dummy_dlc; + dai_link->codecs = &snd_soc_dummy_dlc; dai_link->num_cpus =1 ; dai_link->num_codecs =1 ;
sound/soc/atmel/atmel-pcm-dma.c +4 -4
@@ -52,10 +52,10 @@ static const struct snd_pcm_hardware atmel_pcm_dma_hardware = {static void atmel_pcm_dma_irq (u32 ssc_sr,struct snd_pcm_substream *substream) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_pcm_dma_params *prtd; - prtd =snd_soc_dai_get_dma_data (asoc_rtd_to_cpu (rtd,0 ), substream); + prtd =snd_soc_dai_get_dma_data (snd_soc_rtd_to_cpu (rtd,0 ), substream);if (ssc_sr & prtd->mask->ssc_error) {if (snd_pcm_running (substream))
@@ -77,12 +77,12 @@ static void atmel_pcm_dma_irq(u32 ssc_sr,static int atmel_pcm_configure_dma (struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params,struct dma_slave_config *slave_config) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_pcm_dma_params *prtd;struct ssc_device *ssc;int ret; - prtd =snd_soc_dai_get_dma_data (asoc_rtd_to_cpu (rtd,0 ), substream); + prtd =snd_soc_dai_get_dma_data (snd_soc_rtd_to_cpu (rtd,0 ), substream); ssc = prtd->ssc; ret =snd_hwparams_to_dma_slave_config (substream, params, slave_config);
sound/soc/atmel/atmel-pcm-pdc.c +2 -2
@@ -140,12 +140,12 @@ static int atmel_pcm_hw_params(struct snd_soc_component *component, {struct snd_pcm_runtime *runtime = substream->runtime;struct atmel_runtime_data *prtd = runtime->private_data; -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);/* this may get called several times by oss emulation * with different params */ - prtd->params =snd_soc_dai_get_dma_data (asoc_rtd_to_cpu (rtd,0 ), substream); + prtd->params =snd_soc_dai_get_dma_data (snd_soc_rtd_to_cpu (rtd,0 ), substream); prtd->params->dma_intr_handler = atmel_pcm_dma_irq; prtd->dma_buffer = runtime->dma_addr;
sound/soc/atmel/atmel-pdmic.c +6 -6
@@ -104,7 +104,7 @@ static struct atmel_pdmic_pdata *atmel_pdmic_dt_init(struct device *dev)static int atmel_pdmic_cpu_dai_startup (struct snd_pcm_substream *substream,struct snd_soc_dai *cpu_dai) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_pdmic *dd =snd_soc_card_get_drvdata (rtd->card);int ret;
@@ -132,7 +132,7 @@ static int atmel_pdmic_cpu_dai_startup(struct snd_pcm_substream *substream,static void atmel_pdmic_cpu_dai_shutdown (struct snd_pcm_substream *substream,struct snd_soc_dai *cpu_dai) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_pdmic *dd =snd_soc_card_get_drvdata (rtd->card);/* Disable the overrun error interrupt */
@@ -145,7 +145,7 @@ static void atmel_pdmic_cpu_dai_shutdown(struct snd_pcm_substream *substream,static int atmel_pdmic_cpu_dai_prepare (struct snd_pcm_substream *substream,struct snd_soc_dai *cpu_dai) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream);struct atmel_pdmic *dd =snd_soc_card_get_drvdata (rtd->card);struct snd_soc_component *component = cpu_dai->component;u32 val;
@@ -191,7 +191,7 @@ atmel_pdmic_platform_configure_dma(struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params, struct dma_slave_config *slave_config) { - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);struct atmel_pdmic *dd =snd_soc_card_get_drvdata (rtd->card);int ret;
@@ -356,7 +356,7 @@ atmel_pdmic_cpu_dai_hw_params(struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params, struct snd_soc_dai *cpu_dai) { - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);struct atmel_pdmic *dd =snd_soc_card_get_drvdata (rtd->card);struct snd_soc_component *component = cpu_dai->component;unsigned int rate_min = substream->runtime->hw.rate_min;
@@ -501,7 +501,7 @@ static int atmel_pdmic_asoc_card_init(struct device *dev,return -ENOMEM ; dai_link->cpus = comp; - dai_link->codecs = &asoc_dummy_dlc; + dai_link->codecs = &snd_soc_dummy_dlc; dai_link->num_cpus =1 ; dai_link->num_codecs =1 ;
sound/soc/atmel/atmel_wm8904.c +2 -2
@@ -26,8 +26,8 @@ static const struct snd_soc_dapm_widget atmel_asoc_wm8904_dapm_widgets[] = {static int atmel_asoc_wm8904_hw_params (struct snd_pcm_substream *substream,struct snd_pcm_hw_params *params) { -struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream); -struct snd_soc_dai *codec_dai =asoc_rtd_to_codec (rtd,0 ); +struct snd_soc_pcm_runtime *rtd =snd_soc_substream_to_rtd (substream); +struct snd_soc_dai *codec_dai =snd_soc_rtd_to_codec (rtd,0 );int ret; ret = snd_soc_dai_set_pll(codec_dai, WM8904_FLL_MCLK, WM8904_FLL_MCLK,
sound/soc/atmel/mikroe-proto.c +1 -1
@@ -21,7 +21,7 @@static int snd_proto_init (struct snd_soc_pcm_runtime *rtd) {struct snd_soc_card *card = rtd->card; -struct snd_soc_dai *codec_dai =asoc_rtd_to_codec (rtd,0 ); +struct snd_soc_dai *codec_dai =snd_soc_rtd_to_codec (rtd,0 );/* Set proto sysclk */ int ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL,
sound/soc/atmel/sam9g20_wm8731.c +1 -1
@@ -66,7 +66,7 @@ static const struct snd_soc_dapm_route intercon[] = {*/ static int at91sam9g20ek_wm8731_init (struct snd_soc_pcm_runtime *rtd) { -struct snd_soc_dai *codec_dai =asoc_rtd_to_codec (rtd,0 ); +struct snd_soc_dai *codec_dai =snd_soc_rtd_to_codec (rtd,0 );struct device *dev = rtd->dev;int ret;
sound/soc/atmel/sam9x5_wm8731.c +1 -1
@@ -40,7 +40,7 @@ struct sam9x5_drvdata {*/ static int sam9x5_wm8731_init (struct snd_soc_pcm_runtime *rtd) { -struct snd_soc_dai *codec_dai =asoc_rtd_to_codec (rtd,0 ); +struct snd_soc_dai *codec_dai =snd_soc_rtd_to_codec (rtd,0 );struct device *dev = rtd->dev;int ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/163 ASoC: atmel: atmel-classd: Re-add dai_link->platform to fix card init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Simion <[email protected]>
[ Upstream commit 2ed22161b19b11239aa742804549f63edd7c91e3 ]
The removed dai_link->platform component cause a fail which is exposed at runtime. (ex: when a sound tool is used) This patch re-adds the dai_link->platform component to have a full card registered.
Before this patch:
:~$ aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: CLASSD [CLASSD], device 0: CLASSD PCM snd-soc-dummy-dai-0 []
Subdevices: 1/1
Subdevice #0: subdevice #0:~$ speaker-test -t sine speaker-test 1.2.6 Playback device is default Stream parameters are 48000Hz, S16_LE, 1 channels Sine wave rate is 440.0000Hz Playback open error: -22,Invalid argument
After this patch which restores the platform component:
:~$ aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: CLASSD [CLASSD], device 0: CLASSD PCM snd-soc-dummy-dai-0
[CLASSD PCM snd-soc-dummy-dai-0]
Subdevices: 1/1
Subdevice #0: subdevice #0
-> Resolve the playback error.--- sound/soc/atmel/atmel-classd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/atmel/atmel-classd.c +5 -2
@@ -473,19 +473,22 @@ static int atmel_classd_asoc_card_init(struct device *dev,if (!dai_link)return -ENOMEM ; - comp =devm_kzalloc (dev,sizeof (*comp),GFP_KERNEL ); + comp =devm_kzalloc (dev,2 *sizeof (*comp),GFP_KERNEL );if (!comp)return -ENOMEM ; - dai_link->cpus = comp; + dai_link->cpus = &comp[0 ]; dai_link->codecs = &snd_soc_dummy_dlc; + dai_link->platforms = &comp[1 ]; dai_link->num_cpus =1 ; dai_link->num_codecs =1 ; + dai_link->num_platforms =1 ; dai_link->name ="CLASSD" ; dai_link->stream_name ="CLASSD PCM" ; dai_link->cpus->dai_name =dev_name (dev); + dai_link->platforms->name =dev_name (dev); card->dai_link = dai_link; card->num_links =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/163 workqueue: Increase worker descs length to 32
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenchao Hao <[email protected]>
[ Upstream commit 231035f18d6b80e5c28732a20872398116a54ecd ]
Commit 31c89007285d ("workqueue.c: Increase workqueue name length") increased WQ_NAME_LEN from 24 to 32, but forget to increase WORKER_DESC_LEN, which would cause truncation when setting kworker's desc from workqueue_struct's name, process_one_work() for example.
--- include/linux/workqueue.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/workqueue.h +1 -1
@@ -84,7 +84,7 @@ enum {WORK_BUSY_RUNNING =1 <<1 ,/* maximum string length for set_worker_desc() */ - WORKER_DESC_LEN = 24, + WORKER_DESC_LEN = 32, };/* Convenience constants - of type 'unsigned long', not 'enum'! */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/163 ASoC: q6apm-lpass-dai: close graph on prepare errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit be1fae62cf253a5b67526cee9fbc07689b97c125 ]
There is an issue around with error handling and graph management with the exising code, none of the error paths close the graph, which result in leaving the loaded graph in dsp, however the driver thinks otherwise.
This can have a nasty side effect specially when we try to load the same graph to dsp, dsp returns error which leaves the board with no sound and requires restart.
Fix this by properly closing the graph when we hit errors between open and close.
--- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 32 +++++++++++++++---------- 1 file changed, 20 insertions(+), 12 deletions(-)
sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +20 -12
@@ -140,14 +140,17 @@ static void q6apm_lpass_dai_shutdown(struct snd_pcm_substream *substream, structstruct q6apm_lpass_dai_data *dai_data =dev_get_drvdata (dai->dev);int rc; -if (!dai_data->is_port_started[dai->id]) -return ; - rc =q6apm_graph_stop (dai_data->graph[dai->id]); -if (rc <0 ) -dev_err (dai->dev,"fail to close APM port (%d)\n" , rc); +if (dai_data->is_port_started[dai->id]) { + rc =q6apm_graph_stop (dai_data->graph[dai->id]); + dai_data->is_port_started[dai->id] = false; +if (rc <0 ) +dev_err (dai->dev,"fail to close APM port (%d)\n" , rc); + } -q6apm_graph_close (dai_data->graph[dai->id]); - dai_data->is_port_started[dai->id] = false; +if (dai_data->graph[dai->id]) { +q6apm_graph_close (dai_data->graph[dai->id]); + dai_data->graph[dai->id] =NULL ; + } }static int q6apm_lpass_dai_prepare (struct snd_pcm_substream *substream,struct snd_soc_dai *dai)
@@ -162,8 +165,10 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct sq6apm_graph_stop (dai_data->graph[dai->id]); dai_data->is_port_started[dai->id] = false; -if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) {q6apm_graph_close (dai_data->graph[dai->id]); + dai_data->graph[dai->id] =NULL ; + } }/**
@@ -182,26 +187,29 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s cfg->direction = substream->stream; rc =q6apm_graph_media_format_pcm (dai_data->graph[dai->id], cfg); -if (rc) {dev_err (dai->dev,"Failed to set media format %d\n" , rc); -return rc; + goto err; } rc =q6apm_graph_prepare (dai_data->graph[dai->id]);if (rc) {dev_err (dai->dev,"Failed to prepare Graph %d\n" , rc); -return rc; + goto err; } rc =q6apm_graph_start (dai_data->graph[dai->id]);if (rc <0 ) {dev_err (dai->dev,"fail to start APM port %x\n" , dai->id); -return rc; + goto err; } dai_data->is_port_started[dai->id] = true;return 0 ; +err: +q6apm_graph_close (dai_data->graph[dai->id]); + dai_data->graph[dai->id] =NULL ; +return rc; }static int q6apm_lpass_dai_startup (struct snd_pcm_substream *substream,struct snd_soc_dai *dai)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/163 usb: typec: ucsi: Ack also failed Get Error commands
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
[ Upstream commit 8bdf8a42bca4f47646fd105a387ab6926948c7f1 ]
It is possible that also the GET_ERROR command fails. If that happens, the command completion still needs to be acknowledged. Otherwise the interface will be stuck until it's reset.
--- drivers/usb/typec/ucsi/ucsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.c +6 -1
@@ -153,8 +153,13 @@ static int ucsi_exec_command(struct ucsi *ucsi, u64 cmd) }if (cci &UCSI_CCI_ERROR ) { -if (cmd ==UCSI_GET_ERROR_STATUS ) +if (cmd ==UCSI_GET_ERROR_STATUS ) { + ret =ucsi_acknowledge (ucsi, false); +if (ret) +return ret; +return -EIO ; + }return ucsi_read_error (ucsi); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/163 bpf: Add missed var_off setting in set_sext32_default_val()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 380d5f89a4815ff88461a45de2fb6f28533df708 ]
Zac reported a verification failure and Alexei reproduced the issue with a simple reproducer ([1]). The verification failure is due to missed setting for var_off.
The following is the reproducer in [1]:
0: R1=ctx() R10=fp0
0: (71) r3 = *(u8 *)(r10 -387) ;
R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R10=fp0
1: (bc) w7 = (s8)w3 ;
R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
R7_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=127,var_off=(0x0; 0x7f))
2: (36) if w7 >= 0x2533823b goto pc-3
mark_precise: frame0: last_idx 2 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r7 stack= before 1: (bc) w7 = (s8)w3
mark_precise: frame0: regs=r3 stack= before 0: (71) r3 = *(u8 *)(r10 -387) 2: R7_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=127,var_off=(0x0; 0x7f))
3: (b4) w0 = 0 ; R0_w=0
4: (95) exit
Note that after insn 1, the var_off for R7 is (0x0; 0x7f). This is not correct since upper 24 bits of w7 could be 0 or 1. So correct var_off should be (0x0; 0xffffffff). Missing var_off setting in set_sext32_default_val() caused later incorrect analysis in zext_32_to_64(dst_reg) and reg_bounds_sync(dst_reg).
To fix the issue, set var_off correctly in set_sext32_default_val(). The correct reg state after insn 1 becomes:
1: (bc) w7 = (s8)w3 ;
R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
R7_w=scalar(smin=0,smax=umax=0xffffffff,smin32=-128,smax32=127,var_off=(0x0; 0xffffffff))and at insn 2, the verifier correctly determines either branch is possible.
[1] https://lore.kernel.org/bpf/CAADnVQLPU0Shz7dWV4bn2BgtGdxN3uFHPeobGBA72tpg5Xoykw@mail.gmail.com/
--- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+)
kernel/bpf/verifier.c +1 -0
@@ -6159,6 +6159,7 @@ static void set_sext32_default_val(struct bpf_reg_state *reg, int size) } reg->u32_min_value =0 ; reg->u32_max_value =U32_MAX ; + reg->var_off =tnum_subreg (tnum_unknown); }static void coerce_subreg_to_size_sx (struct bpf_reg_state *reg,int size)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/163 bpf: Add missed var_off setting in coerce_subreg_to_size_sx()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit 44b7f7151dfc2e0947f39ed4b9bc4b0c2ccd46fc ]
In coerce_subreg_to_size_sx(), for the case where upper sign extension bits are the same for smax32 and smin32 values, we missed to setup properly. This is especially problematic if both smax32 and smin32's sign extension bits are 1.
The following is a simple example illustrating the inconsistent verifier states due to missed var_off:
0: (85) call bpf_get_prandom_u32#7 ; R0_w=scalar()
1: (bf) r3 = r0 ; R0_w=scalar(id=1) R3_w=scalar(id=1)
2: (57) r3 &= 15 ; R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=15,var_off=(0x0; 0xf))
3: (47) r3 |= 128 ; R3_w=scalar(smin=umin=smin32=umin32=128,smax=umax=smax32=umax32=143,var_off=(0x80; 0xf))
4: (bc) w7 = (s8)w3
REG INVARIANTS VIOLATION (alu): range bounds violation u64=[0xffffff80, 0x8f] s64=[0xffffff80, 0x8f]
u32=[0xffffff80, 0x8f] s32=[0x80, 0xffffff8f] var_off=(0x80, 0xf)The var_off=(0x80, 0xf) is not correct, and the correct one should be var_off=(0xffffff80; 0xf) since from insn 3, we know that at insn 4, the sign extension bits will be 1. This patch fixed this issue by setting var_off properly.
--- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+)
kernel/bpf/verifier.c +1 -0
@@ -6204,6 +6204,7 @@ static void coerce_subreg_to_size_sx(struct bpf_reg_state *reg, int size) reg->s32_max_value = s32_max; reg->u32_min_value = (u32 )s32_min; reg->u32_max_value = (u32 )s32_max; + reg->var_off =tnum_subreg (tnum_range (s32_min, s32_max));return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/163 s390/pci: Add missing virt_to_phys() for directed DIBV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit 4181b51c38875de9f6f11248fa0bcf3246c19c82 ]
In commit 4e4dc65ab578 ("s390/pci: use phys_to_virt() for AIBVs/DIBVs") the setting of dibv_addr was missed when adding virt_to_phys(). This only affects systems with directed interrupt delivery enabled which are not generally available.
--- arch/s390/pci/pci_irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/pci/pci_irq.c +1 -1
@@ -410,7 +410,7 @@ static void __init cpu_enable_directed_irq(void *unused)union zpci_sic_iib iib = {{0 }};union zpci_sic_iib ziib = {{0 }}; - iib.cdiib.dibv_addr = (u64 ) zpci_ibv[smp_processor_id ()]->vector; + iib.cdiib.dibv_addr =virt_to_phys (zpci_ibv[smp_processor_id ()]->vector);zpci_set_irq_ctrl (SIC_IRQ_MODE_SET_CPU ,0 , &iib);zpci_set_irq_ctrl (SIC_IRQ_MODE_D_SINGLE ,PCI_ISC , &ziib);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/163 ASoC: amd: acp: add a null check for chip_pdev structure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit 98d919dfee1cc402ca29d45da642852d7c9a2301 ]
When acp platform device creation is skipped, chip->chip_pdev value will remain NULL. Add NULL check for chip->chip_pdev structure in snd_acp_resume() function to avoid null pointer dereference.
--- sound/soc/amd/acp/acp-pci.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
sound/soc/amd/acp/acp-pci.c +6 -4
@@ -185,10 +185,12 @@ static int __maybe_unused snd_acp_resume(struct device *dev) ret =acp_init (chip);if (ret)dev_err (dev,"ACP init failed\n" ); - child = chip->chip_pdev->dev; - adata =dev_get_drvdata (&child); -if (adata) -acp_enable_interrupts (adata); +if (chip->chip_pdev) { + child = chip->chip_pdev->dev; + adata =dev_get_drvdata (&child); +if (adata) +acp_enable_interrupts (adata); + }return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/163 ASoC: amd: acp: remove i2s configuration check in acp_i2s_probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit 70fa3900c3ed92158628710e81d274e5cb52f92b ]
ACP supports different pin configurations for I2S IO. Checking ACP pin configuration value against specific value breaks the functionality for other I2S pin configurations. This check is no longer required in i2s dai driver probe call as i2s configuration check will be verified during acp platform device creation sequence.
Remove i2s_mode check in acp_i2s_probe() function.
--- sound/soc/amd/acp/acp-i2s.c | 8 -------- 1 file changed, 8 deletions(-)
sound/soc/amd/acp/acp-i2s.c +0 -8
@@ -543,20 +543,12 @@ static int acp_i2s_probe(struct snd_soc_dai *dai) {struct device *dev = dai->component->dev;struct acp_dev_data *adata =dev_get_drvdata (dev); -struct acp_resource *rsrc = adata->rsrc; -unsigned int val;if (!adata->acp_base) {dev_err (dev,"I2S base is NULL\n" );return -EINVAL ; } - val =readl (adata->acp_base + rsrc->i2s_pin_cfg_offset); -if (val != rsrc->i2s_mode) { -dev_err (dev,"I2S Mode not supported val %x\n" , val); -return -EINVAL ; - } -return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/163 ASoC: fsl-asoc-card: set priv->pdev before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elinor Montmasson <[email protected]>
[ Upstream commit 90f3feb24172185f1832636264943e8b5e289245 ]
priv->pdev pointer was set after being used in fsl_asoc_card_audmux_init().
Move this assignment at the start of the probe function, so sub-functions can correctly use pdev through priv.
fsl_asoc_card_audmux_init() dereferences priv->pdev to get access to the dev struct, used with dev_err macros.
As priv is zero-initialised, there would be a NULL pointer dereference. Note that if priv->dev is dereferenced before assignment but never used, for example if there is no error to be printed, the driver won't crash probably due to compiler optimisations.
--- sound/soc/fsl/fsl-asoc-card.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl-asoc-card.c +2 -1
@@ -559,6 +559,8 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)if (!priv)return -ENOMEM ; + priv->pdev = pdev; + cpu_np =of_parse_phandle (np,"audio-cpu" ,0 );/* Give a chance to old DT binding */ if (!cpu_np)
@@ -781,7 +783,6 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) }/* Initialize sound card */ - priv->pdev = pdev; priv->card.dev = &pdev->dev; priv->card.owner =THIS_MODULE ; ret =snd_soc_of_parse_card_name (&priv->card,"model" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/163 net: dsa: microchip: fix initial port flush problem
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <[email protected]>
[ Upstream commit ad53f5f54f351e967128edbc431f0f26427172cf ]
The very first flush in any port will flush all learned addresses in all ports. This can be observed by unplugging the cable from one port while additional ports are connected and dumping the fdb entries.
This problem is caused by the initially wrong value programmed to the REG_SW_LUE_CTRL_1 register. Setting SW_FLUSH_STP_TABLE and SW_FLUSH_MSTP_TABLE bits does not have an immediate effect. It is when ksz9477_flush_dyn_mac_table() is called then the SW_FLUSH_STP_TABLE bit takes effect and flushes all learned entries. After that call both bits are reset and so the next port flush will not cause such problem again.
--- drivers/net/dsa/microchip/ksz9477.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/dsa/microchip/ksz9477.c +2 -4
@@ -174,10 +174,8 @@ int ksz9477_reset_switch(struct ksz_device *dev) SPI_AUTO_EDGE_DETECTION, 0);/* default configuration */ -ksz_read8 (dev,REG_SW_LUE_CTRL_1 , &data8); - data8 =SW_AGING_ENABLE |SW_LINK_AUTO_AGING | -SW_SRC_ADDR_FILTER |SW_FLUSH_STP_TABLE |SW_FLUSH_MSTP_TABLE ; -ksz_write8 (dev,REG_SW_LUE_CTRL_1 , data8); +ksz_write8 (dev,REG_SW_LUE_CTRL_1 , +SW_AGING_ENABLE |SW_LINK_AUTO_AGING |SW_SRC_ADDR_FILTER );/* disable interrupts */ ksz_write32 (dev,REG_SW_INT_MASK__4 ,SWITCH_INT_MASK );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/163 openvswitch: get related ct labels from its master if it is not confirmed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a23ac973f67f37e77b3c634e8b1ad5b0164fcc1f ]
Ilya found a failure in running check-kernel tests with at_groups=144 (144: conntrack - FTP SNAT orig tuple) in OVS repo. After his further investigation, the root cause is that the labels sent to userspace for related ct are incorrect.
The labels for unconfirmed related ct should use its master's labels. However, the changes made in commit 8c8b73320805 ("openvswitch: set IPS_CONFIRMED in tmpl status only when commit is set in conntrack") led to getting labels from this related ct.
So fix it in ovs_ct_get_labels() by changing to copy labels from its master ct if it is a unconfirmed related ct. Note that there is no fix needed for ct->mark, as it was already copied from its master ct for related ct in init_conntrack().
--- net/openvswitch/conntrack.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/openvswitch/conntrack.c +6 -1
@@ -168,8 +168,13 @@ static u32 ovs_ct_get_mark(const struct nf_conn *ct)static void ovs_ct_get_labels (const struct nf_conn *ct,struct ovs_key_ct_labels *labels) { -struct nf_conn_labels *cl = ct ?nf_ct_labels_find (ct) :NULL ; +struct nf_conn_labels *cl =NULL ; +if (ct) { +if (ct->master && !nf_ct_is_confirmed (ct)) + ct = ct->master; + cl =nf_ct_labels_find (ct); + }if (cl)memcpy (labels, cl->bits,OVS_CT_LABELS_LEN );else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/163 mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit c28947de2bed40217cf256c5d0d16880054fcf13 ]
The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR):
# devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0
The register has two masks of 256 bits to denote on which ingress / egress ports the register should operate on. Spectrum-4 has more than 256 ports, so the register was extended by cited commit with a new 'port_page' field.
However, when filling the register's payload, the driver specifies the ports as absolute numbers and not relative to the first port of the port page, resulting in memory corruptions [1].
Fix by specifying the ports relative to the first port of the port page.
[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 Read of size 1 at addr ffff8881068cb00f by task devlink/1566 [...] Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0 mlxsw_devlink_sb_occ_snapshot+0x75/0xb0 devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0 genl_family_rcv_msg_doit+0x20c/0x300 genl_rcv_msg+0x567/0x800 netlink_rcv_skb+0x170/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x547/0x830 netlink_sendmsg+0x8d4/0xdb0 __sys_sendto+0x49b/0x510 __x64_sys_sendto+0xe5/0x1c0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 copy_verifier_state+0xbc2/0xfb0 do_check_common+0x2c51/0xc7e0 bpf_check+0x5107/0x9960 bpf_prog_load+0xf0e/0x2690 __sys_bpf+0x1a61/0x49d0 __x64_sys_bpf+0x7d/0xc0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x109/0x170 __kasan_slab_free+0x14/0x30 kfree+0xca/0x2b0 free_verifier_state+0xce/0x270 do_check_common+0x4828/0xc7e0 bpf_check+0x5107/0x9960 bpf_prog_load+0xf0e/0x2690 __sys_bpf+0x1a61/0x49d0 __x64_sys_bpf+0x7d/0xc0 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- .../mellanox/mlxsw/spectrum_buffers.c | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +14 -6
@@ -1607,8 +1607,8 @@ static void mlxsw_sp_sb_sr_occ_query_cb(struct mlxsw_core *mlxsw_core,int mlxsw_sp_sb_occ_snapshot (struct mlxsw_core *mlxsw_core,unsigned int sb_index) { +u16 local_port, local_port_1, first_local_port, last_local_port;struct mlxsw_sp *mlxsw_sp =mlxsw_core_driver_priv (mlxsw_core); -u16 local_port, local_port_1, last_local_port;struct mlxsw_sp_sb_sr_occ_query_cb_ctx cb_ctx;u8 masked_count, current_page =0 ;unsigned long cb_priv =0 ;
@@ -1628,6 +1628,7 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core, masked_count =0 ;mlxsw_reg_sbsr_pack (sbsr_pl, false);mlxsw_reg_sbsr_port_page_set (sbsr_pl, current_page); + first_local_port = current_page *MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE ; last_local_port = current_page *MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE +MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE -1 ;
@@ -1645,9 +1646,12 @@ int mlxsw_sp_sb_occ_snapshot(struct mlxsw_core *mlxsw_core,if (local_port !=MLXSW_PORT_CPU_PORT ) {/* Ingress quotas are not supported for the CPU port */ mlxsw_reg_sbsr_ingress_port_mask_set (sbsr_pl, - local_port,1 ); + local_port - first_local_port, +1 ); } -mlxsw_reg_sbsr_egress_port_mask_set (sbsr_pl, local_port,1 ); +mlxsw_reg_sbsr_egress_port_mask_set (sbsr_pl, + local_port - first_local_port, +1 );for (i =0 ; i < mlxsw_sp->sb_vals->pool_count; i++) { err =mlxsw_sp_sb_pm_occ_query (mlxsw_sp, local_port, i, &bulk_list);
@@ -1684,7 +1688,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, unsigned int sb_index) {struct mlxsw_sp *mlxsw_sp =mlxsw_core_driver_priv (mlxsw_core); -u16 local_port, last_local_port; +u16 local_port, first_local_port, last_local_port;LIST_HEAD (bulk_list);unsigned int masked_count;u8 current_page =0 ;
@@ -1702,6 +1706,7 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core, masked_count =0 ;mlxsw_reg_sbsr_pack (sbsr_pl, true);mlxsw_reg_sbsr_port_page_set (sbsr_pl, current_page); + first_local_port = current_page *MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE ; last_local_port = current_page *MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE +MLXSW_REG_SBSR_NUM_PORTS_IN_PAGE -1 ;
@@ -1719,9 +1724,12 @@ int mlxsw_sp_sb_occ_max_clear(struct mlxsw_core *mlxsw_core,if (local_port !=MLXSW_PORT_CPU_PORT ) {/* Ingress quotas are not supported for the CPU port */ mlxsw_reg_sbsr_ingress_port_mask_set (sbsr_pl, - local_port,1 ); + local_port - first_local_port, +1 ); } -mlxsw_reg_sbsr_egress_port_mask_set (sbsr_pl, local_port,1 ); +mlxsw_reg_sbsr_egress_port_mask_set (sbsr_pl, + local_port - first_local_port, +1 );for (i =0 ; i < mlxsw_sp->sb_vals->pool_count; i++) { err =mlxsw_sp_sb_pm_occ_clear (mlxsw_sp, local_port, i, &bulk_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/163 bpf: Fix overrunning reservations in ringbuf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit cfa1a2329a691ffd991fcf7248a57d752e712881 ]
The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers.
Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write.
One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory.
Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return (void *)hdr + BPF_RINGBUF_HDR_SZ for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header.
For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets allocate a chunk B with size 0x3000. This will succeed because consumer_pos was edited ahead of time to pass the new_prod_pos - cons_pos > rb->mask check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data pages. This means that chunk B at [0x4000,0x4008] is chunk A's header. bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong page and could cause a crash.
Fix it by calculating the oldest pending_pos and check whether the range from the oldest outstanding record to the newest would span beyond the ring buffer size. If that is the case, then reject the request. We've tested with the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh) before/after the fix and while it seems a bit slower on some benchmarks, it is still not significantly enough to matter.
--- kernel/bpf/ringbuf.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-)
kernel/bpf/ringbuf.c +25 -6
@@ -51,7 +51,8 @@ struct bpf_ringbuf {* This prevents a user-space application from modifying the * position and ruining in-kernel tracking. The permissions of the * pages depend on who is producing samples: user-space or the -* kernel. +* kernel. Note that the pending counter is placed in the same +* page as the producer, so that it shares the same cache line. * * Kernel-producer * ---------------
@@ -70,6 +71,7 @@ struct bpf_ringbuf {*/ unsigned long consumer_pos__aligned(PAGE_SIZE) ;unsigned long producer_pos__aligned(PAGE_SIZE) ; +unsigned long pending_pos;char data[]__aligned(PAGE_SIZE) ; };
@@ -179,6 +181,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) rb->mask = data_sz -1 ; rb->consumer_pos =0 ; rb->producer_pos =0 ; + rb->pending_pos =0 ;return rb; }
@@ -404,9 +407,9 @@ bpf_ringbuf_restore_from_rec(struct bpf_ringbuf_hdr *hdr)static void *__bpf_ringbuf_reserve (struct bpf_ringbuf *rb,u64 size) { -unsigned long cons_pos, prod_pos, new_prod_pos, flags; -u32 len, pg_off; +unsigned long cons_pos, prod_pos, new_prod_pos, pend_pos, flags;struct bpf_ringbuf_hdr *hdr; +u32 len, pg_off, tmp_size, hdr_len;if (unlikely (size >RINGBUF_MAX_RECORD_SZ ))return NULL ;
@@ -424,13 +427,29 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size)spin_lock_irqsave (&rb->spinlock, flags); } + pend_pos = rb->pending_pos; prod_pos = rb->producer_pos; new_prod_pos = prod_pos + len; -/* check for out of ringbuf space by ensuring producer position -* doesn't advance more than (ringbuf_size - 1) ahead +while (pend_pos < prod_pos) { + hdr = (void *)rb->data + (pend_pos & rb->mask); + hdr_len =READ_ONCE (hdr->len); +if (hdr_len &BPF_RINGBUF_BUSY_BIT ) +break ; + tmp_size = hdr_len & ~BPF_RINGBUF_DISCARD_BIT ; + tmp_size =round_up (tmp_size +BPF_RINGBUF_HDR_SZ ,8 ); + pend_pos += tmp_size; + } + rb->pending_pos = pend_pos; + +/* check for out of ringbuf space: +* - by ensuring producer position doesn't advance more than +* (ringbuf_size - 1) ahead +* - by ensuring oldest not yet committed record until newest +* record does not span more than (ringbuf_size - 1) */ -if (new_prod_pos - cons_pos > rb->mask) { +if (new_prod_pos - cons_pos > rb->mask || + new_prod_pos - pend_pos > rb->mask) {spin_unlock_irqrestore (&rb->spinlock, flags);return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/163 x86/mm/numa: Use NUMA_NO_NODE when calling memblock_set_node()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
[ Upstream commit 3ac36aa7307363b7247ccb6f6a804e11496b2b36 ]
memblock_set_node() warns about using MAX_NUMNODES, see
e0eec24e2e19 ("memblock: make memblock_set_node() also warn about use of MAX_NUMNODES")
for details.
--- arch/x86/mm/numa.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/mm/numa.c +3 -3
@@ -523,7 +523,7 @@ static void __init numa_clear_kernel_node_hotplug(void)for_each_reserved_mem_region (mb_region) {int nid =memblock_get_region_node (mb_region); -if (nid !=MAX_NUMNODES ) +if (nid !=NUMA_NO_NODE )node_set (nid, reserved_nodemask); }
@@ -643,9 +643,9 @@ static int __init numa_init(int (*init_func)(void))nodes_clear (node_online_map);memset (&numa_meminfo,0 ,sizeof (numa_meminfo));WARN_ON (memblock_set_node (0 ,ULLONG_MAX , &memblock.memory, -MAX_NUMNODES )); +NUMA_NO_NODE ));WARN_ON (memblock_set_node (0 ,ULLONG_MAX , &memblock.reserved, -MAX_NUMNODES )); +NUMA_NO_NODE ));/* In case that parsing SRAT failed. */ WARN_ON (memblock_clear_hotplug (0 ,ULLONG_MAX ));numa_reset_distance ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/163 ibmvnic: Free any outstanding tx skbs during scrq reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Child <[email protected]>
[ Upstream commit 49bbeb5719c2f56907d3a9623b47c6c15c2c431d ]
There are 2 types of outstanding tx skb's:
Type 1: Packets that are sitting in the drivers ind_buff that are waiting to be batch sent to the NIC. During a device reset, these are freed with a call to ibmvnic_tx_scrq_clean_buffer()
Type 2: Packets that have been sent to the NIC and are awaiting a TX completion IRQ. These are free'd during a reset with a call to clean_tx_pools()
During any reset which requires us to free the tx irq, ensure that the Type 2 skb references are freed. Since the irq is released, it is impossible for the NIC to inform of any completions.
Furthermore, later in the reset process is a call to init_tx_pools() which marks every entry in the tx pool as free (ie not outstanding). So if the driver is to make a call to init_tx_pools(), it must first be sure that the tx pool is empty of skb references.
This issue was discovered by observing the following in the logs during EEH testing:
TX free map points to untracked skb (tso_pool 0 idx=4) TX free map points to untracked skb (tso_pool 0 idx=5) TX free map points to untracked skb (tso_pool 1 idx=36)
--- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/ibm/ibmvnic.c +6 -0
@@ -4057,6 +4057,12 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter, bool do_h_free) adapter->num_active_tx_scrqs =0 ; } +/* Clean any remaining outstanding SKBs +* we freed the irq so we won't be hearing +* from them +*/ +clean_tx_pools (adapter); +if (adapter->rx_scrq) {for (i =0 ; i < adapter->num_active_rx_scrqs; i++) {if (!adapter->rx_scrq[i])
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/163 net: phy: micrel: add Microchip KSZ 9477 to the device table
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enguerrand de Ribaucourt <[email protected]>
[ Upstream commit 54a4e5c16382e871c01dd82b47e930fdce30406b ]
PHY_ID_KSZ9477 was supported but not added to the device table passed to MODULE_DEVICE_TABLE.
--- drivers/net/phy/micrel.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/micrel.c +1 -0
@@ -5030,6 +5030,7 @@ static struct mdio_device_id __maybe_unused micrel_tbl[] = { { PHY_ID_KSZ8081, MICREL_PHY_ID_MASK }, { PHY_ID_KSZ8873MLL, MICREL_PHY_ID_MASK }, { PHY_ID_KSZ886X, MICREL_PHY_ID_MASK }, + { PHY_ID_KSZ9477, MICREL_PHY_ID_MASK }, { PHY_ID_LAN8814, MICREL_PHY_ID_MASK }, { PHY_ID_LAN8804, MICREL_PHY_ID_MASK }, { PHY_ID_LAN8841, MICREL_PHY_ID_MASK },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/163 net: dsa: microchip: use collision based back pressure mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enguerrand de Ribaucourt <[email protected]>
[ Upstream commit d963c95bc9840d070a788c35e41b715a648717f7 ]
Errata DS80000758 states that carrier sense back pressure mode can cause link down issues in 100BASE-TX half duplex mode. The datasheet also recommends to always use the collision based back pressure mode.
--- drivers/net/dsa/microchip/ksz9477.c | 4 ++++ drivers/net/dsa/microchip/ksz9477_reg.h | 1 + 2 files changed, 5 insertions(+)
drivers/net/dsa/microchip/ksz9477.c +4 -0
@@ -1112,6 +1112,10 @@ int ksz9477_setup(struct dsa_switch *ds)/* Enable REG_SW_MTU__2 reg by setting SW_JUMBO_PACKET */ ksz_cfg (dev,REG_SW_MAC_CTRL_1 ,SW_JUMBO_PACKET , true); +/* Use collision based back pressure mode. */ +ksz_cfg (dev,REG_SW_MAC_CTRL_1 ,SW_BACK_PRESSURE , +SW_BACK_PRESSURE_COLLISION ); +/* Now we can configure default MTU value */ ret =regmap_update_bits (ksz_regmap_16 (dev),REG_SW_MTU__2 ,REG_SW_MTU_MASK ,VLAN_ETH_FRAME_LEN +ETH_FCS_LEN );
drivers/net/dsa/microchip/ksz9477_reg.h +1 -0
@@ -267,6 +267,7 @@#define REG_SW_MAC_CTRL_1 0x0331#define SW_BACK_PRESSURE BIT(5) +#define SW_BACK_PRESSURE_COLLISION 0#define FAIR_FLOW_CTRL BIT(4)#define NO_EXC_COLLISION_DROP BIT(3)#define SW_JUMBO_PACKET BIT(2)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/163 Input: ili210x - fix ili251x_read_touch_data() return value
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 9f0fad0382124e7e23b3c730fa78818c22c89c0a ]
The caller of this function treats all non-zero values as an error, so the return value of i2c_master_recv() cannot be returned directly.
This fixes touch reporting when there are more than 6 active touches.
--- drivers/input/touchscreen/ili210x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/touchscreen/ili210x.c +2 -2
@@ -261,8 +261,8 @@ static int ili251x_read_touch_data(struct i2c_client *client, u8 *data)if (!error && data[0 ] ==2 ) { error =i2c_master_recv (client, data +ILI251X_DATA_SIZE1 ,ILI251X_DATA_SIZE2 ); -if (error >=0 && error !=ILI251X_DATA_SIZE2 ) - error = -EIO ; +if (error >=0 ) + error = error ==ILI251X_DATA_SIZE2 ?0 : -EIO ; }return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/163 pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
[ Upstream commit adec57ff8e66aee632f3dd1f93787c13d112b7a1 ]
In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock.
This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- drivers/pinctrl/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/core.c +1 -1
@@ -1098,8 +1098,8 @@ static struct pinctrl *create_pinctrl(struct device *dev,* an -EPROBE_DEFER later, as that is the worst case. */ if (ret == -EPROBE_DEFER ) { -pinctrl_free (p, false);mutex_unlock (&pinctrl_maps_mutex); +pinctrl_free (p, false);return ERR_PTR (ret); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/163 pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang-Huang Bao <[email protected]>
[ Upstream commit e8448a6c817c2aa6c6af785b1d45678bd5977e8d ]
The pinmux bits for GPIO2-B0 to GPIO2-B6 actually have 2 bits width, correct the bank flag for GPIO2-B. The pinmux bits for GPIO2-B7 is recalculated so it remain unchanged.
The pinmux bits for those pins are not explicitly specified in RK3328 TRM, however we can get hint from pad name and its correspinding IOMUX setting for pins in interface descriptions. The correspinding IOMIX settings for GPIO2-B0 to GPIO2-B6 can be found in the same row next to occurrences of following pad names in RK3328 TRM.
GPIO2-B0: IO_SPIclkm0_GPIO2B0vccio5
GPIO2-B1: IO_SPItxdm0_GPIO2B1vccio5
GPIO2-B2: IO_SPIrxdm0_GPIO2B2vccio5
GPIO2-B3: IO_SPIcsn0m0_GPIO2B3vccio5
GPIO2-B4: IO_SPIcsn1m0_FLASHvol_sel_GPIO2B4vccio5
GPIO2-B5: IO_ I2C2sda_TSADCshut_GPIO2B5vccio5
GPIO2-B6: IO_ I2C2scl_GPIO2B6vccio5
This fix has been tested on NanoPi R2S for fixing confliting pinmux bits between GPIO2-B7 with GPIO2-B5.
--- drivers/pinctrl/pinctrl-rockchip.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/pinctrl/pinctrl-rockchip.c +1 -7
@@ -634,12 +634,6 @@ static struct rockchip_mux_recalced_data rk3308_mux_recalced_data[] = {static struct rockchip_mux_recalced_data rk3328_mux_recalced_data[] = { { - .num =2 , - .pin =12 , - .reg =0x24 , - .bit =8 , - .mask =0x3 - }, { .num =2 , .pin =15 , .reg =0x28 ,
@@ -3765,7 +3759,7 @@ static struct rockchip_pin_bank rk3328_pin_banks[] = {PIN_BANK_IOMUX_FLAGS (0 ,32 ,"gpio0" ,0 ,0 ,0 ,0 ),PIN_BANK_IOMUX_FLAGS (1 ,32 ,"gpio1" ,0 ,0 ,0 ,0 ),PIN_BANK_IOMUX_FLAGS (2 ,32 ,"gpio2" ,0 , -IOMUX_WIDTH_3BIT , +0 ,IOMUX_WIDTH_3BIT ,0 ), PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/163 pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang-Huang Bao <[email protected]>
[ Upstream commit 5ef6914e0bf578357b4c906ffe6b26e7eedb8ccf ]
The pinmux bits for GPIO3-B1 to GPIO3-B6 pins are not explicitly specified in RK3328 TRM, however we can get hint from pad name and its correspinding IOMUX setting for pins in interface descriptions. The correspinding IOMIX settings for these pins can be found in the same row next to occurrences of following pad names in RK3328 TRM.
GPIO3-B1: IO_TSPd5m0_CIFdata5m0_GPIO3B1vccio6
GPIO3-B2: IO_TSPd6m0_CIFdata6m0_GPIO3B2vccio6
GPIO3-B3: IO_TSPd7m0_CIFdata7m0_GPIO3B3vccio6
GPIO3-B4: IO_CARDclkm0_GPIO3B4vccio6
GPIO3-B5: IO_CARDrstm0_GPIO3B5vccio6
GPIO3-B6: IO_CARDdetm0_GPIO3B6vccio6
Add pinmux data to rk3328_mux_recalced_data as mux register offset for these pins does not follow rockchip convention.
--- drivers/pinctrl/pinctrl-rockchip.c | 51 ++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
drivers/pinctrl/pinctrl-rockchip.c +51 -0
@@ -634,17 +634,68 @@ static struct rockchip_mux_recalced_data rk3308_mux_recalced_data[] = {static struct rockchip_mux_recalced_data rk3328_mux_recalced_data[] = { { +/* gpio2_b7_sel */ .num =2 , .pin =15 , .reg =0x28 , .bit =0 , .mask =0x7 }, { +/* gpio2_c7_sel */ .num =2 , .pin =23 , .reg =0x30 , .bit =14 , .mask =0x3 + }, { +/* gpio3_b1_sel */ + .num =3 , + .pin =9 , + .reg =0x44 , + .bit =2 , + .mask =0x3 + }, { +/* gpio3_b2_sel */ + .num =3 , + .pin =10 , + .reg =0x44 , + .bit =4 , + .mask =0x3 + }, { +/* gpio3_b3_sel */ + .num =3 , + .pin =11 , + .reg =0x44 , + .bit =6 , + .mask =0x3 + }, { +/* gpio3_b4_sel */ + .num =3 , + .pin =12 , + .reg =0x44 , + .bit =8 , + .mask =0x3 + }, { +/* gpio3_b5_sel */ + .num =3 , + .pin =13 , + .reg =0x44 , + .bit =10 , + .mask =0x3 + }, { +/* gpio3_b6_sel */ + .num =3 , + .pin =14 , + .reg =0x44 , + .bit =12 , + .mask =0x3 + }, { +/* gpio3_b7_sel */ + .num =3 , + .pin =15 , + .reg =0x44 , + .bit =14 , + .mask =0x3 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/163 pinctrl: rockchip: use dedicated pinctrl type for RK3328
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang-Huang Bao <[email protected]>
[ Upstream commit 01b4b1d1cec48ef4c26616c2fc4600b2c9fec05a ]
rk3328_pin_ctrl uses type of RK3288 which has a hack in rockchip_pinctrl_suspend and rockchip_pinctrl_resume to restore GPIO6-C6 at assume, the hack is not applicable to RK3328 as GPIO6 is not even exist in it. So use a dedicated pinctrl type to skip this hack.
--- drivers/pinctrl/pinctrl-rockchip.c | 5 ++++- drivers/pinctrl/pinctrl-rockchip.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-rockchip.c +4 -1
@@ -2478,6 +2478,7 @@ static int rockchip_get_pull(struct rockchip_pin_bank *bank, int pin_num)case RK3188 :case RK3288 :case RK3308 : +case RK3328 :case RK3368 :case RK3399 :case RK3568 :
@@ -2536,6 +2537,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,case RK3188 :case RK3288 :case RK3308 : +case RK3328 :case RK3368 :case RK3399 :case RK3568 :
@@ -2798,6 +2800,7 @@ static bool rockchip_pinconf_pull_valid(struct rockchip_pin_ctrl *ctrl,case RK3188 :case RK3288 :case RK3308 : +case RK3328 :case RK3368 :case RK3399 :case RK3568 :
@@ -3824,7 +3827,7 @@ static struct rockchip_pin_ctrl rk3328_pin_ctrl = { .pin_banks = rk3328_pin_banks, .nr_banks = ARRAY_SIZE(rk3328_pin_banks), .label = "RK3328-GPIO", - .type = RK3288, + .type = RK3328, .grf_mux_offset = 0x0, .iomux_recalced = rk3328_mux_recalced_data, .niomux_recalced = ARRAY_SIZE(rk3328_mux_recalced_data),
drivers/pinctrl/pinctrl-rockchip.h +1 -0
@@ -193,6 +193,7 @@ enum rockchip_pinctrl_type {RK3188 ,RK3288 ,RK3308 , +RK3328 ,RK3368 ,RK3399 , RK3568,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/163 pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang-Huang Bao <[email protected]>
[ Upstream commit 4ea4d4808e342ddf89ba24b93ffa2057005aaced ]
rockchip_pmx_set reset all pinmuxs in group to 0 in the case of error, add missing bank data retrieval in that code to avoid setting mux on unexpected pins.
--- drivers/pinctrl/pinctrl-rockchip.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-rockchip.c +3 -1
@@ -2751,8 +2751,10 @@ static int rockchip_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,if (ret) {/* revert the already done pin settings */ -for (cnt--; cnt >=0 ; cnt--) +for (cnt--; cnt >=0 ; cnt--) { + bank =pin_to_bank (info, pins[cnt]);rockchip_set_mux (bank, pins[cnt] - bank->pin_base,0 ); + }return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/163 iio: pressure: bmp280: Fix BMP580 temperature reading
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Rizkalla <[email protected]>
[ Upstream commit 0f0f6306617cb4b6231fc9d4ec68ab9a56dba7c0 ]
Fix overflow issue when storing BMP580 temperature reading and properly preserve sign of 24-bit data.
--- drivers/iio/pressure/bmp280-core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/iio/pressure/bmp280-core.c +5 -5
@@ -1385,12 +1385,12 @@ static int bmp580_read_temp(struct bmp280_data *data, int *val, int *val2)/* * Temperature is returned in Celsius degrees in fractional -* form down 2^16. We rescale by x1000 to return milli Celsius -* to respect IIO ABI. +* form down 2^16. We rescale by x1000 to return millidegrees +* Celsius to respect IIO ABI. */ - *val = raw_temp *1000 ; - *val2 =16 ; -return IIO_VAL_FRACTIONAL_LOG2 ; + raw_temp =sign_extend32 (raw_temp,23 ); + *val = ((s64 )raw_temp *1000 ) / (1 <<16 ); +return IIO_VAL_INT ; }static int bmp580_read_press (struct bmp280_data *data,int *val,int *val2)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/163 xdp: Remove WARN() from __xdp_reg_mem_model()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 7e9f79428372c6eab92271390851be34ab26bfb4 ]
syzkaller reports a warning in __xdp_reg_mem_model().
The warning occurs only if __mem_id_init_hash_table() returns an error. It returns the error in two cases:
1. memory allocation fails;
2. rhashtable_init() fails when some fields of rhashtable_params struct are not initialized properly.
The second case cannot happen since there is a static const rhashtable_params struct with valid fields. So, warning is only triggered when there is a problem with memory allocation.
Thus, there is no sense in using WARN() to handle this error and it can be safely removed.
WARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 __xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299 CPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299 Call Trace: xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344 xdp_test_run_setup net/bpf/test_run.c:188 [inline] bpf_test_run_xdp_live+0x365/0x1e90 net/bpf/test_run.c:377 bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267 bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
--- net/core/xdp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/core/xdp.c +1 -3
@@ -294,10 +294,8 @@ static struct xdp_mem_allocator *__xdp_reg_mem_model(struct xdp_mem_info *mem,mutex_lock (&mem_id_lock); ret =__mem_id_init_hash_table ();mutex_unlock (&mem_id_lock); -if (ret <0 ) { -WARN_ON (1 ); +if (ret <0 )return ERR_PTR (ret); - } } xdp_alloc =kzalloc (sizeof (*xdp_alloc), gfp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/163 powerpc: restore some missing spu syscalls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b1e31c134a8ab2e8f5fd62323b6b45a950ac704d ]
A couple of system calls were inadventently removed from the table during a bugfix for 32-bit powerpc entry. Restore the original behavior.
--- arch/powerpc/kernel/syscalls/syscall.tbl | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/kernel/syscalls/syscall.tbl +4 -0
@@ -230,8 +230,10 @@ 178 nospu rt_sigsuspend sys_rt_sigsuspend compat_sys_rt_sigsuspend 179 32 pread64 sys_ppc_pread64 compat_sys_ppc_pread64 179 64 pread64 sys_pread64 +179 spu pread64 sys_pread64 180 32 pwrite64 sys_ppc_pwrite64 compat_sys_ppc_pwrite64 180 64 pwrite64 sys_pwrite64 +180 spu pwrite64 sys_pwrite64 181 common chown sys_chown 182 common getcwd sys_getcwd 183 common capget sys_capget
@@ -246,6 +248,7 @@ 190 common ugetrlimit sys_getrlimit compat_sys_getrlimit 191 32 readahead sys_ppc_readahead compat_sys_ppc_readahead 191 64 readahead sys_readahead +191 spu readahead sys_readahead 192 32 mmap2 sys_mmap2 compat_sys_mmap2 193 32 truncate64 sys_ppc_truncate64 compat_sys_ppc_truncate64 194 32 ftruncate64 sys_ppc_ftruncate64 compat_sys_ppc_ftruncate64
@@ -293,6 +296,7 @@ 232 nospu set_tid_address sys_set_tid_address 233 32 fadvise64 sys_ppc32_fadvise64 compat_sys_ppc32_fadvise64 233 64 fadvise64 sys_fadvise64 +233 spu fadvise64 sys_fadvise64 234 nospu exit_group sys_exit_group 235 nospu lookup_dcookie sys_lookup_dcookie compat_sys_lookup_dcookie 236 common epoll_create sys_epoll_create
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/163 tcp: fix tcp_rcv_fastopen_synack() to enter TCP_CA_Loss for failed TFO
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <[email protected]>
[ Upstream commit 5dfe9d273932c647bdc9d664f939af9a5a398cbc ]
Testing determined that the recent commit 9e046bb111f1 ("tcp: clear tp->retrans_stamp in tcp_rcv_fastopen_synack()") has a race, and does not always ensure retrans_stamp is 0 after a TFO payload retransmit.
If transmit completion for the SYN+data skb happens after the client TCP stack receives the SYNACK (which sometimes happens), then retrans_stamp can erroneously remain non-zero for the lifetime of the connection, causing a premature ETIMEDOUT later.
Testing and tracing showed that the buggy scenario is the following somewhat tricky sequence:
+ Client attempts a TFO handshake. tcp_send_syn_data() sends SYN + TFO cookie + data in a single packet in the syn_data skb. It hands the syn_data skb to tcp_transmit_skb(), which makes a clone. Crucially, it then reuses the same original (non-clone) syn_data skb, transforming it by advancing the seq by one byte and removing the FIN bit, and enques the resulting payload-only skb in the sk->tcp_rtx_queue.
+ Client sets retrans_stamp to the start time of the three-way handshake.
+ Cookie mismatches or server has TFO disabled, and server only ACKs SYN.
+ tcp_ack() sees SYN is acked, tcp_clean_rtx_queue() clears retrans_stamp.
+ Since the client SYN was acked but not the payload, the TFO failure code path in tcp_rcv_fastopen_synack() tries to retransmit the payload skb. However, in some cases the transmit completion for the clone of the syn_data (which had SYN + TFO cookie + data) hasn't happened. In those cases, skb_still_in_host_queue() returns true for the retransmitted TFO payload, because the clone of the syn_data skb has not had its tx completetion.
+ Because skb_still_in_host_queue() finds skb_fclone_busy() is true, it sets the TSQ_THROTTLED bit and the retransmit does not happen in the tcp_rcv_fastopen_synack() call chain.
+ The tcp_rcv_fastopen_synack() code next implicitly assumes the retransmit process is finished, and sets retrans_stamp to 0 to clear it, but this is later overwritten (see below).
+ Later, upon tx completion, tcp_tsq_write() calls tcp_xmit_retransmit_queue(), which puts the retransmit in flight and sets retrans_stamp to a non-zero value.
+ The client receives an ACK for the retransmitted TFO payload data.
+ Since we're in CA_Open and there are no dupacks/SACKs/DSACKs/ECN to make tcp_ack_is_dubious() true and make us call tcp_fastretrans_alert() and reach a code path that clears retrans_stamp, retrans_stamp stays nonzero.
+ Later, if there is a TLP, RTO, RTO sequence, then the connection will suffer an early ETIMEDOUT due to the erroneously ancient retrans_stamp.
The fix: this commit refactors the code to have tcp_rcv_fastopen_synack() retransmit by reusing the relevant parts of tcp_simple_retransmit() that enter CA_Loss (without changing cwnd) and call tcp_xmit_retransmit_queue(). We have tcp_simple_retransmit() and tcp_rcv_fastopen_synack() share code in this way because in both cases we get a packet indicating non-congestion loss (MTU reduction or TFO failure) and thus in both cases we want to retransmit as many packets as cwnd allows, without reducing cwnd. And given that retransmits will set retrans_stamp to a non-zero value (and may do so in a later calling context due to TSQ), we also want to enter CA_Loss so that we track when all retransmitted packets are ACked and clear retrans_stamp when that happens (to ensure later recurring RTOs are using the correct retrans_stamp and don't declare ETIMEDOUT prematurely).
--- net/ipv4/tcp_input.c | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-)
net/ipv4/tcp_input.c +27 -11
@@ -2759,13 +2759,37 @@ static void tcp_mtup_probe_success(struct sock *sk)NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPMTUPSUCCESS ); } +/* Sometimes we deduce that packets have been dropped due to reasons other than +* congestion, like path MTU reductions or failed client TFO attempts. In these +* cases we call this function to retransmit as many packets as cwnd allows, +* without reducing cwnd. Given that retransmits will set retrans_stamp to a +* non-zero value (and may do so in a later calling context due to TSQ), we +* also enter CA_Loss so that we track when all retransmitted packets are ACKed +* and clear retrans_stamp when that happens (to ensure later recurring RTOs +* are using the correct retrans_stamp and don't declare ETIMEDOUT +* prematurely). +*/ +static void tcp_non_congestion_loss_retransmit (struct sock *sk) +{ +const struct inet_connection_sock *icsk =inet_csk (sk); +struct tcp_sock *tp =tcp_sk (sk); + +if (icsk->icsk_ca_state != TCP_CA_Loss) { + tp->high_seq = tp->snd_nxt; + tp->snd_ssthresh =tcp_current_ssthresh (sk); + tp->prior_ssthresh =0 ; + tp->undo_marker =0 ; +tcp_set_ca_state (sk, TCP_CA_Loss); + } +tcp_xmit_retransmit_queue (sk); +} +/* Do a simple retransmit without using the backoff mechanisms in * tcp_timer. This is used for path mtu discovery. * The socket is already locked here. */ void tcp_simple_retransmit (struct sock *sk) { -const struct inet_connection_sock *icsk =inet_csk (sk);struct tcp_sock *tp =tcp_sk (sk);struct sk_buff *skb;int mss;
@@ -2805,14 +2829,7 @@ void tcp_simple_retransmit(struct sock *sk)* in network, but units changed and effective * cwnd/ssthresh really reduced now. */ -if (icsk->icsk_ca_state != TCP_CA_Loss) { - tp->high_seq = tp->snd_nxt; - tp->snd_ssthresh =tcp_current_ssthresh (sk); - tp->prior_ssthresh =0 ; - tp->undo_marker =0 ; -tcp_set_ca_state (sk, TCP_CA_Loss); - } -tcp_xmit_retransmit_queue (sk); +tcp_non_congestion_loss_retransmit (sk); }EXPORT_SYMBOL (tcp_simple_retransmit);
@@ -6175,8 +6192,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, tp->fastopen_client_fail =TFO_DATA_NOT_ACKED ;skb_rbtree_walk_from (data)tcp_mark_skb_lost (sk, data); -tcp_xmit_retransmit_queue (sk); - tp->retrans_stamp =0 ; +tcp_non_congestion_loss_retransmit (sk);NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPFASTOPENACTIVEFAIL );return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/163 ALSA: seq: Fix missing MSB in MIDI2 SPP conversion
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 9d65ab6050d25f17c13f4195aa8e160c6ac638f6 ]
The conversion of SPP to MIDI2 UMP called a wrong function, and the secondary argument wasn't taken. As a result, MSB of SPP was always zero. Fix to call the right function.
--- sound/core/seq/seq_ump_convert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/seq_ump_convert.c +1 -1
@@ -1020,7 +1020,7 @@ static int system_2p_ev_to_ump_midi2(const struct snd_seq_event *event, union snd_ump_midi2_msg *data, unsigned char status) { -return system_1p_ev_to_ump_midi1 (event, dest_port, +return system_2p_ev_to_ump_midi1 (event, dest_port, (union snd_ump_midi1_msg *)data, status); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/163 netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ]
register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers.
--- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 8 ++++---- net/netfilter/nft_lookup.c | 3 ++- 3 files changed, 11 insertions(+), 5 deletions(-)
include/net/netfilter/nf_tables.h +5 -0
@@ -587,6 +587,11 @@ static inline void *nft_set_priv(const struct nft_set *set)return (void *)set->data; } +static inline enum nft_data_types nft_set_datatype (const struct nft_set *set) +{ +return set->dtype ==NFT_DATA_VERDICT ?NFT_DATA_VERDICT :NFT_DATA_VALUE ; +} +static inline bool nft_set_gc_is_pending (const struct nft_set *s) {return refcount_read (&s->refs) !=1 ;
net/netfilter/nf_tables_api.c +4 -4
@@ -5648,8 +5648,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,if (nft_set_ext_exists (ext,NFT_SET_EXT_DATA ) &&nft_data_dump (skb,NFTA_SET_ELEM_DATA ,nft_set_ext_data (ext), - set->dtype ==NFT_DATA_VERDICT ?NFT_DATA_VERDICT :NFT_DATA_VALUE , - set->dlen) <0 ) +nft_set_datatype (set), set->dlen) <0 ) goto nla_put_failure; if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&
@@ -10881,6 +10880,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx,return 0 ;default : +if (type !=NFT_DATA_VALUE ) +return -EINVAL ; +if (reg <NFT_REG_1 *NFT_REG_SIZE /NFT_REG32_SIZE )return -EINVAL ;if (len ==0 )
@@ -10889,8 +10891,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, sizeof_field(struct nft_regs, data))return -ERANGE ; -if (data !=NULL && type !=NFT_DATA_VALUE ) -return -EINVAL ;return 0 ; } }
net/netfilter/nft_lookup.c +2 -1
@@ -132,7 +132,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx,return -EINVAL ; err =nft_parse_register_store (ctx, tb[NFTA_LOOKUP_DREG ], - &priv->dreg,NULL , set->dtype, + &priv->dreg,NULL , +nft_set_datatype (set), set->dlen);if (err <0 )return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/163 tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit bab4923132feb3e439ae45962979c5d9d5c7c1f1 ]
In the TRACE_EVENT(qdisc_reset) NULL dereference occurred from
qdisc->dev_queue->dev <NULL> ->name
This situation simulated from bunch of veths and Bluetooth disconnection and reconnection.
During qdisc initialization, qdisc was being set to noop_queue. In veth_init_queue, the initial tx_num was reduced back to one, causing the qdisc reset to be called with noop, which led to the kernel panic.
I've attached the GitHub gist link that C converted syz-execprogram source code and 3 log of reproduced vmcore-dmesg.
https://gist.github.com/yskelg/cc64562873ce249cdd0d5a358b77d740
Yeoreum and I use two fuzzing tool simultaneously.
One process with syz-executor : https://github.com/google/syzkaller
$ ./syz-execprog -executor=./syz-executor -repeat=1 -sandbox=setuid \
-enable=none -collide=false log1The other process with perf fuzzer:
https://github.com/deater/perf_event_tests/tree/master/fuzzer
$ perf_event_tests/fuzzer/perf_fuzzer
I think this will happen on the kernel version.
Linux kernel version +v6.7.10, +v6.8, +v6.9 and it could happen in v6.10.
This occurred from 51270d573a8d. I think this patch is absolutely necessary. Previously, It was showing not intended string value of name.
I've reproduced 3 time from my fedora 40 Debug Kernel with any other module or patched.
version: 6.10.0-0.rc2.20240608gitdc772f8237f9.29.fc41.aarch64+debug
[ 5287.164555] veth0_vlan: left promiscuous mode [ 5287.164929] veth1_macvtap: left promiscuous mode [ 5287.164950] veth0_macvtap: left promiscuous mode [ 5287.164983] veth1_vlan: left promiscuous mode [ 5287.165008] veth0_vlan: left promiscuous mode [ 5287.165450] veth1_macvtap: left promiscuous mode [ 5287.165472] veth0_macvtap: left promiscuous mode [ 5287.165502] veth1_vlan: left promiscuous mode … [ 5297.598240] bridge0: port 2(bridge_slave_1) entered blocking state [ 5297.598262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 5297.598296] bridge0: port 1(bridge_slave_0) entered blocking state [ 5297.598313] bridge0: port 1(bridge_slave_0) entered forwarding state [ 5297.616090] 8021q: adding VLAN 0 to HW filter on device bond0 [ 5297.620405] bridge0: port 1(bridge_slave_0) entered disabled state [ 5297.620730] bridge0: port 2(bridge_slave_1) entered disabled state [ 5297.627247] 8021q: adding VLAN 0 to HW filter on device team0 [ 5297.629636] bridge0: port 1(bridge_slave_0) entered blocking state … [ 5298.002798] bridge_slave_0: left promiscuous mode [ 5298.002869] bridge0: port 1(bridge_slave_0) entered disabled state [ 5298.309444] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 5298.315206] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 5298.320207] bond0 (unregistering): Released all slaves [ 5298.354296] hsr_slave_0: left promiscuous mode [ 5298.360750] hsr_slave_1: left promiscuous mode [ 5298.374889] veth1_macvtap: left promiscuous mode [ 5298.374931] veth0_macvtap: left promiscuous mode [ 5298.374988] veth1_vlan: left promiscuous mode [ 5298.375024] veth0_vlan: left promiscuous mode [ 5299.109741] team0 (unregistering): Port device team_slave_1 removed [ 5299.185870] team0 (unregistering): Port device team_slave_0 removed … [ 5300.155443] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 5300.155724] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 5300.155988] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 …. [ 5301.075531] team0: Port device team_slave_1 added [ 5301.085515] bridge0: port 1(bridge_slave_0) entered blocking state [ 5301.085531] bridge0: port 1(bridge_slave_0) entered disabled state [ 5301.085588] bridge_slave_0: entered allmulticast mode [ 5301.085800] bridge_slave_0: entered promiscuous mode [ 5301.095617] bridge0: port 1(bridge_slave_0) entered blocking state [ 5301.095633] bridge0: port 1(bridge_slave_0) entered disabled state … [ 5301.149734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5301.173234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5301.180517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5301.193481] hsr_slave_0: entered promiscuous mode [ 5301.204425] hsr_slave_1: entered promiscuous mode [ 5301.210172] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 5301.210185] Cannot create hsr debugfs directory [ 5301.224061] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5301.246901] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5301.255934] team0: Port device team_slave_0 added [ 5301.256480] team0: Port device team_slave_1 added [ 5301.256948] team0: Port device team_slave_0 added … [ 5301.435928] hsr_slave_0: entered promiscuous mode [ 5301.446029] hsr_slave_1: entered promiscuous mode [ 5301.455872] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 5301.455884] Cannot create hsr debugfs directory [ 5301.502664] hsr_slave_0: entered promiscuous mode [ 5301.513675] hsr_slave_1: entered promiscuous mode [ 5301.526155] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 5301.526164] Cannot create hsr debugfs directory [ 5301.563662] hsr_slave_0: entered promiscuous mode [ 5301.576129] hsr_slave_1: entered promiscuous mode [ 5301.580259] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 5301.580270] Cannot create hsr debugfs directory [ 5301.590269] 8021q: adding VLAN 0 to HW filter on device bond0
[ 5301.595872] KASAN: null-ptr-deref in range [0x0000000000000130-0x0000000000000137] [ 5301.595877] Mem abort info: [ 5301.595881] ESR = 0x0000000096000006 [ 5301.595885] EC = 0x25: DABT (current EL), IL = 32 bits [ 5301.595889] SET = 0, FnV = 0 [ 5301.595893] EA = 0, S1PTW = 0 [ 5301.595896] FSC = 0x06: level 2 translation fault [ 5301.595900] Data abort info: [ 5301.595903] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 5301.595907] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 5301.595911] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 5301.595915] [dfff800000000026] address between user and kernel address ranges [ 5301.595971] Internal error: Oops: 0000000096000006 [#1] SMP … [ 5301.596076] CPU: 2 PID: 102769 Comm: syz-executor.3 Kdump: loaded Tainted: G W ------- --- 6.10.0-0.rc2.20240608gitdc772f8237f9.29.fc41.aarch64+debug #1 [ 5301.596080] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.21805430.BA64.2305221830 05/22/2023 [ 5301.596082] pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 5301.596085] pc : strnlen+0x40/0x88 [ 5301.596114] lr : trace_event_get_offsets_qdisc_reset+0x6c/0x2b0 [ 5301.596124] sp : ffff8000beef6b40 [ 5301.596126] x29: ffff8000beef6b40 x28: dfff800000000000 x27: 0000000000000001 [ 5301.596131] x26: 6de1800082c62bd0 x25: 1ffff000110aa9e0 x24: ffff800088554f00 [ 5301.596136] x23: ffff800088554ec0 x22: 0000000000000130 x21: 0000000000000140 [ 5301.596140] x20: dfff800000000000 x19: ffff8000beef6c60 x18: ffff7000115106d8 [ 5301.596143] x17: ffff800121bad000 x16: ffff800080020000 x15: 0000000000000006 [ 5301.596147] x14: 0000000000000002 x13: ffff0001f3ed8d14 x12: ffff700017ddeda5 [ 5301.596151] x11: 1ffff00017ddeda4 x10: ffff700017ddeda4 x9 : ffff800082cc5eec [ 5301.596155] x8 : 0000000000000004 x7 : 00000000f1f1f1f1 x6 : 00000000f2f2f200 [ 5301.596158] x5 : 00000000f3f3f3f3 x4 : ffff700017dded80 x3 : 00000000f204f1f1 [ 5301.596162] x2 : 0000000000000026 x1 : 0000000000000000 x0 : 0000000000000130 [ 5301.596166] Call trace: [ 5301.596175] strnlen+0x40/0x88 [ 5301.596179] trace_event_get_offsets_qdisc_reset+0x6c/0x2b0 [ 5301.596182] perf_trace_qdisc_reset+0xb0/0x538 [ 5301.596184] __traceiter_qdisc_reset+0x68/0xc0 [ 5301.596188] qdisc_reset+0x43c/0x5e8 [ 5301.596190] netif_set_real_num_tx_queues+0x288/0x770 [ 5301.596194] veth_init_queues+0xfc/0x130 [veth] [ 5301.596198] veth_newlink+0x45c/0x850 [veth] [ 5301.596202] rtnl_newlink_create+0x2c8/0x798 [ 5301.596205] __rtnl_newlink+0x92c/0xb60 [ 5301.596208] rtnl_newlink+0xd8/0x130 [ 5301.596211] rtnetlink_rcv_msg+0x2e0/0x890 [ 5301.596214] netlink_rcv_skb+0x1c4/0x380 [ 5301.596225] rtnetlink_rcv+0x20/0x38 [ 5301.596227] netlink_unicast+0x3c8/0x640 [ 5301.596231] netlink_sendmsg+0x658/0xa60 [ 5301.596234] __sock_sendmsg+0xd0/0x180 [ 5301.596243] __sys_sendto+0x1c0/0x280 [ 5301.596246] __arm64_sys_sendto+0xc8/0x150 [ 5301.596249] invoke_syscall+0xdc/0x268 [ 5301.596256] el0_svc_common.constprop.0+0x16c/0x240 [ 5301.596259] do_el0_svc+0x48/0x68 [ 5301.596261] el0_svc+0x50/0x188 [ 5301.596265] el0t_64_sync_handler+0x120/0x130 [ 5301.596268] el0t_64_sync+0x194/0x198 [ 5301.596272] Code: eb15001f 54000120 d343fc02 12000801 (38f46842) [ 5301.596285] SMP: stopping secondary CPUs [ 5301.597053] Starting crashdump kernel... [ 5301.597057] Bye!
After applying our patch, I didn't find any kernel panic errors.
We've found a simple reproducer
# echo 1 > /sys/kernel/debug/tracing/events/qdisc/qdisc_reset/enable
# ip link add veth0 type veth peer name veth1
Error: Unknown device type.
However, without our patch applied, I tested upstream 6.10.0-rc3 kernel using the qdisc_reset event and the ip command on my qemu virtual machine.
This 2 commands makes always kernel panic.
Linux version: 6.10.0-rc3
[ 0.000000] Linux version 6.10.0-rc3-00164-g44ef20baed8e-dirty
(paran@fedora) (gcc (GCC) 14.1.1 20240522 (Red Hat 14.1.1-4), GNU ld version 2.41-34.fc40) #20 SMP PREEMPT Sat Jun 15 16:51:25 KST 2024
Kernel panic message:
[ 615.236484] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 615.237250] Dumping ftrace buffer: [ 615.237679] (ftrace buffer empty) [ 615.238097] Modules linked in: veth crct10dif_ce virtio_gpu
virtio_dma_buf drm_shmem_helper drm_kms_helper zynqmp_fpga xilinx_can xilinx_spi xilinx_selectmap xilinx_core xilinx_pr_decoupler versal_fpga uvcvideo uvc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videodev videobuf2_common mc usbnet deflate zstd ubifs ubi rcar_canfd rcar_can omap_mailbox ntb_msi_test ntb_hw_epf lattice_sysconfig_spi lattice_sysconfig ice40_spi gpio_xilinx dwmac_altr_socfpga mdio_regmap stmmac_platform stmmac pcs_xpcs dfl_fme_region dfl_fme_mgr dfl_fme_br dfl_afu dfl fpga_region fpga_bridge can can_dev br_netfilter bridge stp llc atl1c ath11k_pci mhi ath11k_ahb ath11k qmi_helpers ath10k_sdio ath10k_pci ath10k_core ath mac80211 libarc4 cfg80211 drm fuse backlight ipv6
Jun 22 02:36:5[3 6k152.62-4sm98k4-0k]v kCePUr:n e1l :P IUDn:a b4le6 8t oC ohmma: nidpl eN oketr nteali nptaedg i6n.g1 0re.0q-urecs3t- 0at0 1v6i4r-tgu4a4le fa2d0dbraeeds0se-dir tyd f#f2f08 615.252376] Hardware name: linux,dummy-virt (DT) [ 615.253220] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 615.254433] pc : strnlen+0x6c/0xe0 [ 615.255096] lr : trace_event_get_offsets_qdisc_reset+0x94/0x3d0 [ 615.256088] sp : ffff800080b269a0 [ 615.256615] x29: ffff800080b269a0 x28: ffffc070f3f98500 x27: 0000000000000001 [ 615.257831] x26: 0000000000000010 x25: ffffc070f3f98540 x24: ffffc070f619cf60 [ 615.259020] x23: 0000000000000128 x22: 0000000000000138 x21: dfff800000000000 [ 615.260241] x20: ffffc070f631ad00 x19: 0000000000000128 x18: ffffc070f448b800 [ 615.261454] x17: 0000000000000000 x16: 0000000000000001 x15: ffffc070f4ba2a90 [ 615.262635] x14: ffff700010164d73 x13: 1ffff80e1e8d5eb3 x12: 1ffff00010164d72 [ 615.263877] x11: ffff700010164d72 x10: dfff800000000000 x9 : ffffc070e85d6184 [ 615.265047] x8 : ffffc070e4402070 x7 : 000000000000f1f1 x6 : 000000001504a6d3 [ 615.266336] x5 : ffff28ca21122140 x4 : ffffc070f5043ea8 x3 : 0000000000000000 [ 615.267528] x2 : 0000000000000025 x1 : 0000000000000000 x0 : 0000000000000000 [ 615.268747] Call trace: [ 615.269180] strnlen+0x6c/0xe0 [ 615.269767] trace_event_get_offsets_qdisc_reset+0x94/0x3d0 [ 615.270716] trace_event_raw_event_qdisc_reset+0xe8/0x4e8 [ 615.271667] __traceiter_qdisc_reset+0xa0/0x140 [ 615.272499] qdisc_reset+0x554/0x848 [ 615.273134] netif_set_real_num_tx_queues+0x360/0x9a8 [ 615.274050] veth_init_queues+0x110/0x220 [veth] [ 615.275110] veth_newlink+0x538/0xa50 [veth] [ 615.276172] __rtnl_newlink+0x11e4/0x1bc8 [ 615.276944] rtnl_newlink+0xac/0x120 [ 615.277657] rtnetlink_rcv_msg+0x4e4/0x1370 [ 615.278409] netlink_rcv_skb+0x25c/0x4f0 [ 615.279122] rtnetlink_rcv+0x48/0x70 [ 615.279769] netlink_unicast+0x5a8/0x7b8 [ 615.280462] netlink_sendmsg+0xa70/0x1190
Yeoreum and I don't know if the patch we wrote will fix the underlying cause, but we think that priority is to prevent kernel panic happening. So, we're sending this patch.
--- include/trace/events/qdisc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/qdisc.h +1 -1
@@ -81,7 +81,7 @@ TRACE_EVENT(qdisc_reset,TP_ARGS (q),TP_STRUCT__entry ( - __string( dev, qdisc_dev(q)->name ) + __string( dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)" ) __string( kind, q->ops->id ) __field( u32, parent ) __field( u32, handle )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/163 net: mana: Fix possible double free in error handling path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 1864b8224195d0e43ddb92a8151f54f6562090cc ]
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function adev_release calls kfree(madev). We shouldn't call kfree(madev) again in the error handling path. Set 'madev' to NULL.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/microsoft/mana/mana_en.c +2 -0
@@ -2752,6 +2752,8 @@ static int add_adev(struct gdma_dev *gd)if (ret) goto init_fail; +/* madev is owned by the auxiliary device */ + madev =NULL ; ret =auxiliary_device_add (adev);if (ret) goto add_fail;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/163 bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7d2cc63eca0c993c99d18893214abf8f85d566d8 ]
set_memory_ro() can fail, leaving memory unprotected.
Check its return and take it into account as an error.
Message-ID: <286def78955e04382b227cb3e4b6ba272a7442e3.1709850515.git.christophe.leroy@csgroup.eu>
--- include/linux/filter.h | 5 +++-- kernel/bpf/core.c | 4 +++- kernel/bpf/verifier.c | 8 ++++++-- 3 files changed, 12 insertions(+), 5 deletions(-)
include/linux/filter.h +3 -2
@@ -842,14 +842,15 @@ bpf_ctx_narrow_access_offset(u32 off, u32 size, u32 size_default)#define bpf_classic_proglen (fprog) (fprog->len * sizeof(fprog->filter[0])) -static inline void bpf_prog_lock_ro (struct bpf_prog *fp) +static inline int __must_check bpf_prog_lock_ro (struct bpf_prog *fp) {#ifndef CONFIG_BPF_JIT_ALWAYS_ON if (!fp->jited) {set_vm_flush_reset_perms (fp); -set_memory_ro ((unsigned long )fp, fp->pages); +return set_memory_ro ((unsigned long )fp, fp->pages); }#endif +return 0 ; }static inline void bpf_jit_binary_lock_ro (struct bpf_binary_header *hdr)
kernel/bpf/core.c +3 -1
@@ -2373,7 +2373,9 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) } finalize: -bpf_prog_lock_ro (fp); + *err =bpf_prog_lock_ro (fp); +if (*err) +return fp;/* The tail call compatibility check can only be done at * this late stage as we need to determine, if we deal
kernel/bpf/verifier.c +6 -2
@@ -18625,10 +18625,14 @@ static int jit_subprogs(struct bpf_verifier_env *env)* bpf_prog_load will add the kallsyms for the main program. */ for (i =1 ; i < env->subprog_cnt; i++) { -bpf_prog_lock_ro (func[i]); -bpf_prog_kallsyms_add (func[i]); + err =bpf_prog_lock_ro (func[i]); +if (err) + goto out_free; } +for (i =1 ; i < env->subprog_cnt; i++) +bpf_prog_kallsyms_add (func[i]); +/* Last step: make now unused interpreter insns from main * prog consistent for later dump requests, so they can * later look the same as if they were interpreted only.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/163 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5 ]
set_memory_rox() can fail, leaving memory unprotected.
Check return and bail out when bpf_jit_binary_lock_ro() returns an error.
Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy@csgroup.eu>
--- arch/arm/net/bpf_jit_32.c | 25 ++++++++++++------------- arch/loongarch/net/bpf_jit.c | 22 ++++++++++++++++------ arch/mips/net/bpf_jit_comp.c | 3 ++- arch/parisc/net/bpf_jit_core.c | 8 +++++++- arch/s390/net/bpf_jit_comp.c | 6 +++++- arch/sparc/net/bpf_jit_comp_64.c | 6 +++++- arch/x86/net/bpf_jit_comp32.c | 3 +-- include/linux/filter.h | 5 +++-- 8 files changed, 51 insertions(+), 27 deletions(-)
arch/arm/net/bpf_jit_32.c +12 -13
@@ -1982,28 +1982,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)/* If building the body of the JITed code fails somehow, * we fall back to the interpretation. */ -if (build_body (&ctx) <0 ) { - image_ptr =NULL ; -bpf_jit_binary_free (header); - prog = orig_prog; - goto out_imms; - } +if (build_body (&ctx) <0 ) + goto out_free;build_epilogue (&ctx);/* 3.) Extra pass to validate JITed Code */ -if (validate_code (&ctx)) { - image_ptr =NULL ; -bpf_jit_binary_free (header); - prog = orig_prog; - goto out_imms; - } +if (validate_code (&ctx)) + goto out_free;flush_icache_range ((u32 )header, (u32)(ctx.target + ctx.idx));if (bpf_jit_enable >1 )/* there are 2 passes here */ bpf_jit_dump (prog->len, image_size,2 , ctx.target); -bpf_jit_binary_lock_ro (header); +if (bpf_jit_binary_lock_ro (header)) + goto out_free; prog->bpf_func = (void *)ctx.target; prog->jited =1 ; prog->jited_len = image_size;
@@ -2020,5 +2013,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)bpf_jit_prog_release_other (prog, prog == orig_prog ? tmp : orig_prog);return prog; + +out_free: + image_ptr =NULL ; +bpf_jit_binary_free (header); + prog = orig_prog; + goto out_imms; }
arch/loongarch/net/bpf_jit.c +16 -6
@@ -1206,16 +1206,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)flush_icache_range ((unsigned long )header, (unsigned long )(ctx.image + ctx.idx));if (!prog->is_func || extra_pass) { +int err; +if (extra_pass && ctx.idx != jit_data->ctx.idx) {pr_err_once ("multi-func JIT bug %d != %d\n" , ctx.idx, jit_data->ctx.idx); -bpf_jit_binary_free (header); - prog->bpf_func =NULL ; - prog->jited =0 ; - prog->jited_len =0 ; - goto out_offset; + goto out_free; + } + err =bpf_jit_binary_lock_ro (header); +if (err) { +pr_err_once ("bpf_jit_binary_lock_ro() returned %d\n" , + err); + goto out_free; } -bpf_jit_binary_lock_ro (header); }else { jit_data->ctx = ctx; jit_data->image = image_ptr;
@@ -1246,6 +1249,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) out_offset =-1 ;return prog; + +out_free: +bpf_jit_binary_free (header); + prog->bpf_func =NULL ; + prog->jited =0 ; + prog->jited_len =0 ; + goto out_offset; }/* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
arch/mips/net/bpf_jit_comp.c +2 -1
@@ -1012,7 +1012,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)bpf_prog_fill_jited_linfo (prog, &ctx.descriptors[1 ]);/* Set as read-only exec and flush instruction cache */ -bpf_jit_binary_lock_ro (header); +if (bpf_jit_binary_lock_ro (header)) + goto out_err;flush_icache_range ((unsigned long )header, (unsigned long )&ctx.target[ctx.jit_index]);
arch/parisc/net/bpf_jit_core.c +7 -1
@@ -167,7 +167,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)bpf_flush_icache (jit_data->header, ctx->insns + ctx->ninsns);if (!prog->is_func || extra_pass) { -bpf_jit_binary_lock_ro (jit_data->header); +if (bpf_jit_binary_lock_ro (jit_data->header)) { +bpf_jit_binary_free (jit_data->header); + prog->bpf_func =NULL ; + prog->jited =0 ; + prog->jited_len =0 ; + goto out_offset; + } prologue_len = ctx->epilogue_offset - ctx->body_len;for (i =0 ; i < prog->len; i++) ctx->offset[i] += prologue_len;
arch/s390/net/bpf_jit_comp.c +5 -1
@@ -1973,7 +1973,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)print_fn_code (jit.prg_buf, jit.size_prg); }if (!fp->is_func || extra_pass) { -bpf_jit_binary_lock_ro (header); +if (bpf_jit_binary_lock_ro (header)) { +bpf_jit_binary_free (header); + fp = orig_fp; + goto free_addrs; + } }else { jit_data->header = header; jit_data->ctx = jit;
arch/sparc/net/bpf_jit_comp_64.c +5 -1
@@ -1602,7 +1602,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)bpf_flush_icache (header, (u8 *)header + header->size);if (!prog->is_func || extra_pass) { -bpf_jit_binary_lock_ro (header); +if (bpf_jit_binary_lock_ro (header)) { +bpf_jit_binary_free (header); + prog = orig_prog; + goto out_off; + } }else { jit_data->ctx = ctx; jit_data->image = image_ptr;
arch/x86/net/bpf_jit_comp32.c +1 -2
@@ -2600,8 +2600,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)if (bpf_jit_enable >1 )bpf_jit_dump (prog->len, proglen, pass +1 , image); -if (image) { -bpf_jit_binary_lock_ro (header); +if (image && !bpf_jit_binary_lock_ro (header)) { prog->bpf_func = (void *)image; prog->jited =1 ; prog->jited_len = proglen;
include/linux/filter.h +3 -2
@@ -853,10 +853,11 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp)return 0 ; } -static inline void bpf_jit_binary_lock_ro (struct bpf_binary_header *hdr) +static inline int __must_check +bpf_jit_binary_lock_ro (struct bpf_binary_header *hdr) {set_vm_flush_reset_perms (hdr); -set_memory_rox ((unsigned long )hdr, hdr->size >>PAGE_SHIFT ); +return set_memory_rox ((unsigned long )hdr, hdr->size >>PAGE_SHIFT ); }int sk_filter_trim_cap (struct sock *sk,struct sk_buff *skb,unsigned int cap);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/163 drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit ee7860cd8b5763017f8dc785c2851fecb7a0c565 ]
The ilitek-ili9881c controls the reset GPIO using the non-sleeping gpiod_set_value() function. This complains loudly when the GPIO controller needs to sleep. As the caller can sleep, use gpiod_set_value_cansleep() to fix the issue.
--- drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +3 -3
@@ -883,10 +883,10 @@ static int ili9881c_prepare(struct drm_panel *panel)msleep (5 );/* And reset it */ -gpiod_set_value (ctx->reset,1 ); +gpiod_set_value_cansleep (ctx->reset,1 );msleep (20 ); -gpiod_set_value (ctx->reset,0 ); +gpiod_set_value_cansleep (ctx->reset,0 );msleep (20 );for (i =0 ; i < ctx->desc->init_length; i++) {
@@ -941,7 +941,7 @@ static int ili9881c_unprepare(struct drm_panel *panel)mipi_dsi_dcs_enter_sleep_mode (ctx->dsi);regulator_disable (ctx->power); -gpiod_set_value (ctx->reset,1 ); +gpiod_set_value_cansleep (ctx->reset,1 );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/163 vduse: validate block features only with block devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Coquelin <[email protected]>
[ Upstream commit a115b5716fc9a64652aa9cb332070087178ffafa ]
This patch is preliminary work to enable network device type support to VDUSE.
As VIRTIO_BLK_F_CONFIG_WCE shares the same value as VIRTIO_NET_F_HOST_TSO4, we need to restrict its check to Virtio-blk device type.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_user/vduse_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/vdpa/vdpa_user/vduse_dev.c +5 -4
@@ -1662,13 +1662,14 @@ static bool device_is_allowed(u32 device_id)return false; } -static bool features_is_valid (u64 features) +static bool features_is_valid (struct vduse_dev_config *config) { -if (!(features & (1ULL <<VIRTIO_F_ACCESS_PLATFORM ))) +if (!(config->features &BIT_ULL (VIRTIO_F_ACCESS_PLATFORM )))return false;/* Now we only support read-only configuration space */ -if (features & (1ULL <<VIRTIO_BLK_F_CONFIG_WCE )) +if ((config->device_id ==VIRTIO_ID_BLOCK ) && + (config->features &BIT_ULL (VIRTIO_BLK_F_CONFIG_WCE )))return false;return true;
@@ -1695,7 +1696,7 @@ static bool vduse_validate_config(struct vduse_dev_config *config)if (!device_is_allowed (config->device_id))return false; -if (!features_is_valid (config->features)) +if (!features_is_valid (config))return false;return true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/163 netfilter: fix undefined reference to netfilter_lwtunnel_* when CONFIG_SYSCTL=n
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
[ Upstream commit aef5daa2c49d510436b733827d4f0bab79fcc4a0 ]
if CONFIG_SYSFS is not enabled in config, we get the below compile error,
All errors (new ones prefixed by >>):
csky-linux-ld: net/netfilter/core.o: in function `netfilter_init':
core.c:(.init.text+0x42): undefined reference to `netfilter_lwtunnel_init'
Quoted 2 lines
Quoted 2 lines
csky-linux-ld: core.c:(.init.text+0x56): undefined reference to `netfilter_lwtunnel_fini'
csky-linux-ld: core.c:(.init.text+0x70): undefined reference to `netfilter_lwtunnel_init'
csky-linux-ld: core.c:(.init.text+0x78): undefined reference to `netfilter_lwtunnel_fini'
--- net/netfilter/nf_hooks_lwtunnel.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_hooks_lwtunnel.c +3 -0
@@ -117,4 +117,7 @@ void netfilter_lwtunnel_fini(void) {unregister_pernet_subsys (&nf_lwtunnel_net_ops); } +#else +int __init netfilter_lwtunnel_init (void ) {return 0 ; } +void netfilter_lwtunnel_fini (void ) {}#endif /* CONFIG_SYSCTL */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/163 vduse: Temporarily fail if control queue feature requested
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Coquelin <[email protected]>
[ Upstream commit 56e71885b0349241c07631a7b979b61e81afab6a ]
Virtio-net driver control queue implementation is not safe when used with VDUSE. If the VDUSE application does not reply to control queue messages, it currently ends up hanging the kernel thread sending this command.
Some work is on-going to make the control queue implementation robust with VDUSE. Until it is completed, let's fail features check if control-queue feature is requested.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_user/vduse_dev.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/vdpa/vdpa_user/vduse_dev.c +5 -0
@@ -8,6 +8,7 @@* */ +#include "linux/virtio_net.h" #include <linux/init.h> #include <linux/module.h> #include <linux/cdev.h>
@@ -28,6 +29,7 @@#include <uapi/linux/virtio_config.h> #include <uapi/linux/virtio_ids.h> #include <uapi/linux/virtio_blk.h> +#include <uapi/linux/virtio_ring.h> #include <linux/mod_devicetable.h> #include "iova_domain.h"
@@ -1671,6 +1673,9 @@ static bool features_is_valid(struct vduse_dev_config *config)if ((config->device_id ==VIRTIO_ID_BLOCK ) && (config->features &BIT_ULL (VIRTIO_BLK_F_CONFIG_WCE )))return false; +else if ((config->device_id ==VIRTIO_ID_NET ) && + (config->features &BIT_ULL (VIRTIO_NET_F_CTRL_VQ ))) +return false;return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/163 x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit 5d31174f3c8c465d9dbe88f6b9d1fe5716f44981 ]
The assembly snippet in restore_fpregs_from_fpstate() that implements X86_BUG_FXSAVE_LEAK fixup loads the value from a random variable, preferably the one that is already in the L1 cache.
However, the access to fpinit_state via *fpstate pointer is not implemented correctly. The "m" asm constraint requires dereferenced pointer variable, otherwise the compiler just reloads the value via temporary stack slot. The current asm code reflects this:
mov %rdi,(%rsp)
...
fildl (%rsp)With dereferenced pointer variable, the code does what the comment above the asm snippet says:
fildl (%rdi)
Also, remove the pointless %P operand modifier. The modifier is ineffective on non-symbolic references - it was used to prevent %rip-relative addresses in .altinstr sections, but FILDL in the .text section can use %rip-relative addresses without problems.
--- arch/x86/kernel/fpu/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/fpu/core.c +2 -2
@@ -145,8 +145,8 @@ void restore_fpregs_from_fpstate(struct fpstate *fpstate, u64 mask) asmvolatile ("fnclex\n\t" "emms\n\t" -"fildl %P[addr]" /* set F?P to defined value */ - : : [addr]"m" (fpstate)); +"fildl %[addr]" /* set F?P to defined value */ + : : [addr]"m" (*fpstate)); }if (use_xsave ()) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/163 mtd: partitions: redboot: Added conversion of operands to a larger type
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
[ Upstream commit 1162bc2f8f5de7da23d18aa4b7fbd4e93c369c50 ]
The value of an arithmetic expression directory * master->erasesize is subject to overflow due to a failure to cast operands to a larger data type before perfroming arithmetic
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/mtd/parsers/redboot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/parsers/redboot.c +1 -1
@@ -102,7 +102,7 @@ static int parse_redboot_partitions(struct mtd_info *master, offset -= master->erasesize; } }else { - offset = directory * master->erasesize; + offset = (unsigned long ) directory * master->erasesize;while (mtd_block_isbad (master, offset)) { offset += master->erasesize;if (offset == master->size)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/163 wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit b7793a1a2f370c28b17d9554b58e9dc51afcfcbd ]
For simplicity, we may want to pass a NULL element, and while we should then pass also a zero length, just be a bit more careful here.
--- include/linux/ieee80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ieee80211.h +1 -1
@@ -4952,7 +4952,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len)bool check_common_len = false;u16 control; -if (len < fixed) +if (!data || len < fixed)return false; control =le16_to_cpu (mle->control);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/163 bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit e8742081db7d01f980c6161ae1e8a1dbc1e30979 ]
syzbot reported uninit memory usages during map_{lookup,delete}_elem.
==========
BUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] BUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline] dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796 ____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline] bpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38 ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997 __bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237 ==========
The reproducer should be in the interpreter mode.
The C reproducer is trying to run the following bpf prog:
0: (18) r0 = 0x0
2: (18) r1 = map[id:49]
4: (b7) r8 = 16777216
5: (7b) *(u64 *)(r10 -8) = r8
6: (bf) r2 = r10
7: (07) r2 += -229
^^^^^^^^^^
8: (b7) r3 = 8
9: (b7) r4 = 0 10: (85) call dev_map_lookup_elem#1543472
11: (95) exit
It is due to the "void *key" (r2) passed to the helper. bpf allows uninit stack memory access for bpf prog with the right privileges. This patch uses kmsan_unpoison_memory() to mark the stack as initialized.
This should address different syzbot reports on the uninit "void *key" argument during map_{lookup,delete}_elem.
--- kernel/bpf/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/core.c +2 -0
@@ -2174,6 +2174,7 @@ static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insnu64 stack[stack_size /sizeof (u64)]; \u64 regs[MAX_BPF_EXT_REG ] = {}; \ \ +kmsan_unpoison_memory (stack,sizeof (stack)); \FP = (u64 ) (unsigned long ) &stack[ARRAY_SIZE (stack)]; \ARG1 = (u64 ) (unsigned long ) ctx; \return ___bpf_prog_run (regs, insn); \
@@ -2187,6 +2188,7 @@ static u64 PROG_NAME_ARGS(stack_size)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5, \u64 stack[stack_size /sizeof (u64)]; \u64 regs[MAX_BPF_EXT_REG ]; \ \ +kmsan_unpoison_memory (stack,sizeof (stack)); \FP = (u64 ) (unsigned long ) &stack[ARRAY_SIZE (stack)]; \BPF_R1 = r1; \BPF_R2 = r2; \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/163 RDMA/restrack: Fix potential invalid address access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenchao Hao <[email protected]>
[ Upstream commit ca537a34775c103f7b14d7bbd976403f1d1525d8 ]
struct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME in ib_create_cq(), while if the module exited but forgot del this rdma_restrack_entry, it would cause a invalid address access in rdma_restrack_clean() when print the owner of this rdma_restrack_entry.
These code is used to help find one forgotten PD release in one of the ULPs. But it is not needed anymore, so delete them.
--- drivers/infiniband/core/restrack.c | 51 +----------------------------- 1 file changed, 1 insertion(+), 50 deletions(-)
drivers/infiniband/core/restrack.c +1 -50
@@ -37,22 +37,6 @@ int rdma_restrack_init(struct ib_device *dev)return 0 ; } -static const char *type2str (enum rdma_restrack_type type) -{ -static const char *const names[RDMA_RESTRACK_MAX ] = { - [RDMA_RESTRACK_PD ] ="PD" , - [RDMA_RESTRACK_CQ ] ="CQ" , - [RDMA_RESTRACK_QP ] ="QP" , - [RDMA_RESTRACK_CM_ID ] ="CM_ID" , - [RDMA_RESTRACK_MR ] ="MR" , - [RDMA_RESTRACK_CTX ] ="CTX" , - [RDMA_RESTRACK_COUNTER ] ="COUNTER" , - [RDMA_RESTRACK_SRQ ] ="SRQ" , - }; - -return names[type]; -}; -/** * rdma_restrack_clean() - clean resource tracking * @dev: IB device
@@ -60,47 +44,14 @@ static const char *type2str(enum rdma_restrack_type type)void rdma_restrack_clean (struct ib_device *dev) {struct rdma_restrack_root *rt = dev->res; -struct rdma_restrack_entry *e; -char buf[TASK_COMM_LEN ]; -bool found = false; -const char *owner;int i;for (i =0 ; i <RDMA_RESTRACK_MAX ; i++) {struct xarray *xa = &dev->res[i].xa; -if (!xa_empty (xa)) { -unsigned long index; - -if (!found) { -pr_err ("restrack: %s" ,CUT_HERE ); -dev_err (&dev->dev,"BUG: RESTRACK detected leak of resources\n" ); - } -xa_for_each (xa, index, e) { -if (rdma_is_kernel_res (e)) { - owner = e->kern_name; - }else { -/* -* There is no need to call get_task_struct here, -* because we can be here only if there are more -* get_task_struct() call than put_task_struct(). -*/ -get_task_comm (buf, e->task); - owner = buf; - } - -pr_err ("restrack: %s %s object allocated by %s is not freed\n" , -rdma_is_kernel_res (e) ?"Kernel" : -"User" , -type2str (e->type), owner); - } - found = true; - } +WARN_ON (!xa_empty (xa));xa_destroy (xa); } -if (found) -pr_err ("restrack: %s" ,CUT_HERE ); -kfree (rt); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/163 net/iucv: Avoid explicit cpumask var allocation on stack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Li <[email protected]>
[ Upstream commit be4e1304419c99a164b4c0e101c7c2a756b635b9 ]
For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow.
Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK.
Use *cpumask_var API(s) to address it.
--- net/iucv/iucv.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
net/iucv/iucv.c +18 -8
@@ -519,7 +519,7 @@ static void iucv_setmask_mp(void)*/ static void iucv_setmask_up (void ) { -cpumask_t cpumask; +static cpumask_t cpumask;int cpu;/* Disable all cpu but the first in cpu_irq_cpumask. */
@@ -627,23 +627,33 @@ static int iucv_cpu_online(unsigned int cpu)static int iucv_cpu_down_prep (unsigned int cpu) { -cpumask_t cpumask; +cpumask_var_t cpumask; +int ret =0 ;if (!iucv_path_table)return 0 ; -cpumask_copy (&cpumask, &iucv_buffer_cpumask); -cpumask_clear_cpu (cpu, &cpumask); -if (cpumask_empty (&cpumask)) +if (!alloc_cpumask_var (&cpumask,GFP_KERNEL )) +return -ENOMEM ; + +cpumask_copy (cpumask, &iucv_buffer_cpumask); +cpumask_clear_cpu (cpu, cpumask); +if (cpumask_empty (cpumask)) {/* Can't offline last IUCV enabled cpu. */ -return -EINVAL ; + ret = -EINVAL ; + goto __free_cpumask; + }iucv_retrieve_cpu (NULL );if (!cpumask_empty (&iucv_irq_cpumask)) -return 0 ; + goto __free_cpumask; +smp_call_function_single (cpumask_first (&iucv_buffer_cpumask), iucv_allow_cpu,NULL ,1 ); -return 0 ; + +__free_cpumask: +free_cpumask_var (cpumask); +return ret; }/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/163 net/dpaa2: Avoid explicit cpumask var allocation on stack
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Li <[email protected]>
[ Upstream commit d33fe1714a44ff540629b149d8fab4ac6967585c ]
For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow.
Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK.
Use *cpumask_var API(s) to address it.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +9 -5
@@ -2896,11 +2896,14 @@ static int dpaa2_eth_xdp_xmit(struct net_device *net_dev, int n,static int update_xps (struct dpaa2_eth_priv *priv) {struct net_device *net_dev = priv->net_dev; -struct cpumask xps_mask; -struct dpaa2_eth_fq *fq;int i, num_queues, netdev_queues; +struct dpaa2_eth_fq *fq; +cpumask_var_t xps_mask;int err =0 ; +if (!alloc_cpumask_var (&xps_mask,GFP_KERNEL )) +return -ENOMEM ; + num_queues =dpaa2_eth_queue_count (priv); netdev_queues = (net_dev->num_tc ? :1 ) * num_queues;
@@ -2910,16 +2913,17 @@ static int update_xps(struct dpaa2_eth_priv *priv)for (i =0 ; i < netdev_queues; i++) { fq = &priv->fq[i % num_queues]; -cpumask_clear (&xps_mask); -cpumask_set_cpu (fq->target_cpu, &xps_mask); +cpumask_clear (xps_mask); +cpumask_set_cpu (fq->target_cpu, xps_mask); - err =netif_set_xps_queue (net_dev, &xps_mask, i); + err =netif_set_xps_queue (net_dev, xps_mask, i);if (err) {netdev_warn_once (net_dev,"Error setting XPS queue\n" );break ; } } +free_cpumask_var (xps_mask);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/163 crypto: ecdh - explicitly zeroize private_key
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joachim Vandersmissen <[email protected]>
[ Upstream commit 73e5984e540a76a2ee1868b91590c922da8c24c9 ]
private_key is overwritten with the key parameter passed in by the caller (if present), or alternatively a newly generated private key. However, it is possible that the caller provides a key (or the newly generated key) which is shorter than the previous key. In that scenario, some key material from the previous key would not be overwritten. The easiest solution is to explicitly zeroize the entire private_key array first.
Note that this patch slightly changes the behavior of this function:
previously, if the ecc_gen_privkey failed, the old private_key would remain. Now, the private_key is always zeroized. This behavior is consistent with the case where params.key is set and ecc_is_key_valid fails.
--- crypto/ecdh.c | 2 ++ 1 file changed, 2 insertions(+)
crypto/ecdh.c +2 -0
@@ -33,6 +33,8 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, params.key_size > sizeof(u64) * ctx->ndigits)return -EINVAL ; +memset (ctx->private_key,0 ,sizeof (ctx->private_key)); +if (!params.key || !params.key_size)return ecc_gen_privkey (ctx->curve_id, ctx->ndigits, ctx->private_key);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/163 ALSA: emux: improve patch ioctl data validation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 89b32ccb12ae67e630c6453d778ec30a592a212f ]
In load_data(), make the validation of and skipping over the main info block match that in load_guspatch().
In load_guspatch(), add checking that the specified patch length matches the actually supplied data, like load_data() already did.
Message-ID: <[email protected]>
--- sound/synth/emux/soundfont.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
sound/synth/emux/soundfont.c +11 -6
@@ -701,7 +701,6 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)struct snd_soundfont *sf;struct soundfont_sample_info sample_info;struct snd_sf_sample *sp; -long off;/* patch must be opened */ sf = sflist->currsf;
@@ -711,12 +710,16 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)if (is_special_type (sf->type))return -EINVAL ; +if (count < (long )sizeof (sample_info)) { +return -EINVAL ; + }if (copy_from_user (&sample_info, data,sizeof (sample_info)))return -EFAULT ; + data +=sizeof (sample_info); + count -=sizeof (sample_info); - off =sizeof (sample_info); - -if (sample_info.size != (count-off)/2 ) +// SoundFont uses S16LE samples. +if (sample_info.size *2 != count)return -EINVAL ;/* Check for dup */
@@ -744,7 +747,7 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)int rc; rc = sflist->callback.sample_new (sflist->callback.private_data, sp, sflist->memhdr, - data + off, count - off); + data, count);if (rc <0 ) {sf_sample_delete (sflist, sf, sp);return rc;
@@ -957,10 +960,12 @@ load_guspatch(struct snd_sf_list *sflist, const char __user *data, }if (copy_from_user (&patch, data,sizeof (patch)))return -EFAULT ; - count -=sizeof (patch); data +=sizeof (patch); +if ((patch.len << (patch.mode &WAVE_16_BITS ?1 :0 )) != count) +return -EINVAL ; + sf =newsf (sflist,SNDRV_SFNT_PAT_TYPE_GUS |SNDRV_SFNT_PAT_SHARED ,NULL );if (sf ==NULL )return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/163 btrfs: use NOFS context when getting inodes during logging and log replay
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit d1825752e3074b5ff8d7f6016160e2b7c5c367ca ]
During inode logging (and log replay too), we are holding a transaction handle and we often need to call btrfs_iget(), which will read an inode from its subvolume btree if it's not loaded in memory and that results in allocating an inode with GFP_KERNEL semantics at the btrfs_alloc_inode() callback - and this may recurse into the filesystem in case we are under memory pressure and attempt to commit the current transaction, resulting in a deadlock since the logging (or log replay) task is holding a transaction handle open.
Syzbot reported this with the following stack traces:
WARNING: possible circular locking dependency detected 6.10.0-rc2-syzkaller-00361-g061d1af7b030 #0 Not tainted
------------------------------------------------------
syz-executor.1/9919 is trying to acquire lock:
ffffffff8dd3aac0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:334 [inline] ffffffff8dd3aac0 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:3891 [inline] ffffffff8dd3aac0 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:3981 [inline] ffffffff8dd3aac0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_lru_noprof+0x58/0x2f0 mm/slub.c:4020
but task is already holding lock:
ffff88804b569358 (&ei->log_mutex){+.+.}-{3:3}, at: btrfs_log_inode+0x39c/0x4660 fs/btrfs/tree-log.c:6481
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&ei->log_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
btrfs_log_inode+0x39c/0x4660 fs/btrfs/tree-log.c:6481
btrfs_log_inode_parent+0x8cb/0x2a90 fs/btrfs/tree-log.c:7079
btrfs_log_dentry_safe+0x59/0x80 fs/btrfs/tree-log.c:7180
btrfs_sync_file+0x9c1/0xe10 fs/btrfs/file.c:1959
vfs_fsync_range+0x141/0x230 fs/sync.c:188
generic_write_sync include/linux/fs.h:2794 [inline]
btrfs_do_write_iter+0x584/0x10c0 fs/btrfs/file.c:1705
new_sync_write fs/read_write.c:497 [inline]
vfs_write+0x6b6/0x1140 fs/read_write.c:590
ksys_write+0x12f/0x260 fs/read_write.c:643
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e-> #2 (btrfs_trans_num_extwriters){++++}-{0:0}:
join_transaction+0x164/0xf40 fs/btrfs/transaction.c:315
start_transaction+0x427/0x1a70 fs/btrfs/transaction.c:700
btrfs_commit_super+0xa1/0x110 fs/btrfs/disk-io.c:4170
close_ctree+0xcb0/0xf90 fs/btrfs/disk-io.c:4324
generic_shutdown_super+0x159/0x3d0 fs/super.c:642
kill_anon_super+0x3a/0x60 fs/super.c:1226
btrfs_kill_super+0x3b/0x50 fs/btrfs/super.c:2096
deactivate_locked_super+0xbe/0x1a0 fs/super.c:473
deactivate_super+0xde/0x100 fs/super.c:506
cleanup_mnt+0x222/0x450 fs/namespace.c:1267
task_work_run+0x14e/0x250 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x278/0x2a0 kernel/entry/common.c:218
__do_fast_syscall_32+0x80/0x120 arch/x86/entry/common.c:389
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e-> #1 (btrfs_trans_num_writers){++++}-{0:0}:
__lock_release kernel/locking/lockdep.c:5468 [inline]
lock_release+0x33e/0x6c0 kernel/locking/lockdep.c:5774
percpu_up_read include/linux/percpu-rwsem.h:99 [inline]
__sb_end_write include/linux/fs.h:1650 [inline]
sb_end_intwrite include/linux/fs.h:1767 [inline]
__btrfs_end_transaction+0x5ca/0x920 fs/btrfs/transaction.c:1071
btrfs_commit_inode_delayed_inode+0x228/0x330 fs/btrfs/delayed-inode.c:1301
btrfs_evict_inode+0x960/0xe80 fs/btrfs/inode.c:5291
evict+0x2ed/0x6c0 fs/inode.c:667
iput_final fs/inode.c:1741 [inline]
iput.part.0+0x5a8/0x7f0 fs/inode.c:1767
iput+0x5c/0x80 fs/inode.c:1757
dentry_unlink_inode+0x295/0x480 fs/dcache.c:400
__dentry_kill+0x1d0/0x600 fs/dcache.c:603
dput.part.0+0x4b1/0x9b0 fs/dcache.c:845
dput+0x1f/0x30 fs/dcache.c:835
ovl_stack_put+0x60/0x90 fs/overlayfs/util.c:132
ovl_destroy_inode+0xc6/0x190 fs/overlayfs/super.c:182
destroy_inode+0xc4/0x1b0 fs/inode.c:311
iput_final fs/inode.c:1741 [inline]
iput.part.0+0x5a8/0x7f0 fs/inode.c:1767
iput+0x5c/0x80 fs/inode.c:1757
dentry_unlink_inode+0x295/0x480 fs/dcache.c:400
__dentry_kill+0x1d0/0x600 fs/dcache.c:603
shrink_kill fs/dcache.c:1048 [inline]
shrink_dentry_list+0x140/0x5d0 fs/dcache.c:1075
prune_dcache_sb+0xeb/0x150 fs/dcache.c:1156
super_cache_scan+0x32a/0x550 fs/super.c:221
do_shrink_slab+0x44f/0x11c0 mm/shrinker.c:435
shrink_slab_memcg mm/shrinker.c:548 [inline]
shrink_slab+0xa87/0x1310 mm/shrinker.c:626
shrink_one+0x493/0x7c0 mm/vmscan.c:4790
shrink_many mm/vmscan.c:4851 [inline]
lru_gen_shrink_node+0x89f/0x1750 mm/vmscan.c:4951
shrink_node mm/vmscan.c:5910 [inline]
kswapd_shrink_node mm/vmscan.c:6720 [inline]
balance_pgdat+0x1105/0x1970 mm/vmscan.c:6911
kswapd+0x5ea/0xbf0 mm/vmscan.c:7180
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244-> #0 (fs_reclaim){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137
lock_acquire kernel/locking/lockdep.c:5754 [inline]
lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
__fs_reclaim_acquire mm/page_alloc.c:3801 [inline]
fs_reclaim_acquire+0x102/0x160 mm/page_alloc.c:3815
might_alloc include/linux/sched/mm.h:334 [inline]
slab_pre_alloc_hook mm/slub.c:3891 [inline]
slab_alloc_node mm/slub.c:3981 [inline]
kmem_cache_alloc_lru_noprof+0x58/0x2f0 mm/slub.c:4020
btrfs_alloc_inode+0x118/0xb20 fs/btrfs/inode.c:8411
alloc_inode+0x5d/0x230 fs/inode.c:261
iget5_locked fs/inode.c:1235 [inline]
iget5_locked+0x1c9/0x2c0 fs/inode.c:1228
btrfs_iget_locked fs/btrfs/inode.c:5590 [inline]
btrfs_iget_path fs/btrfs/inode.c:5607 [inline]
btrfs_iget+0xfb/0x230 fs/btrfs/inode.c:5636
add_conflicting_inode fs/btrfs/tree-log.c:5657 [inline]
copy_inode_items_to_log+0x1039/0x1e30 fs/btrfs/tree-log.c:5928
btrfs_log_inode+0xa48/0x4660 fs/btrfs/tree-log.c:6592
log_new_delayed_dentries fs/btrfs/tree-log.c:6363 [inline]
btrfs_log_inode+0x27dd/0x4660 fs/btrfs/tree-log.c:6718
btrfs_log_all_parents fs/btrfs/tree-log.c:6833 [inline]
btrfs_log_inode_parent+0x22ba/0x2a90 fs/btrfs/tree-log.c:7141
btrfs_log_dentry_safe+0x59/0x80 fs/btrfs/tree-log.c:7180
btrfs_sync_file+0x9c1/0xe10 fs/btrfs/file.c:1959
vfs_fsync_range+0x141/0x230 fs/sync.c:188
generic_write_sync include/linux/fs.h:2794 [inline]
btrfs_do_write_iter+0x584/0x10c0 fs/btrfs/file.c:1705
do_iter_readv_writev+0x504/0x780 fs/read_write.c:741
vfs_writev+0x36f/0xde0 fs/read_write.c:971
do_pwritev+0x1b2/0x260 fs/read_write.c:1072
__do_compat_sys_pwritev2 fs/read_write.c:1218 [inline]
__se_compat_sys_pwritev2 fs/read_write.c:1210 [inline]
__ia32_compat_sys_pwritev2+0x121/0x1b0 fs/read_write.c:1210
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8eother info that might help us debug this:
Chain exists of:
fs_reclaim --> btrfs_trans_num_extwriters --> &ei->log_mutex
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(&ei->log_mutex);
lock(btrfs_trans_num_extwriters);
lock(&ei->log_mutex);
lock(fs_reclaim);*** DEADLOCK ***
7 locks held by syz-executor.1/9919:
#0: ffff88802be20420 (sb_writers#23){.+.+}-{0:0}, at: do_pwritev+0x1b2/0x260 fs/read_write.c:1072
#1: ffff888065c0f8f0 (&sb->s_type->i_mutex_key#33){++++}-{3:3}, at: inode_lock include/linux/fs.h:791 [inline] #1: ffff888065c0f8f0 (&sb->s_type->i_mutex_key#33){++++}-{3:3}, at: btrfs_inode_lock+0xc8/0x110 fs/btrfs/inode.c:385 #2: ffff888065c0f778 (&ei->i_mmap_lock){++++}-{3:3}, at: btrfs_inode_lock+0xee/0x110 fs/btrfs/inode.c:388 #3: ffff88802be20610 (sb_internal#4){.+.+}-{0:0}, at: btrfs_sync_file+0x95b/0xe10 fs/btrfs/file.c:1952 #4: ffff8880546323f0 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x430/0xf40 fs/btrfs/transaction.c:290 #5: ffff888054632418 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x430/0xf40 fs/btrfs/transaction.c:290 #6: ffff88804b569358 (&ei->log_mutex){+.+.}-{3:3}, at: btrfs_log_inode+0x39c/0x4660 fs/btrfs/tree-log.c:6481
stack backtrace: CPU: 2 PID: 9919 Comm: syz-executor.1 Not tainted 6.10.0-rc2-syzkaller-00361-g061d1af7b030 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 check_noncircular+0x31a/0x400 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3869 [inline] __lock_acquire+0x2478/0x3b30 kernel/locking/lockdep.c:5137 lock_acquire kernel/locking/lockdep.c:5754 [inline] lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719 __fs_reclaim_acquire mm/page_alloc.c:3801 [inline] fs_reclaim_acquire+0x102/0x160 mm/page_alloc.c:3815 might_alloc include/linux/sched/mm.h:334 [inline] slab_pre_alloc_hook mm/slub.c:3891 [inline] slab_alloc_node mm/slub.c:3981 [inline] kmem_cache_alloc_lru_noprof+0x58/0x2f0 mm/slub.c:4020 btrfs_alloc_inode+0x118/0xb20 fs/btrfs/inode.c:8411 alloc_inode+0x5d/0x230 fs/inode.c:261 iget5_locked fs/inode.c:1235 [inline] iget5_locked+0x1c9/0x2c0 fs/inode.c:1228 btrfs_iget_locked fs/btrfs/inode.c:5590 [inline] btrfs_iget_path fs/btrfs/inode.c:5607 [inline] btrfs_iget+0xfb/0x230 fs/btrfs/inode.c:5636 add_conflicting_inode fs/btrfs/tree-log.c:5657 [inline] copy_inode_items_to_log+0x1039/0x1e30 fs/btrfs/tree-log.c:5928 btrfs_log_inode+0xa48/0x4660 fs/btrfs/tree-log.c:6592 log_new_delayed_dentries fs/btrfs/tree-log.c:6363 [inline] btrfs_log_inode+0x27dd/0x4660 fs/btrfs/tree-log.c:6718 btrfs_log_all_parents fs/btrfs/tree-log.c:6833 [inline] btrfs_log_inode_parent+0x22ba/0x2a90 fs/btrfs/tree-log.c:7141 btrfs_log_dentry_safe+0x59/0x80 fs/btrfs/tree-log.c:7180 btrfs_sync_file+0x9c1/0xe10 fs/btrfs/file.c:1959 vfs_fsync_range+0x141/0x230 fs/sync.c:188 generic_write_sync include/linux/fs.h:2794 [inline] btrfs_do_write_iter+0x584/0x10c0 fs/btrfs/file.c:1705 do_iter_readv_writev+0x504/0x780 fs/read_write.c:741 vfs_writev+0x36f/0xde0 fs/read_write.c:971 do_pwritev+0x1b2/0x260 fs/read_write.c:1072 __do_compat_sys_pwritev2 fs/read_write.c:1218 [inline] __se_compat_sys_pwritev2 fs/read_write.c:1210 [inline] __ia32_compat_sys_pwritev2+0x121/0x1b0 fs/read_write.c:1210 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386 do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7334579 Code: b8 01 10 06 03 (...) RSP: 002b:00000000f5f265ac EFLAGS: 00000292 ORIG_RAX: 000000000000017b RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000200002c0 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Fix this by ensuring we are under a NOFS scope whenever we call btrfs_iget() during inode logging and log replay.
--- fs/btrfs/tree-log.c | 43 ++++++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 15 deletions(-)
fs/btrfs/tree-log.c +28 -15
@@ -140,6 +140,25 @@ static void wait_log_commit(struct btrfs_root *root, int transid);* and once to do all the other items. */ +static struct inode *btrfs_iget_logging (u64 objectid,struct btrfs_root *root) +{ +unsigned int nofs_flag; +struct inode *inode; + +/* +* We're holding a transaction handle whether we are logging or +* replaying a log tree, so we must make sure NOFS semantics apply +* because btrfs_alloc_inode() may be triggered and it uses GFP_KERNEL +* to allocate an inode, which can recurse back into the filesystem and +* attempt a transaction commit, resulting in a deadlock. +*/ + nofs_flag =memalloc_nofs_save (); + inode =btrfs_iget (root->fs_info->sb, objectid, root); +memalloc_nofs_restore (nofs_flag); + +return inode; +} +/* * start a sub transaction and setup the log tree * this increments the log tree writer count to make the people
@@ -603,7 +622,7 @@ static noinline struct inode *read_one_inode(struct btrfs_root *root, {struct inode *inode; - inode =btrfs_iget (root->fs_info->sb, objectid, root); + inode =btrfs_iget_logging (objectid, root);if (IS_ERR (inode)) inode =NULL ;return inode;
@@ -5377,7 +5396,6 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans, struct btrfs_log_ctx *ctx) {struct btrfs_root *root = start_inode->root; -struct btrfs_fs_info *fs_info = root->fs_info;struct btrfs_path *path;LIST_HEAD (dir_list);struct btrfs_dir_list *dir_elem;
@@ -5438,7 +5456,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans,continue ;btrfs_release_path (path); - di_inode =btrfs_iget (fs_info->sb, di_key.objectid, root); + di_inode =btrfs_iget_logging (di_key.objectid, root);if (IS_ERR (di_inode)) { ret =PTR_ERR (di_inode); goto out;
@@ -5498,7 +5516,7 @@ static int log_new_dir_dentries(struct btrfs_trans_handle *trans,btrfs_add_delayed_iput (curr_inode); curr_inode =NULL ; - vfs_inode =btrfs_iget (fs_info->sb, ino, root); + vfs_inode =btrfs_iget_logging (ino, root);if (IS_ERR (vfs_inode)) { ret =PTR_ERR (vfs_inode);break ;
@@ -5593,7 +5611,7 @@ static int add_conflicting_inode(struct btrfs_trans_handle *trans,if (ctx->num_conflict_inodes >=MAX_CONFLICT_INODES )return BTRFS_LOG_FORCE_COMMIT ; - inode =btrfs_iget (root->fs_info->sb, ino, root); + inode =btrfs_iget_logging (ino, root);/* * If the other inode that had a conflicting dir entry was deleted in * the current transaction then we either:
@@ -5694,7 +5712,6 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,struct btrfs_root *root, struct btrfs_log_ctx *ctx) { - struct btrfs_fs_info *fs_info = root->fs_info; int ret = 0;/*
@@ -5725,7 +5742,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,list_del (&curr->list);kfree (curr); - inode =btrfs_iget (fs_info->sb, ino, root); + inode =btrfs_iget_logging (ino, root);/* * If the other inode that had a conflicting dir entry was * deleted in the current transaction, we need to log its parent
@@ -5736,7 +5753,7 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans,if (ret != -ENOENT )break ; - inode =btrfs_iget (fs_info->sb, parent, root); + inode =btrfs_iget_logging (parent, root);if (IS_ERR (inode)) { ret =PTR_ERR (inode);break ;
@@ -6258,7 +6275,6 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans, struct btrfs_log_ctx *ctx) {const bool orig_log_new_dentries = ctx->log_new_dentries; -struct btrfs_fs_info *fs_info = trans->fs_info;struct btrfs_delayed_item *item;int ret =0 ;
@@ -6284,7 +6300,7 @@ static int log_new_delayed_dentries(struct btrfs_trans_handle *trans,if (key.type ==BTRFS_ROOT_ITEM_KEY )continue ; - di_inode =btrfs_iget (fs_info->sb, key.objectid, inode->root); + di_inode =btrfs_iget_logging (key.objectid, inode->root);if (IS_ERR (di_inode)) { ret =PTR_ERR (di_inode);break ;
@@ -6668,7 +6684,6 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans,struct btrfs_inode *inode, struct btrfs_log_ctx *ctx) { - struct btrfs_fs_info *fs_info = trans->fs_info; int ret;struct btrfs_path *path;struct btrfs_key key;
@@ -6733,8 +6748,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans, cur_offset = item_size; } - dir_inode =btrfs_iget (fs_info->sb, inode_key.objectid, - root); + dir_inode =btrfs_iget_logging (inode_key.objectid, root);/* * If the parent inode was deleted, return an error to * fallback to a transaction commit. This is to prevent
@@ -6796,7 +6810,6 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans,btrfs_item_key_to_cpu (path->nodes[0 ], &found_key, path->slots[0 ]);while (true) { -struct btrfs_fs_info *fs_info = root->fs_info;struct extent_buffer *leaf;int slot;struct btrfs_key search_key;
@@ -6811,7 +6824,7 @@ static int log_new_ancestors(struct btrfs_trans_handle *trans, search_key.objectid = found_key.offset; search_key.type =BTRFS_INODE_ITEM_KEY ; search_key.offset =0 ; - inode =btrfs_iget (fs_info->sb, ino, root); + inode =btrfs_iget_logging (ino, root);if (IS_ERR (inode))return PTR_ERR (inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/163 media: dvbdev: Initialize sbuf
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 17d1316de0d7dc1bdc5d6e3ad4efd30a9bf1a381 ]
Because the size passed to copy_from_user() cannot be known beforehand, it needs to be checked during runtime with check_object_size. That makes gcc believe that the content of sbuf can be used before init.
Fix:./include/linux/thread_info.h:215:17: warning: ‘sbuf’ may be used uninitialized [-Wmaybe-uninitialized]
--- drivers/media/dvb-core/dvbdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-core/dvbdev.c +1 -1
@@ -956,7 +956,7 @@ int dvb_usercopy(struct file *file,int (*func)(struct file *file, unsigned int cmd, void *arg)) { -char sbuf[128 ]; +char sbuf[128 ] = {};void *mbuf =NULL ;void *parg =NULL ;int err = -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/163 irqchip/loongson: Select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP for IRQ_LOONGARCH_CPU
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 42a7d887664b02a747ef5d479f6fd01081564af8 ]
An interrupt's effective affinity can only be different from its configured affinity if there are multiple CPUs. Make it clear that this option is only meaningful when SMP is enabled. Otherwise, there exists "WARNING: unmet direct dependencies detected for GENERIC_IRQ_EFFECTIVE_AFF_MASK" when make menuconfig if CONFIG_SMP is not set on LoongArch.
--- drivers/irqchip/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/Kconfig +1 -1
@@ -557,7 +557,7 @@ config IRQ_LOONGARCH_CPU bool select GENERIC_IRQ_CHIP select IRQ_DOMAIN - select GENERIC_IRQ_EFFECTIVE_AFF_MASK + select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP select LOONGSON_HTVEC select LOONGSON_LIOINTC select LOONGSON_EIOINTC
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/163 soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit ddbf3204f600a4d1f153498f618369fca352ae00 ]
mbox_send_message() sends a u32 bit message, not a pointer to a message. We only convert to a pointer type as a generic type. If we want to send a dummy message of 0, then simply send 0 (NULL).
--- drivers/soc/ti/wkup_m3_ipc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/ti/wkup_m3_ipc.c +2 -5
@@ -16,7 +16,6 @@#include <linux/irq.h> #include <linux/module.h> #include <linux/of.h> -#include <linux/omap-mailbox.h> #include <linux/platform_device.h> #include <linux/remoteproc.h> #include <linux/suspend.h>
@@ -314,7 +313,6 @@ static irqreturn_t wkup_m3_txev_handler(int irq, void *ipc_data)static int wkup_m3_ping (struct wkup_m3_ipc *m3_ipc) {struct device *dev = m3_ipc->dev; -mbox_msg_t dummy_msg =0 ;int ret;if (!m3_ipc->mbox) {
@@ -330,7 +328,7 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc)* the RX callback to avoid multiple interrupts being received * by the CM3. */ - ret =mbox_send_message (m3_ipc->mbox, &dummy_msg); + ret =mbox_send_message (m3_ipc->mbox,NULL );if (ret <0 ) {dev_err (dev,"%s: mbox_send_message() failed: %d\n" , __func__, ret);
@@ -352,7 +350,6 @@ static int wkup_m3_ping(struct wkup_m3_ipc *m3_ipc)static int wkup_m3_ping_noirq (struct wkup_m3_ipc *m3_ipc) {struct device *dev = m3_ipc->dev; -mbox_msg_t dummy_msg =0 ;int ret;if (!m3_ipc->mbox) {
@@ -361,7 +358,7 @@ static int wkup_m3_ping_noirq(struct wkup_m3_ipc *m3_ipc)return -EIO ; } - ret =mbox_send_message (m3_ipc->mbox, &dummy_msg); + ret =mbox_send_message (m3_ipc->mbox,NULL );if (ret <0 ) {dev_err (dev,"%s: mbox_send_message() failed: %d\n" , __func__, ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/163 Fix race for duplicate reqsk on identical SYN
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: luoxuanqiang <[email protected]>
[ Upstream commit ff46e3b4421923937b7f6e44ffcd3549a074f321 ]
When bonding is configured in BOND_MODE_BROADCAST mode, if two identical SYN packets are received at the same time and processed on different CPUs, it can potentially create the same sk (sock) but two different reqsk (request_sock) in tcp_conn_request().
These two different reqsk will respond with two SYNACK packets, and since the generation of the seq (ISN) incorporates a timestamp, the final two SYNACK packets will have different seq values.
The consequence is that when the Client receives and replies with an ACK to the earlier SYNACK packet, we will reset(RST) it.
========================================================================
This behavior is consistently reproducible in my local setup, which comprises:
| NETA1 ------ NETB1 |
PC_A --- bond --- | | --- bond --- PC_B
| NETA2 ------ NETB2 |- PC_A is the Server and has two network cards, NETA1 and NETA2. I have bonded these two cards using BOND_MODE_BROADCAST mode and configured them to be handled by different CPU.
- PC_B is the Client, also equipped with two network cards, NETB1 and NETB2, which are also bonded and configured in BOND_MODE_BROADCAST mode.
If the client attempts a TCP connection to the server, it might encounter a failure. Capturing packets from the server side reveals:
10.10.10.10.45182 > localhost: Flags [S], seq 320236027, 10.10.10.10.45182 > localhost: Flags [S], seq 320236027, localhost > 10.10.10.10.45182: Flags [S.], seq 2967855116, localhost > 10.10.10.10.45182: Flags [S.], seq 2967855123, <== 10.10.10.10.45182 > localhost: Flags [.], ack 4294967290, 10.10.10.10.45182 > localhost: Flags [.], ack 4294967290, localhost > 10.10.10.10.45182: Flags [R], seq 2967855117, <== localhost > 10.10.10.10.45182: Flags [R], seq 2967855117,
Two SYNACKs with different seq numbers are sent by localhost, resulting in an anomaly.
========================================================================
The attempted solution is as follows:
Add a return value to inet_csk_reqsk_queue_hash_add() to confirm if the ehash insertion is successful (Up to now, the reason for unsuccessful insertion is that a reqsk for the same connection has already been inserted). If the insertion fails, release the reqsk.
Due to the refcnt, Kuniyuki suggests also adding a return value check for the DCCP module; if ehash insertion fails, indicating a successful insertion of the same connection, simply release the reqsk as well.
Simultaneously, In the reqsk_queue_hash_req(), the start of the req->rsk_timer is adjusted to be after successful insertion.
--- include/net/inet_connection_sock.h | 2 +- net/dccp/ipv4.c | 7 +++++-- net/dccp/ipv6.c | 7 +++++-- net/ipv4/inet_connection_sock.c | 17 +++++++++++++---- net/ipv4/tcp_input.c | 7 ++++++- 5 files changed, 30 insertions(+), 10 deletions(-)
include/net/inet_connection_sock.h +1 -1
@@ -264,7 +264,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,struct sock *inet_csk_reqsk_queue_add (struct sock *sk,struct request_sock *req,struct sock *child); -void inet_csk_reqsk_queue_hash_add (struct sock *sk,struct request_sock *req, +bool inet_csk_reqsk_queue_hash_add (struct sock *sk,struct request_sock *req,unsigned long timeout); struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child, struct request_sock *req,
net/dccp/ipv4.c +5 -2
@@ -655,8 +655,11 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)if (dccp_v4_send_response (sk, req)) goto drop_and_free; -inet_csk_reqsk_queue_hash_add (sk, req,DCCP_TIMEOUT_INIT ); -reqsk_put (req); +if (unlikely (!inet_csk_reqsk_queue_hash_add (sk, req,DCCP_TIMEOUT_INIT ))) +reqsk_free (req); +else +reqsk_put (req); +return 0 ; drop_and_free:
net/dccp/ipv6.c +5 -2
@@ -398,8 +398,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)if (dccp_v6_send_response (sk, req)) goto drop_and_free; -inet_csk_reqsk_queue_hash_add (sk, req,DCCP_TIMEOUT_INIT ); -reqsk_put (req); +if (unlikely (!inet_csk_reqsk_queue_hash_add (sk, req,DCCP_TIMEOUT_INIT ))) +reqsk_free (req); +else +reqsk_put (req); +return 0 ; drop_and_free:
net/ipv4/inet_connection_sock.c +13 -4
@@ -1116,25 +1116,34 @@ static void reqsk_timer_handler(struct timer_list *t)inet_csk_reqsk_queue_drop_and_put (oreq->rsk_listener, oreq); } -static void reqsk_queue_hash_req (struct request_sock *req, +static bool reqsk_queue_hash_req (struct request_sock *req,unsigned long timeout) { +bool found_dup_sk = false; + +if (!inet_ehash_insert (req_to_sk (req),NULL , &found_dup_sk)) +return false; + +/* The timer needs to be setup after a successful insertion. */ timer_setup (&req->rsk_timer, reqsk_timer_handler,TIMER_PINNED );mod_timer (&req->rsk_timer, jiffies + timeout); -inet_ehash_insert (req_to_sk (req),NULL ,NULL );/* before letting lookups find us, make sure all req fields * are committed to memory and refcnt initialized. */ smp_wmb ();refcount_set (&req->rsk_refcnt,2 +1 ); +return true; } -void inet_csk_reqsk_queue_hash_add (struct sock *sk,struct request_sock *req, +bool inet_csk_reqsk_queue_hash_add (struct sock *sk,struct request_sock *req,unsigned long timeout) { -reqsk_queue_hash_req (req, timeout); +if (!reqsk_queue_hash_req (req, timeout)) +return false; +inet_csk_reqsk_queue_added (sk); +return true; }EXPORT_SYMBOL_GPL (inet_csk_reqsk_queue_hash_add);
net/ipv4/tcp_input.c +6 -1
@@ -7091,7 +7091,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,tcp_rsk (req)->tfo_listener = false;if (!want_cookie) { req->timeout =tcp_timeout_init ((struct sock *)req); -inet_csk_reqsk_queue_hash_add (sk, req, req->timeout); +if (unlikely (!inet_csk_reqsk_queue_hash_add (sk, req, + req->timeout))) { +reqsk_free (req); +return 0 ; + } + } af_ops->send_synack(sk, dst, &fl, req, &foc, !want_cookie ? TCP_SYNACK_NORMAL :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/163 ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2 messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c5ab94ea280a9b4108723eecf0a636e22a5bb137 ]
The conversion from the legacy event to MIDI2 UMP for RPN and NRPN missed the setup of the channel number, resulting in always the channel 0. Fix it.
--- sound/core/seq/seq_ump_convert.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/seq/seq_ump_convert.c +5 -3
@@ -791,7 +791,8 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event,/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ static void fill_rpn (struct snd_seq_ump_midi2_bank *cc, -union snd_ump_midi2_msg *data) +union snd_ump_midi2_msg *data, +unsigned char channel) {if (cc->rpn_set) { data->rpn.status =UMP_MSG_STATUS_RPN ;
@@ -808,6 +809,7 @@ static void fill_rpn(struct snd_seq_ump_midi2_bank *cc, } data->rpn.data =upscale_14_to_32bit ((cc->cc_data_msb <<7 ) | cc->cc_data_lsb); + data->rpn.channel = channel; cc->cc_data_msb = cc->cc_data_lsb =0 ; }
@@ -855,7 +857,7 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_data_lsb = val;if (!(cc->rpn_set || cc->nrpn_set))return 0 ;// skip -fill_rpn (cc, data); +fill_rpn (cc, data, channel);return 1 ; }
@@ -957,7 +959,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_data_lsb = lsb;if (!(cc->rpn_set || cc->nrpn_set))return 0 ;// skip -fill_rpn (cc, data); +fill_rpn (cc, data, channel);return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/163 net: dsa: microchip: fix wrong register write when masking interrupt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristram Ha <[email protected]>
[ Upstream commit b1c4b4d45263241ec6c2405a8df8265d4b58e707 ]
The switch global port interrupt mask, REG_SW_PORT_INT_MASK__4, is defined as 0x001C in ksz9477_reg.h. The designers used 32-bit value in anticipation for increase of port count in future product but currently the maximum port count is 7 and the effective value is 0x7F in register 0x001F. Each port has its own interrupt mask and is defined as 0x#01F. It uses only 4 bits for different interrupts.
The developer who implemented the current interrupt mechanism in the switch driver noticed there are similarities between the mechanism to mask port interrupts in global interrupt and individual interrupts in each port and so used the same code to handle these interrupts. He updated the code to use the new macro REG_SW_PORT_INT_MASK__1 which is defined as 0x1F in ksz_common.h but he forgot to update the 32-bit write to 8-bit as now the mask registers are 0x1F and 0x#01F.
In addition all KSZ switches other than the KSZ9897/KSZ9893 and LAN937X families use only 8-bit access and so this common code will eventually be changed to accommodate them.
--- drivers/net/dsa/microchip/ksz_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/microchip/ksz_common.c +1 -1
@@ -1973,7 +1973,7 @@ static void ksz_irq_bus_sync_unlock(struct irq_data *d)struct ksz_device *dev = kirq->dev;int ret; - ret =ksz_write32 (dev, kirq->reg_mask, kirq->masked); + ret =ksz_write8 (dev, kirq->reg_mask, kirq->masked);if (ret)dev_err (dev->dev,"failed to change IRQ mask\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/163 sparc: fix old compat_sys_select()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit bae6428a9fffb2023191b0723e276cf1377a7c9f ]
sparc has two identical select syscalls at numbers 93 and 230, respectively. During the conversion to the modern syscall.tbl format, the older one of the two broke in compat mode, and now refers to the native 64-bit syscall.
Restore the correct behavior. This has very little effect, as glibc has been using the newer number anyway.
--- arch/sparc/kernel/syscalls/syscall.tbl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/kernel/syscalls/syscall.tbl +1 -1
@@ -117,7 +117,7 @@ 90 common dup2 sys_dup2 91 32 setfsuid32 sys_setfsuid 92 common fcntl sys_fcntl compat_sys_fcntl -93 common select sys_select +93 common select sys_select compat_sys_select 94 32 setfsgid32 sys_setfsgid 95 common fsync sys_fsync 96 common setpriority sys_setpriority
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/163 sparc: fix compat recv/recvfrom syscalls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit d6fbd26fb872ec518d25433a12e8ce8163e20909 ]
sparc has the wrong compat version of recv() and recvfrom() for both the direct syscalls and socketcall().
The direct syscalls just need to use the compat version. For socketcall, the same thing could be done, but it seems better to completely remove the custom assembler code for it and just use the same implementation that everyone else has.
--- arch/sparc/kernel/sys32.S | 221 ------------------------- arch/sparc/kernel/syscalls/syscall.tbl | 4 +- 2 files changed, 2 insertions(+), 223 deletions(-)
arch/sparc/kernel/sys32.S +0 -221
@@ -18,224 +18,3 @@ sys32_mmap2: sethi %hi(sys_mmap), %g1 jmpl %g1 + %lo(sys_mmap), %g0 sllx %o5, 12, %o5 - - .align 32 - .globl sys32_socketcall -sys32_socketcall: /* %o0=call, %o1=args */ - cmp %o0, 1 - bl,pn %xcc, do_einval - cmp %o0, 18 - bg,pn %xcc, do_einval - sub %o0, 1, %o0 - sllx %o0, 5, %o0 - sethi %hi(__socketcall_table_begin), %g2 - or %g2, %lo(__socketcall_table_begin), %g2 - jmpl %g2 + %o0, %g0 - nop -do_einval: - retl - mov -EINVAL, %o0 - - .align 32 -__socketcall_table_begin: - - /* Each entry is exactly 32 bytes. */ -do_sys_socket: /* sys_socket(int, int, int) */ -1: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_socket), %g1 -2: ldswa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_socket), %g0 -3: ldswa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_bind: /* sys_bind(int fd, struct sockaddr *, int) */ -4: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_bind), %g1 -5: ldswa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_bind), %g0 -6: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_connect: /* sys_connect(int, struct sockaddr *, int) */ -7: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_connect), %g1 -8: ldswa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_connect), %g0 -9: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_listen: /* sys_listen(int, int) */ -10: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_listen), %g1 - jmpl %g1 + %lo(sys_listen), %g0 -11: ldswa [%o1 + 0x4] %asi, %o1 - nop - nop - nop - nop -do_sys_accept: /* sys_accept(int, struct sockaddr *, int *) */ -12: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_accept), %g1 -13: lduwa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_accept), %g0 -14: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_getsockname: /* sys_getsockname(int, struct sockaddr *, int *) */ -15: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_getsockname), %g1 -16: lduwa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_getsockname), %g0 -17: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_getpeername: /* sys_getpeername(int, struct sockaddr *, int *) */ -18: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_getpeername), %g1 -19: lduwa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(sys_getpeername), %g0 -20: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_socketpair: /* sys_socketpair(int, int, int, int *) */ -21: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_socketpair), %g1 -22: ldswa [%o1 + 0x8] %asi, %o2 -23: lduwa [%o1 + 0xc] %asi, %o3 - jmpl %g1 + %lo(sys_socketpair), %g0 -24: ldswa [%o1 + 0x4] %asi, %o1 - nop - nop -do_sys_send: /* sys_send(int, void *, size_t, unsigned int) */ -25: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_send), %g1 -26: lduwa [%o1 + 0x8] %asi, %o2 -27: lduwa [%o1 + 0xc] %asi, %o3 - jmpl %g1 + %lo(sys_send), %g0 -28: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop -do_sys_recv: /* sys_recv(int, void *, size_t, unsigned int) */ -29: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_recv), %g1 -30: lduwa [%o1 + 0x8] %asi, %o2 -31: lduwa [%o1 + 0xc] %asi, %o3 - jmpl %g1 + %lo(sys_recv), %g0 -32: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop -do_sys_sendto: /* sys_sendto(int, u32, compat_size_t, unsigned int, u32, int) */ -33: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_sendto), %g1 -34: lduwa [%o1 + 0x8] %asi, %o2 -35: lduwa [%o1 + 0xc] %asi, %o3 -36: lduwa [%o1 + 0x10] %asi, %o4 -37: ldswa [%o1 + 0x14] %asi, %o5 - jmpl %g1 + %lo(sys_sendto), %g0 -38: lduwa [%o1 + 0x4] %asi, %o1 -do_sys_recvfrom: /* sys_recvfrom(int, u32, compat_size_t, unsigned int, u32, u32) */ -39: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_recvfrom), %g1 -40: lduwa [%o1 + 0x8] %asi, %o2 -41: lduwa [%o1 + 0xc] %asi, %o3 -42: lduwa [%o1 + 0x10] %asi, %o4 -43: lduwa [%o1 + 0x14] %asi, %o5 - jmpl %g1 + %lo(sys_recvfrom), %g0 -44: lduwa [%o1 + 0x4] %asi, %o1 -do_sys_shutdown: /* sys_shutdown(int, int) */ -45: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_shutdown), %g1 - jmpl %g1 + %lo(sys_shutdown), %g0 -46: ldswa [%o1 + 0x4] %asi, %o1 - nop - nop - nop - nop -do_sys_setsockopt: /* sys_setsockopt(int, int, int, char *, int) */ -47: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_setsockopt), %g1 -48: ldswa [%o1 + 0x8] %asi, %o2 -49: lduwa [%o1 + 0xc] %asi, %o3 -50: ldswa [%o1 + 0x10] %asi, %o4 - jmpl %g1 + %lo(sys_setsockopt), %g0 -51: ldswa [%o1 + 0x4] %asi, %o1 - nop -do_sys_getsockopt: /* sys_getsockopt(int, int, int, u32, u32) */ -52: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_getsockopt), %g1 -53: ldswa [%o1 + 0x8] %asi, %o2 -54: lduwa [%o1 + 0xc] %asi, %o3 -55: lduwa [%o1 + 0x10] %asi, %o4 - jmpl %g1 + %lo(sys_getsockopt), %g0 -56: ldswa [%o1 + 0x4] %asi, %o1 - nop -do_sys_sendmsg: /* compat_sys_sendmsg(int, struct compat_msghdr *, unsigned int) */ -57: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(compat_sys_sendmsg), %g1 -58: lduwa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(compat_sys_sendmsg), %g0 -59: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int) */ -60: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(compat_sys_recvmsg), %g1 -61: lduwa [%o1 + 0x8] %asi, %o2 - jmpl %g1 + %lo(compat_sys_recvmsg), %g0 -62: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - nop -do_sys_accept4: /* sys_accept4(int, struct sockaddr *, int *, int) */ -63: ldswa [%o1 + 0x0] %asi, %o0 - sethi %hi(sys_accept4), %g1 -64: lduwa [%o1 + 0x8] %asi, %o2 -65: ldswa [%o1 + 0xc] %asi, %o3 - jmpl %g1 + %lo(sys_accept4), %g0 -66: lduwa [%o1 + 0x4] %asi, %o1 - nop - nop - - .section __ex_table,"a" - .align 4 - .word 1b, __retl_efault, 2b, __retl_efault - .word 3b, __retl_efault, 4b, __retl_efault - .word 5b, __retl_efault, 6b, __retl_efault - .word 7b, __retl_efault, 8b, __retl_efault - .word 9b, __retl_efault, 10b, __retl_efault - .word 11b, __retl_efault, 12b, __retl_efault - .word 13b, __retl_efault, 14b, __retl_efault - .word 15b, __retl_efault, 16b, __retl_efault - .word 17b, __retl_efault, 18b, __retl_efault - .word 19b, __retl_efault, 20b, __retl_efault - .word 21b, __retl_efault, 22b, __retl_efault - .word 23b, __retl_efault, 24b, __retl_efault - .word 25b, __retl_efault, 26b, __retl_efault - .word 27b, __retl_efault, 28b, __retl_efault - .word 29b, __retl_efault, 30b, __retl_efault - .word 31b, __retl_efault, 32b, __retl_efault - .word 33b, __retl_efault, 34b, __retl_efault - .word 35b, __retl_efault, 36b, __retl_efault - .word 37b, __retl_efault, 38b, __retl_efault - .word 39b, __retl_efault, 40b, __retl_efault - .word 41b, __retl_efault, 42b, __retl_efault - .word 43b, __retl_efault, 44b, __retl_efault - .word 45b, __retl_efault, 46b, __retl_efault - .word 47b, __retl_efault, 48b, __retl_efault - .word 49b, __retl_efault, 50b, __retl_efault - .word 51b, __retl_efault, 52b, __retl_efault - .word 53b, __retl_efault, 54b, __retl_efault - .word 55b, __retl_efault, 56b, __retl_efault - .word 57b, __retl_efault, 58b, __retl_efault - .word 59b, __retl_efault, 60b, __retl_efault - .word 61b, __retl_efault, 62b, __retl_efault - .word 63b, __retl_efault, 64b, __retl_efault - .word 65b, __retl_efault, 66b, __retl_efault - .previous
arch/sparc/kernel/syscalls/syscall.tbl +2 -2
@@ -155,7 +155,7 @@ 123 32 fchown sys_fchown16 123 64 fchown sys_fchown 124 common fchmod sys_fchmod -125 common recvfrom sys_recvfrom +125 common recvfrom sys_recvfrom compat_sys_recvfrom 126 32 setreuid sys_setreuid16 126 64 setreuid sys_setreuid 127 32 setregid sys_setregid16
@@ -247,7 +247,7 @@ 204 32 readdir sys_old_readdir compat_sys_old_readdir 204 64 readdir sys_nis_syscall 205 common readahead sys_readahead compat_sys_readahead -206 common socketcall sys_socketcall sys32_socketcall +206 common socketcall sys_socketcall compat_sys_socketcall 207 common syslog sys_syslog 208 common lookup_dcookie sys_lookup_dcookie compat_sys_lookup_dcookie 209 common fadvise64 sys_fadvise64 compat_sys_fadvise64
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/163 parisc: use correct compat recv/recvfrom syscalls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 20a50787349fadf66ac5c48f62e58d753878d2bb ]
Johannes missed parisc back when he introduced the compat version of these syscalls, so receiving cmsg messages that require a compat conversion is still broken.
Use the correct calls like the other architectures do.
--- arch/parisc/kernel/syscalls/syscall.tbl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/kernel/syscalls/syscall.tbl +2 -2
@@ -108,7 +108,7 @@ 95 common fchown sys_fchown 96 common getpriority sys_getpriority 97 common setpriority sys_setpriority -98 common recv sys_recv +98 common recv sys_recv compat_sys_recv 99 common statfs sys_statfs compat_sys_statfs 100 common fstatfs sys_fstatfs compat_sys_fstatfs 101 common stat64 sys_stat64
@@ -135,7 +135,7 @@ 120 common clone sys_clone_wrapper 121 common setdomainname sys_setdomainname 122 common sendfile sys_sendfile compat_sys_sendfile -123 common recvfrom sys_recvfrom +123 common recvfrom sys_recvfrom compat_sys_recvfrom 124 32 adjtimex sys_adjtimex_time32 124 64 adjtimex sys_adjtimex 125 common mprotect sys_mprotect
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/163 ice: Rebuild TC queues on VSI queue reconfiguration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Sokolowski <[email protected]>
[ Upstream commit f4b91c1d17c676b8ad4c6bd674da874f3f7d5701 ]
TC queues needs to be correctly updated when the number of queues on a VSI is reconfigured, so netdev's queue and TC settings will be dynamically adjusted and could accurately represent the underlying hardware state after changes to the VSI queue counts.
--- drivers/net/ethernet/intel/ice/ice_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +9 -1
@@ -3958,7 +3958,7 @@ bool ice_is_wol_supported(struct ice_hw *hw)int ice_vsi_recfg_qs (struct ice_vsi *vsi,int new_rx,int new_tx,bool locked) {struct ice_pf *pf = vsi->back; -int err =0 , timeout =50 ; +int i, err =0 , timeout =50 ;if (!new_rx && !new_tx)return -EINVAL ;
@@ -3984,6 +3984,14 @@ int ice_vsi_recfg_qs(struct ice_vsi *vsi, int new_rx, int new_tx, bool locked)ice_vsi_close (vsi);ice_vsi_rebuild (vsi,ICE_VSI_FLAG_NO_INIT ); + +ice_for_each_traffic_class (i) { +if (vsi->tc_cfg.ena_tc &BIT (i)) +netdev_set_tc_queue (vsi->netdev, + vsi->tc_cfg.tc_info[i].netdev_tc, + vsi->tc_cfg.tc_info[i].qcount_tx, + vsi->tc_cfg.tc_info[i].qoffset); + }ice_pf_dcb_recfg (pf, locked);ice_vsi_open (vsi); done:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/163 drm/radeon/radeon_display: Decrease the size of allocated memory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erick Archer <[email protected]>
[ Upstream commit ae6a233092747e9652eb793d92f79d0820e01c6a ]
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1] [2].
In this case, the memory allocated to store RADEONFB_CONN_LIMIT pointers to "drm_connector" structures can be avoided. This is because this memory area is never accessed.
Also, in the kzalloc function, it is preferred to use sizeof(*pointer) instead of sizeof(type) due to the type of the variable can change and one needs not change the former (unlike the latter).
At the same time take advantage to remove the "#if 0" block, the code where the removed memory area was accessed, and the RADEONFB_CONN_LIMIT constant due to now is never used.
--- drivers/gpu/drm/radeon/radeon.h | 1 - drivers/gpu/drm/radeon/radeon_display.c | 8 +------- 2 files changed, 1 insertion(+), 8 deletions(-)
drivers/gpu/drm/radeon/radeon.h +0 -1
@@ -132,7 +132,6 @@ extern int radeon_cik_support;/* RADEON_IB_POOL_SIZE must be a power of 2 */ #define RADEON_IB_POOL_SIZE 16#define RADEON_DEBUGFS_MAX_COMPONENTS 32 -#define RADEONFB_CONN_LIMIT 4#define RADEON_BIOS_NUM_SCRATCH 8/* internal ring indices */
drivers/gpu/drm/radeon/radeon_display.c +1 -7
@@ -683,7 +683,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index)struct radeon_device *rdev = dev->dev_private;struct radeon_crtc *radeon_crtc; - radeon_crtc =kzalloc (sizeof (struct radeon_crtc ) + (RADEONFB_CONN_LIMIT *sizeof (struct drm_connector *)),GFP_KERNEL ); + radeon_crtc =kzalloc (sizeof (*radeon_crtc),GFP_KERNEL );if (radeon_crtc ==NULL )return ;
@@ -709,12 +709,6 @@ static void radeon_crtc_init(struct drm_device *dev, int index) dev->mode_config.cursor_width = radeon_crtc->max_cursor_width; dev->mode_config.cursor_height = radeon_crtc->max_cursor_height; -#if 0 - radeon_crtc->mode_set.crtc = &radeon_crtc->base; - radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc +1 ); - radeon_crtc->mode_set.num_connectors =0 ; -#endif -if (rdev->is_atom_bios && (ASIC_IS_AVIVO (rdev) || radeon_r4xx_atom))radeon_atombios_init_crtc (dev, radeon_crtc);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/163 x86: stop playing stack games in profile_pc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit 093d9603b60093a9aaae942db56107f6432a5dca ]
The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up making assumptions based on the stack layout that aren't necessarily valid.
Basically, the code tries to account the time spent in spinlocks to the caller rather than the spinlock, and while I support that as a concept, it's not worth the code complexity or the KASAN warnings when no serious profiling is done using timers anyway these days.
And the code really does depend on stack layout that is only true in the simplest of cases. We've lost the comment at some point (I think when the 32-bit and 64-bit code was unified), but it used to say:
Assume the lock function has either no stack frame or a copy of eflags from PUSHF.
which explains why it just blindly loads a word or two straight off the stack pointer and then takes a minimal look at the values to just check if they might be eflags or the return pc:
Eflags always has bits 22 and up cleared unlike kernel addresses
but that basic stack layout assumption assumes that there isn't any lock debugging etc going on that would complicate the code and cause a stack frame.
It causes KASAN unhappiness reported for years by syzkaller [1] and others [2].
With no real practical reason for this any more, just remove the code.
Just for historical interest, here's some background commits relating to this code from 2006:
0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels") 31679f38d886 ("Simplify profile_pc on x86-64")
and a code unification from 2009:
ef4512882dbe ("x86: time_32/64.c unify profile_pc")
but the basics of this thing actually goes back to before the git tree.
--- arch/x86/kernel/time.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-)
arch/x86/kernel/time.c +1 -19
@@ -27,25 +27,7 @@unsigned long profile_pc (struct pt_regs *regs) { -unsigned long pc =instruction_pointer (regs); - -if (!user_mode (regs) &&in_lock_functions (pc)) { -#ifdef CONFIG_FRAME_POINTER -return *(unsigned long *)(regs->bp +sizeof (long )); -#else -unsigned long *sp = (unsigned long *)regs->sp; -/* -* Return address is either directly at stack pointer -* or above a saved flags. Eflags has bits 22-31 zero, -* kernel addresses don't. -*/ -if (sp[0 ] >>22 ) -return sp[0 ]; -if (sp[1 ] >>22 ) -return sp[1 ]; -#endif - } -return pc; +return instruction_pointer (regs); }EXPORT_SYMBOL (profile_pc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/163 parisc: use generic sys_fanotify_mark implementation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 403f17a330732a666ae793f3b15bc75bb5540524 ]
The sys_fanotify_mark() syscall on parisc uses the reverse word order for the two halves of the 64-bit argument compared to all syscalls on all 32-bit architectures. As far as I can tell, the problem is that the function arguments on parisc are sorted backwards (26, 25, 24, 23, ...) compared to everyone else, so the calling conventions of using an even/odd register pair in native word order result in the lower word coming first in function arguments, matching the expected behavior on little-endian architectures. The system call conventions however ended up matching what the other 32-bit architectures do.
A glibc cleanup in 2020 changed the userspace behavior in a way that handles all architectures consistently, but this inadvertently broke parisc32 by changing to the same method as everyone else.
The change made it into glibc-2.35 and subsequently into debian 12 (bookworm), which is the latest stable release. This means we need to choose between reverting the glibc change or changing the kernel to match it again, but either hange will leave some systems broken.
Pick the option that is more likely to help current and future users and change the kernel to match current glibc. This also means the behavior is now consistent across architectures, but it breaks running new kernels with old glibc builds before 2.35.
---
I found this through code inspection, please double-check to make sure I got the bug and the fix right.
The alternative is to fix this by reverting glibc back to the unusual behavior.
--- arch/parisc/Kconfig | 1 + arch/parisc/kernel/sys_parisc32.c | 9 --------- arch/parisc/kernel/syscalls/syscall.tbl | 2 +- 3 files changed, 2 insertions(+), 10 deletions(-)
arch/parisc/Kconfig +1 -0
@@ -14,6 +14,7 @@ config PARISC select ARCH_HAS_UBSAN_SANITIZE_ALL select ARCH_HAS_PTE_SPECIAL select ARCH_NO_SG_CHAIN + select ARCH_SPLIT_ARG64 if !64BIT select ARCH_SUPPORTS_HUGETLBFS if PA20 select ARCH_SUPPORTS_MEMORY_FAILURE select ARCH_STACKWALK
arch/parisc/kernel/sys_parisc32.c +0 -9
@@ -23,12 +23,3 @@ asmlinkage long sys32_unimplemented(int r26, int r25, int r24, int r23, current->comm, current->pid, r20);return -ENOSYS ; } - -asmlinkage long sys32_fanotify_mark (compat_int_t fanotify_fd,compat_uint_t flags, -compat_uint_t mask0,compat_uint_t mask1,compat_int_t dfd, -const char __user * pathname) -{ -return sys_fanotify_mark (fanotify_fd, flags, - ((__u64 )mask1 <<32 ) | mask0, - dfd, pathname); -}
arch/parisc/kernel/syscalls/syscall.tbl +1 -1
@@ -364,7 +364,7 @@ 320 common accept4 sys_accept4 321 common prlimit64 sys_prlimit64 322 common fanotify_init sys_fanotify_init -323 common fanotify_mark sys_fanotify_mark sys32_fanotify_mark +323 common fanotify_mark sys_fanotify_mark compat_sys_fanotify_mark 324 32 clock_adjtime sys_clock_adjtime32 324 64 clock_adjtime sys_clock_adjtime 325 common name_to_handle_at sys_name_to_handle_at
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/163 Revert "MIPS: pci: lantiq: restore reset gpio polarity"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <[email protected]>
commit 6e5aee08bd2517397c9572243a816664f2ead547 upstream.
This reverts commit 277a0363120276645ae598d8d5fea7265e076ae9.
While fixing old boards with broken DTs, this change will break newer ones with correct gpio polarity annotation.
--- arch/mips/pci/pci-lantiq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/mips/pci/pci-lantiq.c +4 -4
@@ -124,14 +124,14 @@ static int ltq_pci_startup(struct platfoclk_disable (clk_external);/* setup reset gpio used by pci */ - reset_gpio =devm_gpiod_get_optional (&pdev->dev,"reset" ,GPIOD_ASIS ); + reset_gpio =devm_gpiod_get_optional (&pdev->dev,"reset" , +GPIOD_OUT_LOW ); error =PTR_ERR_OR_ZERO (reset_gpio);if (error) {dev_err (&pdev->dev,"failed to request gpio: %d\n" , error);return error; }gpiod_set_consumer_name (reset_gpio,"pci_reset" ); -gpiod_direction_output (reset_gpio,1 );/* enable auto-switching between PCI and EBU */ ltq_pci_w32 (0xa ,PCI_CR_CLK_CTRL );
@@ -194,10 +194,10 @@ static int ltq_pci_startup(struct platfo/* toggle reset pin */ if (reset_gpio) { -gpiod_set_value_cansleep (reset_gpio,0 ); +gpiod_set_value_cansleep (reset_gpio,1 );wmb ();mdelay (1 ); -gpiod_set_value_cansleep (reset_gpio,1 ); +gpiod_set_value_cansleep (reset_gpio,0 ); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 81/163 pinctrl: qcom: spmi-gpio: drop broken pm8008 support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 8da86499d4cd125a9561f9cd1de7fba99b0aecbf upstream.
The SPMI GPIO driver assumes that the parent device is an SPMI device and accesses random data when backcasting the parent struct device pointer for non-SPMI devices.
Fortunately this does not seem to cause any issues currently when the parent device is an I2C client like the PM8008, but this could change if the structures are reorganised (e.g. using structure randomisation).
Notably the interrupt implementation is also broken for non-SPMI devices.
Also note that the two GPIO pins on PM8008 are used for interrupts and reset so their practical use should be limited.
Drop the broken GPIO support for PM8008 for now.
--- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +0 -1
@@ -1207,7 +1207,6 @@ static const struct of_device_id pmic_gp { .compatible = "qcom,pm7325-gpio", .data = (void *) 10 }, { .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8}, { .compatible = "qcom,pm8005-gpio", .data = (void *) 4 }, - { .compatible = "qcom,pm8008-gpio", .data = (void *) 2 }, { .compatible = "qcom,pm8019-gpio", .data = (void *) 6 }, /* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */ { .compatible = "qcom,pm8150-gpio", .data = (void *) 10 },
Greg Kroah-Hartman
maintainerPATCH 82/163 ocfs2: fix DIO failure due to insufficient transaction credits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit be346c1a6eeb49d8fda827d2a9522124c2f72f36 upstream.
The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents.
Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error. This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem.
To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written().
Heming Zhao said:
------
PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error"
PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA"
#0 machine_kexec at ffffffff8c069932
#1 __crash_kexec at ffffffff8c1338fa
#2 panic at ffffffff8c1d69b9
#3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]
#5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]
#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] #11 dio_complete at ffffffff8c2b9fa7
#12 do_blockdev_direct_IO at ffffffff8c2bc09f
#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write at ffffffff8c1dcf14 #15 __generic_file_write_iter at ffffffff8c1dd07b #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] #17 aio_write at ffffffff8c2cc72e
#18 kmem_cache_alloc at ffffffff8c248dde
#19 do_io_submit at ffffffff8c2ccada
#20 do_syscall_64 at ffffffff8c004984
#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba
--- fs/ocfs2/aops.c | 5 +++++ fs/ocfs2/journal.c | 17 +++++++++++++++++ fs/ocfs2/journal.h | 2 ++ fs/ocfs2/ocfs2_trace.h | 2 ++ 4 files changed, 26 insertions(+)
fs/ocfs2/aops.c +5 -0
@@ -2370,6 +2370,11 @@ static int ocfs2_dio_end_io_write(struct }list_for_each_entry (ue, &dwc->dw_zero_list, ue_node) { + ret =ocfs2_assure_trans_credits (handle, credits); +if (ret <0 ) { +mlog_errno (ret); +break ; + } ret = ocfs2_mark_extent_written(inode, &et, handle, ue->ue_cpos, 1, ue->ue_phys,
fs/ocfs2/journal.c +17 -0
@@ -446,6 +446,23 @@ bail: }/* +* Make sure handle has at least 'nblocks' credits available. If it does not +* have that many credits available, we will try to extend the handle to have +* enough credits. If that fails, we will restart transaction to have enough +* credits. Similar notes regarding data consistency and locking implications +* as for ocfs2_extend_trans() apply here. +*/ +int ocfs2_assure_trans_credits (handle_t *handle,int nblocks) +{ +int old_nblks =jbd2_handle_buffer_credits (handle); + +trace_ocfs2_assure_trans_credits (old_nblks); +if (old_nblks >= nblocks) +return 0 ; +return ocfs2_extend_trans (handle, nblocks - old_nblks); +} + +/* * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA. * If that fails, restart the transaction & regain write access for the * buffer head which is used for metadata modifications.
fs/ocfs2/journal.h +2 -0
@@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(structint ocfs2_commit_trans (struct ocfs2_super *osb,handle_t *handle);int ocfs2_extend_trans (handle_t *handle,int nblocks); +int ocfs2_assure_trans_credits (handle_t *handle, +int nblocks);int ocfs2_allocate_extend_trans (handle_t *handle,int thresh);
fs/ocfs2/ocfs2_trace.h +2 -0
@@ -2579,6 +2579,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commitDEFINE_OCFS2_INT_INT_EVENT (ocfs2_extend_trans); +DEFINE_OCFS2_INT_EVENT (ocfs2_assure_trans_credits); +DEFINE_OCFS2_INT_EVENT (ocfs2_extend_trans_restart);DEFINE_OCFS2_INT_INT_EVENT (ocfs2_allocate_extend_trans);
Greg Kroah-Hartman
maintainerPATCH 83/163 nfs: drop the incorrect assertion in nfs_swap_rw()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 54e7d59841dab977f6cb1183d658b1b82c9f4e94 upstream.
Since commit 2282679fb20b ("mm: submit multipage write for SWP_FS_OPS swap-space"), we can plug multiple pages then unplug them all together. That means iov_iter_count(iter) could be way bigger than PAGE_SIZE, it actually equals the size of iov_iter_npages(iter, INT_MAX).
Note this issue has nothing to do with large folios as we don't support THP_SWPOUT to non-block devices.
--- fs/nfs/direct.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfs/direct.c +0 -2
@@ -141,8 +141,6 @@ int nfs_swap_rw(struct kiocb *iocb, stru {ssize_t ret; -VM_BUG_ON (iov_iter_count (iter) !=PAGE_SIZE ); -if (iov_iter_rw (iter) ==READ ) ret =nfs_file_direct_read (iocb, iter, true);else
Greg Kroah-Hartman
maintainerPATCH 84/163 mm: fix incorrect vbq reference in purge_fragmented_block
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <[email protected]>
commit 8c61291fd8500e3b35c7ec0c781b273d8cc96cde upstream.
xa_for_each() in _vm_unmap_aliases() loops through all vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks xarray") the vb from xarray may not be on the corresponding CPU vmap_block_queue. Consequently, purge_fragmented_block() might use the wrong vbq->lock to protect the free list, leading to vbq->free breakage.
Incorrect lock protection can exhaust all vmalloc space as follows:
CPU0 CPU1
+--------------------------------------------+
| +--------------------+ +-----+ |
+--> | |---->| |------+
| CPU1:vbq free_list | | vb1 |
+--- | |<----| |<-----+
| +--------------------+ +-----+ |
+--------------------------------------------+_vm_unmap_aliases() vb_alloc()
new_vmap_block()xa_for_each(&vbq->vmap_blocks, idx, vb)
--> vb in CPU1:vbq->freelist
purge_fragmented_block(vb)spin_lock(&vbq->lock) spin_lock(&vbq->lock)
--> use CPU0:vbq->lock --> use CPU1:vbq->lock
list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free)
__list_del(vb->prev, vb->next)
next->prev = prev
+--------------------+
| |
| CPU1:vbq free_list |
+---| |<--+
| +--------------------+ |
+----------------------------+
__list_add(new, head->prev, head)
+--------------------------------------------+
| +--------------------+ +-----+ |
+--> | |---->| |------+
| CPU1:vbq free_list | | vb2 |
+--- | |<----| |<-----+
| +--------------------+ +-----+ |
+--------------------------------------------+ prev->next = next
+--------------------------------------------+
|----------------------------+ |
| +--------------------+ | +-----+ |
+--> | |--+ | |------+
| CPU1:vbq free_list | | vb2 |
+--- | |<----| |<-----+
| +--------------------+ +-----+ |
+--------------------------------------------+Here’s a list breakdown. All vbs, which were to be added to ‘prev’, cannot be used by list_for_each_entry_rcu(vb, &vbq->free, free_list) in vb_alloc(). Thus, vmalloc space is exhausted.
This issue affects both erofs and f2fs, the stacktrace is as follows:
erofs:
[<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624
[<ffffffd4ffb946f4>] schedule+0x7c
[<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24
[<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0
[<ffffffd4ff1b46f4>] z_erofs_lz4_decompress+0x278 [<ffffffd4ff1b8ac4>] z_erofs_decompress_queue+0x650 [<ffffffd4ff1b8328>] z_erofs_runqueue+0x7f4 [<ffffffd4ff1b66a8>] z_erofs_read_folio+0x104 [<ffffffd4feeb6fec>] filemap_read_folio+0x6c [<ffffffd4feeb68c4>] filemap_fault+0x300 [<ffffffd4fef0ecac>] __do_fault+0xc8
[<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70
[<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0
f2fs:
[<ffffffd4ffb93ad4>] __switch_to+0x174 [<ffffffd4ffb942f0>] __schedule+0x624 [<ffffffd4ffb946f4>] schedule+0x7c [<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24 [<ffffffd4ffb962ec>] __mutex_lock+0x374 [<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14 [<ffffffd4ffb95954>] mutex_lock+0x24 [<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44 [<ffffffd4fef25908>] alloc_vmap_area+0x2e0 [<ffffffd4fef24ea0>] vm_map_ram+0x1b0 [<ffffffd4ff1a3b60>] f2fs_prepare_decomp_mem+0x144 [<ffffffd4ff1a6c24>] f2fs_alloc_dic+0x264 [<ffffffd4ff175468>] f2fs_read_multi_pages+0x428 [<ffffffd4ff17b46c>] f2fs_mpage_readpages+0x314 [<ffffffd4ff1785c4>] f2fs_readahead+0x50 [<ffffffd4feec3384>] read_pages+0x80 [<ffffffd4feec32c0>] page_cache_ra_unbounded+0x1a0 [<ffffffd4feec39e8>] page_cache_ra_order+0x274 [<ffffffd4feeb6cec>] do_sync_mmap_readahead+0x11c [<ffffffd4feeb6764>] filemap_fault+0x1a0 [<ffffffd4ff1423bc>] f2fs_filemap_fault+0x28 [<ffffffd4fef0ecac>] __do_fault+0xc8 [<ffffffd4fef0c908>] handle_mm_fault+0xb38 [<ffffffd4ffb9f008>] do_page_fault+0x288 [<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40 [<ffffffd4fec39c78>] do_mem_abort+0x58 [<ffffffd4ffb8c3e4>] el0_ia+0x70 [<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0 [<ffffffd4fec11588>] ret_to_user[jt]+0x0
To fix this, introducee cpu within vmap_block to record which this vb belongs to.
--- mm/vmalloc.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
mm/vmalloc.c +15 -6
@@ -1939,6 +1939,7 @@ struct vmap_block {struct list_head free_list;struct rcu_head rcu_head;struct list_head purge; +unsigned int cpu; };/* Queue of free and dirty vmap blocks, for allocation and flushing purposes */
@@ -2066,8 +2067,15 @@ static void *new_vmap_block(unsigned intfree_vmap_area (va);return ERR_PTR (err); } - - vbq =raw_cpu_ptr (&vmap_block_queue); +/* +* list_add_tail_rcu could happened in another core +* rather than vb->cpu due to task migration, which +* is safe as list_add_tail_rcu will ensure the list's +* integrity together with list_for_each_rcu from read +* side. +*/ + vb->cpu =raw_smp_processor_id (); + vbq =per_cpu_ptr (&vmap_block_queue, vb->cpu);spin_lock (&vbq->lock);list_add_tail_rcu (&vb->free_list, &vbq->free);spin_unlock (&vbq->lock);
@@ -2093,9 +2101,10 @@ static void free_vmap_block(struct vmap_ }static bool purge_fragmented_block (struct vmap_block *vb, -struct vmap_block_queue *vbq,struct list_head *purge_list, -bool force_purge) +struct list_head *purge_list,bool force_purge) { +struct vmap_block_queue *vbq = &per_cpu (vmap_block_queue, vb->cpu); +if (vb->free + vb->dirty !=VMAP_BBMAP_BITS || vb->dirty ==VMAP_BBMAP_BITS )return false;
@@ -2143,7 +2152,7 @@ static void purge_fragmented_blocks(intcontinue ;spin_lock (&vb->lock); -purge_fragmented_block (vb, vbq, &purge, true); +purge_fragmented_block (vb, &purge, true);spin_unlock (&vb->lock); }rcu_read_unlock ();
@@ -2280,7 +2289,7 @@ static void _vm_unmap_aliases(unsigned l* not purgeable, check whether there is dirty * space to be flushed. */ -if (!purge_fragmented_block (vb, vbq, &purge_list, false) && +if (!purge_fragmented_block (vb, &purge_list, false) && vb->dirty_max && vb->dirty !=VMAP_BBMAP_BITS ) {unsigned long va_start = vb->va->va_start;unsigned long s, e;
Greg Kroah-Hartman
maintainerPATCH 85/163 mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit a91bf3b3beadbb4f8b3bbc7969fb2ae1615e25c8 upstream.
sdhci_pci_o2_probe() uses pci_read_config_{byte,dword}() that return PCIBIOS_* codes. The return code is then returned as is but as sdhci_pci_o2_probe() is probe function chain, it should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning them. Add a label for read failure so that the conversion can be done in one place rather than on all of the return statements.
--- drivers/mmc/host/sdhci-pci-o2micro.c | 41 ++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 19 deletions(-)
drivers/mmc/host/sdhci-pci-o2micro.c +22 -19
@@ -823,7 +823,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch &=0x7f ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);
@@ -834,7 +834,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_CLKREQ , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x20 ;pci_write_config_byte (chip->pdev,O2_SD_CLKREQ , scratch);
@@ -843,7 +843,7 @@ static int sdhci_pci_o2_probe(struct sdh*/ ret =pci_read_config_byte (chip->pdev,O2_SD_CAPS , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x01 ;pci_write_config_byte (chip->pdev,O2_SD_CAPS , scratch);pci_write_config_byte (chip->pdev,O2_SD_CAPS ,0x73 );
@@ -856,7 +856,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_INF_MOD , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x08 ;pci_write_config_byte (chip->pdev,O2_SD_INF_MOD , scratch);
@@ -864,7 +864,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x80 ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);break ;
@@ -875,7 +875,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch &=0x7f ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);
@@ -886,7 +886,7 @@ static int sdhci_pci_o2_probe(struct sdhO2_SD_FUNC_REG0 , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 = ((scratch_32 &0xFF000000 ) >>24 );/* Check Whether subId is 0x11 or 0x12 */
@@ -898,7 +898,7 @@ static int sdhci_pci_o2_probe(struct sdhO2_SD_FUNC_REG4 , &scratch_32);if (ret) -return ret; + goto read_fail;/* Enable Base Clk setting change */ scratch_32 |=O2_SD_FREG4_ENABLE_CLK_SET ;
@@ -921,7 +921,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_dword (chip->pdev,O2_SD_CLK_SETTING , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 &= ~(0xFF00 ); scratch_32 |=0x07E0C800 ;
@@ -931,14 +931,14 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_dword (chip->pdev,O2_SD_CLKREQ , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 |=0x3 ;pci_write_config_dword (chip->pdev,O2_SD_CLKREQ , scratch_32); ret =pci_read_config_dword (chip->pdev,O2_SD_PLL_SETTING , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 &= ~(0x1F3F070E ); scratch_32 |=0x18270106 ;
@@ -949,7 +949,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_dword (chip->pdev,O2_SD_CAP_REG2 , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 &= ~(0xE0 );pci_write_config_dword (chip->pdev,O2_SD_CAP_REG2 , scratch_32);
@@ -961,7 +961,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x80 ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);break ;
@@ -971,7 +971,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch &=0x7f ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);
@@ -979,7 +979,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_dword (chip->pdev,O2_SD_PLL_SETTING , &scratch_32);if (ret) -return ret; + goto read_fail;if ((scratch_32 &0xff000000 ) ==0x01000000 ) { scratch_32 &=0x0000FFFF ;
@@ -998,7 +998,7 @@ static int sdhci_pci_o2_probe(struct sdhO2_SD_FUNC_REG4 , &scratch_32);if (ret) -return ret; + goto read_fail; scratch_32 |= (1 <<22 );pci_write_config_dword (chip->pdev,O2_SD_FUNC_REG4 , scratch_32);
@@ -1017,7 +1017,7 @@ static int sdhci_pci_o2_probe(struct sdh ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x80 ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);break ;
@@ -1028,7 +1028,7 @@ static int sdhci_pci_o2_probe(struct sdh/* UnLock WP */ ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch &=0x7f ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);
@@ -1057,13 +1057,16 @@ static int sdhci_pci_o2_probe(struct sdh/* Lock WP */ ret =pci_read_config_byte (chip->pdev,O2_SD_LOCK_WP , &scratch);if (ret) -return ret; + goto read_fail; scratch |=0x80 ;pci_write_config_byte (chip->pdev,O2_SD_LOCK_WP , scratch);break ; }return 0 ; + +read_fail: +return pcibios_err_to_errno (ret); }#ifdef CONFIG_PM_SLEEP
Greg Kroah-Hartman
maintainerPATCH 86/163 mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Dasu <[email protected]>
commit d77dc388cd61dfdafe30b98025fa827498378199 upstream.
When erase/trim/discard completion was converted to mmc_poll_for_busy(), optional support to poll with the host_ops->card_busy() callback was also added.
The common sdhci's ->card_busy() turns out not to be working as expected for the sdhci-brcmstb variant, as it keeps returning busy beyond the card's busy period. In particular, this leads to the below splat for mmc_do_erase() when running a discard (BLKSECDISCARD) operation during mkfs.f2fs:
Info: [/dev/mmcblk1p9] Discarding device
[ 39.597258] sysrq: Show Blocked State
[ 39.601183] task:mkfs.f2fs state:D stack:0 pid:1561 tgid:1561 ppid:1542 flags:0x0000000d
[ 39.610609] Call trace:
[ 39.613098] __switch_to+0xd8/0xf4
[ 39.616582] __schedule+0x440/0x4f4
[ 39.620137] schedule+0x2c/0x48
[ 39.623341] schedule_hrtimeout_range_clock+0xe0/0x114
[ 39.628562] schedule_hrtimeout_range+0x10/0x18
[ 39.633169] usleep_range_state+0x5c/0x90
[ 39.637253] __mmc_poll_for_busy+0xec/0x128
[ 39.641514] mmc_poll_for_busy+0x48/0x70
[ 39.645511] mmc_do_erase+0x1ec/0x210
[ 39.649237] mmc_erase+0x1b4/0x1d4
[ 39.652701] mmc_blk_mq_issue_rq+0x35c/0x6ac
[ 39.657037] mmc_mq_queue_rq+0x18c/0x214
[ 39.661022] blk_mq_dispatch_rq_list+0x3a8/0x528
[ 39.665722] __blk_mq_sched_dispatch_requests+0x3a0/0x4ac
[ 39.671198] blk_mq_sched_dispatch_requests+0x28/0x5c
[ 39.676322] blk_mq_run_hw_queue+0x11c/0x12c
[ 39.680668] blk_mq_flush_plug_list+0x200/0x33c
[ 39.685278] blk_add_rq_to_plug+0x68/0xd8
[ 39.689365] blk_mq_submit_bio+0x3a4/0x458
[ 39.693539] __submit_bio+0x1c/0x80
[ 39.697096] submit_bio_noacct_nocheck+0x94/0x174
[ 39.701875] submit_bio_noacct+0x1b0/0x22c
[ 39.706042] submit_bio+0xac/0xe8
[ 39.709424] blk_next_bio+0x4c/0x5c
[ 39.712973] blkdev_issue_secure_erase+0x118/0x170
[ 39.717835] blkdev_common_ioctl+0x374/0x728
[ 39.722175] blkdev_ioctl+0x8c/0x2b0
[ 39.725816] vfs_ioctl+0x24/0x40
[ 39.729117] __arm64_sys_ioctl+0x5c/0x8c
[ 39.733114] invoke_syscall+0x68/0xec
[ 39.736839] el0_svc_common.constprop.0+0x70/0xd8
[ 39.741609] do_el0_svc+0x18/0x20
[ 39.744981] el0_svc+0x68/0x94
[ 39.748107] el0t_64_sync_handler+0x88/0x124
[ 39.752455] el0t_64_sync+0x168/0x16cTo fix the problem let's override the host_ops->card_busy() callback by setting it to NULL, which forces the mmc core to poll with a CMD13 and checking the R1_STATUS in the mmc_busy_cb() function.
--- drivers/mmc/host/sdhci-brcmstb.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mmc/host/sdhci-brcmstb.c +4 -0
@@ -23,6 +23,7 @@#define BRCMSTB_MATCH_FLAGS_NO_64BIT BIT(0)#define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT BIT(1)#define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE BIT(2) +#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY BIT(4)#define BRCMSTB_PRIV_FLAGS_HAS_CQE BIT(0)#define BRCMSTB_PRIV_FLAGS_GATE_CLOCK BIT(1)
@@ -325,6 +326,9 @@ static int sdhci_brcmstb_probe(struct plif (match_priv->flags &BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT ) host->quirks |=SDHCI_QUIRK_BROKEN_TIMEOUT_VAL ; +if (!(match_priv->flags &BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY )) + host->mmc_host_ops.card_busy =NULL ; +/* Change the base clock frequency if the DT property exists */ if (device_property_read_u32 (&pdev->dev,"clock-frequency" , &priv->base_freq_hz) !=0 )
Greg Kroah-Hartman
maintainerPATCH 87/163 mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d upstream.
jmicron_pmos() and sdhci_pci_probe() use pci_{read,write}_config_byte() that return PCIBIOS_* codes. The return code is then returned as is by jmicron_probe() and sdhci_pci_probe(). Similarly, the return code is also returned as is from jmicron_resume(). Both probe and resume functions should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning them the fix these issues.
--- drivers/mmc/host/sdhci-pci-core.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/mmc/host/sdhci-pci-core.c +7 -4
@@ -1325,7 +1325,7 @@ static int jmicron_pmos(struct sdhci_pci ret =pci_read_config_byte (chip->pdev,0xAE , &scratch);if (ret) -return ret; + goto fail;/* * Turn PMOS on [bit 0], set over current detection to 2.4 V
@@ -1336,7 +1336,10 @@ static int jmicron_pmos(struct sdhci_pcielse scratch &= ~0x47 ; -return pci_write_config_byte (chip->pdev,0xAE , scratch); + ret =pci_write_config_byte (chip->pdev,0xAE , scratch); + +fail: +return pcibios_err_to_errno (ret); }static int jmicron_probe (struct sdhci_pci_chip *chip)
@@ -2201,7 +2204,7 @@ static int sdhci_pci_probe(struct pci_de ret =pci_read_config_byte (pdev,PCI_SLOT_INFO , &slots);if (ret) -return ret; +return pcibios_err_to_errno (ret); slots =PCI_SLOT_INFO_SLOTS (slots) +1 ;dev_dbg (&pdev->dev,"found %d slot(s)\n" , slots);
@@ -2210,7 +2213,7 @@ static int sdhci_pci_probe(struct pci_de ret =pci_read_config_byte (pdev,PCI_SLOT_INFO , &first_bar);if (ret) -return ret; +return pcibios_err_to_errno (ret); first_bar &=PCI_SLOT_INFO_FIRST_BAR_MASK ;
Greg Kroah-Hartman
maintainerPATCH 70/163 nvme: fixup comment for nvme RDMA Provider Type
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit f80a55fa90fa76d01e3fffaa5d0413e522ab9a00 ]
PRTYPE is the provider type, not the QP service type.
--- include/linux/nvme.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/nvme.h +2 -2
@@ -90,8 +90,8 @@ enum { NVMF_RDMA_QPTYPE_DATAGRAM = 2, /* Reliable Datagram */ }; -/* RDMA QP Service Type codes for Discovery Log Page entry TSAS -* RDMA_QPTYPE field +/* RDMA Provider Type codes for Discovery Log Page entry TSAS +* RDMA_PRTYPE field */ enum {NVMF_RDMA_PRTYPE_NOT_SPECIFIED =1 ,/* No Provider Specified */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/163 mmc: sdhci: Do not invert write-protect twice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit fbd64f902b93fe9658b855b9892ae59ef6ea22b9 upstream.
mmc_of_parse() reads device property "wp-inverted" and sets MMC_CAP2_RO_ACTIVE_HIGH if it is true. MMC_CAP2_RO_ACTIVE_HIGH is used to invert a write-protect (AKA read-only) GPIO value.
sdhci_get_property() also reads "wp-inverted" and sets SDHCI_QUIRK_INVERTED_WRITE_PROTECT which is used to invert the write-protect value as well but also acts upon a value read out from the SDHCI_PRESENT_STATE register.
Many drivers call both mmc_of_parse() and sdhci_get_property(), so that both MMC_CAP2_RO_ACTIVE_HIGH and SDHCI_QUIRK_INVERTED_WRITE_PROTECT will be set if the controller has device property "wp-inverted".
Amend the logic in sdhci_check_ro() to allow for that possibility, so that the write-protect value is not inverted twice.
Also do not invert the value if it is a negative error value. Note that callers treat an error the same as not-write-protected, so the result is functionally the same in that case.
Also do not invert the value if sdhci host operation ->get_ro() is used. None of the users of that callback set SDHCI_QUIRK_INVERTED_WRITE_PROTECT directly or indirectly, but two do call mmc_gpio_get_ro(), so leave it to them to deal with that if they ever set SDHCI_QUIRK_INVERTED_WRITE_PROTECT in the future.
--- drivers/mmc/host/sdhci.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/mmc/host/sdhci.c +15 -7
@@ -2515,26 +2515,34 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio);static int sdhci_check_ro (struct sdhci_host *host) { +bool allow_invert = false;unsigned long flags;int is_readonly;spin_lock_irqsave (&host->lock, flags); -if (host->flags &SDHCI_DEVICE_DEAD ) +if (host->flags &SDHCI_DEVICE_DEAD ) { is_readonly =0 ; -else if (host->ops->get_ro) + }else if (host->ops->get_ro) { is_readonly = host->ops->get_ro (host); -else if (mmc_can_gpio_ro (host->mmc)) + }else if (mmc_can_gpio_ro (host->mmc)) { is_readonly =mmc_gpio_get_ro (host->mmc); -else +/* Do not invert twice */ + allow_invert = !(host->mmc->caps2 &MMC_CAP2_RO_ACTIVE_HIGH ); + }else { is_readonly = !(sdhci_readl (host,SDHCI_PRESENT_STATE ) &SDHCI_WRITE_PROTECT ); + allow_invert = true; + }spin_unlock_irqrestore (&host->lock, flags); -/* This quirk needs to be replaced by a callback-function later */ -return host->quirks &SDHCI_QUIRK_INVERTED_WRITE_PROTECT ? - !is_readonly : is_readonly; +if (is_readonly >=0 && + allow_invert && + (host->quirks &SDHCI_QUIRK_INVERTED_WRITE_PROTECT )) + is_readonly = !is_readonly; + +return is_readonly; }#define SAMPLE_COUNT 5
Greg Kroah-Hartman
maintainerPATCH 89/163 mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit ab069ce125965a5e282f7b53b86aee76ab32975c upstream.
sdhci_check_ro() can call mmc_gpio_get_ro() while holding the sdhci host->lock spinlock. That would be a problem if the GPIO access done by mmc_gpio_get_ro() needed to sleep.
However, host->lock is not needed anyway. The mmc core ensures that host operations do not race with each other, and asynchronous callbacks like the interrupt handler, software timeouts, completion work etc, cannot affect sdhci_check_ro().
So remove the locking.
--- drivers/mmc/host/sdhci.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/mmc/host/sdhci.c +0 -5
@@ -2516,11 +2516,8 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio);static int sdhci_check_ro (struct sdhci_host *host) {bool allow_invert = false; -unsigned long flags;int is_readonly; -spin_lock_irqsave (&host->lock, flags); -if (host->flags &SDHCI_DEVICE_DEAD ) { is_readonly =0 ; }else if (host->ops->get_ro) {
@@ -2535,8 +2532,6 @@ static int sdhci_check_ro(struct sdhci_h allow_invert = true; } -spin_unlock_irqrestore (&host->lock, flags); -if (is_readonly >=0 && allow_invert && (host->quirks &SDHCI_QUIRK_INVERTED_WRITE_PROTECT ))
Greg Kroah-Hartman
maintainerPATCH 90/163 iio: xilinx-ams: Dont include ams_ctrl_channels in scan_mask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 89b898c627a49b978a4c323ea6856eacfc21f6ba ]
ams_enable_channel_sequence constructs a "scan_mask" for all the PS and PL channels. This works out fine, since scan_index for these channels is less than 64. However, it also includes the ams_ctrl_channels, where scan_index is greater than 64, triggering undefined behavior. Since we don't need these channels anyway, just exclude them.
--- drivers/iio/adc/xilinx-ams.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/iio/adc/xilinx-ams.c +6 -2
@@ -414,8 +414,12 @@ static void ams_enable_channel_sequence(struct iio_dev *indio_dev)/* Run calibration of PS & PL as part of the sequence */ scan_mask =BIT (0 ) |BIT (AMS_PS_SEQ_MAX ); -for (i =0 ; i < indio_dev->num_channels; i++) - scan_mask |=BIT_ULL (indio_dev->channels[i].scan_index); +for (i =0 ; i < indio_dev->num_channels; i++) { +const struct iio_chan_spec *chan = &indio_dev->channels[i]; + +if (chan->scan_index <AMS_CTRL_SEQ_BASE ) + scan_mask |=BIT_ULL (chan->scan_index); + }if (ams->ps_base) {/* put sysmon in a soft reset to change the sequence */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/163 counter: ti-eqep: enable clock at probe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 0cf81c73e4c6a4861128a8f27861176ec312af4e ]
The TI eQEP clock is both a functional and interface clock. Since it is required for the device to function, we should be enabling it at probe.
Up to now, we've just been lucky that the clock was enabled by something else on the system already.
--- drivers/counter/ti-eqep.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/counter/ti-eqep.c +6 -0
@@ -6,6 +6,7 @@*/ #include <linux/bitops.h> +#include <linux/clk.h> #include <linux/counter.h> #include <linux/kernel.h> #include <linux/mod_devicetable.h>
@@ -376,6 +377,7 @@ static int ti_eqep_probe(struct platform_device *pdev)struct counter_device *counter;struct ti_eqep_cnt *priv;void __iomem *base; +struct clk *clk;int err; counter =devm_counter_alloc (dev,sizeof (*priv));
@@ -415,6 +417,10 @@ static int ti_eqep_probe(struct platform_device *pdev)pm_runtime_enable (dev);pm_runtime_get_sync (dev); + clk =devm_clk_get_enabled (dev,NULL ); +if (IS_ERR (clk)) +return dev_err_probe (dev,PTR_ERR (clk),"failed to enable clock\n" ); + err =counter_add (counter);if (err <0 ) {pm_runtime_put_sync (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/163 kbuild: doc: Update default INSTALL_MOD_DIR from extra to updates
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark-PK Tsai <[email protected]>
[ Upstream commit 07d4cc2e7444356faac6552d0688a1670cc9d749 ]
The default INSTALL_MOD_DIR was changed from 'extra' to 'updates' in commit b74d7bb7ca24 ("kbuild: Modify default INSTALL_MOD_DIR from extra to updates").
This commit updates the documentation to align with the latest kernel.
--- Documentation/kbuild/modules.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
Documentation/kbuild/modules.rst +4 -4
@@ -128,7 +128,7 @@ executed to make module versioning work. modules_install Install the external module(s). The default location is - /lib/modules/<kernel_release>/extra/, but a prefix may + /lib/modules/<kernel_release>/updates/, but a prefix may be added with INSTALL_MOD_PATH (discussed in section 5). clean
@@ -417,7 +417,7 @@ directory: And external modules are installed in: - /lib/modules/$(KERNELRELEASE)/extra/ + /lib/modules/$(KERNELRELEASE)/updates/ 5.1 INSTALL_MOD_PATH --------------------
@@ -438,10 +438,10 @@ And external modules are installed in: ------------------- External modules are by default installed to a directory under - /lib/modules/$(KERNELRELEASE)/extra/, but you may wish to + /lib/modules/$(KERNELRELEASE)/updates/, but you may wish to locate modules for a specific functionality in a separate directory. For this purpose, use INSTALL_MOD_DIR to specify an - alternative name to "extra.":: + alternative name to "updates.":: $ make INSTALL_MOD_DIR=gandalf -C $KDIR \ M=$PWD modules_install
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/163 kbuild: Fix build target deb-pkg: ln: failed to create hard link
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thayne Harbaugh <[email protected]>
[ Upstream commit c61566538968ffb040acc411246fd7ad38c7e8c9 ]
The make deb-pkg target calls debian-orig which attempts to either hard link the source .tar to the build-output location or copy the source .tar to the build-output location. The test to determine whether to ln or cp is incorrectly expanded by Make and consequently always attempts to ln the source .tar. This fix corrects the escaping of '$' so that the test is expanded by the shell rather than by Make and appropriately selects between ln and cp.
--- scripts/Makefile.package | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.package +1 -1
@@ -126,7 +126,7 @@ debian-orig: private version = $(shell dpkg-parsechangelog -S Version | sed 's/- debian-orig: private orig-name = $(source)_$(version).orig.tar$(debian-orig-suffix) debian-orig: mkdebian-opts = --need-source debian-orig: linux.tar$(debian-orig-suffix) debian - $(Q)if [ "$(df --output=target .. 2>/dev/null)" = "$(df --output=target $< 2>/dev/null)" ]; then \ + $(Q)if [ "$$(df --output=target .. 2>/dev/null)" = "$$(df --output=target $< 2>/dev/null)" ]; then \ ln -f $< ../$(orig-name); \ else \ cp $< ../$(orig-name); \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/163 i2c: testunit: dont erase registers after STOP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit c422b6a630240f706063e0ecbb894aa8491b1fa1 ]
STOP fallsthrough to WRITE_REQUESTED but this became problematic when clearing the testunit registers was added to the latter. Actually, there is no reason to clear the testunit state after STOP. Doing it when a new WRITE_REQUESTED arrives is enough. So, no need to fallthrough, at all.
--- drivers/i2c/i2c-slave-testunit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/i2c-slave-testunit.c +1 -1
@@ -118,7 +118,7 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,queue_delayed_work (system_long_wq, &tu->worker,msecs_to_jiffies (10 * tu->regs[TU_REG_DELAY ])); } - fallthrough; +break ;case I2C_SLAVE_WRITE_REQUESTED :memset (tu->regs,0 ,TU_NUM_REGS );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/163 i2c: testunit: discard write requests while old command is running
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit c116deafd1a5cc1e9739099eb32114e90623209c ]
When clearing registers on new write requests was added, the protection for currently running commands was missed leading to concurrent access to the testunit registers. Check the flag beforehand.
--- drivers/i2c/i2c-slave-testunit.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/i2c-slave-testunit.c +3 -0
@@ -121,6 +121,9 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client,break ;case I2C_SLAVE_WRITE_REQUESTED : +if (test_bit (TU_FLAG_IN_PROCESS , &tu->flags)) +return -EBUSY ; +memset (tu->regs,0 ,TU_NUM_REGS ); tu->reg_idx =0 ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/163 ata: libata-core: Fix null pointer dereference on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 5d92c7c566dc76d96e0e19e481d926bbe6631c1e ]
If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called.
However, the code in ata_host_release() tries to free ata_port struct members unconditionally, which can lead to the following:
BUG: unable to handle page fault for address: 0000000000003990 PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:ata_host_release.cold+0x2f/0x6e [libata] Code: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41 RSP: 0018:ffffc90000ebb968 EFLAGS: 00010246 RAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0 RBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68 R10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004 R13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006 FS: 00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? ata_host_release.cold+0x2f/0x6e [libata] ? ata_host_release.cold+0x2f/0x6e [libata] release_nodes+0x35/0xb0 devres_release_group+0x113/0x140 ata_host_alloc+0xed/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci]
Do not access ata_port struct members unconditionally.
Stable-dep-of: f6549f538fe0 ("ata,scsi: libata-core: Do not leak memory for ata_port struct members")
--- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/libata-core.c +3 -0
@@ -5527,6 +5527,9 @@ static void ata_host_release(struct kref *kref)for (i =0 ; i < host->n_ports; i++) {struct ata_port *ap = host->ports[i]; +if (!ap) +continue ; +kfree (ap->pmp_link);kfree (ap->slave_link);kfree (ap->ncq_sense_buf);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/163 ata,scsi: libata-core: Do not leak memory for ata_port struct members
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit f6549f538fe0b2c389e1a7037f4e21039e25137a ]
libsas is currently not freeing all the struct ata_port struct members, e.g. ncq_sense_buf for a driver supporting Command Duration Limits (CDL).
Add a function, ata_port_free(), that is used to free a ata_port, including its struct members. It makes sense to keep the code related to freeing a ata_port in its own function, which will also free all the struct members of struct ata_port.
--- drivers/ata/libata-core.c | 24 ++++++++++++++---------- drivers/scsi/libsas/sas_ata.c | 6 +++--- drivers/scsi/libsas/sas_discover.c | 2 +- include/linux/libata.h | 1 + 4 files changed, 19 insertions(+), 14 deletions(-)
drivers/ata/libata-core.c +14 -10
@@ -5499,6 +5499,18 @@ struct ata_port *ata_port_alloc(struct ata_host *host)return ap; } +void ata_port_free (struct ata_port *ap) +{ +if (!ap) +return ; + +kfree (ap->pmp_link); +kfree (ap->slave_link); +kfree (ap->ncq_sense_buf); +kfree (ap); +} +EXPORT_SYMBOL_GPL (ata_port_free); +static void ata_devres_release (struct device *gendev,void *res) {struct ata_host *host =dev_get_drvdata (gendev);
@@ -5525,15 +5537,7 @@ static void ata_host_release(struct kref *kref)int i;for (i =0 ; i < host->n_ports; i++) { -struct ata_port *ap = host->ports[i]; - -if (!ap) -continue ; - -kfree (ap->pmp_link); -kfree (ap->slave_link); -kfree (ap->ncq_sense_buf); -kfree (ap); +ata_port_free (host->ports[i]); host->ports[i] =NULL ; }kfree (host);
@@ -5916,7 +5920,7 @@ int ata_host_register(struct ata_host *host, const struct scsi_host_template *sh* allocation time. */ for (i = host->n_ports; host->ports[i]; i++) -kfree (host->ports[i]); +ata_port_free (host->ports[i]);/* give ports names and add SCSI hosts */ for (i =0 ; i < host->n_ports; i++) {
drivers/scsi/libsas/sas_ata.c +3 -3
@@ -610,15 +610,15 @@ int sas_ata_init(struct domain_device *found_dev) rc =ata_sas_tport_add (ata_host->dev, ap);if (rc) - goto destroy_port; + goto free_port; found_dev->sata_dev.ata_host = ata_host; found_dev->sata_dev.ap = ap;return 0 ; -destroy_port: -kfree (ap); +free_port: +ata_port_free (ap); free_host:ata_host_put (ata_host);return rc;
drivers/scsi/libsas/sas_discover.c +1 -1
@@ -301,7 +301,7 @@ void sas_free_device(struct kref *kref)if (dev_is_sata (dev) && dev->sata_dev.ap) {ata_sas_tport_delete (dev->sata_dev.ap); -kfree (dev->sata_dev.ap); +ata_port_free (dev->sata_dev.ap);ata_host_put (dev->sata_dev.ata_host); dev->sata_dev.ata_host =NULL ; dev->sata_dev.ap =NULL ;
include/linux/libata.h +1 -0
@@ -1242,6 +1242,7 @@ extern int ata_slave_link_init(struct ata_port *ap);extern struct ata_port *ata_sas_port_alloc (struct ata_host *,struct ata_port_info *,struct Scsi_Host *);extern void ata_port_probe (struct ata_port *ap); +extern void ata_port_free (struct ata_port *ap);extern int ata_sas_tport_add (struct device *parent,struct ata_port *ap);extern void ata_sas_tport_delete (struct ata_port *ap);extern int ata_sas_slave_configure (struct scsi_device *,struct ata_port *);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/163 drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Ying <[email protected]>
[ Upstream commit 37ce99b77762256ec9fda58d58fd613230151456 ]
KOE TX26D202VM0BWA panel spec indicates the DE signal is active high in timing chart, so add DISPLAY_FLAGS_DE_HIGH flag in display timing flags. This aligns display_timing with panel_desc.
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -2523,6 +2523,7 @@ static const struct display_timing koe_tx26d202vm0bwa_timing = { .vfront_porch = { 3, 5, 10 }, .vback_porch = { 2, 5, 10 }, .vsync_len = { 5, 5, 5 }, + .flags = DISPLAY_FLAGS_DE_HIGH, }; static const struct panel_desc koe_tx26d202vm0bwa = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/163 iio: adc: ad7266: Fix variable checking bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Yang <[email protected]>
commit a2b86132955268b2a1703082fbc2d4832fc001b8 upstream.
The ret variable was not checked after iio_device_release_direct_mode(), which could possibly cause errors
--- drivers/iio/adc/ad7266.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/adc/ad7266.c +2 -0
@@ -157,6 +157,8 @@ static int ad7266_read_raw(struct iio_de ret =ad7266_read_single (st, val, chan->address);iio_device_release_direct_mode (indio_dev); +if (ret <0 ) +return ret; *val = (*val >>2 ) &0xfff ;if (chan->scan_type.sign =='s' ) *val = sign_extend32(*val,
Greg Kroah-Hartman
maintainerPATCH 99/163 iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit a821d7111e3f7c8869961b606714a299bfe20014 upstream.
Provide missing symbols to the module:
ERROR: modpost: iio_push_to_buffers [drivers/iio/accel/fxls8962af-core.ko] undefined!
ERROR: modpost: devm_iio_kfifo_buffer_setup_ext [drivers/iio/accel/fxls8962af-core.ko] undefined!
--- drivers/iio/accel/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/accel/Kconfig +2 -0
@@ -325,6 +325,8 @@ config DMARD10 config FXLS8962AF tristate depends on I2C || !I2C # cannot be built-in for modular I2C + select IIO_BUFFER + select IIO_KFIFO_BUF config FXLS8962AF_I2C tristate "NXP FXLS8962AF/FXLS8964AF Accelerometer I2C Driver"
Greg Kroah-Hartman
maintainerPATCH 100/163 iio: chemical: bme680: Fix pressure value output
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Amoiridis <[email protected]>
commit ae1f7b93b52095be6776d0f34957b4f35dda44d9 upstream.
The IIO standard units are measured in kPa while the driver is using hPa.
Apart from checking the userspace value itself, it is mentioned also in the Bosch API [1] that the pressure value is in Pascal.
[1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x_defs.h#L742
--- drivers/iio/chemical/bme680_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/chemical/bme680_core.c +1 -1
@@ -678,7 +678,7 @@ static int bme680_read_press(struct bme6 } *val =bme680_compensate_press (data, adc_press); - *val2 =100 ; + *val2 =1000 ;return IIO_VAL_FRACTIONAL ; }
Greg Kroah-Hartman
maintainerPATCH 101/163 iio: chemical: bme680: Fix calibration data variable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Amoiridis <[email protected]>
commit b47c0fee73a810c4503c4a94ea34858a1d865bba upstream.
According to the BME68x Sensor API [1], the h6 calibration data variable should be an unsigned integer of size 8.
[1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x_defs.h#L789
--- drivers/iio/chemical/bme680_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/chemical/bme680_core.c +1 -1
@@ -38,7 +38,7 @@ struct bme680_calib {s8 par_h3;s8 par_h4;s8 par_h5; -s8 par_h6; +u8 par_h6;s8 par_h7;s8 par_gh1;s16 par_gh2;
Greg Kroah-Hartman
maintainerPATCH 72/163 gpio: davinci: Validate the obtained number of IRQs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 7aa9b96e9a73e4ec1771492d0527bd5fc5ef9164 ]
Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value validation there can be out of chips->irqs array boundaries access in davinci_gpio_probe().
Validate the obtained nirq value so that it won't exceed the maximum number of IRQs per bank.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpio/gpio-davinci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpio/gpio-davinci.c +5 -0
@@ -225,6 +225,11 @@ static int davinci_gpio_probe(struct platform_device *pdev)else nirq =DIV_ROUND_UP (ngpio,16 ); +if (nirq >MAX_INT_PER_BANK ) { +dev_err (dev,"Too many IRQs!\n" ); +return -EINVAL ; + } + chips =devm_kzalloc (dev,sizeof (*chips),GFP_KERNEL );if (!chips)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/163 RISC-V: fix vector insn load/store width mask
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Taube <[email protected]>
[ Upstream commit 04a2aef59cfe192aa99020601d922359978cc72a ]
RVFDQ_FL_FS_WIDTH_MASK should be 3 bits [14-12], shifted down by 12 bits. Replace GENMASK(3, 0) with GENMASK(2, 0).
--- arch/riscv/include/asm/insn.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/insn.h +1 -1
@@ -145,7 +145,7 @@/* parts of opcode for RVF, RVD and RVQ */ #define RVFDQ_FL_FS_WIDTH_OFF 12 -#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(3, 0) +#define RVFDQ_FL_FS_WIDTH_MASK GENMASK(2, 0)#define RVFDQ_FL_FS_WIDTH_W 2#define RVFDQ_FL_FS_WIDTH_D 3#define RVFDQ_LS_FS_WIDTH_Q 4
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/163 drm/amdgpu: Fix pci state save during mode-1 reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 74fa02c4a5ea1ade5156a6ce494d3ea83881c2d8 ]
Cache the PCI state before bus master is disabled. The saved state is later used for other cases like restoring config space after mode-2 reset.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +5 -2
@@ -4685,11 +4685,14 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev)dev_info (adev->dev,"GPU mode1 reset\n" ); +/* Cache the state before bus master disable. The saved config space +* values are used in other cases like restore after mode-2 reset. +*/ +amdgpu_device_cache_pci_state (adev->pdev); +/* disable BM */ pci_clear_master (adev->pdev); -amdgpu_device_cache_pci_state (adev->pdev); -if (amdgpu_dpm_is_mode1_reset_supported (adev)) {dev_info (adev->dev,"GPU smu mode1 reset\n" ); ret =amdgpu_dpm_mode1_reset (adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/163 riscv: stacktrace: convert arch_stack_walk() to noinstr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Chiu <[email protected]>
[ Upstream commit 23b2188920a25e88d447dd7d819a0b0f62fb4455 ]
arch_stack_walk() is called intensively in function_graph when the kernel is compiled with CONFIG_TRACE_IRQFLAGS. As a result, the kernel logs a lot of arch_stack_walk and its sub-functions into the ftrace buffer. However, these functions should not appear on the trace log because they are part of the ftrace itself. This patch references what arm64 does for the smae function. So it further prevent the re-enter kprobe issue, which is also possible on riscv.
Related-to: commit 0fbcd8abf337 ("arm64: Prohibit instrumentation on arch_stack_walk()")
--- arch/riscv/kernel/stacktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/stacktrace.c +1 -1
@@ -156,7 +156,7 @@ unsigned long __get_wchan(struct task_struct *task)return pc; } -noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, +noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,struct task_struct *task,struct pt_regs *regs) {walk_stackframe (task, regs, consume_entry, cookie);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/163 gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Gibson <[email protected]>
[ Upstream commit 9919cce62f68e6ab68dc2a975b5dc670f8ca7d40 ]
linehandle_set_config() behaves badly when direction is not set. The configuration validation is borrowed from linehandle_create(), where, to verify the intent of the user, the direction must be set to in order to effect a change to the electrical configuration of a line. But, when applied to reconfiguration, that validation does not allow for the unset direction case, making it possible to clear flags set previously without specifying the line direction.
Adding to the inconsistency, those changes are not immediately applied by linehandle_set_config(), but will take effect when the line value is next get or set.
For example, by requesting a configuration with no flags set, an output line with GPIOHANDLE_REQUEST_ACTIVE_LOW and GPIOHANDLE_REQUEST_OPEN_DRAIN requested could have those flags cleared, inverting the sense of the line and changing the line drive to push-pull on the next line value set.
Ensure the intent of the user by disallowing configurations which do not have direction set, returning an error to userspace to indicate that the configuration is invalid.
And, for clarity, use lflags, a local copy of gcnf.flags, throughout when dealing with the requested flags, rather than a mixture of both.
--- drivers/gpio/gpiolib-cdev.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/gpio/gpiolib-cdev.c +10 -6
@@ -132,6 +132,10 @@ struct linehandle_state { GPIOHANDLE_REQUEST_OPEN_DRAIN | \ GPIOHANDLE_REQUEST_OPEN_SOURCE) +#define GPIOHANDLE_REQUEST_DIRECTION_FLAGS \ + (GPIOHANDLE_REQUEST_INPUT | \ + GPIOHANDLE_REQUEST_OUTPUT) +static int linehandle_validate_flags (u32 flags) {/* Return an error if an unknown flag is set */
@@ -212,21 +216,21 @@ static long linehandle_set_config(struct linehandle_state *lh,if (ret)return ret; +/* Lines must be reconfigured explicitly as input or output. */ +if (!(lflags &GPIOHANDLE_REQUEST_DIRECTION_FLAGS )) +return -EINVAL ; +for (i =0 ; i < lh->num_descs; i++) { desc = lh->descs[i]; -linehandle_flags_to_desc_flags (gcnf.flags, &desc->flags); +linehandle_flags_to_desc_flags (lflags, &desc->flags); -/* -* Lines have to be requested explicitly for input -* or output, else the line will be treated "as is". -*/ if (lflags &GPIOHANDLE_REQUEST_OUTPUT ) {int val = !!gcnf.default_values[i]; ret =gpiod_direction_output (desc, val);if (ret)return ret; - }else if (lflags &GPIOHANDLE_REQUEST_INPUT ) { + }else { ret =gpiod_direction_input (desc);if (ret)return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/163 randomize_kstack: Remove non-functional per-arch entropy filtering
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 6db1208bf95b4c091897b597c415e11edeab2e2d ]
An unintended consequence of commit 9c573cd31343 ("randomize_kstack:
Improve entropy diffusion") was that the per-architecture entropy size filtering reduced how many bits were being added to the mix, rather than how many bits were being used during the offsetting. All architectures fell back to the existing default of 0x3FF (10 bits), which will consume at most 1KiB of stack space. It seems that this is working just fine, so let's avoid the confusion and update everything to use the default.
The prior intent of the per-architecture limits were:
arm64: capped at 0x1FF (9 bits), 5 bits effective
powerpc: uncapped (10 bits), 6 or 7 bits effective
riscv: uncapped (10 bits), 6 bits effective
x86: capped at 0xFF (8 bits), 5 (x86_64) or 6 (ia32) bits effective
s390: capped at 0xFF (8 bits), undocumented effective entropy
Current discussion has led to just dropping the original per-architecture filters. The additional entropy appears to be safe for arm64, x86, and s390. Quoting Arnd, "There is no point pretending that 15.75KB is somehow safe to use while 15.00KB is not."
--- arch/arm64/kernel/syscall.c | 16 +++++++--------- arch/s390/include/asm/entry-common.h | 2 +- arch/x86/include/asm/entry-common.h | 15 ++++++--------- 3 files changed, 14 insertions(+), 19 deletions(-)
arch/arm64/kernel/syscall.c +7 -9
@@ -56,17 +56,15 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,syscall_set_return_value (current, regs,0 , ret);/* -* Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), -* but not enough for arm64 stack utilization comfort. To keep -* reasonable stack head room, reduce the maximum offset to 9 bits. +* This value will get limited by KSTACK_OFFSET_MAX(), which is 10 +* bits. The actual entropy will be further reduced by the compiler +* when applying stack alignment constraints: the AAPCS mandates a +* 16-byte aligned SP at function boundaries, which will remove the +* 4 low bits from any entropy chosen here. * -* The actual entropy will be further reduced by the compiler when -* applying stack alignment constraints: the AAPCS mandates a -* 16-byte (i.e. 4-bit) aligned SP at function boundaries. -* -* The resulting 5 bits of entropy is seen in SP[8:4]. +* The resulting 6 bits of entropy is seen in SP[9:4]. */ -choose_random_kstack_offset (get_random_u16 () &0x1FF ); +choose_random_kstack_offset (get_random_u16 ()); }static inline bool has_syscall_work (unsigned long flags)
arch/s390/include/asm/entry-common.h +1 -1
@@ -55,7 +55,7 @@ static __always_inline void arch_exit_to_user_mode(void)static inline void arch_exit_to_user_mode_prepare (struct pt_regs *regs,unsigned long ti_work) { -choose_random_kstack_offset (get_tod_clock_fast () &0xff ); +choose_random_kstack_offset (get_tod_clock_fast ()); }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
arch/x86/include/asm/entry-common.h +6 -9
@@ -73,19 +73,16 @@ static inline void arch_exit_to_user_mode_prepare(struct pt_regs *regs,#endif /* -* Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), -* but not enough for x86 stack utilization comfort. To keep -* reasonable stack head room, reduce the maximum offset to 8 bits. -* -* The actual entropy will be further reduced by the compiler when -* applying stack alignment constraints (see cc_stack_align4/8 in +* This value will get limited by KSTACK_OFFSET_MAX(), which is 10 +* bits. The actual entropy will be further reduced by the compiler +* when applying stack alignment constraints (see cc_stack_align4/8 in * arch/x86/Makefile), which will remove the 3 (x86_64) or 2 (ia32) * low bits from any entropy chosen here. * -* Therefore, final stack offset entropy will be 5 (x86_64) or -* 6 (ia32) bits. +* Therefore, final stack offset entropy will be 7 (x86_64) or +* 8 (ia32) bits. */ -choose_random_kstack_offset (rdtsc () &0xFF ); +choose_random_kstack_offset (rdtsc ()); }#define arch_exit_to_user_mode_prepare arch_exit_to_user_mode_prepare
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/163 gfs2: Fix NULL pointer dereference in gfs2_log_flush
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 35264909e9d1973ab9aaa2a1b07cda70f12bb828 ]
In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion against gfs2_log_flush().
In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before dereferencing it. Otherwise, we could run into a NULL pointer dereference when outstanding glock work races with an unmount (glock_work_func -> run_queue -> do_xmote -> inode_go_sync -> gfs2_log_flush).
--- fs/gfs2/log.c | 3 ++- fs/gfs2/super.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-)
fs/gfs2/log.c +2 -1
@@ -1102,7 +1102,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)lops_before_commit (sdp, tr);if (gfs2_withdrawing_or_withdrawn (sdp)) goto out_withdraw; -gfs2_log_submit_bio (&sdp->sd_jdesc->jd_log_bio,REQ_OP_WRITE ); +if (sdp->sd_jdesc) +gfs2_log_submit_bio (&sdp->sd_jdesc->jd_log_bio,REQ_OP_WRITE );if (gfs2_withdrawing_or_withdrawn (sdp)) goto out_withdraw;
fs/gfs2/super.c +4 -0
@@ -67,9 +67,13 @@ void gfs2_jindex_free(struct gfs2_sbd *sdp) sdp->sd_journals =0 ;spin_unlock (&sdp->sd_jindex_spin); +down_write (&sdp->sd_log_flush_lock); sdp->sd_jdesc =NULL ; +up_write (&sdp->sd_log_flush_lock); +while (!list_empty (&list)) { jd = list_first_entry(&list, struct gfs2_jdesc, jd_list); +BUG_ON (jd->jd_log_bio);gfs2_free_journal_extents (jd);list_del (&jd->jd_list);iput (jd->jd_inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/163 iio: chemical: bme680: Fix sensor data read operation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Amoiridis <[email protected]>
commit 4241665e6ea063a9c1d734de790121a71db763fc upstream.
A read operation is happening as follows:
a) Set sensor to forced mode
b) Sensor measures values and update data registers and sleeps again
c) Read data registers
In the current implementation the read operation happens immediately after the sensor is set to forced mode so the sensor does not have the time to update properly the registers. This leads to the following 2 problems:
1) The first ever value which is read by the register is always wrong
2) Every read operation, puts the register into forced mode and reads the data that were calculated in the previous conversion.
This behaviour was tested in 2 ways:
1) The internal meas_status_0 register was read before and after every read operation in order to verify that the data were ready even before the register was set to forced mode and also to check that after the forced mode was set the new data were not yet ready.
2) Physically changing the temperature and measuring the temperature
This commit adds the waiting time in between the set of the forced mode and the read of the data. The function is taken from the Bosch BME68x Sensor API [1].
[1]: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L490
--- drivers/iio/chemical/bme680.h | 2 + drivers/iio/chemical/bme680_core.c | 46 +++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+)
drivers/iio/chemical/bme680.h +2 -0
@@ -54,7 +54,9 @@#define BME680_NB_CONV_MASK GENMASK(3, 0)#define BME680_REG_MEAS_STAT_0 0x1D +#define BME680_NEW_DATA_BIT BIT(7)#define BME680_GAS_MEAS_BIT BIT(6) +#define BME680_MEAS_BIT BIT(5)/* Calibration Parameters */ #define BME680_T2_LSB_REG 0x8A
drivers/iio/chemical/bme680_core.c +46 -0
70 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 112/163 usb: ucsi: stm32: fix command completion handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 8e1ec117efdfd4b2f59f57bd0ad16b4edf5b963f upstream.
Sometimes errors are seen, when doing DR swap, like:
[ 24.672481] ucsi-stm32g0-i2c 0-0035: UCSI_GET_PDOS failed (-5) [ 24.720188] ucsi-stm32g0-i2c 0-0035: ucsi_handle_connector_change: GET_CONNECTOR_STATUS failed (-5)
There may be some race, which lead to read CCI, before the command complete flag is set, hence returning -EIO. Similar fix has been done also in ucsi_acpi [1].
In case of a spurious or otherwise delayed notification it is possible that CCI still reports the previous completion. The UCSI spec is aware of this and provides two completion bits in CCI, one for normal commands and one for acks. As acks and commands alternate the notification handler can determine if the completion bit is from the current command.
To fix this add the ACK_PENDING bit for ucsi_stm32g0 and only complete commands if the completion bit matches.
[1] https://lore.kernel.org/lkml/[email protected]/
--- drivers/usb/typec/ucsi/ucsi_stm32g0.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/usb/typec/ucsi/ucsi_stm32g0.c +15 -4
@@ -64,6 +64,7 @@ struct ucsi_stm32g0 {struct completion complete;struct device *dev;unsigned long flags; +#define ACK_PENDING 2const char *fw_name;struct ucsi *ucsi;bool suspended;
@@ -395,9 +396,13 @@ static int ucsi_stm32g0_sync_write(struc size_t len) {struct ucsi_stm32g0 *g0 =ucsi_get_drvdata (ucsi); +bool ack =UCSI_COMMAND (*(u64 *)val) ==UCSI_ACK_CC_CI ;int ret; -set_bit (COMMAND_PENDING , &g0->flags); +if (ack) +set_bit (ACK_PENDING , &g0->flags); +else +set_bit (COMMAND_PENDING , &g0->flags); ret =ucsi_stm32g0_async_write (ucsi, offset, val, len);if (ret)
@@ -405,9 +410,14 @@ static int ucsi_stm32g0_sync_write(strucif (!wait_for_completion_timeout (&g0->complete,msecs_to_jiffies (5000 ))) ret = -ETIMEDOUT ; +else +return 0 ; out_clear_bit: -clear_bit (COMMAND_PENDING , &g0->flags); +if (ack) +clear_bit (ACK_PENDING , &g0->flags); +else +clear_bit (COMMAND_PENDING , &g0->flags);return ret; }
@@ -428,8 +438,9 @@ static irqreturn_t ucsi_stm32g0_irq_handif (UCSI_CCI_CONNECTOR (cci))ucsi_connector_change (g0->ucsi,UCSI_CCI_CONNECTOR (cci)); -if (test_bit (COMMAND_PENDING , &g0->flags) && - cci & (UCSI_CCI_ACK_COMPLETE |UCSI_CCI_COMMAND_COMPLETE )) +if (cci &UCSI_CCI_ACK_COMPLETE &&test_and_clear_bit (ACK_PENDING , &g0->flags)) +complete (&g0->complete); +if (cci &UCSI_CCI_COMMAND_COMPLETE &&test_and_clear_bit (COMMAND_PENDING , &g0->flags))complete (&g0->complete);return IRQ_HANDLED ;
Greg Kroah-Hartman
maintainerPATCH 113/163 usb: dwc3: core: Add DWC31 version 2.00a controller
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wesley Cheng <[email protected]>
commit 1e43c86d84fb0503e82a143e017f35421498fc1a upstream.
Add revision value for identifying DWC31 version 2.00a based controllers.
--- drivers/usb/dwc3/core.h | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/core.h +1 -0
@@ -1247,6 +1247,7 @@ struct dwc3 {#define DWC31_REVISION_170A 0x3137302a#define DWC31_REVISION_180A 0x3138302a#define DWC31_REVISION_190A 0x3139302a +#define DWC31_REVISION_200A 0x3230302a#define DWC32_REVISION_ANY 0x0#define DWC32_REVISION_100A 0x3130302a
Greg Kroah-Hartman
maintainerPATCH 114/163 usb: dwc3: core: Workaround for CSR read timeout
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jos Wang <[email protected]>
commit fc1d1a712b517bbcb383b1f1f7ef478e7d0579f2 upstream.
This is a workaround for STAR 4846132, which only affects DWC_usb31 version2.00a operating in host mode.
There is a problem in DWC_usb31 version 2.00a operating in host mode that would cause a CSR read timeout When CSR read coincides with RAM Clock Gating Entry. By disable Clock Gating, sacrificing power consumption for normal operation.
--- drivers/usb/dwc3/core.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/usb/dwc3/core.c +19 -1
@@ -865,12 +865,16 @@ static bool dwc3_core_is_valid(struct dwstatic void dwc3_core_setup_global_control (struct dwc3 *dwc) { +unsigned int power_opt; +unsigned int hw_mode;u32 reg; reg =dwc3_readl (dwc->regs,DWC3_GCTL ); reg &= ~DWC3_GCTL_SCALEDOWN_MASK ; + hw_mode =DWC3_GHWPARAMS0_MODE (dwc->hwparams.hwparams0); + power_opt =DWC3_GHWPARAMS1_EN_PWROPT (dwc->hwparams.hwparams1); -switch (DWC3_GHWPARAMS1_EN_PWROPT (dwc->hwparams.hwparams1)) { +switch (power_opt) {case DWC3_GHWPARAMS1_EN_PWROPT_CLK :/** * WORKAROUND: DWC3 revisions between 2.10a and 2.50a have an
@@ -903,6 +907,20 @@ static void dwc3_core_setup_global_contrbreak ; } +/* +* This is a workaround for STAR#4846132, which only affects +* DWC_usb31 version2.00a operating in host mode. +* +* There is a problem in DWC_usb31 version 2.00a operating +* in host mode that would cause a CSR read timeout When CSR +* read coincides with RAM Clock Gating Entry. By disable +* Clock Gating, sacrificing power consumption for normal +* operation. +*/ +if (power_opt !=DWC3_GHWPARAMS1_EN_PWROPT_NO && + hw_mode != DWC3_GHWPARAMS0_MODE_GADGET && DWC3_VER_IS(DWC31, 200A)) + reg |=DWC3_GCTL_DSBLCLKGTNG ; +/* check if current dwc3 is on simulation board */ if (dwc->hwparams.hwparams6 &DWC3_GHWPARAMS6_EN_FPGA ) {dev_info (dwc->dev,"Running with FPGA optimizations\n" );
Greg Kroah-Hartman
maintainerPATCH 115/163 Revert "serial: core: only stop transmit when HW fifo is empty"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Brown <[email protected]>
commit c5603e2a621dac10c5e21cc430848ebcfa6c7e01 upstream.
This reverts commit 7bfb915a597a301abb892f620fe5c283a9fdbd77.
This commit broke pxa and omap-serial, because it inhibited them from calling stop_tx() if their TX FIFOs weren't completely empty. This resulted in these two drivers hanging during transmits because the TX interrupt would stay enabled, and a new TX interrupt would never fire.
--- include/linux/serial_core.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
include/linux/serial_core.h +1 -2
@@ -787,8 +787,7 @@ enum UART_TX_FLAGS {if (pending <WAKEUP_CHARS ) { \uart_write_wakeup (__port); \ \ -if (!((flags) &UART_TX_NOSTOP ) && pending ==0 && \ - __port->ops->tx_empty (__port)) \ +if (!((flags) &UART_TX_NOSTOP ) && pending ==0 ) \ __port->ops->stop_tx (__port); \ } \ \
Greg Kroah-Hartman
maintainerPATCH 116/163 serial: 8250_omap: Implementation of Errata i2310
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Udit Kumar <[email protected]>
commit 9d141c1e615795eeb93cd35501ad144ee997a826 upstream.
As per Errata i2310[0], Erroneous timeout can be triggered, if this Erroneous interrupt is not cleared then it may leads to storm of interrupts, therefore apply Errata i2310 solution.
[0] https://www.ti.com/lit/pdf/sprz536 page 23
--- drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-)
drivers/tty/serial/8250/8250_omap.c +20 -5
@@ -165,6 +165,10 @@ static u32 uart_read(struct omap8250_prireturn readl (priv->membase + (reg <<OMAP_UART_REGSHIFT )); } +/* Timeout low and High */ +#define UART_OMAP_TO_L 0x26 +#define UART_OMAP_TO_H 0x27 +/* * Called on runtime PM resume path from omap8250_restore_regs(), and * omap8250_set_mctrl().
@@ -646,13 +650,24 @@ static irqreturn_t omap8250_irq(int irq,/* * On K3 SoCs, it is observed that RX TIMEOUT is signalled after -* FIFO has been drained, in which case a dummy read of RX FIFO -* is required to clear RX TIMEOUT condition. +* FIFO has been drained or erroneously. +* So apply solution of Errata i2310 as mentioned in +* https://www.ti.com/lit/pdf/sprz536 */ if (priv->habit &UART_RX_TIMEOUT_QUIRK && - (iir &UART_IIR_RX_TIMEOUT ) ==UART_IIR_RX_TIMEOUT && -serial_port_in (port,UART_OMAP_RX_LVL ) ==0 ) { -serial_port_in (port,UART_RX ); + (iir &UART_IIR_RX_TIMEOUT ) ==UART_IIR_RX_TIMEOUT ) { +unsigned char efr2, timeout_h, timeout_l; + + efr2 =serial_in (up,UART_OMAP_EFR2 ); + timeout_h =serial_in (up,UART_OMAP_TO_H ); + timeout_l =serial_in (up,UART_OMAP_TO_L ); +serial_out (up,UART_OMAP_TO_H ,0xFF ); +serial_out (up,UART_OMAP_TO_L ,0xFF ); +serial_out (up,UART_OMAP_EFR2 ,UART_OMAP_EFR2_TIMEOUT_BEHAVE ); +serial_in (up,UART_IIR ); +serial_out (up,UART_OMAP_EFR2 , efr2); +serial_out (up,UART_OMAP_TO_H , timeout_h); +serial_out (up,UART_OMAP_TO_L , timeout_l); }/* Stop processing interrupts on input overrun */
Greg Kroah-Hartman
maintainerPATCH 117/163 serial: imx: set receiver level before starting uart
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <[email protected]>
commit a81dbd0463eca317eee44985a66aa6cc2ce5c101 upstream.
Set the receiver level to something > 0 before calling imx_uart_start_rx in rs485_config. This is necessary to avoid an interrupt storm that might prevent the system from booting. This was seen on an i.MX7 device when the rs485-rts-active-low property was active in the device tree.
--- drivers/tty/serial/imx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/imx.c +3 -1
@@ -1959,8 +1959,10 @@ static int imx_uart_rs485_config(struct/* Make sure Rx is enabled in case Tx is active with Rx disabled */ if (!(rs485conf->flags &SER_RS485_ENABLED ) || - rs485conf->flags &SER_RS485_RX_DURING_TX ) + rs485conf->flags &SER_RS485_RX_DURING_TX ) { +imx_uart_setup_ufcr (sport,TXTL_DEFAULT ,RXTL_DEFAULT );imx_uart_start_rx (port); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 118/163 serial: core: introduce uart_port_tx_limited_flags()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
commit 9bb43b9e8d9a288a214e9b17acc9e46fda3977cf upstream.
Analogue to uart_port_tx_flags() introduced in commit 3ee07964d407 ("serial: core: introduce uart_port_tx_flags()"), add a _flags variant for uart_port_tx_limited().
--- include/linux/serial_core.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/linux/serial_core.h +18 -0
@@ -827,6 +827,24 @@ enum UART_TX_FLAGS { })/** +* uart_port_tx_limited_flags -- transmit helper for uart_port with count limiting with flags +* @port: uart port +* @ch: variable to store a character to be written to the HW +* @flags: %UART_TX_NOSTOP or similar +* @count: a limit of characters to send +* @tx_ready: can HW accept more data function +* @put_char: function to write a character +* @tx_done: function to call after the loop is done +* +* See uart_port_tx_limited() for more details. +*/ +#define uart_port_tx_limited_flags (port, ch, flags, count, tx_ready, put_char, tx_done) ({ \ + unsigned int __count = (count); \ + __uart_port_tx(port, ch, flags, tx_ready, put_char, tx_done, __count, \ + __count--); \ +}) + +/** * uart_port_tx -- transmit helper for uart_port * @port: uart port * @ch: variable to store a character to be written to the HW
Greg Kroah-Hartman
maintainerPATCH 119/163 serial: bcm63xx-uart: fix tx after conversion to uart_port_tx_limited()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
commit ea55c65dedf40e9c1911dc1e63e26bc9a59692b9 upstream.
When bcm63xx-uart was converted to uart_port_tx_limited(), it implicitly added a call to stop_tx(). This causes garbage to be put out on the serial console. To fix this, pass UART_TX_NOSTOP in flags, and manually call stop_tx() ourselves analogue to how a similar issue was fixed in commit 7be50f2e8f20 ("serial: mxs-auart: fix tx").
--- drivers/tty/serial/bcm63xx_uart.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/tty/serial/bcm63xx_uart.c +5 -2
@@ -309,8 +309,8 @@ static void bcm_uart_do_tx(struct uart_p val =bcm_uart_readl (port,UART_MCTL_REG ); val = (val &UART_MCTL_TXFIFOFILL_MASK ) >>UART_MCTL_TXFIFOFILL_SHIFT ; - - pending =uart_port_tx_limited (port, ch, port->fifosize - val, + pending =uart_port_tx_limited_flags (port, ch,UART_TX_NOSTOP , + port->fifosize - val, true,bcm_uart_writel (port, ch,UART_FIFO_REG ), ({}));
@@ -321,6 +321,9 @@ static void bcm_uart_do_tx(struct uart_p val =bcm_uart_readl (port,UART_IR_REG ); val &= ~UART_TX_INT_MASK ;bcm_uart_writel (port, val,UART_IR_REG ); + +if (uart_tx_stopped (port)) +bcm_uart_stop_tx (port); }/*
Greg Kroah-Hartman
maintainerPATCH 120/163 ALSA: hda/realtek: fix mute/micmute LEDs dont work for EliteBook 645/665 G11.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dirk Su <[email protected]>
commit 3cd59d8ef8df7d7a079f54d56502dae8f716b39b upstream.
HP EliteBook 645/665 G11 needs ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mic-mute/audio-mute working.
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -9963,6 +9963,9 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8c7c ,"HP ProBook 445 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8c7d ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8c7e ,"HP ProBook 465 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c7f ,"HP EliteBook 645 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c80 ,"HP EliteBook 645 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ), +SND_PCI_QUIRK (0x103c ,0x8c81 ,"HP EliteBook 665 G11" ,ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF ),SND_PCI_QUIRK (0x103c ,0x8c89 ,"HP ProBook 460 G11" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8c8a ,"HP EliteBook 630" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 121/163 tty: mcf: MCF54418 has 10 UARTS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Michel Hautbois <[email protected]>
commit 7c92a8bd53f24d50c8cf4aba53bb75505b382fed upstream.
Most of the colfires have up to 5 UARTs but MCF54418 has up-to 10 ! Change the maximum value authorized.
--- drivers/tty/serial/mcf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/mcf.c +1 -1
@@ -462,7 +462,7 @@ static const struct uart_ops mcf_uart_op .verify_port = mcf_verify_port, }; -static struct mcf_uart mcf_ports[4 ]; +static struct mcf_uart mcf_ports[10 ];#define MCF_MAXPORTS ARRAY_SIZE(mcf_ports)
Greg Kroah-Hartman
maintainerPATCH 104/163 net: usb: ax88179_178a: improve link status logs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <[email protected]>
commit 058722ee350c0bdd664e467156feb2bf5d9cc271 upstream.
Avoid spurious link status logs that may ultimately be wrong; for example, if the link is set to down with the cable plugged, then the cable is unplugged and after this the link is set to up, the last new log that is appearing is incorrectly telling that the link is up.
In order to avoid errors, show link status logs after link_reset processing, and in order to avoid spurious as much as possible, only show the link loss when some link status change is detected.
--- drivers/net/usb/ax88179_178a.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/usb/ax88179_178a.c +5 -1
@@ -326,7 +326,8 @@ static void ax88179_status(struct usbnetif (netif_carrier_ok (dev->net) != link) {usbnet_link_change (dev, link,1 ); -netdev_info (dev->net,"ax88179 - Link status is: %d\n" , link); +if (!link) +netdev_info (dev->net,"ax88179 - Link status is: 0\n" ); } }
@@ -1540,6 +1541,7 @@ static int ax88179_link_reset(struct usb GMII_PHY_PHYSR, 2, &tmp16);if (!(tmp16 &GMII_PHY_PHYSR_LINK )) { +netdev_info (dev->net,"ax88179 - Link status is: 0\n" );return 0 ; }else if (GMII_PHY_PHYSR_GIGA == (tmp16 &GMII_PHY_PHYSR_SMASK )) { mode |=AX_MEDIUM_GIGAMODE |AX_MEDIUM_EN_125MHZ ;
@@ -1577,6 +1579,8 @@ static int ax88179_link_reset(struct usbnetif_carrier_on (dev->net); +netdev_info (dev->net,"ax88179 - Link status is: 1\n" ); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 122/163 net: can: j1939: Initialize unused data in j1939_send_one()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
commit b7cdf1dd5d2a2d8200efd98d1893684db48fe134 upstream.
syzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one() creates full frame including unused data, but it doesn't initialize it. This causes the kernel-infoleak issue. Fix this by initializing unused data.
[1]
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185 copy_to_iter include/linux/uio.h:196 [inline] memcpy_to_msg include/linux/skbuff.h:4113 [inline] raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x2c4/0x340 net/socket.c:1068 ____sys_recvmsg+0x18a/0x620 net/socket.c:2803 ___sys_recvmsg+0x223/0x840 net/socket.c:2845 do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939 __sys_recvmmsg net/socket.c:3018 [inline] __do_sys_recvmmsg net/socket.c:3041 [inline] __se_sys_recvmmsg net/socket.c:3034 [inline] __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034 x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1313 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 sock_alloc_send_skb include/net/sock.h:1842 [inline] j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline] j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline] j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674 x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Bytes 12-15 of 16 are uninitialized
Memory access of size 16 starts at ffff888120969690 Data copied to user address 00000000200017c0
CPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
--- net/can/j1939/main.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/can/j1939/main.c +1 -5
@@ -30,10 +30,6 @@ MODULE_ALIAS("can-proto-" __stringify(CA/* CAN_HDR: #bytes before can_frame data part */ #define J1939_CAN_HDR (offsetof(struct can_frame, data)) -/* CAN_FTR: #bytes beyond data part */ -#define J1939_CAN_FTR (sizeof(struct can_frame) - J1939_CAN_HDR - \ - sizeof(((struct can_frame *)0)->data)) -/* lowest layer */ static void j1939_can_recv (struct sk_buff *iskb,void *data) {
@@ -342,7 +338,7 @@ int j1939_send_one(struct j1939_priv *prmemset (cf,0 ,J1939_CAN_HDR );/* make it a full can frame again */ -skb_put (skb,J1939_CAN_FTR + (8 - dlc)); +skb_put_zero (skb,8 - dlc); canid =CAN_EFF_FLAG | (skcb->priority << 26) |
Greg Kroah-Hartman
maintainerPATCH 123/163 net: can: j1939: recover socket queue on CAN bus error during BAM transmission
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 9ad1da14ab3bf23087ae45fe399d84a109ddb81a upstream.
Addresses an issue where a CAN bus error during a BAM transmission could stall the socket queue, preventing further transmissions even after the bus error is resolved. The fix activates the next queued session after the error recovery, allowing communication to continue.
--- net/can/j1939/transport.c | 2 ++ 1 file changed, 2 insertions(+)
net/can/j1939/transport.c +2 -0
@@ -1681,6 +1681,8 @@ static int j1939_xtp_rx_rts_session_actij1939_session_timers_cancel (session);j1939_session_cancel (session,J1939_XTP_ABORT_BUSY ); +if (session->transmission) +j1939_session_deactivate_activate_next (session);return -EBUSY ; }
Greg Kroah-Hartman
maintainerPATCH 124/163 net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit d3e2904f71ea0fe7eaff1d68a2b0363c888ea0fb upstream.
This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939_xtp_rx_rts().
Potentially this could be reproduced with something like:
testj1939 -r vcan0:0x80 &
while true; do
# send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done
--- net/can/j1939/transport.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
net/can/j1939/transport.c +17 -2
@@ -1593,8 +1593,8 @@ j1939_session *j1939_xtp_rx_rts_session_struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb (skb);struct j1939_session *session;const u8 *dat; +int len, ret;pgn_t pgn; -int len;netdev_dbg (priv->ndev,"%s\n" , __func__);
@@ -1653,7 +1653,22 @@ j1939_session *j1939_xtp_rx_rts_session_ session->tskey = priv->rx_tskey++;j1939_sk_errqueue (session,J1939_ERRQUEUE_RX_RTS ); -WARN_ON_ONCE (j1939_session_activate (session)); + ret =j1939_session_activate (session); +if (ret) { +/* Entering this scope indicates an issue with the J1939 bus. +* Possible scenarios include: +* - A time lapse occurred, and a new session was initiated +* due to another packet being sent correctly. This could +* have been caused by too long interrupt, debugger, or being +* out-scheduled by another task. +* - The bus is receiving numerous erroneous packets, either +* from a malfunctioning device or during a test scenario. +*/ +netdev_alert (priv->ndev,"%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n" , + __func__, session, skcb.addr.sa, skcb.addr.da); +j1939_session_put (session); +return NULL ; + }return session; }
Greg Kroah-Hartman
maintainerPATCH 125/163 PCI/MSI: Fix UAF in msi_capability_init
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
commit 9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1 upstream.
KFENCE reports the following UAF:
BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488
Use-after-free read at 0x0000000024629571 (in kfence-#12):
__pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128
allocated by task 81 on cpu 7 at 10.808142s:
__kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
freed by task 81 on cpu 7 at 10.811436s:
msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
Descriptor allocation done in:__pci_enable_msi_range
msi_capability_init
msi_setup_msi_desc
msi_insert_msi_desc
msi_domain_insert_msi_desc
msi_alloc_desc
...Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range
msi_capability_init
pci_msi_setup_msi_irqs
msi_domain_alloc_irqs_all_locked
msi_domain_alloc_locked
__msi_domain_alloc_locked => fails msi_domain_free_locked
...
That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path.
Cure it by copying the descriptor and using the copy for the error exit path unmask operation.
[ tglx: Massaged change log ]
--- drivers/pci/msi/msi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/pci/msi/msi.c +8 -2
@@ -348,7 +348,7 @@ static int msi_capability_init(struct pc struct irq_affinity *affd) {struct irq_affinity_desc *masks =NULL ; -struct msi_desc *entry; +struct msi_desc *entry, desc;int ret;/* Reject multi-MSI early on irq domain enabled architectures */
@@ -373,6 +373,12 @@ static int msi_capability_init(struct pc/* All MSIs are unmasked by default; mask them all */ entry =msi_first_desc (&dev->dev,MSI_DESC_ALL );pci_msi_mask (entry,msi_multi_mask (entry)); +/* +* Copy the MSI descriptor for the error path because +* pci_msi_setup_msi_irqs() will free it for the hierarchical +* interrupt domain case. +*/ +memcpy (&desc, entry,sizeof (desc));/* Configure MSI capability structure */ ret =pci_msi_setup_msi_irqs (dev, nvec,PCI_CAP_ID_MSI );
@@ -392,7 +398,7 @@ static int msi_capability_init(struct pc goto unlock; err: -pci_msi_unmask (entry,msi_multi_mask (entry)); +pci_msi_unmask (&desc,msi_multi_mask (&desc));pci_free_msi_irqs (dev); fail: dev->msi_enabled =0 ;
Greg Kroah-Hartman
maintainerPATCH 126/163 cpufreq: intel_pstate: Use HWP to initialize ITMT if CPPC is missing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit a1ff59784b277795a613beaa5d3dd9c5595c69a7 upstream.
It is reported that single-thread performance on some hybrid systems dropped significantly after commit 7feec7430edd ("ACPI: CPPC: Only probe for _CPC if CPPC v2 is acked") which prevented _CPC from being used if the support for it had not been confirmed by the platform firmware.
The problem is that if the platform firmware does not confirm CPPC v2 support, cppc_get_perf_caps() returns an error which prevents the intel_pstate driver from enabling ITMT. Consequently, the scheduler does not get any hints on CPU performance differences, so in a hybrid system some tasks may run on CPUs with lower capacity even though they should be running on high-capacity CPUs.
To address this, modify intel_pstate to use the information from MSR_HWP_CAPABILITIES to enable ITMT if CPPC is not available (which is done already if the highest performance number coming from CPPC is not realistic).
--- drivers/cpufreq/intel_pstate.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/cpufreq/intel_pstate.c +6 -7
@@ -356,15 +356,14 @@ static void intel_pstate_set_itmt_prio(iint ret; ret =cppc_get_perf_caps (cpu, &cppc_perf); -if (ret) -return ; -/* -* On some systems with overclocking enabled, CPPC.highest_perf is hardcoded to 0xff. -* In this case we can't use CPPC.highest_perf to enable ITMT. -* In this case we can look at MSR_HWP_CAPABILITIES bits [8:0] to decide. +* If CPPC is not available, fall back to MSR_HWP_CAPABILITIES bits [8:0]. +* +* Also, on some systems with overclocking enabled, CPPC.highest_perf is +* hardcoded to 0xff, so CPPC.highest_perf cannot be used to enable ITMT. +* Fall back to MSR_HWP_CAPABILITIES then too. */ -if (cppc_perf.highest_perf ==CPPC_MAX_PERF ) +if (ret || cppc_perf.highest_perf ==CPPC_MAX_PERF ) cppc_perf.highest_perf =HWP_HIGHEST_PERF (READ_ONCE (all_cpu_data[cpu]->hwp_cap_cached));/*
Greg Kroah-Hartman
maintainerPATCH 127/163 irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 2d64eaeeeda5659d52da1af79d237269ba3c2d2c upstream.
Multi-bridge machines required that all eiointc controllers in the system are initialized, otherwise the system does not boot.
The initialization happens on the boot CPU during early boot and relies on cpu_to_node() for identifying the individual nodes.
That works when the number of possible CPUs is large enough, but with a command line limit, e.g. "nr_cpus=$N" for kdump, but fails when the CPUs of the secondary nodes are not covered.
During early ACPI enumeration all CPU to node mappings are recorded up to CONFIG_NR_CPUS. These are accessible via early_cpu_to_node() even in the case that "nr_cpus=N" truncates the number of possible CPUs and only provides the possible CPUs via cpu_to_node() translation.
Change the node lookup in the driver to use early_cpu_to_node() so that even with a limitation on the number of possible CPUs all eointc instances are initialized.
This can't obviously cure the case where CONFIG_NR_CPUS is too small.
[ tglx: Massaged changelog ]
--- drivers/irqchip/irq-loongson-eiointc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/irqchip/irq-loongson-eiointc.c +3 -2
@@ -15,6 +15,7 @@#include <linux/irqchip/chained_irq.h> #include <linux/kernel.h> #include <linux/syscore_ops.h> +#include <asm/numa.h> #define EIOINTC_REG_NODEMAP 0x14a0#define EIOINTC_REG_IPMAP 0x14c0
@@ -349,7 +350,7 @@ static int __init pch_msi_parse_madt(uniint node;if (cpu_has_flatmode) - node =cpu_to_node (eiointc_priv[nr_pics -1 ]->node *CORES_PER_EIO_NODE ); + node =early_cpu_to_node (eiointc_priv[nr_pics -1 ]->node *CORES_PER_EIO_NODE );else node = eiointc_priv[nr_pics -1 ]->node;
@@ -441,7 +442,7 @@ int __init eiointc_acpi_init(struct irq_ goto out_free_handle;if (cpu_has_flatmode) - node =cpu_to_node (acpi_eiointc->node *CORES_PER_EIO_NODE ); + node =early_cpu_to_node (acpi_eiointc->node *CORES_PER_EIO_NODE );else node = acpi_eiointc->node;acpi_set_vec_parent (node, priv->eiointc_domain, pch_group);
Greg Kroah-Hartman
maintainerPATCH 128/163 cpu/hotplug: Fix dynstate assignment in __cpuhp_setup_state_cpuslocked()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
commit 932d8476399f622aa0767a4a0a9e78e5341dc0e1 upstream.
Commit 4205e4786d0b ("cpu/hotplug: Provide dynamic range for prepare stage") added a dynamic range for the prepare states, but did not handle the assignment of the dynstate variable in __cpuhp_setup_state_cpuslocked().
This causes the corresponding startup callback not to be invoked when calling __cpuhp_setup_state_cpuslocked() with the CPUHP_BP_PREPARE_DYN parameter, even though it should be.
Currently, the users of __cpuhp_setup_state_cpuslocked(), for one reason or another, have not triggered this bug.
--- kernel/cpu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/cpu.c +4 -4
@@ -2495,7 +2495,7 @@ EXPORT_SYMBOL_GPL(__cpuhp_state_add_inst* The caller needs to hold cpus read locked while calling this function. * Return: * On success: -* Positive state number if @state is CPUHP_AP_ONLINE_DYN; +* Positive state number if @state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN; * 0 for all other states * On failure: proper (negative) error code */
@@ -2518,7 +2518,7 @@ int __cpuhp_setup_state_cpuslocked(enum ret =cpuhp_store_callbacks (state, name, startup, teardown, multi_instance); - dynstate = state ==CPUHP_AP_ONLINE_DYN ; + dynstate = state ==CPUHP_AP_ONLINE_DYN || state ==CPUHP_BP_PREPARE_DYN ;if (ret >0 && dynstate) { state = ret; ret =0 ;
@@ -2549,8 +2549,8 @@ int __cpuhp_setup_state_cpuslocked(enum out:mutex_unlock (&cpuhp_state_mutex);/* -* If the requested state is CPUHP_AP_ONLINE_DYN, return the -* dynamically allocated state in case of success. +* If the requested state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN, +* return the dynamically allocated state in case of success. */ if (!ret && dynstate)return state;
Greg Kroah-Hartman
maintainerPATCH 129/163 irqchip/loongson-liointc: Set different ISRs for different cores
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit a9c3ee5d0fdb069b54902300df6ac822027f3b0a upstream.
The liointc hardware provides separate Interrupt Status Registers (ISR) for each core. The current code uses always the ISR of core #0, which works during boot because by default all interrupts are routed to core #0.
When the interrupt routing changes in the firmware configuration then this causes interrupts to be lost because they are not configured in the corresponding core.
Use the core index to access the correct ISR instead of a hardcoded 0.
[ tglx: Massaged changelog ]
--- drivers/irqchip/irq-loongson-liointc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-loongson-liointc.c +2 -2
@@ -28,7 +28,7 @@#define LIOINTC_INTC_CHIP_START 0x20 -#define LIOINTC_REG_INTC_STATUS (LIOINTC_INTC_CHIP_START + 0x20) +#define LIOINTC_REG_INTC_STATUS (core) (LIOINTC_INTC_CHIP_START + 0x20 + (core) * 8)#define LIOINTC_REG_INTC_EN_STATUS (LIOINTC_INTC_CHIP_START + 0x04)#define LIOINTC_REG_INTC_ENABLE (LIOINTC_INTC_CHIP_START + 0x08)#define LIOINTC_REG_INTC_DISABLE (LIOINTC_INTC_CHIP_START + 0x0c)
@@ -217,7 +217,7 @@ static int liointc_init(phys_addr_t addr goto out_free_priv;for (i =0 ; i <LIOINTC_NUM_CORES ; i++) - priv->core_isr[i] = base +LIOINTC_REG_INTC_STATUS ; + priv->core_isr[i] = base +LIOINTC_REG_INTC_STATUS (i);for (i =0 ; i <LIOINTC_NUM_PARENT ; i++) priv->handler[i].parent_int_map = parent_int_map[i];
Greg Kroah-Hartman
maintainerPATCH 130/163 kbuild: Install dtb files as 0644 in Makefile.dtbinst
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 9cc5f3bf63aa98bd7cc7ce8a8599077fde13283e upstream.
The compiled dtb files aren't executable, so install them with 0644 as their permission mode, instead of defaulting to 0755 for the permission mode and installing them with the executable bits set.
Some Linux distributions, including Debian, [1][2][3] already include fixes in their kernel package build recipes to change the dtb file permissions to 0644 in their kernel packages. These changes, when additionally propagated into the long-term kernel versions, will allow such distributions to remove their downstream fixes.
[1] https://salsa.debian.org/kernel-team/linux/-/merge_requests/642
[2] https://salsa.debian.org/kernel-team/linux/-/merge_requests/749
[3] https://salsa.debian.org/kernel-team/linux/-/blob/debian/6.8.12-1/debian/rules.real#L193
--- scripts/Makefile.dtbinst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.dtbinst +1 -1
@@ -24,7 +24,7 @@ __dtbs_install: $(dtbs) $(subdirs) @: quiet_cmd_dtb_install = INSTALL $@ - cmd_dtb_install = install -D $< $@ + cmd_dtb_install = install -D -m 0644 $< $@ $(dst)/%.dtb: $(obj)/%.dtb $(call cmd,dtb_install)
Greg Kroah-Hartman
maintainerPATCH 131/163 sh: rework sync_file_range ABI
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 30766f1105d6d2459c3b9fe34a3e52b637a72950 upstream.
The unusual function calling conventions on SuperH ended up causing sync_file_range to have the wrong argument order, with the 'flags' argument getting sorted before 'nbytes' by the compiler.
In userspace, I found that musl, glibc, uclibc and strace all expect the normal calling conventions with 'nbytes' last, so changing the kernel to match them should make all of those work.
In order to be able to also fix libc implementations to work with existing kernels, they need to be able to tell which ABI is used. An easy way to do this is to add yet another system call using the sync_file_range2 ABI that works the same on all architectures.
Old user binaries can now work on new kernels, and new binaries can try the new sync_file_range2() to work with new kernels or fall back to the old sync_file_range() version if that doesn't exist.
--- arch/sh/kernel/sys_sh32.c | 11 +++++++++++ arch/sh/kernel/syscalls/syscall.tbl | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-)
arch/sh/kernel/sys_sh32.c +11 -0
@@ -59,3 +59,14 @@ asmlinkage int sys_fadvise64_64_wrapper( (u64)len0 << 32 | len1, advice);#endif } + +/* +* swap the arguments the way that libc wants them instead of +* moving flags ahead of the 64-bit nbytes argument +*/ +SYSCALL_DEFINE6 (sh_sync_file_range6, int, fd,SC_ARG64 (offset), + SC_ARG64(nbytes), unsigned int, flags) +{ +return ksys_sync_file_range (fd,SC_VAL64 (loff_t, offset), +SC_VAL64 (loff_t, nbytes), flags); +}
arch/sh/kernel/syscalls/syscall.tbl +2 -1
@@ -321,7 +321,7 @@ 311 common set_robust_list sys_set_robust_list 312 common get_robust_list sys_get_robust_list 313 common splice sys_splice -314 common sync_file_range sys_sync_file_range +314 common sync_file_range sys_sh_sync_file_range6 315 common tee sys_tee 316 common vmsplice sys_vmsplice 317 common move_pages sys_move_pages
@@ -395,6 +395,7 @@ 385 common pkey_alloc sys_pkey_alloc 386 common pkey_free sys_pkey_free 387 common rseq sys_rseq +388 common sync_file_range2 sys_sync_file_range2 # room for arch specific syscalls 393 common semget sys_semget 394 common semctl sys_semctl
Greg Kroah-Hartman
maintainerPATCH 105/163 usb: gadget: printer: SS+ support
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit fd80731e5e9d1402cb2f85022a6abf9b1982ec5f upstream.
We need to treat super speed plus as super speed, not the default, which is full speed.
--- drivers/usb/gadget/function/f_printer.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/function/f_printer.c +1 -0
@@ -213,6 +213,7 @@ static inline struct usb_endpoint_descri struct usb_endpoint_descriptor *ss) {switch (gadget->speed) { +case USB_SPEED_SUPER_PLUS :case USB_SPEED_SUPER :return ss;case USB_SPEED_HIGH :
Greg Kroah-Hartman
maintainerPATCH 132/163 btrfs: zoned: fix initial free space detection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <[email protected]>
commit b9fd2affe4aa99a4ca14ee87e1f38fea22ece52a upstream.
When creating a new block group, it calls btrfs_add_new_free_space() to add the entire block group range into the free space accounting. __btrfs_add_free_space_zoned() checks if size == block_group->length to detect the initial free space adding, and proceed that case properly.
However, if the zone_capacity == zone_size and the over-write speed is fast enough, the entire zone can be over-written within one transaction. That confuses __btrfs_add_free_space_zoned() to handle it as an initial free space accounting. As a result, that block group becomes a strange state: 0 used bytes, 0 zone_unusable bytes, but alloc_offset == zone_capacity (no allocation anymore).
The initial free space accounting can properly be checked by checking alloc_offset too.
--- fs/btrfs/free-space-cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/free-space-cache.c +1 -1
@@ -2695,7 +2695,7 @@ static int __btrfs_add_free_space_zoned(u64 offset = bytenr - block_group->start;u64 to_free, to_unusable;int bg_reclaim_threshold =0 ; -bool initial = (size == block_group->length); +bool initial = ((size == block_group->length) && (block_group->alloc_offset ==0 ));u64 reclaimable_unusable;WARN_ON (!initial && offset + size > block_group->zone_capacity);
Greg Kroah-Hartman
maintainerPATCH 133/163 csky, hexagon: fix broken sys_sync_file_range
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 3339b99ef6fe38dac43b534cba3a8a0e29fb2eff upstream.
Both of these architectures require u64 function arguments to be passed in even/odd pairs of registers or stack slots, which in case of sync_file_range would result in a seven-argument system call that is not currently possible. The system call is therefore incompatible with all existing binaries.
While it would be possible to implement support for seven arguments like on mips, it seems better to use a six-argument version, either with the normal argument order but misaligned as on most architectures or with the reordered sync_file_range2() calling conventions as on arm and powerpc.
--- arch/csky/include/uapi/asm/unistd.h | 1 + arch/hexagon/include/uapi/asm/unistd.h | 1 + 2 files changed, 2 insertions(+)
arch/csky/include/uapi/asm/unistd.h +1 -0
@@ -6,6 +6,7 @@#define __ARCH_WANT_SYS_CLONE3#define __ARCH_WANT_SET_GET_RLIMIT#define __ARCH_WANT_TIME32_SYSCALLS +#define __ARCH_WANT_SYNC_FILE_RANGE2#include <asm-generic/unistd.h> #define __NR_set_thread_area (__NR_arch_specific_syscall + 0)
arch/hexagon/include/uapi/asm/unistd.h +1 -0
@@ -36,5 +36,6 @@#define __ARCH_WANT_SYS_VFORK#define __ARCH_WANT_SYS_FORK#define __ARCH_WANT_TIME32_SYSCALLS +#define __ARCH_WANT_SYNC_FILE_RANGE2#include <asm-generic/unistd.h>
Greg Kroah-Hartman
maintainerPATCH 134/163 hexagon: fix fadvise64_64 calling conventions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 896842284c6ccba25ec9d78b7b6e62cdd507c083 upstream.
fadvise64_64() has two 64-bit arguments at the wrong alignment for hexagon, which turns them into a 7-argument syscall that is not supported by Linux.
The downstream musl port for hexagon actually asks for a 6-argument version the same way we do it on arm, csky, powerpc, so make the kernel do it the same way to avoid having to change both.
--- arch/hexagon/include/asm/syscalls.h | 6 ++++++ arch/hexagon/kernel/syscalltab.c | 7 +++++++ 2 files changed, 13 insertions(+) create mode 100644 arch/hexagon/include/asm/syscalls.h
arch/hexagon/include/asm/syscalls.h new file +6 -0
@@ -0,0 +1,6 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#include <asm-generic/syscalls.h> + +asmlinkage long sys_hexagon_fadvise64_64 (int fd,int advice, +u32 a2,u32 a3,u32 a4,u32 a5);
arch/hexagon/kernel/syscalltab.c +7 -0
@@ -14,6 +14,13 @@#undef __SYSCALL#define __SYSCALL (nr, call) [nr] = (call), +SYSCALL_DEFINE6 (hexagon_fadvise64_64, int, fd, int, advice, + SC_ARG64(offset), SC_ARG64(len)) +{ +return ksys_fadvise64_64 (fd,SC_VAL64 (loff_t, offset),SC_VAL64 (loff_t, len), advice); +} +#define sys_fadvise64_64 sys_hexagon_fadvise64_64 + void *sys_call_table[__NR_syscalls] = {#include <asm/unistd.h> };
Greg Kroah-Hartman
maintainerPATCH 106/163 usb: gadget: printer: fix races against disable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit e587a7633dfee8987a999cf253f7c52a8e09276c upstream.
printer_read() and printer_write() guard against the race against disable() by checking the dev->interface flag, which in turn is guarded by a spinlock.
These functions, however, drop the lock on multiple occasions. This means that the test has to be redone after reacquiring the lock and before doing IO.
Add the tests.
This also addresses CVE-2024-25741
--- drivers/usb/gadget/function/f_printer.c | 39 +++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 10 deletions(-)
drivers/usb/gadget/function/f_printer.c +29 -10
@@ -450,11 +450,8 @@ printer_read(struct file *fd, char __usemutex_lock (&dev->lock_printer_io);spin_lock_irqsave (&dev->lock, flags); -if (dev->interface <0 ) { -spin_unlock_irqrestore (&dev->lock, flags); -mutex_unlock (&dev->lock_printer_io); -return -ENODEV ; - } +if (dev->interface <0 ) + goto out_disabled;/* We will use this flag later to check if a printer reset happened * after we turn interrupts back on.
@@ -462,6 +459,9 @@ printer_read(struct file *fd, char __use dev->reset_printer =0 ;setup_rx_reqs (dev); +/* this dropped the lock - need to retest */ +if (dev->interface <0 ) + goto out_disabled; bytes_copied =0 ; current_rx_req = dev->current_rx_req;
@@ -495,6 +495,8 @@ printer_read(struct file *fd, char __usewait_event_interruptible (dev->rx_wait, (likely (!list_empty (&dev->rx_buffers))));spin_lock_irqsave (&dev->lock, flags); +if (dev->interface <0 ) + goto out_disabled; }/* We have data to return then copy it to the caller's buffer.*/
@@ -538,6 +540,9 @@ printer_read(struct file *fd, char __usereturn -EAGAIN ; } +if (dev->interface <0 ) + goto out_disabled; +/* If we not returning all the data left in this RX request * buffer then adjust the amount of data left in the buffer. * Othewise if we are done with this RX request buffer then
@@ -567,6 +572,11 @@ printer_read(struct file *fd, char __usereturn bytes_copied; else return -EAGAIN; + +out_disabled: +spin_unlock_irqrestore (&dev->lock, flags); +mutex_unlock (&dev->lock_printer_io); +return -ENODEV ; } static ssize_t
@@ -587,11 +597,8 @@ printer_write(struct file *fd, const chamutex_lock (&dev->lock_printer_io);spin_lock_irqsave (&dev->lock, flags); -if (dev->interface <0 ) { -spin_unlock_irqrestore (&dev->lock, flags); -mutex_unlock (&dev->lock_printer_io); -return -ENODEV ; - } +if (dev->interface <0 ) + goto out_disabled;/* Check if a printer reset happens while we have interrupts on */ dev->reset_printer =0 ;
@@ -614,6 +621,8 @@ printer_write(struct file *fd, const chawait_event_interruptible (dev->tx_wait, (likely (!list_empty (&dev->tx_reqs))));spin_lock_irqsave (&dev->lock, flags); +if (dev->interface <0 ) + goto out_disabled; }while (likely (!list_empty (&dev->tx_reqs)) && len) {
@@ -663,6 +672,9 @@ printer_write(struct file *fd, const chareturn -EAGAIN ; } +if (dev->interface <0 ) + goto out_disabled; +list_add (&req->list, &dev->tx_reqs_active);/* here, we unlock, and only unlock, to avoid deadlock. */
@@ -675,6 +687,8 @@ printer_write(struct file *fd, const chamutex_unlock (&dev->lock_printer_io);return -EAGAIN ; } +if (dev->interface <0 ) + goto out_disabled; }spin_unlock_irqrestore (&dev->lock, flags);
@@ -686,6 +700,11 @@ printer_write(struct file *fd, const chareturn bytes_copied; else return -EAGAIN; + +out_disabled: +spin_unlock_irqrestore (&dev->lock, flags); +mutex_unlock (&dev->lock_printer_io); +return -ENODEV ; } static int
Greg Kroah-Hartman
maintainerPATCH 107/163 usb: musb: da8xx: fix a resource leak in probe()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit de644a4a86be04ed8a43ef8267d0f7d021941c5e upstream.
Call usb_phy_generic_unregister() if of_platform_populate() fails.
--- drivers/usb/musb/da8xx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/musb/da8xx.c +6 -2
@@ -555,7 +555,7 @@ static int da8xx_probe(struct platform_d ret =of_platform_populate (pdev->dev.of_node,NULL , da8xx_auxdata_lookup, &pdev->dev);if (ret) -return ret; + goto err_unregister_phy; pinfo = da8xx_dev_info; pinfo.parent = &pdev->dev;
@@ -570,9 +570,13 @@ static int da8xx_probe(struct platform_d ret =PTR_ERR_OR_ZERO (glue->musb);if (ret) {dev_err (&pdev->dev,"failed to register musb device: %d\n" , ret); -usb_phy_generic_unregister (glue->usb_phy); + goto err_unregister_phy; } +return 0 ; + +err_unregister_phy: +usb_phy_generic_unregister (glue->usb_phy);return ret; }
Greg Kroah-Hartman
maintainerPATCH 108/163 usb: atm: cxacru: fix endpoint checking in cxacru_bind()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 2eabb655a968b862bc0c31629a09f0fbf3c80d51 upstream.
Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpoints types may be used at urb sumbitting stage which in turn triggers a warning in usb_submit_urb().
Fix the issue by verifying that required endpoint types are present for both in and out endpoints, taking into account cmd endpoint type.
Unfortunately, this patch has not been tested on real hardware.
[1] Syzbot report:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 ... Call Trace: cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649 cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760 cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209 usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055 cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x23c/0xcd0 drivers/base/dd.c:595 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:965 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc2f/0x2180 drivers/base/core.c:3354 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
--- drivers/usb/atm/cxacru.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/atm/cxacru.c +14 -0
@@ -1131,6 +1131,7 @@ static int cxacru_bind(struct usbatm_datstruct cxacru_data *instance;struct usb_device *usb_dev =interface_to_usbdev (intf);struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD ]; +struct usb_endpoint_descriptor *in, *out;int ret;/* instance init */
@@ -1176,6 +1177,19 @@ static int cxacru_bind(struct usbatm_dat ret = -ENODEV ; goto fail; } + +if (usb_endpoint_xfer_int (&cmd_ep->desc)) + ret =usb_find_common_endpoints (intf->cur_altsetting, +NULL ,NULL , &in, &out); +else + ret =usb_find_common_endpoints (intf->cur_altsetting, + &in, &out,NULL ,NULL ); + +if (ret) { +usb_err (usbatm_instance,"cxacru_bind: interface has incorrect endpoints\n" ); + ret = -ENODEV ; + goto fail; + }if ((cmd_ep->desc.bmAttributes &USB_ENDPOINT_XFERTYPE_MASK ) ==USB_ENDPOINT_XFER_INT ) {
Greg Kroah-Hartman
maintainerPATCH 109/163 usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meng Li <[email protected]>
commit 7838de15bb700c2898a7d741db9b1f3cbc86c136 upstream.
When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system to enter suspend status with below command:
echo mem > /sys/power/state
There will be a deadlock issue occurring. Detailed invoking path as below:dwc3_suspend_common()
spin_lock_irqsave(&dwc->lock, flags); <-- 1st
dwc3_gadget_suspend(dwc);
dwc3_gadget_soft_disconnect(dwc);
spin_lock_irqsave(&dwc->lock, flags); <-- 2ndThis issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes the code of checking whether dwc->gadget_driver is NULL or not. It causes the following code is executed and deadlock occurs when trying to get the spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3:
Remove DWC3 locking during gadget suspend/resume") that forgot to remove the lock of otg mode. So, remove the redundant lock of otg mode during gadget suspend/resume.
--- drivers/usb/dwc3/core.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/usb/dwc3/core.c +0 -6
@@ -2044,7 +2044,6 @@ assert_reset:static int dwc3_suspend_common (struct dwc3 *dwc,pm_message_t msg) { -unsigned long flags;u32 reg;switch (dwc->current_dr_role) {
@@ -2082,9 +2081,7 @@ static int dwc3_suspend_common(struct dwbreak ;if (dwc->current_otg_role ==DWC3_OTG_ROLE_DEVICE ) { -spin_lock_irqsave (&dwc->lock, flags);dwc3_gadget_suspend (dwc); -spin_unlock_irqrestore (&dwc->lock, flags);synchronize_irq (dwc->irq_gadget); }
@@ -2101,7 +2098,6 @@ static int dwc3_suspend_common(struct dwstatic int dwc3_resume_common (struct dwc3 *dwc,pm_message_t msg) { -unsigned long flags;int ret;u32 reg;
@@ -2150,9 +2146,7 @@ static int dwc3_resume_common(struct dwcif (dwc->current_otg_role ==DWC3_OTG_ROLE_HOST ) {dwc3_otg_host_init (dwc); }else if (dwc->current_otg_role ==DWC3_OTG_ROLE_DEVICE ) { -spin_lock_irqsave (&dwc->lock, flags);dwc3_gadget_resume (dwc); -spin_unlock_irqrestore (&dwc->lock, flags); }break ;
Greg Kroah-Hartman
maintainerPATCH 110/163 usb: gadget: aspeed_udc: fix device address configuration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
commit dba7567c2fbbf10a4de2471cdb0e16e5572dc007 upstream.
In the aspeed UDC setup, we configure the UDC hardware with the assigned USB device address.
However, we have an off-by-one in the bitmask, so we're only setting the lower 6 bits of the address (USB addresses being 7 bits, and the hardware bitmask being bits 0:6).
This means that device enumeration fails if the assigned address is greater than 64:
[ 344.607255] usb 1-1: new high-speed USB device number 63 using ehci-platform [ 344.808459] usb 1-1: New USB device found, idVendor=cc00, idProduct=cc00, bcdDevice= 6.10 [ 344.817684] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.825671] usb 1-1: Product: Test device [ 344.831075] usb 1-1: Manufacturer: Test vendor [ 344.836335] usb 1-1: SerialNumber: 00 [ 349.917181] usb 1-1: USB disconnect, device number 63 [ 352.036775] usb 1-1: new high-speed USB device number 64 using ehci-platform [ 352.249432] usb 1-1: device descriptor read/all, error -71 [ 352.696740] usb 1-1: new high-speed USB device number 65 using ehci-platform [ 352.909431] usb 1-1: device descriptor read/all, error -71
Use the correct mask of 0x7f (rather than 0x3f), and generate this through the GENMASK macro, so we have numbers that correspond exactly to the hardware register definition.
--- drivers/usb/gadget/udc/aspeed_udc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/aspeed_udc.c +2 -2
@@ -66,8 +66,8 @@#define USB_UPSTREAM_EN BIT(0)/* Main config reg */ -#define UDC_CFG_SET_ADDR (x) ((x) & 0x3f) -#define UDC_CFG_ADDR_MASK (0x3f) +#define UDC_CFG_SET_ADDR (x) ((x) & UDC_CFG_ADDR_MASK) +#define UDC_CFG_ADDR_MASK GENMASK(6, 0)/* Interrupt ctrl & status reg */ #define UDC_IRQ_EP_POOL_NAK BIT(17)
Greg Kroah-Hartman
maintainerPATCH 111/163 usb: typec: ucsi: glink: fix child node release in probe function
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit c68942624e254a4e8a65afcd3c17ed95acda5489 upstream.
The device_for_each_child_node() macro requires explicit calls to fwnode_handle_put() in all early exits of the loop if the child node is not required outside. Otherwise, the child node's refcount is not decremented and the resource is not released.
The current implementation of pmic_glink_ucsi_probe() makes use of the device_for_each_child_node(), but does not release the child node on early returns. Add the missing calls to fwnode_handle_put().
--- drivers/usb/typec/ucsi/ucsi_glink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi_glink.c +4 -1
@@ -348,6 +348,7 @@ static int pmic_glink_ucsi_probe(struct ret =fwnode_property_read_u32 (fwnode,"reg" , &port);if (ret <0 ) {dev_err (dev,"missing reg property of %pOFn\n" , fwnode); +fwnode_handle_put (fwnode);return ret; }
@@ -362,9 +363,11 @@ static int pmic_glink_ucsi_probe(structif (!desc)continue ; -if (IS_ERR (desc)) +if (IS_ERR (desc)) { +fwnode_handle_put (fwnode);return dev_err_probe (dev,PTR_ERR (desc),"unable to acquire orientation gpio\n" ); + } ucsi->port_orientation[port] = desc; ucsi->port_switch[port] =fwnode_typec_switch_get (fwnode);
Greg Kroah-Hartman
maintainerPATCH 102/163 iio: chemical: bme680: Fix overflows in compensate() functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasileios Amoiridis <[email protected]>
commit fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8 upstream.
There are cases in the compensate functions of the driver that there could be overflows of variables due to bit shifting ops. These implications were initially discussed here [1] and they were mentioned in log message of Commit 1b3bd8592780 ("iio:
chemical: Add support for Bosch BME680 sensor").
[1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/
--- drivers/iio/chemical/bme680_core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/iio/chemical/bme680_core.c +6 -6
@@ -342,10 +342,10 @@ static s16 bme680_compensate_temp(structif (!calib->par_t2)bme680_read_calib (data, calib); - var1 = (adc_temp >>3 ) - (calib->par_t1 <<1 ); + var1 = (adc_temp >>3 ) - ((s32 )calib->par_t1 <<1 ); var2 = (var1 * calib->par_t2) >>11 ; var3 = ((var1 >>1 ) * (var1 >>1 )) >>12 ; - var3 = (var3 * (calib->par_t3 <<4 )) >>14 ; + var3 = (var3 * ((s32 )calib->par_t3 <<4 )) >>14 ; data->t_fine = var2 + var3; calc_temp = (data->t_fine *5 +128 ) >>8 ;
@@ -368,9 +368,9 @@ static u32 bme680_compensate_press(struc var1 = (data->t_fine >>1 ) -64000 ; var2 = ((((var1 >>2 ) * (var1 >>2 )) >>11 ) * calib->par_p6) >>2 ; var2 = var2 + (var1 * calib->par_p5 <<1 ); - var2 = (var2 >>2 ) + (calib->par_p4 <<16 ); + var2 = (var2 >>2 ) + ((s32 )calib->par_p4 <<16 ); var1 = (((((var1 >>2 ) * (var1 >>2 )) >>13 ) * - (calib->par_p3 <<5 )) >>3 ) + + ((s32 )calib->par_p3 <<5 )) >>3 ) + ((calib->par_p2 * var1) >>1 ); var1 = var1 >>18 ; var1 = ((32768 + var1) * calib->par_p1) >>15 ;
@@ -388,7 +388,7 @@ static u32 bme680_compensate_press(struc var3 = ((press_comp >>8 ) * (press_comp >>8 ) * (press_comp >>8 ) * calib->par_p10) >>17 ; - press_comp += (var1 + var2 + var3 + (calib->par_p7 <<7 )) >>4 ; + press_comp += (var1 + var2 + var3 + ((s32 )calib->par_p7 <<7 )) >>4 ;return press_comp; }
@@ -414,7 +414,7 @@ static u32 bme680_compensate_humid(struc (((temp_scaled * ((temp_scaled * calib->par_h5) /100 )) >> 6) / 100) + (1 << 14))) >> 10; var3 = var1 * var2; - var4 = calib->par_h6 <<7 ; + var4 = (s32 )calib->par_h6 <<7 ; var4 = (var4 + ((temp_scaled * calib->par_h7) /100 )) >>4 ; var5 = ((var3 >>14 ) * (var3 >>14 )) >>10 ; var6 = (var4 * var5) >>1 ;
Greg Kroah-Hartman
maintainerPATCH 136/163 drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 66edf3fb331b6c55439b10f9862987b0916b3726 upstream.
In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +2 -0
@@ -209,6 +209,8 @@ static int nv17_tv_get_ld_modes(struct dstruct drm_display_mode *mode; mode =drm_mode_duplicate (encoder->dev, tv_mode); +if (!mode) +continue ; mode->clock = tv_norm->tv_enc_mode.vrefresh * mode->htotal / 1000 *
Greg Kroah-Hartman
maintainerPATCH 145/163 ata: ahci: Clean up sysfs file on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit eeb25a09c5e0805d92e4ebd12c4b0ad0df1b0295 upstream.
.probe() (ahci_init_one()) calls sysfs_add_file_to_group(), however, if probe() fails after this call, we currently never call sysfs_remove_file_from_group().
(The sysfs_remove_file_from_group() call in .remove() (ahci_remove_one()) does not help, as .remove() is not called on .probe() error.)
Thus, if probe() fails after the sysfs_add_file_to_group() call, the next time we insmod the module we will get:
sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:04.0/remapped_nvme'
CPU: 11 PID: 954 Comm: modprobe Not tainted 6.10.0-rc5 #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 sysfs_warn_dup.cold+0x17/0x23 sysfs_add_file_mode_ns+0x11a/0x130 sysfs_add_file_to_group+0x7e/0xc0 ahci_init_one+0x31f/0xd40 [ahci]
--- drivers/ata/ahci.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/ata/ahci.c +12 -5
@@ -1890,8 +1890,10 @@ static int ahci_init_one(struct pci_dev n_ports =max (ahci_nr_ports (hpriv->cap),fls (hpriv->port_map)); host =ata_host_alloc_pinfo (&pdev->dev, ppi, n_ports); -if (!host) -return -ENOMEM ; +if (!host) { + rc = -ENOMEM ; + goto err_rm_sysfs_file; + } host->private_data = hpriv;if (ahci_init_msi (pdev, n_ports, hpriv) <0 ) {
@@ -1944,11 +1946,11 @@ static int ahci_init_one(struct pci_dev/* initialize adapter */ rc =ahci_configure_dma_masks (pdev, hpriv);if (rc) -return rc; + goto err_rm_sysfs_file; rc =ahci_pci_reset_controller (host);if (rc) -return rc; + goto err_rm_sysfs_file;ahci_pci_init_controller (host);ahci_pci_print_info (host);
@@ -1957,10 +1959,15 @@ static int ahci_init_one(struct pci_dev rc =ahci_host_activate (host, &ahci_sht);if (rc) -return rc; + goto err_rm_sysfs_file;pm_runtime_put_noidle (&pdev->dev);return 0 ; + +err_rm_sysfs_file: +sysfs_remove_file_from_group (&pdev->dev.kobj, + &dev_attr_remapped_nvme.attr,NULL ); +return rc; }static void ahci_shutdown_one (struct pci_dev *pdev)
Greg Kroah-Hartman
maintainerPATCH 146/163 ata: libata-core: Fix double free on error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit ab9e0c529eb7cafebdd31fe1644524e80a48b05d upstream.
If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump to the err_out label, which will call devres_release_group(). devres_release_group() will trigger a call to ata_host_release(). ata_host_release() calls kfree(host), so executing the kfree(host) in ata_host_alloc() will lead to a double free:
kernel BUG at mm/slub.c:553!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 11 PID: 599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:kfree+0x2cf/0x2f0 Code: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da RSP: 0018:ffffc90000f377f0 EFLAGS: 00010246 RAX: ffff888112b1f2c0 RBX: ffff888112b1f2c0 RCX: ffff888112b1f320 RDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0 RBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780 R13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006 FS: 00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? kfree+0x2cf/0x2f0 ? exc_invalid_op+0x50/0x70 ? kfree+0x2cf/0x2f0 ? asm_exc_invalid_op+0x1a/0x20 ? ata_host_alloc+0xf5/0x120 [libata] ? ata_host_alloc+0xf5/0x120 [libata] ? kfree+0x2cf/0x2f0 ata_host_alloc+0xf5/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci]
Ensure that we will not call kfree(host) twice, by performing the kfree() only if the devres_open_group() call failed.
--- drivers/ata/libata-core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/ata/libata-core.c +4 -4
@@ -5587,8 +5587,10 @@ struct ata_host *ata_host_alloc(struct dif (!host)return NULL ; -if (!devres_open_group (dev,NULL ,GFP_KERNEL )) - goto err_free; +if (!devres_open_group (dev,NULL ,GFP_KERNEL )) { +kfree (host); +return NULL ; + } dr =devres_alloc (ata_devres_release,0 ,GFP_KERNEL );if (!dr)
@@ -5620,8 +5622,6 @@ struct ata_host *ata_host_alloc(struct d err_out:devres_release_group (dev,NULL ); - err_free: -kfree (host);return NULL ; }EXPORT_SYMBOL_GPL (ata_host_alloc);
Greg Kroah-Hartman
maintainerPATCH 147/163 ftruncate: pass a signed offset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 upstream.
The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB.
Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL.
The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.
--- fs/open.c | 4 ++-- include/linux/compat.h | 2 +- include/linux/syscalls.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/open.c +2 -2
@@ -200,13 +200,13 @@ out:return error; } -SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length) +SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) {return do_sys_ftruncate (fd, length,1 ); }#ifdef CONFIG_COMPAT -COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length) +COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) {return do_sys_ftruncate (fd, length,1 ); }
include/linux/compat.h +1 -1
@@ -609,7 +609,7 @@ asmlinkage long compat_sys_fstatfs(unsigasmlinkage long compat_sys_fstatfs64 (unsigned int fd,compat_size_t sz,struct compat_statfs64 __user *buf);asmlinkage long compat_sys_truncate (const char __user *,compat_off_t ); -asmlinkage long compat_sys_ftruncate (unsigned int ,compat_ulong_t ); +asmlinkage long compat_sys_ftruncate (unsigned int ,compat_off_t );/* No generic prototype for truncate64, ftruncate64, fallocate */ asmlinkage long compat_sys_openat (int dfd,const char __user *filename,int flags,umode_t mode);
include/linux/syscalls.h +1 -1
@@ -410,7 +410,7 @@ asmlinkage long sys_fstatfs(unsigned intasmlinkage long sys_fstatfs64 (unsigned int fd,size_t sz,struct statfs64 __user *buf);asmlinkage long sys_truncate (const char __user *path,long length); -asmlinkage long sys_ftruncate (unsigned int fd,unsigned long length); +asmlinkage long sys_ftruncate (unsigned int fd,off_t length);#if BITS_PER_LONG ==32 asmlinkage long sys_truncate64 (const char __user *path,loff_t length);asmlinkage long sys_ftruncate64 (unsigned int fd,loff_t length);
Greg Kroah-Hartman
maintainerPATCH 148/163 syscalls: fix compat_sys_io_pgetevents_time64 usage
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit d3882564a77c21eb746ba5364f3fa89b88de3d61 upstream.
Using sys_io_pgetevents() as the entry point for compat mode tasks works almost correctly, but misses the sign extension for the min_nr and nr arguments.
This was addressed on parisc by switching to compat_sys_io_pgetevents_time64() in commit 6431e92fc827 ("parisc:io_pgetevents_time64() needs compat syscall in 32-bit compat mode"), as well as by using more sophisticated system call wrappers on x86 and s390. However, arm64, mips, powerpc, sparc and riscv still have the same bug.
Change all of them over to use compat_sys_io_pgetevents_time64() like parisc already does. This was clearly the intention when the function was originally added, but it got hooked up incorrectly in the tables.
--- arch/arm64/include/asm/unistd32.h | 2 +- arch/mips/kernel/syscalls/syscall_n32.tbl | 2 +- arch/mips/kernel/syscalls/syscall_o32.tbl | 2 +- arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- arch/s390/kernel/syscalls/syscall.tbl | 2 +- arch/sparc/kernel/syscalls/syscall.tbl | 2 +- arch/x86/entry/syscalls/syscall_32.tbl | 2 +- include/uapi/asm-generic/unistd.h | 2 +- kernel/sys_ni.c | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-)
arch/arm64/include/asm/unistd32.h +1 -1
@@ -840,7 +840,7 @@ __SYSCALL(__NR_pselect6_time64, compat_s#define __NR_ppoll_time64 414 __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64)#define __NR_io_pgetevents_time64 416 -__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) +__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64)#define __NR_recvmmsg_time64 417 __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64)#define __NR_mq_timedsend_time64 418
arch/mips/kernel/syscalls/syscall_n32.tbl +1 -1
@@ -354,7 +354,7 @@ 412 n32 utimensat_time64 sys_utimensat 413 n32 pselect6_time64 compat_sys_pselect6_time64 414 n32 ppoll_time64 compat_sys_ppoll_time64 -416 n32 io_pgetevents_time64 sys_io_pgetevents +416 n32 io_pgetevents_time64 compat_sys_io_pgetevents_time64 417 n32 recvmmsg_time64 compat_sys_recvmmsg_time64 418 n32 mq_timedsend_time64 sys_mq_timedsend 419 n32 mq_timedreceive_time64 sys_mq_timedreceive
arch/mips/kernel/syscalls/syscall_o32.tbl +1 -1
@@ -403,7 +403,7 @@ 412 o32 utimensat_time64 sys_utimensat sys_utimensat 413 o32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 414 o32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 -416 o32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents +416 o32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 417 o32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 418 o32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend 419 o32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive
arch/powerpc/kernel/syscalls/syscall.tbl +1 -1
@@ -506,7 +506,7 @@ 412 32 utimensat_time64 sys_utimensat sys_utimensat 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 -416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents +416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive
arch/s390/kernel/syscalls/syscall.tbl +1 -1
@@ -418,7 +418,7 @@ 412 32 utimensat_time64 - sys_utimensat 413 32 pselect6_time64 - compat_sys_pselect6_time64 414 32 ppoll_time64 - compat_sys_ppoll_time64 -416 32 io_pgetevents_time64 - sys_io_pgetevents +416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64 417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64 418 32 mq_timedsend_time64 - sys_mq_timedsend 419 32 mq_timedreceive_time64 - sys_mq_timedreceive
arch/sparc/kernel/syscalls/syscall.tbl +1 -1
@@ -461,7 +461,7 @@ 412 32 utimensat_time64 sys_utimensat sys_utimensat 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 -416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents +416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive
arch/x86/entry/syscalls/syscall_32.tbl +1 -1
@@ -420,7 +420,7 @@ 412 i386 utimensat_time64 sys_utimensat 413 i386 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 414 i386 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 -416 i386 io_pgetevents_time64 sys_io_pgetevents +416 i386 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 417 i386 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 418 i386 mq_timedsend_time64 sys_mq_timedsend 419 i386 mq_timedreceive_time64 sys_mq_timedreceive
include/uapi/asm-generic/unistd.h +1 -1
@@ -737,7 +737,7 @@ __SC_COMP(__NR_pselect6_time64, sys_psel#define __NR_ppoll_time64 414 __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64)#define __NR_io_pgetevents_time64 416 -__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) +__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64)#define __NR_recvmmsg_time64 417 __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64)#define __NR_mq_timedsend_time64 418
kernel/sys_ni.c +1 -1
@@ -46,8 +46,8 @@ COND_SYSCALL(io_getevents_time32);COND_SYSCALL (io_getevents);COND_SYSCALL (io_pgetevents_time32);COND_SYSCALL (io_pgetevents); -COND_SYSCALL_COMPAT (io_pgetevents_time32);COND_SYSCALL_COMPAT (io_pgetevents); +COND_SYSCALL_COMPAT (io_pgetevents_time64);COND_SYSCALL (io_uring_setup);COND_SYSCALL (io_uring_enter);COND_SYSCALL (io_uring_register);
Greg Kroah-Hartman
maintainerPATCH 149/163 syscalls: fix sys_fanotify_mark prototype
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 63e2f40c9e3187641afacde4153f54b3ee4dbc8c ]
My earlier fix missed an incorrect function prototype that shows up on native 32-bit builds:
In file included from fs/notify/fanotify/fanotify_user.c:14:include/linux/syscalls.h:248:25: error: conflicting types for 'sys_fanotify_mark'; have 'long int(int, unsigned int, u32, u32, int, const char *)' {aka 'long int(int, unsigned int, unsigned int, unsigned int, int, const char *)'}
1924 | SYSCALL32_DEFINE6(fanotify_mark,
| ^~~~~~~~~~~~~~~~~
include/linux/syscalls.h:862:17: note: previous declaration of 'sys_fanotify_mark' with type 'long int(int, unsigned int, u64, int, const char *)' {aka 'long int(int, unsigned int, long long unsigned int, int, const char *)'}
On x86 and powerpc, the prototype is also wrong but hidden in an #ifdef, so it never caused problems.
Add another alternative declaration that matches the conditional function definition.
--- include/linux/syscalls.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/linux/syscalls.h +6 -0
@@ -840,9 +840,15 @@ asmlinkage long sys_prlimit64(pid_t pid, unsigned int resource,const struct rlimit64 __user *new_rlim, struct rlimit64 __user *old_rlim);asmlinkage long sys_fanotify_init (unsigned int flags,unsigned int event_f_flags); +#if defined(CONFIG_ARCH_SPLIT_ARG64 ) +asmlinkage long sys_fanotify_mark (int fanotify_fd,unsigned int flags, +unsigned int mask_1,unsigned int mask_2, +int dfd,const char __user * pathname); +#else asmlinkage long sys_fanotify_mark (int fanotify_fd,unsigned int flags,u64 mask,int fd,const char __user *pathname); +#endif asmlinkage long sys_name_to_handle_at (int dfd,const char __user *name,struct file_handle __user *handle,int __user *mnt_id,int flag);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/163 erofs: fix NULL dereference of dif->bdev_handle in fscache mode
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingbo Xu <[email protected]>
commit 8bd90b6ae7856dd5000b75691d905b39b9ea5d6b upstream.
Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode.
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:erofs_map_dev+0xbd/0x1c0 Call Trace: <TASK> erofs_fscache_data_read_slice+0xa7/0x340 erofs_fscache_data_read+0x11/0x30 erofs_fscache_readahead+0xd9/0x100 read_pages+0x47/0x1f0 page_cache_ra_order+0x1e5/0x270 filemap_get_pages+0xf2/0x5f0 filemap_read+0xb8/0x2e0 vfs_read+0x18d/0x2b0 ksys_read+0x53/0xd0 do_syscall_64+0x42/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76
--- fs/erofs/data.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/erofs/data.c +3 -2
@@ -222,7 +222,7 @@ int erofs_map_dev(struct super_block *sbup_read (&devs->rwsem);return 0 ; } - map->m_bdev = dif->bdev_handle->bdev; + map->m_bdev = dif->bdev_handle ? dif->bdev_handle->bdev :NULL ; map->m_daxdev = dif->dax_dev; map->m_dax_part_off = dif->dax_part_off; map->m_fscache = dif->fscache;
@@ -240,7 +240,8 @@ int erofs_map_dev(struct super_block *sbif (map->m_pa >= startoff && map->m_pa < startoff + length) { map->m_pa -= startoff; - map->m_bdev = dif->bdev_handle->bdev; + map->m_bdev = dif->bdev_handle ? + dif->bdev_handle->bdev :NULL ; map->m_daxdev = dif->dax_dev; map->m_dax_part_off = dif->dax_part_off; map->m_fscache = dif->fscache;
Greg Kroah-Hartman
maintainerPATCH 151/163 pwm: stm32: Refuse too small period requests
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit c45fcf46ca2368dafe7e5c513a711a6f0f974308 upstream.
If period_ns is small, prd might well become 0. Catch that case because otherwise with
regmap_write(priv->regmap, TIM_ARR, prd - 1);
a few lines down quite a big period is configured.
--- drivers/pwm/pwm-stm32.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pwm/pwm-stm32.c +3 -0
@@ -344,6 +344,9 @@ static int stm32_pwm_config(struct stm32 prd = div; +if (!prd) +return -EINVAL ; +if (prescaler >MAX_TIM_PSC )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 152/163 Revert "cpufreq: amd-pstate: Fix the inconsistency in max frequency units"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 8f893e52b9e030a25ea62e31271bf930b01f2f07 which is commit e4731baaf29438508197d3a8a6d4f5a8c51663f8 upstream.
It causes a regression in kernels older than 6.9.y, so drop it from here.
--- drivers/cpufreq/amd-pstate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/amd-pstate.c +1 -1
@@ -675,7 +675,7 @@ static int amd_pstate_set_boost(struct cif (state) policy->cpuinfo.max_freq = cpudata->max_freq;else - policy->cpuinfo.max_freq = cpudata->nominal_freq *1000 ; + policy->cpuinfo.max_freq = cpudata->nominal_freq; policy->max = policy->cpuinfo.max_freq;
Greg Kroah-Hartman
maintainerPATCH 153/163 mm/page_alloc: Separate THP PCP into movable and non-movable categories
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangge <[email protected]>
commit bf14ed81f571f8dba31cd72ab2e50fbcc877cc31 upstream.
Since commit 5d0a661d808f ("mm/page_alloc: use only one PCP list for THP-sized allocations") no longer differentiates the migration type of pages in THP-sized PCP list, it's possible that non-movable allocation requests may get a CMA page from the list, in some cases, it's not acceptable.
If a large number of CMA memory are configured in system (for example, the CMA memory accounts for 50% of the system memory), starting a virtual machine with device passthrough will get stuck. During starting the virtual machine, it will call pin_user_pages_remote(..., FOLL_LONGTERM, ...) to pin memory. Normally if a page is present and in CMA area, pin_user_pages_remote() will migrate the page from CMA area to non-CMA area because of FOLL_LONGTERM flag. But if non-movable allocation requests return CMA memory, migrate_longterm_unpinnable_pages() will migrate a CMA page to another CMA page, which will fail to pass the check in check_and_migrate_movable_pages() and cause migration endless.
Call trace:
pin_user_pages_remote
--__gup_longterm_locked // endless loops in this function ----_get_user_pages_locked ----check_and_migrate_movable_pages ------migrate_longterm_unpinnable_pages --------alloc_migration_target
This problem will also have a negative impact on CMA itself. For example, when CMA is borrowed by THP, and we need to reclaim it through cma_alloc() or dma_alloc_coherent(), we must move those pages out to ensure CMA's users can retrieve that contigous memory. Currently, CMA's memory is occupied by non-movable pages, meaning we can't relocate them. As a result, cma_alloc() is more likely to fail.
To fix the problem above, we add one PCP list for THP, which will not introduce a new cacheline for struct per_cpu_pages. THP will have 2 PCP lists, one PCP list is used by MOVABLE allocation, and the other PCP list is used by UNMOVABLE allocation. MOVABLE allocation contains GPF_MOVABLE, and UNMOVABLE allocation contains GFP_UNMOVABLE and GFP_RECLAIMABLE.
--- include/linux/mmzone.h | 9 ++++----- mm/page_alloc.c | 9 +++++++-- 2 files changed, 11 insertions(+), 7 deletions(-)
include/linux/mmzone.h +4 -5
@@ -664,13 +664,12 @@ enum zone_watermarks { };/* -* One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. One additional list -* for THP which will usually be GFP_MOVABLE. Even if it is another type, -* it should not contribute to serious fragmentation causing THP allocation -* failures. +* One per migratetype for each PAGE_ALLOC_COSTLY_ORDER. Two additional lists +* are added for THP. One PCP list is used by GPF_MOVABLE, and the other PCP list +* is used by GFP_UNMOVABLE and GFP_RECLAIMABLE. */ #ifdef CONFIG_TRANSPARENT_HUGEPAGE -#define NR_PCP_THP 1 +#define NR_PCP_THP 2#else #define NR_PCP_THP 0#endif
mm/page_alloc.c +7 -2
@@ -519,10 +519,15 @@ out:static inline unsigned int order_to_pindex (int migratetype,int order) { +bool __maybe_unused movable; +#ifdef CONFIG_TRANSPARENT_HUGEPAGE if (order >PAGE_ALLOC_COSTLY_ORDER ) {VM_BUG_ON (order != pageblock_order); -return NR_LOWORDER_PCP_LISTS ; + + movable = migratetype ==MIGRATE_MOVABLE ; + +return NR_LOWORDER_PCP_LISTS + movable; }#else VM_BUG_ON (order >PAGE_ALLOC_COSTLY_ORDER );
@@ -536,7 +541,7 @@ static inline int pindex_to_order(unsignint order = pindex /MIGRATE_PCPTYPES ;#ifdef CONFIG_TRANSPARENT_HUGEPAGE -if (pindex ==NR_LOWORDER_PCP_LISTS ) +if (pindex >=NR_LOWORDER_PCP_LISTS ) order = pageblock_order;#else VM_BUG_ON (order >PAGE_ALLOC_COSTLY_ORDER );
Greg Kroah-Hartman
maintainerPATCH 154/163 arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 1fb98c855ccd7bc7f50c7a9626fbb8440454760b ]
Radxa ROCK Pi S have optional onboard SD NAND on board revision v1.1, v1.2 and v1.3, revision v1.5 changed to use optional onboard eMMC.
The optional SD NAND typically fails to initialize:
mmc_host mmc0: Bus speed (slot 0) = 400000Hz (slot req 400000Hz, actual 400000HZ div = 0)
mmc0: error -110 whilst initialising SD card
mmc_host mmc0: Bus speed (slot 0) = 300000Hz (slot req 300000Hz, actual 300000HZ div = 0)
mmc0: error -110 whilst initialising SD card
mmc_host mmc0: Bus speed (slot 0) = 200000Hz (slot req 200000Hz, actual 200000HZ div = 0)
mmc0: error -110 whilst initialising SD card
mmc_host mmc0: Bus speed (slot 0) = 100000Hz (slot req 100000Hz, actual 100000HZ div = 0)
mmc0: error -110 whilst initialising SD card
Add pinctrl and cap-sd-highspeed to fix SD NAND initialization. Also drop bus-width and mmc-hs200-1_8v to fix eMMC initialization on the new v1.5 board revision, only 3v3 signal voltage is used.
--- arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +4 -2
@@ -126,10 +126,12 @@ }; &emmc { - bus-width = <4>; cap-mmc-highspeed; - mmc-hs200-1_8v; + cap-sd-highspeed; + no-sdio; non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>; vmmc-supply = <&vcc_io>; status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/163 drm/fbdev-dma: Only set smem_start is enable per module option
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit d92a7580392ad4681b1d4f9275d00b95375ebe01 upstream.
Only export struct fb_info.fix.smem_start if that is required by the user and the memory does not come from vmalloc().
Setting struct fb_info.fix.smem_start breaks systems where DMA memory is backed by vmalloc address space. An example error is shown below.
[ 3.536043] ------------[ cut here ]------------ [ 3.540716] virt_to_phys used for non-linear address: 000000007fc4f540 (0xffff800086001000) [ 3.552628] WARNING: CPU: 4 PID: 61 at arch/arm64/mm/physaddr.c:12 __virt_to_phys+0x68/0x98 [ 3.565455] Modules linked in: [ 3.568525] CPU: 4 PID: 61 Comm: kworker/u12:5 Not tainted 6.6.23-06226-g4986cc3e1b75-dirty #250 [ 3.577310] Hardware name: NXP i.MX95 19X19 board (DT) [ 3.582452] Workqueue: events_unbound deferred_probe_work_func [ 3.588291] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.595233] pc : __virt_to_phys+0x68/0x98 [ 3.599246] lr : __virt_to_phys+0x68/0x98 [ 3.603276] sp : ffff800083603990 [ 3.677939] Call trace: [ 3.680393] __virt_to_phys+0x68/0x98 [ 3.684067] drm_fbdev_dma_helper_fb_probe+0x138/0x238 [ 3.689214] __drm_fb_helper_initial_config_and_unlock+0x2b0/0x4c0 [ 3.695385] drm_fb_helper_initial_config+0x4c/0x68 [ 3.700264] drm_fbdev_dma_client_hotplug+0x8c/0xe0 [ 3.705161] drm_client_register+0x60/0xb0 [ 3.709269] drm_fbdev_dma_setup+0x94/0x148
Additionally, DMA memory is assumed to by contiguous in physical address space, which is not guaranteed by vmalloc().
Resolve this by checking the module flag drm_leak_fbdev_smem when DRM allocated the instance of struct fb_info. Fbdev-dma then only sets smem_start only if required (via FBINFO_HIDE_SMEM_START). Also guarantee that the framebuffer is not located in vmalloc address space.
--- drivers/gpu/drm/drm_fb_helper.c | 6 +++--- drivers/gpu/drm/drm_fbdev_dma.c | 5 ++++- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_fb_helper.c +3 -3
@@ -524,6 +524,9 @@ struct fb_info *drm_fb_helper_alloc_infoif (!info)return ERR_PTR (-ENOMEM ); +if (!drm_leak_fbdev_smem) + info->flags |=FBINFO_HIDE_SMEM_START ; + ret =fb_alloc_cmap (&info->cmap,256 ,0 );if (ret) goto err_release;
@@ -1860,9 +1863,6 @@ __drm_fb_helper_initial_config_and_unloc info = fb_helper->info; info->var.pixclock =0 ; -if (!drm_leak_fbdev_smem) - info->flags |=FBINFO_HIDE_SMEM_START ; -/* Need to drop locks to avoid recursive deadlock in * register_framebuffer. This is ok because the only thing left to do is * register the fbdev emulation instance in kernel_fb_helper_list. */
drivers/gpu/drm/drm_fbdev_dma.c +4 -1
@@ -130,7 +130,10 @@ static int drm_fbdev_dma_helper_fb_probe info->flags |=FBINFO_READS_FAST ;/* signal caching */ info->screen_size = sizes->surface_height * fb->pitches[0 ]; info->screen_buffer = map.vaddr; - info->fix.smem_start =page_to_phys (virt_to_page (info->screen_buffer)); +if (!(info->flags &FBINFO_HIDE_SMEM_START )) { +if (!drm_WARN_ON (dev,is_vmalloc_addr (info->screen_buffer))) + info->fix.smem_start =page_to_phys (virt_to_page (info->screen_buffer)); + } info->fix.smem_len = info->screen_size;return 0 ;