6.10.14-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 1/482 static_call: Handle module init failure correctly in static_call_del_module()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 4b30051c4864234ec57290c3d142db7c88f10d8a ]
Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain.
If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries.
This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod.
The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space:
union {
/* bit 0: 0 = mods, 1 = sites */
unsigned long type;
struct static_call_mod *mods;
struct static_call_site *sites;
};key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set.
As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus.
Cure it by checking whether the key has a sites or a mods pointer.
If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit.
If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing.
A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer.
--- kernel/static_call_inline.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
kernel/static_call_inline.c +11 -0
@@ -411,6 +411,17 @@ static void static_call_del_module(struct module *mod)for (site = start; site < stop; site++) { key =static_call_key (site); + +/* +* If the key was not updated due to a memory allocation +* failure in __static_call_init() then treating key::sites +* as key::mods in the code below would cause random memory +* access and #GP. In that case all subsequent sites have +* not been touched either, so stop iterating. +*/ +if (!static_call_key_has_mods (key)) +break ; +if (key == prev_key)continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/482 mailbox: ARM_MHU_V3 should depend on ARM64
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 0e4ed48292c55eeb0afab22f8930b556f17eaad2 ]
The ARM MHUv3 controller is only present on ARM64 SoCs. Hence add a dependency on ARM64, to prevent asking the user about this driver when configuring a kernel for a different architecture than ARM64.
--- drivers/mailbox/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/mailbox/Kconfig +1 -0
@@ -25,6 +25,7 @@ config ARM_MHU_V2 config ARM_MHU_V3 tristate "ARM MHUv3 Mailbox" + depends on ARM64 || COMPILE_TEST depends on HAS_IOMEM || COMPILE_TEST depends on OF help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/482 mailbox: rockchip: fix a typo in module autoloading
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit e92d87c9c5d769e4cb1dd7c90faa38dddd7e52e3 ]
MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match) could let the module properly autoloaded based on the alias from of_device_id table. It should be 'rockchip_mbox_of_match' instead of 'rockchp_mbox_of_match', just fix it.
--- drivers/mailbox/rockchip-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/rockchip-mailbox.c +1 -1
@@ -159,7 +159,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = { { .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data}, { }, }; -MODULE_DEVICE_TABLE (of, rockchp_mbox_of_match); +MODULE_DEVICE_TABLE (of, rockchip_mbox_of_match);static int rockchip_mbox_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/482 mailbox: bcm2835: Fix timeout during suspend mode
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ]
During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1].
Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle.
[1]
PM: late suspend of devices complete after 1.754 msecs
WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0)
[...]
PM: noirq suspend of devices complete after 3095.584 msecs
--- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mailbox/bcm2835-mailbox.c +2 -1
@@ -145,7 +145,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)spin_lock_init (&mbox->lock); ret =devm_request_irq (dev,irq_of_parse_and_map (dev->of_node,0 ), - bcm2835_mbox_irq,0 ,dev_name (dev), mbox); + bcm2835_mbox_irq,IRQF_NO_SUSPEND ,dev_name (dev), + mbox);if (ret) {dev_err (dev,"Failed to register a mailbox IRQ handler: %d\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/482 ceph: fix a memory leak on cap_auths in MDS client
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
[ Upstream commit d97079e97eab20e08afc507f2bed4501e2824717 ]
The cap_auths that are allocated during an MDS session opening are never released, causing a memory leak detected by kmemleak. Fix this by freeing the memory allocated when shutting down the MDS client.
--- fs/ceph/mds_client.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/ceph/mds_client.c +12 -0
@@ -6011,6 +6011,18 @@ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)ceph_mdsmap_destroy (mdsc->mdsmap);kfree (mdsc->sessions);ceph_caps_finalize (mdsc); + +if (mdsc->s_cap_auths) { +int i; + +for (i =0 ; i < mdsc->s_cap_auths_num; i++) { +kfree (mdsc->s_cap_auths[i].match.gids); +kfree (mdsc->s_cap_auths[i].match.path); +kfree (mdsc->s_cap_auths[i].match.fs_name); + } +kfree (mdsc->s_cap_auths); + } +ceph_pool_perm_destroy (mdsc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/482 ceph: remove the incorrect Fw reference check when dirtying pages
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit c08dfb1b49492c09cf13838c71897493ea3b424e ]
When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.
--- fs/ceph/addr.c | 1 - 1 file changed, 1 deletion(-)
fs/ceph/addr.c +0 -1
@@ -95,7 +95,6 @@ static bool ceph_dirty_folio(struct address_space *mapping, struct folio *folio)/* dirty the head */ spin_lock (&ci->i_ceph_lock); -BUG_ON (ci->i_wr_ref ==0 );// caller should hold Fw reference if (__ceph_have_pending_cap_snap (ci)) {struct ceph_cap_snap *capsnap = list_last_entry(&ci->i_cap_snaps,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/482 drm/i915/dp: Fix colorimetry detection
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
[ Upstream commit e860513f56d8428fcb2bd0282ac8ab691a53fc6c ]
intel_dp_init_connector() is no place for detecting stuff via DPCD (except perhaps for eDP). Move the colorimetry stuff into a more appropriate place.
--- drivers/gpu/drm/i915/display/intel_dp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_dp.c +6 -3
@@ -3944,6 +3944,9 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp, struct intel_connector *connector drm_dp_is_branch(intel_dp->dpcd));intel_init_dpcd_quirks (intel_dp, &intel_dp->desc.ident); + intel_dp->colorimetry_support = +intel_dp_get_colorimetry_status (intel_dp); +/* * Read the eDP display control registers. *
@@ -4057,6 +4060,9 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)intel_init_dpcd_quirks (intel_dp, &intel_dp->desc.ident); + intel_dp->colorimetry_support = +intel_dp_get_colorimetry_status (intel_dp); +intel_dp_update_sink_caps (intel_dp); }
@@ -6774,9 +6780,6 @@ intel_dp_init_connector(struct intel_digital_port *dig_port, "HDCP init failed, skipping.\n"); } - intel_dp->colorimetry_support = -intel_dp_get_colorimetry_status (intel_dp); - intel_dp->frl.is_trained = false; intel_dp->frl.trained_rate_gbps =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/482 ieee802154: Fix build error
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit addf89774e48c992316449ffab4f29c2309ebefb ]
If REGMAP_SPI is m and IEEE802154_MCR20A is y,
mcr20a.c:(.text+0x3ed6c5b): undefined reference to `__devm_regmap_init_spi' ld: mcr20a.c:(.text+0x3ed6cb5): undefined reference to `__devm_regmap_init_spi'
Select REGMAP_SPI for IEEE802154_MCR20A to fix it.
--- drivers/net/ieee802154/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/ieee802154/Kconfig +1 -0
@@ -101,6 +101,7 @@ config IEEE802154_CA8210_DEBUGFS config IEEE802154_MCR20A tristate "MCR20A transceiver driver" + select REGMAP_SPI depends on IEEE802154_DRIVERS && MAC802154 depends on SPI help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/482 net: sparx5: Fix invalid timestamps
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aakash Menon <[email protected]>
[ Upstream commit 151ac45348afc5b56baa584c7cd4876addf461ff ]
Bit 270-271 are occasionally unexpectedly set by the hardware. This issue was observed with 10G SFPs causing huge time errors (> 30ms) in PTP. Only 30 bits are needed for the nanosecond part of the timestamp, clear 2 most significant bits before extracting timestamp from the internal frame header.
--- drivers/net/ethernet/microchip/sparx5/sparx5_packet.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c +5 -1
@@ -45,8 +45,12 @@ void sparx5_ifh_parse(u32 *ifh, struct frame_info *info) fwd = (fwd >>5 ); info->src_port =FIELD_GET (GENMASK (7 ,1 ), fwd); +/* +* Bit 270-271 are occasionally unexpectedly set by the hardware, +* clear bits before extracting timestamp +*/ info->timestamp = - ((u64 )xtr_hdr[2 ] <<24 ) | + ((u64)(xtr_hdr[2 ] &GENMASK (5 ,0 )) <<24 ) | ((u64 )xtr_hdr[3 ] <<16 ) | ((u64 )xtr_hdr[4 ] <<8 ) | ((u64 )xtr_hdr[5 ] <<0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/482 static_call: Replace pointless WARN_ON() in static_call_module_notify()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit fe513c2ef0a172a58f158e2e70465c4317f0a9a2 ]
static_call_module_notify() triggers a WARN_ON(), when memory allocation fails in __static_call_add_module().
That's not really justified, because the failure case must be correctly handled by the well known call chain and the error code is passed through to the initiating userspace application.
A memory allocation fail is not a fatal problem, but the WARN_ON() takes the machine out when panic_on_warn is set.
Replace it with a pr_warn().
--- kernel/static_call_inline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/static_call_inline.c +1 -1
@@ -453,7 +453,7 @@ static int static_call_module_notify(struct notifier_block *nb,case MODULE_STATE_COMING : ret =static_call_add_module (mod);if (ret) { -WARN (1 ,"Failed to allocate memory for static calls" ); +pr_warn ("Failed to allocate memory for static calls\n" );static_call_del_module (mod); }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/482 jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 9bc2ff871f00437ad2f10c1eceff51aaa72b478f ]
Make the code more obvious and add proper comments to avoid future head scratching.
Stable-dep-of: 1d7f856c2ca4 ("jump_label: Fix static_key_slow_dec() yet again")
--- kernel/jump_label.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
kernel/jump_label.c +11 -9
@@ -159,22 +159,24 @@ bool static_key_slow_inc_cpuslocked(struct static_key *key)if (static_key_fast_inc_not_disabled (key))return true; -jump_label_lock (); -if (atomic_read (&key->enabled) ==0 ) { -atomic_set (&key->enabled,-1 ); +guard (mutex)(&jump_label_mutex); +/* Try to mark it as 'enabling in progress. */ +if (!atomic_cmpxchg (&key->enabled,0 ,-1 )) {jump_label_update (key);/* -* Ensure that if the above cmpxchg loop observes our positive -* value, it must also observe all the text changes. +* Ensure that when static_key_fast_inc_not_disabled() or +* static_key_slow_try_dec() observe the positive value, +* they must also observe all the text changes. */ atomic_set_release (&key->enabled,1 ); }else { -if (WARN_ON_ONCE (!static_key_fast_inc_not_disabled (key))) { -jump_label_unlock (); +/* +* While holding the mutex this should never observe +* anything else than a value >= 1 and succeed +*/ +if (WARN_ON_ONCE (!static_key_fast_inc_not_disabled (key)))return false; - } } -jump_label_unlock ();return true; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/482 jump_label: Fix static_key_slow_dec() yet again
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 1d7f856c2ca449f04a22d876e36b464b7a9d28b6 ]
While commit 83ab38ef0a0b ("jump_label: Fix concurrency issues in static_key_slow_dec()") fixed one problem, it created yet another, notably the following is now possible:
slow_dec
if (try_dec) // dec_not_one-ish, false
// enabled == 1
slow_inc
if (inc_not_disabled) // inc_not_zero-ish
// enabled == 2
return
guard((mutex)(&jump_label_mutex);
if (atomic_cmpxchg(1,0)==1) // false, we're 2
slow_dec
if (try-dec) // dec_not_one, true
// enabled == 1
return
else
try_dec() // dec_not_one, false
WARNUse dec_and_test instead of cmpxchg(), like it was prior to 83ab38ef0a0b. Add a few WARNs for the paranoid.
--- kernel/jump_label.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
kernel/jump_label.c +27 -7
@@ -165,7 +165,7 @@ bool static_key_slow_inc_cpuslocked(struct static_key *key)jump_label_update (key);/* * Ensure that when static_key_fast_inc_not_disabled() or -* static_key_slow_try_dec() observe the positive value, +* static_key_dec_not_one() observe the positive value, * they must also observe all the text changes. */ atomic_set_release (&key->enabled,1 );
@@ -247,7 +247,7 @@ void static_key_disable(struct static_key *key) }EXPORT_SYMBOL_GPL (static_key_disable); -static bool static_key_slow_try_dec (struct static_key *key) +static bool static_key_dec_not_one (struct static_key *key) {int v;
@@ -271,6 +271,14 @@ static bool static_key_slow_try_dec(struct static_key *key)* enabled. This suggests an ordering problem on the user side. */ WARN_ON_ONCE (v <0 ); + +/* +* Warn about underflow, and lie about success in an attempt to +* not make things worse. +*/ +if (WARN_ON_ONCE (v ==0 )) +return true; +if (v <=1 )return false; }while (!likely (atomic_try_cmpxchg (&key->enabled, &v, v -1 )));
@@ -281,15 +289,27 @@ static bool static_key_slow_try_dec(struct static_key *key)static void __static_key_slow_dec_cpuslocked (struct static_key *key) {lockdep_assert_cpus_held (); +int val; -if (static_key_slow_try_dec (key)) +if (static_key_dec_not_one (key))return ;guard (mutex)(&jump_label_mutex); -if (atomic_cmpxchg (&key->enabled,1 ,0 ) ==1 ) + val =atomic_read (&key->enabled); +/* +* It should be impossible to observe -1 with jump_label_mutex held, +* see static_key_slow_inc_cpuslocked(). +*/ +if (WARN_ON_ONCE (val ==-1 )) +return ; +/* +* Cannot already be 0, something went sideways. +*/ +if (WARN_ON_ONCE (val ==0 )) +return ; + +if (atomic_dec_and_test (&key->enabled))jump_label_update (key); -else -WARN_ON_ONCE (!static_key_slow_try_dec (key)); }static void __static_key_slow_dec (struct static_key *key)
@@ -326,7 +346,7 @@ void __static_key_slow_dec_deferred(struct static_key *key, {STATIC_KEY_CHECK_USE (key); -if (static_key_slow_try_dec (key)) +if (static_key_dec_not_one (key))return ;schedule_delayed_work (work, timeout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/482 scsi: st: Fix input/output error on empty drive reset
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Rocha <[email protected]>
[ Upstream commit 3d882cca73be830549833517ddccb3ac4668c04e ]
A previous change was introduced to prevent data loss during a power-on reset when a tape is present inside the drive. This commit set the "pos_unknown" flag to true to avoid operations that could compromise data by performing actions from an untracked position. The relevant change is commit 9604eea5bd3a ("scsi: st: Add third party poweron reset handling")
As a consequence of this change, a new issue has surfaced: the driver now returns an "Input/output error" even for empty drives when the drive, host, or bus is reset. This issue stems from the "flush_buffer" function, which first checks whether the "pos_unknown" flag is set. If the flag is set, the user will encounter an "Input/output error" until the tape position is known again. This behavior differs from the previous implementation, where empty drives were not affected at system start up time, allowing tape software to send commands to the driver to retrieve the drive's status and other information.
The current behavior prioritizes the "pos_unknown" flag over the "ST_NO_TAPE" status, leading to issues for software that detects drives during system startup. This software will receive an "Input/output error" until a tape is loaded and its position is known.
To resolve this, the "ST_NO_TAPE" status should take priority when the drive is empty, allowing communication with the drive following a power-on reset. At the same time, the change should continue to protect data by maintaining the "pos_unknown" flag when the drive contains a tape and its position is unknown.
--- drivers/scsi/st.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/st.c +3 -2
@@ -834,6 +834,9 @@ static int flush_buffer(struct scsi_tape *STp, int seek_next)int backspace, result;struct st_partstat *STps; +if (STp->ready !=ST_READY ) +return 0 ; +/* * If there was a bus reset, block further access * to this device.
@@ -841,8 +844,6 @@ static int flush_buffer(struct scsi_tape *STp, int seek_next)if (STp->pos_unknown)return (-EIO ); -if (STp->ready !=ST_READY ) -return 0 ; STps = &(STp->ps[STp->partition]);if (STps->rw ==ST_WRITING )/* Writing */ return st_flush_write_buffer (STp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/482 scsi: pm8001: Do not overwrite PCI queue mapping
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit a141c17a543332fc1238eb5cba562bfc66879126 ]
blk_mq_pci_map_queues() maps all queues but right after this, we overwrite these mappings by calling blk_mq_map_queues(). Just use one helper but not both.
--- drivers/scsi/pm8001/pm8001_init.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/pm8001/pm8001_init.c +4 -2
@@ -100,10 +100,12 @@ static void pm8001_map_queues(struct Scsi_Host *shost)struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;struct blk_mq_queue_map *qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT ]; -if (pm8001_ha->number_of_intr >1 ) +if (pm8001_ha->number_of_intr >1 ) {blk_mq_pci_map_queues (qmap, pm8001_ha->pdev,1 ); +return ; + } -return blk_mq_map_queues (qmap); +blk_mq_map_queues (qmap); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/482 drm/i915/dp: Fix AUX IO power enabling for eDP PSR
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
[ Upstream commit ec2231b8dd2dc515912ff7816c420153b4a95e92 ]
Panel Self Refresh on eDP requires the AUX IO power to be enabled whenever the output (main link) is enabled. This is required by the AUX_PHY_WAKE/ML_PHY_LOCK signaling initiated by the HW automatically to re-enable the main link after it got disabled in power saving states (see eDP v1.4b, sections 5.1, 6.1.3.3.1.1).
The Panel Replay mode on non-eDP outputs on the other hand is only supported by keeping the main link active, thus not requiring the above AUX_PHY_WAKE/ML_PHY_LOCK signaling (eDP v1.4b, section 6.1.3.3.1.2). Thus enabling the AUX IO power for this case is not required either.
Based on the above enable the AUX IO power only for eDP/PSR outputs.
Bspec: 49274, 53370
v2:
- Add a TODO comment to adjust the requirement for AUX IO based on whether the ALPM/main-link off mode gets enabled. (Rodrigo)
--- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- drivers/gpu/drm/i915/display/intel_psr.c | 19 +++++++++++++++++++ drivers/gpu/drm/i915/display/intel_psr.h | 2 ++ 3 files changed, 22 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_ddi.c +1 -1
@@ -908,7 +908,7 @@ intel_ddi_main_link_aux_domain(struct intel_digital_port *dig_port,* instead of a specific AUX_IO_<port> reference without powering up any * extra wells. */ -if (intel_encoder_can_psr (&dig_port->base)) +if (intel_psr_needs_aux_io_power (&dig_port->base, crtc_state))return intel_display_power_aux_io_domain (i915, dig_port->aux_ch); else if (DISPLAY_VER(i915) < 14 && (intel_crtc_has_dp_encoder(crtc_state) ||
drivers/gpu/drm/i915/display/intel_psr.c +19 -0
@@ -201,6 +201,25 @@ bool intel_encoder_can_psr(struct intel_encoder *encoder)return false; } +bool intel_psr_needs_aux_io_power (struct intel_encoder *encoder, +const struct intel_crtc_state *crtc_state) +{ +/* +* For PSR/PR modes only eDP requires the AUX IO power to be enabled whenever +* the output is enabled. For non-eDP outputs the main link is always +* on, hence it doesn't require the HW initiated AUX wake-up signaling used +* for eDP. +* +* TODO: +* - Consider leaving AUX IO disabled for eDP / PR as well, in case +* the ALPM with main-link off mode is not enabled. +* - Leave AUX IO enabled for DP / PR, once support for ALPM with +* main-link off mode is added for it and this mode gets enabled. +*/ +return intel_crtc_has_type (crtc_state,INTEL_OUTPUT_EDP ) && +intel_encoder_can_psr (encoder); +} +static bool psr_global_enabled (struct intel_dp *intel_dp) {struct intel_connector *connector = intel_dp->attached_connector;
drivers/gpu/drm/i915/display/intel_psr.h +2 -0
@@ -25,6 +25,8 @@ struct intel_plane_state; (intel_dp)->psr.source_panel_replay_support)bool intel_encoder_can_psr (struct intel_encoder *encoder); +bool intel_psr_needs_aux_io_power (struct intel_encoder *encoder, +const struct intel_crtc_state *crtc_state);void intel_psr_init_dpcd (struct intel_dp *intel_dp);void intel_psr_enable_sink (struct intel_dp *intel_dp,const struct intel_crtc_state *crtc_state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/482 drm/amdgpu: Fix get each xcp macro
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <[email protected]>
[ Upstream commit ef126c06a98bde1a41303970eb0fc0ac33c3cc02 ]
Fix get each xcp macro to loop over each partition correctly
--- drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h +1 -1
@@ -180,6 +180,6 @@ amdgpu_get_next_xcp(struct amdgpu_xcp_mgr *xcp_mgr, int *from)#define for_each_xcp (xcp_mgr, xcp, i) \ for (i = 0, xcp = amdgpu_get_next_xcp(xcp_mgr, &i); xcp; \ - xcp = amdgpu_get_next_xcp(xcp_mgr, &i)) + ++i, xcp = amdgpu_get_next_xcp(xcp_mgr, &i))#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/482 drm/amd/display: handle nulled pipe context in DCE110s set_drr()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tobias Jakobi <[email protected]>
[ Upstream commit e7d4e1438533abe448813bdc45691f9c230aa307 ]
As set_drr() is called from IRQ context, it can happen that the pipe context has been nulled by dc_state_destruct().
Apply the same protection here that is already present for dcn35_set_drr() and dcn10_set_drr(). I.e. fetch the tg pointer first (to avoid a race with dc_state_destruct()), and then check the local copy before using it.
--- .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +14 -7
@@ -2020,13 +2020,20 @@ static void set_drr(struct pipe_ctx **pipe_ctx,* as well. */ for (i =0 ; i < num_pipes; i++) { - pipe_ctx[i]->stream_res.tg->funcs->set_drr ( - pipe_ctx[i]->stream_res.tg, ¶ms); - -if (adjust.v_total_max !=0 && adjust.v_total_min !=0 ) - pipe_ctx[i]->stream_res.tg->funcs->set_static_screen_control ( - pipe_ctx[i]->stream_res.tg, - event_triggers, num_frames); +/* dc_state_destruct() might null the stream resources, so fetch tg +* here first to avoid a race condition. The lifetime of the pointee +* itself (the timing_generator object) is not a problem here. +*/ +struct timing_generator *tg = pipe_ctx[i]->stream_res.tg; + +if ((tg !=NULL ) && tg->funcs) { +if (tg->funcs->set_drr) + tg->funcs->set_drr (tg, ¶ms); +if (adjust.v_total_max !=0 && adjust.v_total_min !=0 ) +if (tg->funcs->set_static_screen_control) + tg->funcs->set_static_screen_control ( + tg, event_triggers, num_frames); + } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainercover 6.10.14-rc1 review
This is the start of the stable review cycle for the 6.10.14 release. There are 482 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Oct 2024 11:55:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.14-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.10.14-rc1
Alex Hung <[email protected]>
drm/amd/display: enable_hpo_dp_link_output: Check link_res->hpo_dp_link_enc before using it
Namhyung Kim <[email protected]>
perf report: Fix segfault when 'sym' sort key is not used
Gabe Teeger <[email protected]>
drm/amd/display: Revert Avoid overflow assignment
Herbert Xu <[email protected]>
crypto: octeontx* - Select CRYPTO_AUTHENC
Takashi Iwai <[email protected]>
ALSA: control: Fix leftover snd_power_unref()
Haoran Zhang <[email protected]>
vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
David Howells <[email protected]>
rxrpc: Fix a race between socket set up and I/O thread creation
Christian König <[email protected]>
drm/sched: revert "Always increment correct scheduler score"
Jonathan Gray <[email protected]>
Revert "drm/amd/display: Skip Recompute DSC Params if no Stream on Link"
Val Packett <[email protected]>
drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Heiner Kallweit <[email protected]>
r8169: add tally counter fields added with RTL8125
Colin Ian King <[email protected]>
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Fix waiting time for BMP3xx configuration
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Fix regmap for BMP280 device
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Use BME prefix for BME280 specifics
Vasileios Amoiridis <[email protected]>
iio: pressure: bmp280: Improve indentation and line wrapping
Udit Kumar <[email protected]>
remoteproc: k3-r5: Delay notification of wakeup event
Beleswar Padhi <[email protected]>
remoteproc: k3-r5: Acquire mailbox handle during probe routine
Long Li <[email protected]>
RDMA/mana_ib: use the correct page table index based on hardware page size
Haiyang Zhang <[email protected]>
net: mana: Add support for page sizes other than 4KB on ARM64
Chuck Lever <[email protected]>
NFSD: Limit the number of concurrent async COPY operations
Chuck Lever <[email protected]>
NFSD: Async COPY result needs to return a write verifier
NeilBrown <[email protected]>
sunrpc: change sp_nrthreads from atomic_t to unsigned int.
Johannes Weiner <[email protected]>
sched: psi: fix bogus pressure spikes from aggregation race
Matthew Auld <[email protected]>
drm/xe: fix UAF around queue destruction
Matthew Brost <[email protected]>
drm/xe: Delete unused GuC submission_state.suspend
Andrii Nakryiko <[email protected]>
lib/buildid: harden build ID parsing logic
Alexey Dobriyan <[email protected]>
build-id: require program headers to be right after ELF header
Mario Limonciello <[email protected]>
drm/amd/display: Allow backlight to go below AMDGPU_DM_DEFAULT_MIN_BACKLIGHT
Yosry Ahmed <[email protected]>
mm: z3fold: deprecate CONFIG_Z3FOLD
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Masahiro Yamada <[email protected]>
kconfig: qconf: fix buffer overflow in debug links
Uwe Kleine-König <[email protected]>
cpufreq: intel_pstate: Make hwp_notify_lock a raw spinlock
Tom Chung <[email protected]>
drm/amd/display: Fix system hang while resume with TBT monitor
Yihan Zhu <[email protected]>
drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35
Alex Hung <[email protected]>
drm/amd/display: Add HDR workaround for specific eDP
Tvrtko Ursulin <[email protected]>
drm/sched: Always increment correct scheduler score
Tvrtko Ursulin <[email protected]>
drm/sched: Always wake up correct scheduler in drm_sched_entity_push_job
Tvrtko Ursulin <[email protected]>
drm/sched: Add locking to drm_sched_entity_modify_sched
Rob Clark <[email protected]>
drm/sched: Fix dynamic job-flow control race
Boris Brezillon <[email protected]>
drm/panthor: Don't declare a queue blocked if deferred operations are pending
Boris Brezillon <[email protected]>
drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()
Boris Brezillon <[email protected]>
drm/panthor: Don't add write fences to the shared BOs
Jani Nikula <[email protected]>
drm/i915/gem: fix bitwise and logical AND mixup
Al Viro <[email protected]>
close_range(): fix the logics in descriptor table trimming
Thomas Zimmermann <[email protected]>
firmware/sysfb: Disable sysfb for firmware buffers with unknown parent
Eder Zulian <[email protected]>
rtla: Fix the help text in osnoise and timerlat top tools
Wei Li <[email protected]>
tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline
Wei Li <[email protected]>
tracing/timerlat: Fix a race during cpuhp processing
Wei Li <[email protected]>
tracing/timerlat: Drop interface_lock in stop_kthread()
Wei Li <[email protected]>
tracing/hwlat: Fix a race during cpuhp processing
Patrick Donnelly <[email protected]>
ceph: fix cap ref leak via netfs init_request
Jens Axboe <[email protected]>
io_uring/net: harden multishot termination case for recv
Jiawei Ye <[email protected]>
mac802154: Fix potential RCU dereference issue in mac802154_scan_worker
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
Jiawen Wu <[email protected]>
net: pcs: xpcs: fix the wrong register that was written back
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Miquel Sabaté Solà <[email protected]>
cpufreq: Avoid a bad reference count on CPU node
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Filipe Manana <[email protected]>
btrfs: send: fix invalid clone operation for file that got its size decreased
Josef Bacik <[email protected]>
btrfs: drop the backref cache during relocation if we commit
Qu Wenruo <[email protected]>
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Hans de Goede <[email protected]>
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Hans de Goede <[email protected]>
ACPI: resource: Loosen the Asus E1404GAB DMI match to also cover the E1404GA
Hans de Goede <[email protected]>
ACPI: resource: Remove duplicate Asus E1504GAB IRQ override
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native quirk for Dell OptiPlex 5480 AIO
Baokun Li <[email protected]>
cachefiles: fix dentry leak in cachefiles_open_file()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Nuno Sa <[email protected]>
Input: adp5589-keys - fix NULL pointer dereference
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
KhaiWenTan <[email protected]>
net: stmmac: Fix zero-division error when disabling tc cbs
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Willem de Bruijn <[email protected]>
gso: fix udp gso fraglist segmentation after pull from frag_list
Felix Fietkau <[email protected]>
net: gso: fix tcp fraglist segmentation after pull from frag_list
Willem de Bruijn <[email protected]>
vrf: revert "vrf: Remove unnecessary RCU-bh critical section"
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
Steve French <[email protected]>
smb3: fix incorrect mode displayed for read-only files
wangrong <[email protected]>
smb: client: use actual path when queryfs
Ajit Pandey <[email protected]>
clk: qcom: clk-alpha-pll: Fix CAL_L_VAL override for LUCID EVO PLL
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Fix the sdcc2 and sdcc4 clocks freq table
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix ordering of pm_runtime_enable
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sc8180x: Add GPLL9 support
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Remove use_count guard in stop_streaming
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gcc-sm8150: De-register gcc_cpuss_ahb_clk_src
David Virag <[email protected]>
clk: samsung: exynos7885: Update CLKS_NR_FSYS after bindings fix
Mike Tipton <[email protected]>
clk: qcom: clk-rpmh: Fix overflow in BCM vote
Satya Priya Kakitapalli <[email protected]>
dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Manivannan Sadhasivam <[email protected]>
clk: qcom: gcc-sm8450: Do not turn off PCIe GDSCs during gdsc_disable()
Laurent Pinchart <[email protected]>
media: sun4i_csi: Implement link validate for sun4i_csi subdev
Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
Laurent Pinchart <[email protected]>
media: videobuf2: Drop minimum allocation requirement of 2 buffers
Jan Kiszka <[email protected]>
remoteproc: k3-r5: Fix error handling when power-up failed
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Bryan O'Donoghue <[email protected]>
media: ov5675: Fix power on/off delay timings
Umang Jain <[email protected]>
media: imx335: Fix reset-gpio handling
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Alexandre Ghiti <[email protected]>
riscv: Fix kernel stack size when KASAN is enabled
Pu Lehui <[email protected]>
drivers/perf: riscv: Align errno for unsupported perf event
Long Li <[email protected]>
RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page
Thomas Weißschuh <[email protected]>
sysctl: avoid spurious permanent empty tables
Kaixin Wang <[email protected]>
i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
Chuck Lever <[email protected]>
NFSD: Fix NFSv4's PUTPUBFH operation
Li Lingfeng <[email protected]>
nfsd: map the EBADMSG to nfserr_io to avoid warning
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Matt Fleming <[email protected]>
perf hist: Update hist symbol when updating maps
Arnaldo Carvalho de Melo <[email protected]>
perf python: Disable -Wno-cast-function-type-mismatch if present on clang
Yuezhang Mo <[email protected]>
exfat: fix memory leak in exfat_load_bitmap()
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Youssef Esmat <[email protected]>
sched/core: Clear prev->dl_server in CFS pick fast path
Joel Fernandes (Google) <[email protected]>
sched/core: Add clearing of ->dl_server in put_prev_task_balance()
Daniel Bristot de Oliveira <[email protected]>
sched/deadline: Comment sched_dl_entity::dl_server variable
Easwar Hariharan <[email protected]>
arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386
Mark Rutland <[email protected]>
arm64: fix selection of HAVE_DYNAMIC_FTRACE_WITH_ARGS
Kuan-Ying Lee <[email protected]>
scripts/gdb: fix lx-mounts command error
Kuan-Ying Lee <[email protected]>
scripts/gdb: add iteration function for rbtree
Kuan-Ying Lee <[email protected]>
scripts/gdb: fix timerlist parsing issue
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Danilo Krummrich <[email protected]>
mm: krealloc: consider spare memory for __GFP_ZERO
Kemeng Shi <[email protected]>
jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Huang Ying <[email protected]>
resource: fix region_intersects() vs add_memory_driver_managed()
Ma Ke <[email protected]>
drm: omapdrm: Add missing check for alloc_ordered_workqueue
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Thomas Weißschuh <[email protected]>
of: address: Report error on resource bounds overflow
Val Packett <[email protected]>
drm/rockchip: vop: clear DMA stop bit on RK3066
Helge Deller <[email protected]>
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
Helge Deller <[email protected]>
parisc: Allow mmap(MAP_STACK) memory to automatically expand upwards
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
Baokun Li <[email protected]>
ext4: fix off by one issue in alloc_flex_gd()
Luis Henriques (SUSE) <[email protected]>
ext4: mark fc as ineligible using an handle in ext4_xattr_set()
Luis Henriques (SUSE) <[email protected]>
ext4: use handle to mark fc as ineligible in __track_dentry_update()
Luis Henriques (SUSE) <[email protected]>
ext4: fix fast commit inode enqueueing during a full journal commit
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Luis Henriques (SUSE) <[email protected]>
ext4: fix access to uninitialised lock in fc replay path
Xiaxi Shen <[email protected]>
ext4: fix timer use-after-free on failed mount
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Baokun Li <[email protected]>
ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Zhihao Cheng <[email protected]>
ext4: dax: fix overflowing extents beyond inode size when partially writing
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
yao.ly <[email protected]>
ext4: correct encrypted dentry name hash when not casefolded
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Abhishek Tamboli <[email protected]>
ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
Ai Chao <[email protected]>
ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
Nikolai Afanasenkov <[email protected]>
ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
Hans P. Moller <[email protected]>
ALSA: line6: add hw monitor volume control to POD HD500X
Jan Lalinsky <[email protected]>
ALSA: usb-audio: Add native DSD support for Luxman D-08u
Lianqin Hu <[email protected]>
ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Baojun Xu <[email protected]>
ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
Thomas Zimmermann <[email protected]>
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
Javier Carrasco <[email protected]>
drm/mediatek: ovl_adaptor: Add missing of_node_put()
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Tvrtko Ursulin <[email protected]>
drm/v3d: Prevent out of bounds access in performance query extensions
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Peng Fan <[email protected]>
mm, slub: avoid zeroing kmalloc redzone
Hans de Goede <[email protected]>
power: supply: hwmon: Fix missing temp1_max_alarm attribute
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
David Virag <[email protected]>
dt-bindings: clock: exynos7885: Fix duplicated binding
Krzysztof Kozlowski <[email protected]>
memory: tegra186-emc: drop unused to_tegra186_emc()
Krzysztof Kozlowski <[email protected]>
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
Mike Baynton <[email protected]>
ovl: fail if trusted xattrs are needed but caller lacks permission
Alice Ryhl <[email protected]>
rust: sync: require T: Sync for LockedBy::access
Ard Biesheuvel <[email protected]>
i2c: synquacer: Deal with optional PCLK correctly
Kimriver Liu <[email protected]>
i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
Jinjie Ruan <[email protected]>
i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
Heiner Kallweit <[email protected]>
i2c: core: Lock address during client device instantiation
Alexander Shiyan <[email protected]>
media: i2c: ar0521: Use cansleep version of gpiod_set_value()
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Jinjie Ruan <[email protected]>
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
Marek Vasut <[email protected]>
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
Marc Zyngier <[email protected]>
KVM: arm64: Fix kvm_has_feat*() handling of negative features
Zach Wade <[email protected]>
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
Takashi Iwai <[email protected]>
Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
Daeho Jeong <[email protected]>
f2fs: forcibly migrate to secure space for zoned device file pinning
Daeho Jeong <[email protected]>
f2fs: do FG_GC when GC boosting is required for zoned devices
Daeho Jeong <[email protected]>
f2fs: increase BG GC migration window granularity when boosted for zoned devices
Daeho Jeong <[email protected]>
f2fs: introduce migration_window_granularity
Daeho Jeong <[email protected]>
f2fs: make BG GC more aggressive for zoned devices
Heiko Carstens <[email protected]>
selftests: vDSO: fix vdso_config for s390
Jens Remus <[email protected]>
selftests: vDSO: fix ELF hash table entry size for s390x
Christophe Leroy <[email protected]>
powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
Chao Yu <[email protected]>
f2fs: fix to don't panic system for no free segment fault injection
Liao Yuanhong <[email protected]>
f2fs: add write priority option based on zone UFS
Arnd Bergmann <[email protected]>
nvme-tcp: fix link failure for TCP auth
David Hildenbrand <[email protected]>
selftests/mm: fix charge_reserved_hugetlb.sh test
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Christophe Leroy <[email protected]>
selftests: vDSO: fix vdso_config for powerpc
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO name for powerpc
Nirmoy Das <[email protected]>
drm/xe: Fix memory leak on xe_alloc_pf_queue failure
Matthew Auld <[email protected]>
drm/xe: fixup xe_alloc_pf_queue
Namhyung Kim <[email protected]>
perf: Really fix event_function_call() locking
Ian Rogers <[email protected]>
perf callchain: Fix stitch LBR memory leaks
Takashi Iwai <[email protected]>
ALSA: control: Fix power_ref lock order for compat code, too
Biju Das <[email protected]>
spi: rpc-if: Add missing MODULE_DEVICE_TABLE
Alexander F. Lent <[email protected]>
accel/ivpu: Add missing MODULE_FIRMWARE metadata
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Alessandro Zanni <[email protected]>
kselftest/devices/probe: Fix SyntaxWarning in regex strings for Python3
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Yun Lu <[email protected]>
selftest: hid: add missing run-hid-tools-tests.sh
Jinjie Ruan <[email protected]>
spi: spi-cadence: Fix missing spi_controller_is_target() check
Jinjie Ruan <[email protected]>
spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
Jinjie Ruan <[email protected]>
spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
Ben Cheatham <[email protected]>
EINJ, CXL: Fix CXL device SBDF calculation
Yonghong Song <[email protected]>
bpf: Fix a sdiv overflow issue
Kuan-Wei Chiu <[email protected]>
bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
Christoph Hellwig <[email protected]>
iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
Kuan-Wei Chiu <[email protected]>
bpftool: Fix undefined behavior caused by shifting into the sign bit
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Baokun Li <[email protected]>
ext4: avoid use-after-free in ext4_ext_show_leaf()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Juntong Deng <[email protected]>
bpf: Make the pointer returned by iter next method valid
Jan Kara <[email protected]>
ext4: don't set SB_RDONLY after filesystem errors
Hans de Goede <[email protected]>
platform/x86: x86-android-tablets: Adjust Xiaomi Pad 2 bottom bezel touch buttons LED
Luiz Capitulino <[email protected]>
platform/mellanox: mlxbf-pmc: fix lockdep warning
Namjae Jeon <[email protected]>
ksmbd: add refcnt to ksmbd_conn struct
Dmitry Torokhov <[email protected]>
HID: i2c-hid: ensure various commands do not interfere with each other
Zhu Jun <[email protected]>
tools/hv: Add memory allocation check in hv_fcopy_start
Gergo Koteles <[email protected]>
platform/x86: lenovo-ymc: Ignore the 0x0 state
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: use rlc safe mode for soft recovery
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: use rlc safe mode for soft recovery
Amir Goldstein <[email protected]>
ovl: fsync after metadata copy-up
Haren Myneni <[email protected]>
powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Matthew Brost <[email protected]>
drm/xe: Drop warn on xe_guc_pc_gucrc_disable in guc pc fini
Hawking Zhang <[email protected]>
drm/amdkfd: Check int source id for utcl2 poison event
Tim Huang <[email protected]>
drm/amd/pm: ensure the fw_info is not null before using it
Stuart Summers <[email protected]>
drm/xe: Use topology to determine page fault queue size
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: enter safe mode before touching CP_INT_CNTL
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: use rlc safe mode for soft recovery
Victor Skvortsov <[email protected]>
drm/amdgpu: Block MMR_READ IOCTL in reset
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Finn Thain <[email protected]>
scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
Peter Zijlstra <[email protected]>
perf: Fix event_function_call() locking
Tim Huang <[email protected]>
drm/amdgpu: fix unchecked return value warning for amdgpu_atombios
Tim Huang <[email protected]>
drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
Justin Tee <[email protected]>
scsi: lpfc: Update PRLO handling in direct attached topology
Justin Tee <[email protected]>
scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology
Justin Tee <[email protected]>
scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Andrii Nakryiko <[email protected]>
perf,x86: avoid missing caller address in stack traces captured in uprobe
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Alex Hung <[email protected]>
drm/amd/display: Initialize get_bytes_per_element's default to 1
Alex Hung <[email protected]>
drm/amd/display: Avoid overflow assignment in link_dp_cts
Alex Deucher <[email protected]>
drm/amdgpu/gfx9: properly handle error ints on all pipes
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 color transformation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Check link_res->hpo_dp_link_enc before using it
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Alex Hung <[email protected]>
drm/amd/display: Check phantom_stream before it is used
Alex Hung <[email protected]>
drm/amd/display: Check null-initialized variables
Yannick Fertre <[email protected]>
drm/stm: ltdc: reset plane transparency after plane disable
aln8 <[email protected]>
platform/x86/amd: pmf: Add quirk for TUF Gaming A14
Ckath <[email protected]>
platform/x86: touchscreen_dmi: add nanote-next quirk
Vishnu Sankar <[email protected]>
HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
Jesse Zhang <[email protected]>
drm/amdkfd: Fix resource leak in criu restore queue
Peng Liu <[email protected]>
drm/amdgpu: enable gfxoff quirk on HP 705G4
Peng Liu <[email protected]>
drm/amdgpu: add raven1 gfxoff quirk
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Konrad Dybcio <[email protected]>
drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
David Strahan <[email protected]>
scsi: smartpqi: add new controller PCI IDs
Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: correct stream detection
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Yang Wang <[email protected]>
drm/amdgpu: add list empty check to avoid null pointer issue
Tim Huang <[email protected]>
drm/amd/display: fix double free issue during amdgpu module unload
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using dc->clk_mgr
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'
Hans de Goede <[email protected]>
HID: Ignore battery for all ELAN I2C-HID devices
David Strahan <[email protected]>
scsi: smartpqi: Add new controller PCI IDs
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Damien Le Moal <[email protected]>
ata: pata_serverworks: Do not use the term blacklist
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Use gpuvm_min_page_size_kbytes for DML2 surfaces
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
Suraj Kandpal <[email protected]>
drm/xe/hdcp: Check GSC structure validity
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer
Philip Yang <[email protected]>
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
Alex Hung <[email protected]>
drm/amd/display: Check null pointers before using them
Alex Hung <[email protected]>
drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
Katya Orlova <[email protected]>
drm/stm: Avoid use-after-free issues with crtc and plane
Michal Koutný <[email protected]>
cgroup: Disallow mounting v1 hierarchies without controller implementation
Jason Gunthorpe <[email protected]>
iommu/arm-smmu-v3: Do not use devm for the cd table allocations
Lu Baolu <[email protected]>
iommu/vt-d: Unconditionally flush device TLB for pasid table updates
Sanjay K Kumar <[email protected]>
iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
Lu Baolu <[email protected]>
iommu/vt-d: Always reserve a domain ID for identity setup
Mostafa Saleh <[email protected]>
iommu/arm-smmu-v3: Match Stall behaviour for S2
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Paul E. McKenney <[email protected]>
rcuscale: Provide clear error when async specified without primitives
Ulf Hansson <[email protected]>
pmdomain: core: Don't hold the genpd-lock when calling dev_pm_domain_set()
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Thomas Weißschuh <[email protected]>
fbdev: efifb: Register sysfs groups through driver core
Denis Pauk <[email protected]>
hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
Zqiang <[email protected]>
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: boards: always check the result of acpi_dev_get_first_match_dev()
Kees Cook <[email protected]>
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
Thomas Weißschuh <[email protected]>
selftests/nolibc: avoid passing NULL to printf("%s")
Thomas Weißschuh <[email protected]>
tools/nolibc: powerpc: limit stack-protector workaround to GCC
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Steve Wahl <[email protected]>
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
Tao Liu <[email protected]>
x86/kexec: Add EFI config table identity mapping for kexec kernel
Aruna Ramakrishna <[email protected]>
x86/pkeys: Restore altstack access in sigreturn()
Aruna Ramakrishna <[email protected]>
x86/pkeys: Add PKRU as a parameter in signal handling functions
Ahmed S. Darwish <[email protected]>
tools/x86/kcpuid: Protect against faulty "max subleaf" values
Takashi Iwai <[email protected]>
ALSA: control: Take power_ref lock primarily
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa883x: Handle reading version failure
Joshua Pius <[email protected]>
ALSA: usb-audio: Add logitech Audio profile quirk
Asahi Lina <[email protected]>
ALSA: usb-audio: Add mixer quirk for RME Digiface USB
Cyan Nyan <[email protected]>
ALSA: usb-audio: Add quirk for RME Digiface USB
Takashi Iwai <[email protected]>
ALSA: usb-audio: Replace complex quirk lines with macros
Takashi Iwai <[email protected]>
ALSA: usb-audio: Define macros for quirk table entries
Karol Kosik <[email protected]>
ALSA: usb-audio: Support multiple control interfaces
Thomas Gleixner <[email protected]>
x86/apic: Remove logical destination mode for 64-bit
Thomas Gleixner <[email protected]>
x86/ioapic: Handle allocation failures gracefully
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add input value sanity checks for standard types
Jinjie Ruan <[email protected]>
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
David Howells <[email protected]>
netfs: Cancel dirty folios that have no storage destination
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
Benjamin Lin <[email protected]>
wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
Yang Shen <[email protected]>
crypto: hisilicon - fix missed error branch
Joe Damato <[email protected]>
net: napi: Prevent overflow of napi_defer_hard_irqs
David Kaplan <[email protected]>
x86/bugs: Fix handling when SRSO mitigation is disabled
Daniel Sneddon <[email protected]>
x86/bugs: Add missing NO_SSB flag
Zong-Zhe Yang <[email protected]>
wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
Niklas Söderlund <[email protected]>
net: phy: Check for read errors in SIOCGMIIREG
Fares Mehanna <[email protected]>
arm64: trans_pgd: mark PTEs entries as valid to avoid dead kexec()
Alexey Dobriyan <[email protected]>
block: fix integer overflow in BLKSECDISCARD
Joe Damato <[email protected]>
netdev-genl: Set extack and fix error on napi-get
Stefan Mätje <[email protected]>
can: netlink: avoid call to do_set_data_bittiming callback with stale can_priv::ctrlmode
James Clark <[email protected]>
drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
Adrian Ratiu <[email protected]>
proc: add config & param to block forcing mem writes
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Johannes Berg <[email protected]>
wifi: mac80211: fix RCU list iterations
Miri Korenblit <[email protected]>
wifi: iwlwifi: mvm: avoid NULL pointer dereference
Anjaneyulu <[email protected]>
wifi: iwlwifi: allow only CN mcc from WRDD
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: use correct key iteration
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Breno Leitao <[email protected]>
netpoll: Ensure clean state on setup failures
Herbert Xu <[email protected]>
crypto: simd - Do not call crypto_alloc_tfm during registration
Simon Horman <[email protected]>
net: atlantic: Avoid warning about potential string truncation
Hannes Reinecke <[email protected]>
nvme-tcp: check for invalidated or revoked key
Hannes Reinecke <[email protected]>
nvme-tcp: sanitize TLS key handling
Hannes Reinecke <[email protected]>
nvme-keyring: restrict match length for version '1' identifiers
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Ping-Ke Shih <[email protected]>
wifi: rtw89: correct base HT rate mask for firmware
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
bnxt_en: Extend maximum length of version string by 1 byte
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Zong-Zhe Yang <[email protected]>
wifi: rtw88: select WANT_DEV_COREDUMP
Karthikeyan Periyasamy <[email protected]>
wifi: ath11k: fix array out-of-bound access in SoC stats
Karthikeyan Periyasamy <[email protected]>
wifi: ath12k: fix array out-of-bound access in SoC stats
Konstantin Ovsepian <[email protected]>
blk_iocost: fix more out of bound shifts
Mario Limonciello <[email protected]>
ACPI: CPPC: Add support for setting EPP register in FFH
Hans de Goede <[email protected]>
ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
Hilda Wu <[email protected]>
Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
Hilda Wu <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
Dmitry Antipov <[email protected]>
net: sched: consistently use rcu_replace_pointer() in taprio_change()
Felix Fietkau <[email protected]>
wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
Tamim Khan <[email protected]>
ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
Vitaly Lifshits <[email protected]>
e1000e: avoid failing the system during pm_suspend
Li Zhijian <[email protected]>
fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Seiji Nishikawa <[email protected]>
ACPI: PAD: fix crash in exit_round_robin()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Jeongjun Park <[email protected]>
net/xen-netback: prevent UAF in xenvif_flush_hash()
Issam Hamdi <[email protected]>
wifi: cfg80211: Set correct chandef when starting CAC
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: drop wrong STA selection in TX
Ilan Peer <[email protected]>
wifi: iwlwifi: mvm: Fix a race in scan abort flow
Aleksandr Mishin <[email protected]>
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
Herbert Xu <[email protected]>
crypto: octeontx2 - Fix authenc setkey
Herbert Xu <[email protected]>
crypto: octeontx - Fix authenc setkey
Fangrui Song <[email protected]>
crypto: x86/sha256 - Add parentheses around macros' single arguments
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Chih-Kang Chang <[email protected]>
wifi: rtw89: avoid to add interface to list twice when SER
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Christophe JAILLET <[email protected]>
ALSA: gus: Fix some error handling paths related to get_bpos() usage
Ben Hutchings <[email protected]>
tools/rtla: Fix installation from out-of-tree build
Pali Rohár <[email protected]>
cifs: Do not convert delimiter when parsing NFS-style symlinks
Pali Rohár <[email protected]>
cifs: Fix buffer overflow when parsing NFS reparse points
Zhanjun Dong <[email protected]>
drm/xe: Prevent null pointer access in xe_migrate_copy
Matthew Brost <[email protected]>
drm/xe: Resume TDR after GT reset
Rodrigo Vivi <[email protected]>
drm/xe: Restore pci state upon resume
Hui Wang <[email protected]>
ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Boris Brezillon <[email protected]>
drm/panthor: Lock the VM resv before calling drm_gpuvm_bo_obtain_prealloc()
Pali Rohár <[email protected]>
cifs: Remove intermediate object of failed create reparse call
Oder Chiou <[email protected]>
ALSA: hda/realtek: Fix the push button function for the ALC257
Christophe JAILLET <[email protected]>
ALSA: mixer_oss: Remove some incorrect kfree_const() usages
Guixin Liu <[email protected]>
io_uring: fix memory leak when cache init fail
Andrei Simion <[email protected]>
ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
Steven Price <[email protected]>
drm/panthor: Fix race when converting group handle to group object
Christoph Hellwig <[email protected]>
loop: don't set QUEUE_FLAG_NOMERGES
Robert Hancock <[email protected]>
i2c: xiic: Try re-initialization on bus busy timeout
Marc Ferland <[email protected]>
i2c: xiic: improve error message when transfer fails to start
Jeff Xu <[email protected]>
selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Ravikanth Tuniki <[email protected]>
dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
Darrick J. Wong <[email protected]>
iomap: constrain the file range passed to iomap_file_unshare
Eddie James <[email protected]>
net/ncsi: Disable the ncsi work before freeing the associated structure
Ido Schimmel <[email protected]>
bridge: mcast: Fail MDB get request on empty entry
Eric Dumazet <[email protected]>
ppp: do not assume bh is held in ppp_channel_bridge_input()
Eric Dumazet <[email protected]>
net: test for not too small csum_start in virtio_net_hdr_to_skb()
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Shenwei Wang <[email protected]>
net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Csókás, Bence <[email protected]>
net: fec: Reload PTP registers after link-state change
Csókás, Bence <[email protected]>
net: fec: Restart PPS after link state change
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Daniel Borkmann <[email protected]>
net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_sizeDaniel Borkmann <[email protected]>
net: Add netif_get_gro_max_size helper for GRO
Vladimir Oltean <[email protected]>
net: dsa: improve shutdown sequence
David Howells <[email protected]>
afs: Fix the setting of the server responding flag
David Howells <[email protected]>
afs: Fix missing wire-up of afs_retry_request()
Jinjie Ruan <[email protected]>
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix uaf in l2cap_connect
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
zhang jiao <[email protected]>
selftests: netfilter: Add missing return value
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Phil Sutter <[email protected]>
selftests: netfilter: Fix nft_audit.sh for newer nft binaries
Jinjie Ruan <[email protected]>
net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
Jinjie Ruan <[email protected]>
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Jianbo Liu <[email protected]>
net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
Elena Salomatkina <[email protected]>
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
Mohamed Khalfella <[email protected]>
net/mlx5: Added cond_resched() to crdump collection
Gerd Bayer <[email protected]>
net/mlx5: Fix error path in multi-packet WQE transmit
Aakash Menon <[email protected]>
net: sparx5: Fix invalid timestamps
Jinjie Ruan <[email protected]>
ieee802154: Fix build error
Ville Syrjälä <[email protected]>
drm/i915/dp: Fix colorimetry detection
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Luis Henriques (SUSE) <[email protected]>
ceph: fix a memory leak on cap_auths in MDS client
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Geert Uytterhoeven <[email protected]>
mailbox: ARM_MHU_V3 should depend on ARM64
Tobias Jakobi <[email protected]>
drm/amd/display: handle nulled pipe context in DCE110's set_drr()
Asad Kamal <[email protected]>
drm/amdgpu: Fix get each xcp macro
Imre Deak <[email protected]>
drm/i915/dp: Fix AUX IO power enabling for eDP PSR
Daniel Wagner <[email protected]>
scsi: pm8001: Do not overwrite PCI queue mapping
Rafael Rocha <[email protected]>
scsi: st: Fix input/output error on empty drive reset
Peter Zijlstra <[email protected]>
jump_label: Fix static_key_slow_dec() yet again
Thomas Gleixner <[email protected]>
jump_label: Simplify and clarify static_key_fast_inc_cpus_locked()
Thomas Gleixner <[email protected]>
static_call: Replace pointless WARN_ON() in static_call_module_notify()
Thomas Gleixner <[email protected]>
static_call: Handle module init failure correctly in static_call_del_module()
-------------
Diffstat:
Documentation/ABI/testing/sysfs-fs-f2fs | 22 + Documentation/admin-guide/kernel-parameters.txt | 10 + Documentation/arch/arm64/silicon-errata.rst | 6 + .../devicetree/bindings/net/xlnx,axi-ethernet.yaml | 3 +- .../networking/net_cachelines/net_device.rst | 2 +- Makefile | 4 +- arch/arm/crypto/aes-ce-glue.c | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/Kconfig | 7 +- arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/kvm_host.h | 25 +- arch/arm64/kernel/cpu_errata.c | 3 + arch/arm64/mm/trans_pgd.c | 6 +- arch/loongarch/configs/loongson3_defconfig | 1 - arch/parisc/include/asm/mman.h | 14 + arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/powerpc/configs/ppc64_defconfig | 1 - arch/powerpc/include/asm/vdso_datapage.h | 15 + arch/powerpc/kernel/asm-offsets.c | 2 + arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 +- arch/powerpc/platforms/pseries/dlpar.c | 17 - arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 +- arch/powerpc/platforms/pseries/pmem.c | 2 +- arch/riscv/Kconfig | 8 +- arch/riscv/include/asm/thread_info.h | 7 +- arch/x86/crypto/sha256-avx2-asm.S | 16 +- arch/x86/events/core.c | 63 + arch/x86/include/asm/apic.h | 8 - arch/x86/include/asm/fpu/signal.h | 2 +- arch/x86/include/asm/syscall.h | 7 +- arch/x86/kernel/apic/apic_flat_64.c | 119 +- arch/x86/kernel/apic/io_apic.c | 46 +- arch/x86/kernel/cpu/bugs.c | 14 +- arch/x86/kernel/cpu/common.c | 4 +- arch/x86/kernel/fpu/signal.c | 6 +- arch/x86/kernel/machine_kexec_64.c | 27 + arch/x86/kernel/signal.c | 3 +- arch/x86/kernel/signal_64.c | 6 +- arch/x86/mm/ident_map.c | 23 +- block/blk-iocost.c | 8 +- block/ioctl.c | 9 +- crypto/simd.c | 76 +- drivers/accel/ivpu/ivpu_fw.c | 4 + drivers/acpi/acpi_pad.c | 6 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/psargs.c | 47 + drivers/acpi/apei/einj-cxl.c | 2 +- drivers/acpi/battery.c | 28 +- drivers/acpi/cppc_acpi.c | 10 +- drivers/acpi/ec.c | 55 +- drivers/acpi/resource.c | 22 +- drivers/acpi/video_detect.c | 17 + drivers/ata/pata_serverworks.c | 16 +- drivers/ata/sata_sil.c | 12 +- drivers/block/aoe/aoecmd.c | 13 +- drivers/block/loop.c | 15 +- drivers/bluetooth/btmrvl_sdio.c | 3 +- drivers/bluetooth/btrtl.c | 1 + drivers/bluetooth/btusb.c | 2 + drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/clk-rpmh.c | 2 + drivers/clk/qcom/dispcc-sm8250.c | 3 + drivers/clk/qcom/gcc-sc8180x.c | 88 +- drivers/clk/qcom/gcc-sm8250.c | 6 +- drivers/clk/qcom/gcc-sm8450.c | 4 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/samsung/clk-exynos7885.c | 2 +- drivers/cpufreq/intel_pstate.c | 16 +- drivers/crypto/hisilicon/sgl.c | 14 +- drivers/crypto/marvell/Kconfig | 2 + drivers/crypto/marvell/octeontx/otx_cptvf_algs.c | 265 +-- drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 256 +- drivers/firmware/sysfb.c | 4 +- drivers/firmware/tegra/bpmp.c | 6 - drivers/gpio/gpio-davinci.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 10 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 35 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 45 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.h | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 50 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 50 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 18 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 5 +- drivers/gpu/drm/amd/amdkfd/soc15_int.h | 1 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 31 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 4 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 - .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 1 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + .../gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 4 + .../dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 7 +- drivers/gpu/drm/amd/display/dc/dml2/dml2_policy.c | 1 - .../amd/display/dc/dml2/dml2_translation_helper.c | 20 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 19 +- .../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 +- .../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 7 +- .../drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 11 +- .../amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 12 + drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- .../amd/display/dc/resource/dcn20/dcn20_resource.c | 3 +- .../display/dc/resource/dcn201/dcn201_resource.c | 4 +- .../amd/display/dc/resource/dcn21/dcn21_resource.c | 3 +- .../amd/display/dc/resource/dcn32/dcn32_resource.c | 7 +- .../drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 + drivers/gpu/drm/drm_atomic_uapi.c | 2 +- drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/i915/display/intel_ddi.c | 2 +- drivers/gpu/drm/i915/display/intel_dp.c | 9 +- drivers/gpu/drm/i915/display/intel_psr.c | 19 + drivers/gpu/drm/i915/display/intel_psr.h | 2 + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 4 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 + drivers/gpu/drm/msm/msm_gpu.c | 1 - drivers/gpu/drm/omapdrm/omap_drv.c | 5 + drivers/gpu/drm/panthor/panthor_mmu.c | 8 + drivers/gpu/drm/panthor/panthor_sched.c | 36 +- drivers/gpu/drm/radeon/r100.c | 70 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 + drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 1 + drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 2 + drivers/gpu/drm/scheduler/sched_entity.c | 14 +- drivers/gpu/drm/scheduler/sched_main.c | 7 +- drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 76 +- drivers/gpu/drm/v3d/v3d_submit.c | 6 + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 8 +- drivers/gpu/drm/xe/xe_bo.c | 4 +- drivers/gpu/drm/xe/xe_device.c | 6 +- drivers/gpu/drm/xe/xe_device_types.h | 3 + drivers/gpu/drm/xe/xe_gpu_scheduler.c | 5 + drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 + drivers/gpu/drm/xe/xe_gt_pagefault.c | 55 +- drivers/gpu/drm/xe/xe_gt_types.h | 9 +- drivers/gpu/drm/xe/xe_guc_pc.c | 2 +- drivers/gpu/drm/xe/xe_guc_submit.c | 29 +- drivers/gpu/drm/xe/xe_guc_types.h | 11 +- drivers/gpu/drm/xe/xe_pci.c | 2 + drivers/hid/hid-ids.h | 17 +- drivers/hid/hid-input.c | 37 +- drivers/hid/hid-multitouch.c | 6 + drivers/hid/i2c-hid/i2c-hid-core.c | 42 +- drivers/hwmon/nct6775-platform.c | 1 + drivers/i2c/busses/i2c-designware-common.c | 14 + drivers/i2c/busses/i2c-designware-core.h | 1 + drivers/i2c/busses/i2c-designware-master.c | 38 + drivers/i2c/busses/i2c-qcom-geni.c | 4 +- drivers/i2c/busses/i2c-stm32f7.c | 6 +- drivers/i2c/busses/i2c-synquacer.c | 5 +- drivers/i2c/busses/i2c-xiic.c | 69 +- drivers/i2c/i2c-core-base.c | 28 + drivers/i3c/master/svc-i3c-master.c | 1 + drivers/iio/magnetometer/ak8975.c | 32 +- drivers/iio/pressure/bmp280-core.c | 150 +- drivers/iio/pressure/bmp280-regmap.c | 47 +- drivers/iio/pressure/bmp280-spi.c | 4 +- drivers/iio/pressure/bmp280.h | 46 +- drivers/infiniband/hw/mana/main.c | 8 +- drivers/input/keyboard/adp5589-keys.c | 22 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 37 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/intel/dmar.c | 16 +- drivers/iommu/intel/iommu.c | 6 +- drivers/iommu/intel/pasid.c | 12 +- drivers/mailbox/Kconfig | 1 + drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/media/common/videobuf2/videobuf2-core.c | 7 - drivers/media/i2c/ar0521.c | 5 +- drivers/media/i2c/imx335.c | 9 +- drivers/media/i2c/ov5675.c | 12 +- drivers/media/platform/qcom/camss/camss-video.c | 6 - drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c | 5 + drivers/memory/tegra/tegra186-emc.c | 5 - drivers/net/can/dev/netlink.c | 102 +- .../net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/freescale/fec.h | 9 + drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/freescale/fec_ptp.c | 50 + drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/intel/e1000e/netdev.c | 19 +- drivers/net/ethernet/intel/ice/ice_sched.c | 6 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 + .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - .../net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 + .../net/ethernet/microchip/sparx5/sparx5_packet.c | 6 +- drivers/net/ethernet/microsoft/Kconfig | 2 +- drivers/net/ethernet/microsoft/mana/gdma_main.c | 10 +- drivers/net/ethernet/microsoft/mana/hw_channel.c | 14 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 8 +- drivers/net/ethernet/microsoft/mana/shm_channel.c | 13 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 5 +- drivers/net/ethernet/realtek/r8169_main.c | 31 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 18 +- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 1 + drivers/net/ieee802154/Kconfig | 1 + drivers/net/ieee802154/mcr20a.c | 5 +- drivers/net/pcs/pcs-xpcs-wx.c | 2 +- drivers/net/phy/phy.c | 17 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/vrf.c | 2 + drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath9k/debug.c | 4 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 + drivers/net/wireless/intel/iwlwifi/fw/api/scan.h | 13 + drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 2 + drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/uefi.h | 2 - drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 16 +- drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c | 12 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 1 + drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 7 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + drivers/net/wireless/realtek/rtw89/core.h | 18 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw89/phy.c | 4 +- drivers/net/wireless/realtek/rtw89/util.h | 18 + drivers/net/wwan/qcom_bam_dmux.c | 11 +- drivers/net/xen-netback/hash.c | 5 +- drivers/nvme/common/keyring.c | 58 +- drivers/nvme/host/Kconfig | 3 +- drivers/nvme/host/core.c | 1 - drivers/nvme/host/fabrics.c | 2 +- drivers/nvme/host/nvme.h | 2 +- drivers/nvme/host/sysfs.c | 4 +- drivers/nvme/host/tcp.c | 55 +- drivers/of/address.c | 5 + drivers/of/irq.c | 38 +- drivers/perf/arm_spe_pmu.c | 9 +- drivers/perf/riscv_pmu_legacy.c | 4 +- drivers/perf/riscv_pmu_sbi.c | 4 +- drivers/platform/mellanox/mlxbf-pmc.c | 5 + drivers/platform/x86/amd/pmf/pmf-quirks.c | 8 + .../x86/intel/speed_select_if/isst_if_common.c | 4 +- drivers/platform/x86/lenovo-ymc.c | 2 + drivers/platform/x86/touchscreen_dmi.c | 26 + drivers/platform/x86/x86-android-tablets/core.c | 6 +- drivers/platform/x86/x86-android-tablets/other.c | 10 +- drivers/pmdomain/core.c | 5 +- drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/power_supply_hwmon.c | 3 +- drivers/remoteproc/ti_k3_r5_remoteproc.c | 86 +- drivers/rtc/rtc-at91sam9.c | 1 + drivers/scsi/NCR5380.c | 4 + drivers/scsi/aacraid/aacraid.h | 2 +- drivers/scsi/lpfc/lpfc.h | 12 +- drivers/scsi/lpfc/lpfc_els.c | 73 +- drivers/scsi/lpfc/lpfc_hbadisc.c | 14 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 +- drivers/scsi/lpfc/lpfc_scsi.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 11 + drivers/scsi/pm8001/pm8001_init.c | 6 +- drivers/scsi/smartpqi/smartpqi_init.c | 130 +- drivers/scsi/st.c | 5 +- drivers/spi/spi-bcm63xx.c | 9 +- drivers/spi/spi-cadence.c | 8 +- drivers/spi/spi-imx.c | 2 +- drivers/spi/spi-rpc-if.c | 7 + drivers/spi/spi-s3c64xx.c | 4 +- drivers/vhost/scsi.c | 25 +- drivers/video/fbdev/efifb.c | 11 +- drivers/video/fbdev/pxafb.c | 1 + fs/afs/file.c | 1 + fs/afs/fs_operation.c | 2 +- fs/btrfs/backref.c | 12 +- fs/btrfs/disk-io.c | 11 + fs/btrfs/relocation.c | 77 +- fs/btrfs/send.c | 23 +- fs/cachefiles/namei.c | 7 +- fs/ceph/addr.c | 6 +- fs/ceph/mds_client.c | 12 + fs/dax.c | 6 +- fs/exec.c | 3 +- fs/exfat/balloc.c | 10 +- fs/ext4/dir.c | 14 +- fs/ext4/extents.c | 55 +- fs/ext4/fast_commit.c | 49 +- fs/ext4/file.c | 8 +- fs/ext4/inode.c | 11 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/resize.c | 18 +- fs/ext4/super.c | 14 +- fs/ext4/xattr.c | 3 +- fs/f2fs/f2fs.h | 31 +- fs/f2fs/gc.c | 85 +- fs/f2fs/gc.h | 23 + fs/f2fs/segment.c | 31 +- fs/f2fs/super.c | 8 + fs/f2fs/sysfs.c | 18 + fs/file.c | 93 +- fs/inode.c | 10 +- fs/iomap/buffered-io.c | 16 +- fs/jbd2/checkpoint.c | 21 +- fs/jbd2/journal.c | 4 +- fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 7 +- fs/jfs/xattr.c | 2 + fs/netfs/write_issue.c | 6 +- fs/nfsd/netns.h | 1 + fs/nfsd/nfs4proc.c | 36 +- fs/nfsd/nfs4state.c | 6 +- fs/nfsd/nfs4xdr.c | 10 +- fs/nfsd/nfsctl.c | 2 +- fs/nfsd/nfssvc.c | 2 +- fs/nfsd/vfs.c | 1 + fs/nfsd/xdr4.h | 1 + fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 11 +- fs/overlayfs/copy_up.c | 43 +- fs/overlayfs/params.c | 38 +- fs/proc/base.c | 61 +- fs/proc/proc_sysctl.c | 11 +- fs/smb/client/cifsfs.c | 13 +- fs/smb/client/cifsglob.h | 2 +- fs/smb/client/inode.c | 19 +- fs/smb/client/reparse.c | 16 +- fs/smb/client/smb1ops.c | 2 +- fs/smb/client/smb2inode.c | 24 +- fs/smb/client/smb2ops.c | 19 +- fs/smb/server/connection.c | 4 +- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +- fs/smb/server/vfs_cache.c | 3 + include/crypto/internal/simd.h | 12 +- include/drm/drm_print.h | 54 +- include/drm/gpu_scheduler.h | 2 +- include/dt-bindings/clock/exynos7885.h | 2 +- include/dt-bindings/clock/qcom,gcc-sc8180x.h | 1 + include/linux/cpufreq.h | 6 +- include/linux/fdtable.h | 8 +- include/linux/i2c.h | 3 + include/linux/netdevice.h | 22 +- include/linux/nvme-keyring.h | 6 +- include/linux/perf_event.h | 8 +- include/linux/sched.h | 2 + include/linux/sunrpc/svc.h | 4 +- include/linux/uprobes.h | 2 + include/linux/virtio_net.h | 4 +- include/net/mana/gdma.h | 10 +- include/net/mana/mana.h | 3 +- include/trace/events/netfs.h | 1 + include/uapi/linux/cec.h | 6 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- io_uring/io_uring.c | 5 +- io_uring/net.c | 4 +- kernel/bpf/verifier.c | 119 +- kernel/cgroup/cgroup-v1.c | 12 +- kernel/events/core.c | 33 +- kernel/events/uprobes.c | 4 +- kernel/fork.c | 32 +- kernel/jump_label.c | 52 +- kernel/rcu/rcuscale.c | 4 +- kernel/rcu/tasks.h | 82 +- kernel/resource.c | 58 +- kernel/sched/core.c | 23 +- kernel/sched/psi.c | 26 +- kernel/static_call_inline.c | 13 +- kernel/trace/trace_hwlat.c | 2 + kernel/trace/trace_osnoise.c | 22 +- lib/buildid.c | 88 +- mm/Kconfig | 25 +- mm/slab_common.c | 7 + mm/slub.c | 100 +- net/bluetooth/hci_core.c | 2 + net/bluetooth/hci_event.c | 15 +- net/bluetooth/l2cap_core.c | 8 - net/bluetooth/mgmt.c | 23 +- net/bridge/br_mdb.c | 2 +- net/core/dev.c | 14 +- net/core/gro.c | 9 +- net/core/net-sysfs.c | 6 +- net/core/netdev-genl.c | 8 +- net/core/netpoll.c | 15 +- net/dsa/dsa.c | 7 + net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/tcp_ipv4.c | 3 + net/ipv4/tcp_offload.c | 10 +- net/ipv4/udp_offload.c | 22 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/tcpv6_offload.c | 10 +- net/mac80211/chan.c | 4 +- net/mac80211/mlme.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/util.c | 4 +- net/mac802154/scan.c | 4 +- net/ncsi/ncsi-manage.c | 2 + net/rxrpc/ar-internal.h | 2 +- net/rxrpc/io_thread.c | 10 +- net/rxrpc/local_object.c | 2 +- net/sched/sch_taprio.c | 4 +- net/sctp/socket.c | 4 +- net/sunrpc/svc.c | 31 +- net/tipc/bearer.c | 8 +- net/wireless/nl80211.c | 15 +- rust/kernel/sync/locked_by.rs | 18 +- scripts/gdb/linux/proc.py | 4 +- scripts/gdb/linux/rbtree.py | 12 + scripts/gdb/linux/timerlist.py | 31 +- scripts/kconfig/qconf.cc | 2 +- security/Kconfig | 32 + security/tomoyo/domain.c | 9 +- sound/core/control.c | 55 +- sound/core/control_compat.c | 45 +- sound/core/init.c | 14 +- sound/core/oss/mixer_oss.c | 4 +- sound/isa/gus/gus_pcm.c | 4 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/hda_intel.c | 10 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 5 + sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/atmel/mchp-pdmc.c | 3 + sound/soc/codecs/wsa883x.c | 16 +- sound/soc/fsl/imx-card.c | 1 + sound/soc/intel/boards/bytcht_cx2072x.c | 4 + sound/soc/intel/boards/bytcht_da7213.c | 4 + sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 4 + sound/soc/intel/boards/cht_bsw_rt5672.c | 4 + sound/soc/intel/boards/sof_es8336.c | 2 +- sound/soc/intel/boards/sof_wm8804.c | 4 + sound/usb/card.c | 8 + sound/usb/clock.c | 62 +- sound/usb/format.c | 6 +- sound/usb/helper.c | 34 + sound/usb/helper.h | 10 +- sound/usb/line6/podhd.c | 2 +- sound/usb/mixer.c | 37 +- sound/usb/mixer.h | 1 + sound/usb/mixer_quirks.c | 430 +++- sound/usb/mixer_scarlett.c | 4 +- sound/usb/power.c | 3 +- sound/usb/power.h | 1 + sound/usb/quirks-table.h | 2455 +++++++------------- sound/usb/quirks.c | 62 + sound/usb/stream.c | 21 +- sound/usb/usbaudio.h | 12 + tools/arch/x86/kcpuid/kcpuid.c | 12 +- tools/bpf/bpftool/net.c | 11 +- tools/hv/hv_fcopy_uio_daemon.c | 7 + tools/include/nolibc/arch-powerpc.h | 2 +- tools/perf/util/hist.c | 7 +- tools/perf/util/machine.c | 17 +- tools/perf/util/setup.py | 2 + tools/perf/util/thread.c | 4 + tools/perf/util/thread.h | 1 + .../breakpoints/step_after_suspend_test.c | 5 +- .../selftests/devices/test_discoverable_devices.py | 4 +- tools/testing/selftests/hid/Makefile | 2 + .../selftests/mm/charge_reserved_hugetlb.sh | 2 +- tools/testing/selftests/mm/mseal_test.c | 57 +- tools/testing/selftests/mm/write_to_hugetlbfs.c | 23 +- .../selftests/net/netfilter/conntrack_dump_flush.c | 1 + tools/testing/selftests/net/netfilter/nft_audit.sh | 57 +- tools/testing/selftests/nolibc/nolibc-test.c | 4 +- tools/testing/selftests/vDSO/parse_vdso.c | 17 +- tools/testing/selftests/vDSO/vdso_config.h | 10 +- .../testing/selftests/vDSO/vdso_test_correctness.c | 6 + tools/tracing/rtla/Makefile.rtla | 2 +- tools/tracing/rtla/src/osnoise_top.c | 2 +- tools/tracing/rtla/src/timerlat_top.c | 4 +- 512 files changed, 6151 insertions(+), 4351 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 19/482 net/mlx5: Added cond_resched() to crdump collection
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <[email protected]>
[ Upstream commit ec793155894140df7421d25903de2e6bc12c695b ]
Collecting crdump involves reading vsc registers from pci config space of mlx device, which can take long time to complete. This might result in starving other threads waiting to run on the cpu.
Numbers I got from testing ConnectX-5 Ex MCX516A-CDAT in the lab:
- mlx5_vsc_gw_read_block_fast() was called with length = 1310716.
- mlx5_vsc_gw_read_fast() reads 4 bytes at a time. It was not used to read the entire 1310716 bytes. It was called 53813 times because there are jumps in read_addr.
- On average mlx5_vsc_gw_read_fast() took 35284.4ns.
- In total mlx5_vsc_wait_on_flag() called vsc_read() 54707 times. The average time for each call was 17548.3ns. In some instances vsc_read() was called more than one time when the flag was not set. As expected the thread released the cpu after 16 iterations in mlx5_vsc_wait_on_flag().
- Total time to read crdump was 35284.4ns * 53813 ~= 1.898s.
It was seen in the field that crdump can take more than 5 seconds to complete. During that time mlx5_vsc_wait_on_flag() did not release the cpu because it did not complete 16 iterations. It is believed that pci config reads were slow. Adding cond_resched() every 128 register read improves the situation. In the common case the, crdump takes ~1.8989s, the thread yields the cpu every ~4.51ms. If crdump takes ~5s, the thread yields the cpu every ~18.0ms.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/pci_vsc.c +10 -0
@@ -24,6 +24,11 @@ pci_write_config_dword((dev)->pdev, (dev)->vsc_addr + (offset), (val))#define VSC_MAX_RETRIES 2048 +/* Reading VSC registers can take relatively long time. +* Yield the cpu every 128 registers read. +*/ +#define VSC_GW_READ_BLOCK_COUNT 128 +enum {VSC_CTRL_OFFSET =0x4 ,VSC_COUNTER_OFFSET =0x8 ,
@@ -273,6 +278,7 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data, {unsigned int next_read_addr =0 ;unsigned int read_addr =0 ; +unsigned int count =0 ;while (read_addr < length) { if (mlx5_vsc_gw_read_fast(dev, read_addr, &next_read_addr,
@@ -280,6 +286,10 @@ int mlx5_vsc_gw_read_block_fast(struct mlx5_core_dev *dev, u32 *data,return read_addr; read_addr = next_read_addr; +if (++count ==VSC_GW_READ_BLOCK_COUNT ) { +cond_resched (); + count =0 ; + } }return length; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/482 Bluetooth: MGMT: Fix possible crash on mgmt_index_removed
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit f53e1c9c726d83092167f2226f32bd3b73f26c21 ]
If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace:
0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc 0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth] 0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth] 0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth]
So while handling mgmt_index_removed this attempts to dequeue commands passed as user_data to cmd_sync.
--- net/bluetooth/mgmt.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
net/bluetooth/mgmt.c +14 -9
@@ -1454,10 +1454,15 @@ static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)static void cmd_complete_rsp (struct mgmt_pending_cmd *cmd,void *data) { -if (cmd->cmd_complete) { -u8 *status = data; +struct cmd_lookup *match = data; + +/* dequeue cmd_sync entries using cmd as data as that is about to be +* removed/freed. +*/ +hci_cmd_sync_dequeue (match->hdev,NULL , cmd,NULL ); - cmd->cmd_complete (cmd, *status); +if (cmd->cmd_complete) { + cmd->cmd_complete (cmd, match->mgmt_status);mgmt_pending_remove (cmd);return ;
@@ -9349,12 +9354,12 @@ void mgmt_index_added(struct hci_dev *hdev)void mgmt_index_removed (struct hci_dev *hdev) {struct mgmt_ev_ext_index ev; -u8 status =MGMT_STATUS_INVALID_INDEX ; +struct cmd_lookup match = {NULL , hdev,MGMT_STATUS_INVALID_INDEX };if (test_bit (HCI_QUIRK_RAW_DEVICE , &hdev->quirks))return ; -mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &status); +mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &match);if (hci_dev_test_flag (hdev,HCI_UNCONFIGURED )) { mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
@@ -9405,7 +9410,7 @@ void mgmt_power_on(struct hci_dev *hdev, int err)void __mgmt_power_off (struct hci_dev *hdev) {struct cmd_lookup match = {NULL , hdev }; -u8 status, zero_cod[] = {0 ,0 ,0 }; +u8 zero_cod[] = {0 ,0 ,0 };mgmt_pending_foreach (MGMT_OP_SET_POWERED , hdev, settings_rsp, &match);
@@ -9417,11 +9422,11 @@ void __mgmt_power_off(struct hci_dev *hdev)* status responses. */ if (hci_dev_test_flag (hdev,HCI_UNREGISTER )) - status =MGMT_STATUS_INVALID_INDEX ; + match.mgmt_status =MGMT_STATUS_INVALID_INDEX ;else - status =MGMT_STATUS_NOT_POWERED ; + match.mgmt_status =MGMT_STATUS_NOT_POWERED ; -mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &status); +mgmt_pending_foreach (0 , hdev, cmd_complete_rsp, &match);if (memcmp (hdev->dev_class, zero_cod,sizeof (zero_cod)) !=0 ) { mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/482 Bluetooth: L2CAP: Fix uaf in l2cap_connect
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 333b4fd11e89b29c84c269123f871883a30be586 ]
[Syzbot reported]
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline] l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825 l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514 hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline] hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
...
Freed by task 5245: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2256 [inline] slab_free mm/slub.c:4477 [inline] kfree+0x12a/0x3b0 mm/slub.c:4598 l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline] l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802 l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241 hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline] hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265 hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583 abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917 hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
--- net/bluetooth/hci_core.c | 2 ++ net/bluetooth/hci_event.c | 2 +- net/bluetooth/l2cap_core.c | 8 -------- 3 files changed, 3 insertions(+), 9 deletions(-)
net/bluetooth/hci_core.c +2 -0
@@ -3792,6 +3792,8 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)hci_dev_lock (hdev); conn =hci_conn_hash_lookup_handle (hdev, handle); +if (conn &&hci_dev_test_flag (hdev,HCI_MGMT )) +mgmt_device_connected (hdev, conn,NULL ,0 );hci_dev_unlock (hdev);if (conn) {
net/bluetooth/hci_event.c +1 -1
@@ -3707,7 +3707,7 @@ static void hci_remote_features_evt(struct hci_dev *hdev, void *data, goto unlock; } -if (!ev->status && !test_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags)) { +if (!ev->status) {struct hci_cp_remote_name_req cp;memset (&cp,0 ,sizeof (cp));bacpy (&cp.bdaddr, &conn->dst);
net/bluetooth/l2cap_core.c +0 -8
@@ -4066,17 +4066,9 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,static int l2cap_connect_req (struct l2cap_conn *conn,struct l2cap_cmd_hdr *cmd,u16 cmd_len,u8 *data) { -struct hci_dev *hdev = conn->hcon->hdev; -struct hci_conn *hcon = conn->hcon; -if (cmd_len <sizeof (struct l2cap_conn_req ))return -EPROTO ; -hci_dev_lock (hdev); -if (hci_dev_test_flag (hdev,HCI_MGMT )) -mgmt_device_connected (hdev, hcon,NULL ,0 ); -hci_dev_unlock (hdev); -l2cap_connect (conn, cmd, data,L2CAP_CONN_RSP );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/482 Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 7b1ab460592ca818e7b52f27cd3ec86af79220d1 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/bluetooth/btmrvl_sdio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bluetooth/btmrvl_sdio.c +1 -2
@@ -92,7 +92,7 @@ static int btmrvl_sdio_probe_of(struct device *dev, }else { ret =devm_request_irq (dev, cfg->irq_bt, btmrvl_wake_irq_bt, -0 ,"bt_wake" , card); +IRQF_NO_AUTOEN ,"bt_wake" , card);if (ret) { dev_err(dev, "Failed to request irq_bt %d (%d)\n",
@@ -101,7 +101,6 @@ static int btmrvl_sdio_probe_of(struct device *dev,/* Configure wakeup (enabled by default) */ device_init_wakeup (dev, true); -disable_irq (cfg->irq_bt); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/482 afs: Fix missing wire-up of afs_retry_request()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 2cf36327ee1e47733aba96092d7bd082a4056ff5 ]
afs_retry_request() is supposed to be pointed to by the afs_req_ops netfs operations table, but the pointer got lost somewhere. The function is used during writeback to rotate through the authentication keys that were in force when the file was modified locally.
Fix this by adding the pointer to the function.
--- fs/afs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/afs/file.c +1 -0
@@ -403,6 +403,7 @@ const struct netfs_request_ops afs_req_ops = { .begin_writeback = afs_begin_writeback, .prepare_write = afs_prepare_write, .issue_write = afs_issue_write, + .retry_request = afs_retry_request, };static void afs_add_open_mmap (struct afs_vnode *vnode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/482 afs: Fix the setting of the server responding flag
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit ff98751bae40faed1ba9c6a7287e84430f7dec64 ]
In afs_wait_for_operation(), we set transcribe the call responded flag to the server record that we used after doing the fileserver iteration loop - but it's possible to exit the loop having had a response from the server that we've discarded (e.g. it returned an abort or we started receiving data, but the call didn't complete).
This means that op->server might be NULL, but we don't check that before attempting to set the server flag.
--- fs/afs/fs_operation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/afs/fs_operation.c +1 -1
@@ -201,7 +201,7 @@ void afs_wait_for_operation(struct afs_operation *op) } } -if (op->call_responded) +if (op->call_responded && op->server)set_bit (AFS_SERVER_FL_RESPONDING , &op->server->flags);if (!afs_op_error (op)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/482 net: dsa: improve shutdown sequence
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 6c24a03a61a245fe34d47582898331fa034b6ccd ]
Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there.
The first problem is that lan9303 is unique among DSA drivers in that it calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown, not remove):
phy_state_machine()
-> ...
-> dsa_user_phy_read()
-> ds->ops->phy_read()
-> lan9303_phy_read()
-> chip->ops->phy_read()
-> lan9303_mdio_phy_read()
-> dev_get_drvdata()But we never stop the phy_state_machine(), so it may continue to run after dsa_switch_shutdown(). Our common pattern in all DSA drivers is to set drvdata to NULL to suppress the remove() method that may come afterwards. But in this case it will result in an NPD.
The second problem is that the way in which we set dp->conduit->dsa_ptr = NULL; is concurrent with receive packet processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL, but afterwards, rather than continuing to use that non-NULL value, dev->dsa_ptr is dereferenced again and again without NULL checks:dsa_conduit_find_user() and many other places. In between dereferences, there is no locking to ensure that what was valid once continues to be valid.
Both problems have the common aspect that closing the conduit interface solves them.
In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN event in dsa_user_netdevice_event() which closes user ports as well. dsa_port_disable_rt() calls phylink_stop(), which synchronously stops the phylink state machine, and ds->ops->phy_read() will thus no longer call into the driver after this point.
In the second case, dev_close(conduit) should do this, as per Documentation/networking/driver.rst:
| Quiescence | ---------- | | After the ndo_stop routine has been called, the hardware must | not receive or transmit any data. All in flight packets must | be aborted. If necessary, poll or wait for completion of | any reset commands.
So it should be sufficient to ensure that later, when we zeroize conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call on this conduit.
The addition of the netif_device_detach() function is to ensure that ioctls, rtnetlinks and ethtool requests on the user ports no longer propagate down to the driver - we're no longer prepared to handle them.
The race condition actually did not exist when commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") first introduced dsa_switch_shutdown(). It was created later, when we stopped unregistering the user interfaces from a bad spot, and we just replaced that sequence with a racy zeroization of conduit->dsa_ptr (one which doesn't ensure that the interfaces aren't up).
--- net/dsa/dsa.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/dsa/dsa.c +7 -0
@@ -1579,6 +1579,7 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch);void dsa_switch_shutdown (struct dsa_switch *ds) {struct net_device *conduit, *user_dev; +LIST_HEAD (close_list);struct dsa_port *dp;mutex_lock (&dsa2_mutex);
@@ -1588,10 +1589,16 @@ void dsa_switch_shutdown(struct dsa_switch *ds)rtnl_lock (); +dsa_switch_for_each_cpu_port (dp, ds) +list_add (&dp->conduit->close_list, &close_list); + +dev_close_many (&close_list, true); +dsa_switch_for_each_user_port (dp, ds) { conduit =dsa_port_to_conduit (dp); user_dev = dp->user; +netif_device_detach (user_dev);netdev_upper_dev_unlink (conduit, user_dev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/482 net: Add netif_get_gro_max_size helper for GRO
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e8d4d34df715133c319fabcf63fdec684be75ff8 ]
Add a small netif_get_gro_max_size() helper which returns the maximum IPv4 or IPv6 GRO size of the netdevice.
We later add a netif_get_gso_max_size() equivalent as well for GSO, so that these helpers can be used consistently instead of open-coded checks.
Stable-dep-of: e609c959a939 ("net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size")
--- include/linux/netdevice.h | 9 +++++++++ net/core/gro.c | 9 ++------- 2 files changed, 11 insertions(+), 7 deletions(-)
include/linux/netdevice.h +9 -0
@@ -5000,6 +5000,15 @@ void netif_set_tso_max_segs(struct net_device *dev, unsigned int segs);void netif_inherit_tso_max (struct net_device *to,const struct net_device *from); +static inline unsigned int +netif_get_gro_max_size (const struct net_device *dev,const struct sk_buff *skb) +{ +/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */ +return skb->protocol ==htons (ETH_P_IPV6 ) ? +READ_ONCE (dev->gro_max_size) : +READ_ONCE (dev->gro_ipv4_max_size); +} +static inline bool netif_is_macsec (const struct net_device *dev) {return dev->priv_flags &IFF_MACSEC ;
net/core/gro.c +2 -7
@@ -98,7 +98,6 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)unsigned int headlen =skb_headlen (skb);unsigned int len =skb_gro_len (skb);unsigned int delta_truesize; -unsigned int gro_max_size;unsigned int new_truesize;struct sk_buff *lp;int segs;
@@ -112,12 +111,8 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)if (p->pp_recycle != skb->pp_recycle)return -ETOOMANYREFS ; -/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */ - gro_max_size = p->protocol ==htons (ETH_P_IPV6 ) ? -READ_ONCE (p->dev->gro_max_size) : -READ_ONCE (p->dev->gro_ipv4_max_size); - -if (unlikely (p->len + len >= gro_max_size ||NAPI_GRO_CB (skb)->flush)) +if (unlikely (p->len + len >=netif_get_gro_max_size (p->dev, p) || +NAPI_GRO_CB (skb)->flush))return -E2BIG ;if (unlikely (p->len + len >=GRO_LEGACY_MAX_SIZE )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/482 net: Fix gso_features_check to check for both dev->gso_{ipv4_,}max_size
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit e609c959a939660c7519895f853dfa5624c6827a ]
Commit 24ab059d2ebd ("net: check dev->gso_max_size in gso_features_check()") added a dev->gso_max_size test to gso_features_check() in order to fall back to GSO when needed.
This was added as it was noticed that some drivers could misbehave if TSO packets get too big. However, the check doesn't respect dev->gso_ipv4_max_size limit. For instance, a device could be configured with BIG TCP for IPv4, but not IPv6.
Therefore, add a netif_get_gso_max_size() equivalent to netif_get_gro_max_size() and use the helper to respect both limits before falling back to GSO engine.
--- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-)
include/linux/netdevice.h +9 -0
@@ -5009,6 +5009,15 @@ netif_get_gro_max_size(const struct net_device *dev, const struct sk_buff *skb)READ_ONCE (dev->gro_ipv4_max_size); } +static inline unsigned int +netif_get_gso_max_size (const struct net_device *dev,const struct sk_buff *skb) +{ +/* pairs with WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */ +return skb->protocol ==htons (ETH_P_IPV6 ) ? +READ_ONCE (dev->gso_max_size) : +READ_ONCE (dev->gso_ipv4_max_size); +} +static inline bool netif_is_macsec (const struct net_device *dev) {return dev->priv_flags &IFF_MACSEC ;
net/core/dev.c +1 -1
@@ -3502,7 +3502,7 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb,if (gso_segs >READ_ONCE (dev->gso_max_segs))return features & ~NETIF_F_GSO_MASK ; -if (unlikely (skb->len >=READ_ONCE (dev->gso_max_size))) +if (unlikely (skb->len >=netif_get_gso_max_size (dev, skb)))return features & ~NETIF_F_GSO_MASK ;if (!skb_shinfo (skb)->gso_type) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/482 net: ethernet: lantiq_etop: fix memory disclosure
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ]
When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer.
In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions.
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.
--- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/lantiq_etop.c +3 -1
@@ -482,7 +482,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)unsigned long flags;u32 byte_offset; - len = skb->len <ETH_ZLEN ?ETH_ZLEN : skb->len; +if (skb_put_padto (skb,ETH_ZLEN )) +return NETDEV_TX_OK ; + len = skb->len;if ((desc->ctl & (LTQ_DMA_OWN |LTQ_DMA_C )) || ch->skb[ch->dma.desc]) {netdev_err (dev,"tx ring full\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/482 net: fec: Restart PPS after link state change
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit a1477dc87dc4996dcf65a4893d4e2c3a6b593002 ]
On link state change, the controller gets reset,
causing PPS to drop out. Re-enable PPS if it was
enabled before the controller reset.
--- drivers/net/ethernet/freescale/fec.h | 6 +++++ drivers/net/ethernet/freescale/fec_main.c | 11 ++++++++- drivers/net/ethernet/freescale/fec_ptp.c | 30 +++++++++++++++++++++++ 3 files changed, 46 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/fec.h +6 -0
@@ -691,10 +691,16 @@ struct fec_enet_private {/* XDP BPF Program */ struct bpf_prog *xdp_prog; +struct { +int pps_enable; + } ptp_saved_state; +u64 ethtool_stats[]; };void fec_ptp_init (struct platform_device *pdev,int irq_idx); +void fec_ptp_restore_state (struct fec_enet_private *fep); +void fec_ptp_save_state (struct fec_enet_private *fep);void fec_ptp_stop (struct platform_device *pdev);void fec_ptp_start_cyclecounter (struct net_device *ndev); int fec_ptp_set(struct net_device *ndev, struct kernel_hwtstamp_config *config,
drivers/net/ethernet/freescale/fec_main.c +10 -1
@@ -1077,6 +1077,8 @@ fec_restart(struct net_device *ndev)u32 rcntl =OPT_FRAME_SIZE |0x04 ;u32 ecntl =FEC_ECR_ETHEREN ; +fec_ptp_save_state (fep); +/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC * instead of reset MAC itself.
@@ -1244,8 +1246,10 @@ fec_restart(struct net_device *ndev)writel (ecntl, fep->hwp +FEC_ECNTRL );fec_enet_active_rxring (ndev); -if (fep->bufdesc_ex) +if (fep->bufdesc_ex) {fec_ptp_start_cyclecounter (ndev); +fec_ptp_restore_state (fep); + }/* Enable interrupts we wish to service */ if (fep->link)
@@ -1336,6 +1340,8 @@ fec_stop(struct net_device *ndev)netdev_err (ndev,"Graceful transmit stop did not complete!\n" ); } +fec_ptp_save_state (fep); +/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC * instead of reset MAC itself.
@@ -1366,6 +1372,9 @@ fec_stop(struct net_device *ndev) val =readl (fep->hwp +FEC_ECNTRL ); val |=FEC_ECR_EN1588 ;writel (val, fep->hwp +FEC_ECNTRL ); + +fec_ptp_start_cyclecounter (ndev); +fec_ptp_restore_state (fep); } }
drivers/net/ethernet/freescale/fec_ptp.c +30 -0
@@ -770,6 +770,36 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)schedule_delayed_work (&fep->time_keep,HZ ); } +void fec_ptp_save_state (struct fec_enet_private *fep) +{ +unsigned long flags; + +spin_lock_irqsave (&fep->tmreg_lock, flags); + + fep->ptp_saved_state.pps_enable = fep->pps_enable; + +spin_unlock_irqrestore (&fep->tmreg_lock, flags); +} + +/* Restore PTP functionality after a reset */ +void fec_ptp_restore_state (struct fec_enet_private *fep) +{ +unsigned long flags; + +spin_lock_irqsave (&fep->tmreg_lock, flags); + +/* Reset turned it off, so adjust our status flag */ + fep->pps_enable =0 ; + +spin_unlock_irqrestore (&fep->tmreg_lock, flags); + +/* Restart PPS if needed */ +if (fep->ptp_saved_state.pps_enable) { +/* Re-enable PPS */ +fec_ptp_enable_pps (fep,1 ); + } +} +void fec_ptp_stop (struct platform_device *pdev) {struct net_device *ndev =platform_get_drvdata (pdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/482 net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elena Salomatkina <[email protected]>
[ Upstream commit f25389e779500cf4a59ef9804534237841bce536 ]
In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en/tir.c +3 -0
@@ -23,6 +23,9 @@ struct mlx5e_tir_builder *mlx5e_tir_builder_alloc(bool modify)struct mlx5e_tir_builder *builder; builder =kvzalloc (sizeof (*builder),GFP_KERNEL ); +if (!builder) +return NULL ; + builder->modify = modify;return builder;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/482 net: fec: Reload PTP registers after link-state change
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit d9335d0232d2da605585eea1518ac6733518f938 ]
On link-state change, the controller gets reset, which clears all PTP registers, including PHC time, calibrated clock correction values etc. For correct IEEE 1588 operation we need to restore these after the reset.
--- drivers/net/ethernet/freescale/fec.h | 3 +++ drivers/net/ethernet/freescale/fec_ptp.c | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+)
drivers/net/ethernet/freescale/fec.h +3 -0
@@ -693,6 +693,9 @@ struct fec_enet_private {struct {int pps_enable; +u64 ns_sys, ns_phc; +u32 at_corr; +u8 at_inc_corr; } ptp_saved_state;u64 ethtool_stats[];
drivers/net/ethernet/freescale/fec_ptp.c +20 -0
@@ -773,24 +773,44 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)void fec_ptp_save_state (struct fec_enet_private *fep) {unsigned long flags; +u32 atime_inc_corr;spin_lock_irqsave (&fep->tmreg_lock, flags); fep->ptp_saved_state.pps_enable = fep->pps_enable; + fep->ptp_saved_state.ns_phc =timecounter_read (&fep->tc); + fep->ptp_saved_state.ns_sys =ktime_get_ns (); + + fep->ptp_saved_state.at_corr =readl (fep->hwp +FEC_ATIME_CORR ); + atime_inc_corr =readl (fep->hwp +FEC_ATIME_INC ) &FEC_T_INC_CORR_MASK ; + fep->ptp_saved_state.at_inc_corr = (u8)(atime_inc_corr >>FEC_T_INC_CORR_OFFSET ); +spin_unlock_irqrestore (&fep->tmreg_lock, flags); }/* Restore PTP functionality after a reset */ void fec_ptp_restore_state (struct fec_enet_private *fep) { +u32 atime_inc =readl (fep->hwp +FEC_ATIME_INC ) &FEC_T_INC_MASK ;unsigned long flags; +u32 counter; +u64 ns;spin_lock_irqsave (&fep->tmreg_lock, flags);/* Reset turned it off, so adjust our status flag */ fep->pps_enable =0 ; +writel (fep->ptp_saved_state.at_corr, fep->hwp +FEC_ATIME_CORR ); + atime_inc |= ((u32 )fep->ptp_saved_state.at_inc_corr) <<FEC_T_INC_CORR_OFFSET ; +writel (atime_inc, fep->hwp +FEC_ATIME_INC ); + + ns =ktime_get_ns () - fep->ptp_saved_state.ns_sys + fep->ptp_saved_state.ns_phc; + counter = ns & fep->cc.mask; +writel (counter, fep->hwp +FEC_ATIME ); +timecounter_init (&fep->tc, &fep->cc, ns); +spin_unlock_irqrestore (&fep->tmreg_lock, flags);/* Restart PPS if needed */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/482 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c20029db28399ecc50e556964eaba75c43b1e2f1 ]
After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.
Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :
IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.
When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len
Then the following sets gso_segs to 0 :
gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
shinfo->gso_size);
Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/
qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
This leads to the following crash in fq_codel [1]
qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.
This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.
[1]
[ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15)
3f: 49 rex.WB
Code starting with the faulting instruction
===========================================
0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.724561] CR2: 0000000000000000 CR3: 000000010c568000 CR4: 00000000000006f0 [ 70.724561] Call Trace: [ 70.724561] <TASK> [ 70.724561] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 70.724561] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 70.724561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 70.724561] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 70.724561] ? fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] dev_qdisc_enqueue (net/core/dev.c:3784) [ 70.724561] __dev_queue_xmit (net/core/dev.c:3880 (discriminator 2) net/core/dev.c:4390 (discriminator 2)) [ 70.724561] ? irqentry_enter (kernel/entry/common.c:237) [ 70.724561] ? sysvec_apic_timer_interrupt (./arch/x86/include/asm/hardirq.h:74 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2)) [ 70.724561] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 70.724561] ? asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) [ 70.724561] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/virtio_net.h:129 (discriminator 1)) [ 70.724561] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 70.724561] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 70.724561] ? netdev_name_node_lookup_rcu (net/core/dev.c:325 (discriminator 1)) [ 70.724561] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 70.724561] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 70.724561] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 70.724561] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 70.724561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 70.724561] RIP: 0033:0x41ae09
--- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/dev.c +1 -1
@@ -3748,7 +3748,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) sizeof(_tcphdr), &_tcphdr);if (likely (th)) hdr_len +=__tcp_hdrlen (th); - }else { + }else if (shinfo->gso_type &SKB_GSO_UDP_L4 ) {struct udphdr _udphdr; if (skb_header_pointer(skb, hdr_len,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/482 net: add more sanity checks to qdisc_pkt_len_init()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ]
One path takes care of SKB_GSO_DODGY, assumingskb->len is bigger than hdr_len.
virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header
- 60 bytes TCP header
- a small gso_size like 8
virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow
qdisc_skb_cb(skb)->pkt_len.
--- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/dev.c +7 -3
@@ -3756,10 +3756,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len +=sizeof (struct udphdr ); } -if (shinfo->gso_type &SKB_GSO_DODGY ) - gso_segs =DIV_ROUND_UP (skb->len - hdr_len, - shinfo->gso_size); +if (unlikely (shinfo->gso_type &SKB_GSO_DODGY )) { +int payload = skb->len - hdr_len; +/* Malicious packet. */ +if (payload <=0 ) +return ; + gso_segs =DIV_ROUND_UP (payload, shinfo->gso_size); + }qdisc_skb_cb (skb)->pkt_len += (gso_segs -1 ) * hdr_len; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/482 net: stmmac: dwmac4: extend timeout for VLAN Tag register busy bit check
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenwei Wang <[email protected]>
[ Upstream commit 4c1b56671b68ffcbe6b78308bfdda6bcce6491ae ]
Increase the timeout for checking the busy bit of the VLAN Tag register from 10µs to 500ms. This change is necessary to accommodate scenarios where Energy Efficient Ethernet (EEE) is enabled.
Overnight testing revealed that when EEE is active, the busy bit can remain set for up to approximately 300ms. The new 500ms timeout provides a safety margin.
--- .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +9 -9
@@ -14,6 +14,7 @@#include <linux/slab.h> #include <linux/ethtool.h> #include <linux/io.h> +#include <linux/iopoll.h> #include "stmmac.h" #include "stmmac_pcs.h" #include "dwmac4.h"
@@ -475,7 +476,7 @@ static int dwmac4_write_vlan_filter(struct net_device *dev, u8 index, u32 data) { void __iomem *ioaddr = (void __iomem *)dev->base_addr; -int i, timeout =10 ; +int ret;u32 val;if (index >= hw->num_vlan)
@@ -491,16 +492,15 @@ static int dwmac4_write_vlan_filter(struct net_device *dev,writel (val, ioaddr +GMAC_VLAN_TAG ); -for (i =0 ; i < timeout; i++) { - val =readl (ioaddr +GMAC_VLAN_TAG ); -if (!(val &GMAC_VLAN_TAG_CTRL_OB )) -return 0 ; -udelay (1 ); + ret =readl_poll_timeout (ioaddr +GMAC_VLAN_TAG , val, + !(val &GMAC_VLAN_TAG_CTRL_OB ), +1000 ,500000 ); +if (ret) { +netdev_err (dev,"Timeout accessing MAC_VLAN_Tag_Filter\n" ); +return -EBUSY ; } -netdev_err (dev,"Timeout accessing MAC_VLAN_Tag_Filter\n" ); - -return -EBUSY ; +return 0 ; } static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/482 ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Danilov <[email protected]>
[ Upstream commit c4a14f6d9d17ad1e41a36182dd3b8a5fd91efbd7 ]
Regression Description:
Depending on the options specified for the GRE tunnel device, small packets may be dropped. This occurs because the pskb_network_may_pull function fails due to the packet's insufficient length.
For example, if only the okey option is specified for the tunnel device, original (before encapsulation) packets smaller than 28 bytes (including the IPv4 header) will be dropped. This happens because the required length is calculated relative to the network header, not the skb->head.
Here is how the required length is computed and checked:
* The pull_len variable is set to 28 bytes, consisting of:
* IPv4 header: 20 bytes
* GRE header with Key field: 8 bytes
* The pskb_network_may_pull function adds the network offset, shifting the checkable space further to the beginning of the network header and extending it to the beginning of the packet. As a result, the end of the checkable space occurs beyond the actual end of the packet.
Instead of ensuring that 28 bytes are present in skb->head, the function is requesting these 28 bytes starting from the network header. For small packets, this requested length exceeds the actual packet size, causing the check to fail and the packets to be dropped.
This issue affects both locally originated and forwarded packets in DMVPN-like setups.
How to reproduce (for local originated packets):
ip link add dev gre1 type gre ikey 1.9.8.4 okey 1.9.8.4 \
local <your-ip> remote 0.0.0.0 ip link set mtu 1400 dev gre1
ip link set up dev gre1
ip address add 192.168.13.1/24 dev gre1
ip neighbor add 192.168.13.2 lladdr <remote-ip> dev gre1 ping -s 1374 -c 10 192.168.13.2
tcpdump -vni gre1
tcpdump -vni <your-ext-iface> 'ip proto 47'
ip -s -s -d link show dev gre1
Solution:
Use the pskb_may_pull function instead the pskb_network_may_pull.
--- net/ipv4/ip_gre.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/ip_gre.c +3 -3
@@ -661,11 +661,11 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,if (skb_cow_head (skb,0 )) goto free_skb; - tnl_params = (const struct iphdr *)skb->data; - -if (!pskb_network_may_pull (skb, pull_len)) +if (!pskb_may_pull (skb, pull_len)) goto free_skb; + tnl_params = (const struct iphdr *)skb->data; +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ skb_pull (skb, pull_len);skb_reset_mac_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/482 net: test for not too small csum_start in virtio_net_hdr_to_skb()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 49d14b54a527289d09a9480f214b8c586322310a ]
syzbot was able to trigger this warning [1], after injecting a malicious packet through af_packet, setting skb->csum_start and thus the transport header to an incorrect value.
We can at least make sure the transport header is after the end of the network header (with a estimated minimal size).
[1]
[ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0
mac=(-1,-1) mac_len=0 net=(16,-6) trans=10 shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) csum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0 priority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0 encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
[ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9 [ 67.877764] sk family=17 type=3 proto=0 [ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00 [ 67.879128] skb frag: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02 [ 67.879877] skb frag: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00 [ 67.881156] skb frag: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882173] skb frag: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882790] skb frag: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883733] skb frag: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.884206] skb frag: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e [ 67.884704] skb frag: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00 [ 67.885139] skb frag: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.885677] skb frag: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886042] skb frag: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886408] skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887020] skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887384] skb frag: 00000100: 00 00 [ 67.887878] ------------[ cut here ]------------ [ 67.887908] offset (-6) >= skb_headlen() (14) [ 67.888445] WARNING: CPU: 10 PID: 2088 at net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.889353] Modules linked in: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 dummy bridge sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs [ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 Not tainted 6.11.0-virtme #1011 [ 67.890183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891043] Call Trace: [ 67.891173] <TASK> [ 67.891274] ? __warn (kernel/panic.c:741) [ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239) [ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 67.891372] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 67.891388] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891399] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891416] ip_do_fragment (net/ipv4/ip_output.c:777 (discriminator 1)) [ 67.891448] ? __ip_local_out (./include/linux/skbuff.h:1146 ./include/net/l3mdev.h:196 ./include/net/l3mdev.h:213 net/ipv4/ip_output.c:113) [ 67.891459] ? __pfx_ip_finish_output2 (net/ipv4/ip_output.c:200) [ 67.891470] ? ip_route_output_flow (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:96 (discriminator 13) ./include/linux/rcupdate.h:871 (discriminator 13) net/ipv4/route.c:2625 (discriminator 13) ./include/net/route.h:141 (discriminator 13) net/ipv4/route.c:2852 (discriminator 13)) [ 67.891484] ipvlan_process_v4_outbound (drivers/net/ipvlan/ipvlan_core.c:445 (discriminator 1)) [ 67.891581] ipvlan_queue_xmit (drivers/net/ipvlan/ipvlan_core.c:542 drivers/net/ipvlan/ipvlan_core.c:604 drivers/net/ipvlan/ipvlan_core.c:670) [ 67.891596] ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:227) [ 67.891607] dev_hard_start_xmit (./include/linux/netdevice.h:4916 ./include/linux/netdevice.h:4925 net/core/dev.c:3588 net/core/dev.c:3604) [ 67.891620] __dev_queue_xmit (net/core/dev.h:168 (discriminator 25) net/core/dev.c:4425 (discriminator 25)) [ 67.891630] ? skb_copy_bits (./include/linux/uaccess.h:233 (discriminator 1) ./include/linux/uaccess.h:260 (discriminator 1) ./include/linux/highmem-internal.h:230 (discriminator 1) net/core/skbuff.c:3018 (discriminator 1)) [ 67.891645] ? __pskb_pull_tail (net/core/skbuff.c:2848 (discriminator 4)) [ 67.891655] ? skb_partial_csum_set (net/core/skbuff.c:5657) [ 67.891666] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/skbuff.h:2791 (discriminator 3) ./include/linux/skbuff.h:2799 (discriminator 3) ./include/linux/virtio_net.h:109 (discriminator 3)) [ 67.891684] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 67.891700] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 67.891716] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 67.891734] ? do_sock_setsockopt (net/socket.c:2335) [ 67.891747] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 67.891761] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 67.891772] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 67.891785] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
--- include/linux/virtio_net.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
include/linux/virtio_net.h +3 -1
@@ -103,8 +103,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (!skb_partial_csum_set (skb, start, off))return -EINVAL ; +if (skb_transport_offset (skb) < nh_min_len) +return -EINVAL ; - nh_min_len =max_t (u32, nh_min_len,skb_transport_offset (skb)); + nh_min_len =skb_transport_offset (skb); p_off = nh_min_len + thlen;if (!pskb_may_pull (skb, p_off))return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/482 ppp: do not assume bh is held in ppp_channel_bridge_input()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit aec7291003df78cb71fd461d7b672912bde55807 ]
Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the socket was owned by a user process.
In this case, release_sock(), __release_sock(), and sk_backlog_rcv() might call the sk->sk_backlog_rcv() handler in process context.
sybot caught ppp was not considering this case inppp_channel_bridge_input() :
WARNING: inconsistent lock state
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x1a8/0x3d8 net/core/sock.c:3004 release_sock+0x68/0x1b8 net/core/sock.c:3558 pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 282914 hardirqs last enabled at (282914): [<ffff80008b42e30c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (282914): [<ffff80008b42e30c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194 hardirqs last disabled at (282913): [<ffff80008b42e13c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (282913): [<ffff80008b42e13c>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (282904): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (282904): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582 softirqs last disabled at (282909): [<ffff8000801fbdf8>] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&pch->downl);
<Interrupt>
lock(&pch->downl);*** DEADLOCK ***
1 lock held by ksoftirqd/1/24:
#0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325
stack backtrace: CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326 __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119 dump_stack+0x1c/0x28 lib/dump_stack.c:128 print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000 mark_lock_irq+0x980/0xd2c mark_lock+0x258/0x360 kernel/locking/lockdep.c:4677 __lock_acquire+0xf48/0x779c kernel/locking/lockdep.c:5096 lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 ppp_async_process+0x98/0x150 drivers/net/ppp/ppp_async.c:495 tasklet_action_common+0x318/0x3f4 kernel/softirq.c:785 tasklet_action+0x68/0x8c kernel/softirq.c:811 handle_softirqs+0x2e4/0xbfc kernel/softirq.c:554 run_ksoftirqd+0x70/0x158 kernel/softirq.c:928 smpboot_thread_fn+0x4b0/0x90c kernel/smpboot.c:164 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
--- drivers/net/ppp/ppp_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ppp/ppp_generic.c +2 -2
@@ -2269,7 +2269,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)if (!pchb) goto out_rcu; -spin_lock (&pchb->downl); +spin_lock_bh (&pchb->downl);if (!pchb->chan) {/* channel got unregistered */ kfree_skb (skb);
@@ -2281,7 +2281,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)kfree_skb (skb); outl: -spin_unlock (&pchb->downl); +spin_unlock_bh (&pchb->downl); out_rcu:rcu_read_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/482 bridge: mcast: Fail MDB get request on empty entry
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 555f45d24ba7cd5527716553031641cdebbe76c7 ]
When user space deletes a port from an MDB entry, the port is removed synchronously. If this was the last port in the entry and the entry is not joined by the host itself, then the entry is scheduled for deletion via a timer.
The above means that it is possible for the MDB get netlink request to retrieve an empty entry which is scheduled for deletion. This is problematic as after deleting the last port in an entry, user space cannot rely on a non-zero return code from the MDB get request as an indication that the port was successfully removed.
Fix by returning an error when the entry's port list is empty and the entry is not joined by the host.
--- net/bridge/br_mdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_mdb.c +1 -1
@@ -1674,7 +1674,7 @@ int br_mdb_get(struct net_device *dev, struct nlattr *tb[], u32 portid, u32 seq,spin_lock_bh (&br->multicast_lock); mp =br_mdb_ip_get (br, &group); -if (!mp) { +if (!mp || (!mp->ports && !mp->host_joined)) {NL_SET_ERR_MSG_MOD (extack,"MDB entry not found" ); err = -ENOENT ; goto unlock;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/482 net/ncsi: Disable the ncsi work before freeing the associated structure
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie James <[email protected]>
[ Upstream commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c ]
The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic.
--- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+)
net/ncsi/ncsi-manage.c +2 -0
@@ -1954,6 +1954,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)list_del_rcu (&ndp->node);spin_unlock_irqrestore (&ncsi_dev_lock, flags); +disable_work_sync (&ndp->work); +kfree (ndp); }EXPORT_SYMBOL_GPL (ncsi_unregister_dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/482 iomap: constrain the file range passed to iomap_file_unshare
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
[ Upstream commit a311a08a4237241fb5b9d219d3e33346de6e83e0 ]
File contents can only be shared (i.e. reflinked) below EOF, so it makes no sense to try to unshare ranges beyond EOF. Constrain the file range parameters here so that we don't have to do that in the callers.
--- fs/dax.c | 6 +++++- fs/iomap/buffered-io.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-)
fs/dax.c +5 -1
@@ -1305,11 +1305,15 @@ int dax_file_unshare(struct inode *inode, loff_t pos, loff_t len,struct iomap_iter iter = { .inode = inode, .pos = pos, - .len = len, .flags =IOMAP_WRITE |IOMAP_UNSHARE |IOMAP_DAX , }; +loff_t size =i_size_read (inode);int ret; +if (pos <0 || pos >= size) +return 0 ; + + iter.len =min (len, size - pos);while ((ret =iomap_iter (&iter, ops)) >0 ) iter.processed =dax_unshare_iter (&iter);return ret;
fs/iomap/buffered-io.c +5 -1
@@ -1366,11 +1366,15 @@ iomap_file_unshare(struct inode *inode, loff_t pos, loff_t len,struct iomap_iter iter = { .inode = inode, .pos = pos, - .len = len, .flags =IOMAP_WRITE |IOMAP_UNSHARE , }; +loff_t size =i_size_read (inode);int ret; +if (pos <0 || pos >= size) +return 0 ; + + iter.len =min (len, size - pos);while ((ret =iomap_iter (&iter, ops)) >0 ) iter.processed =iomap_unshare_iter (&iter);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/482 net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 7b124695db40d5c9c5295a94ae928a8d67a01c3d ]
The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not freed yet. As __xfrm_state_delete() is called again in xfrm timer, the following crash occurs.
To fix this issue, skip xfrm_state_check_expire() if km.state is not XFRM_STATE_VALID.
Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core] RIP: 0010:__xfrm_state_delete+0x3d/0x1b0 Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48 RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246 RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036 RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980 RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246 R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400 FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x1a2/0x390 ? asm_exc_general_protection+0x22/0x30 ? __xfrm_state_delete+0x3d/0x1b0 ? __xfrm_state_delete+0x2f/0x1b0 xfrm_timer_handler+0x174/0x350 ? __xfrm_state_delete+0x1b0/0x1b0 __hrtimer_run_queues+0x121/0x270 hrtimer_run_softirq+0x88/0xd0 handle_softirqs+0xcc/0x270 do_softirq+0x3c/0x50 </IRQ> <TASK> __local_bh_enable_ip+0x47/0x50 mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core] process_one_work+0x137/0x2d0 worker_thread+0x28d/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +7 -1
@@ -67,7 +67,6 @@ static void mlx5e_ipsec_handle_sw_limits(struct work_struct *_work)return ;spin_lock_bh (&x->lock); -xfrm_state_check_expire (x);if (x->km.state ==XFRM_STATE_EXPIRED ) { sa_entry->attrs.drop = true;spin_unlock_bh (&x->lock);
@@ -75,6 +74,13 @@ static void mlx5e_ipsec_handle_sw_limits(struct work_struct *_work)mlx5e_accel_ipsec_fs_modify (sa_entry);return ; } + +if (x->km.state !=XFRM_STATE_VALID ) { +spin_unlock_bh (&x->lock); +return ; + } + +xfrm_state_check_expire (x);spin_unlock_bh (&x->lock); queue_delayed_work(sa_entry->ipsec->wq, &dwork->dwork,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/482 dt-bindings: net: xlnx,axi-ethernet: Add missing reg minItems
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravikanth Tuniki <[email protected]>
[ Upstream commit c6929644c1e0d6108e57061d427eb966e1746351 ]
Add missing reg minItems as based on current binding document only ethernet MAC IO space is a supported configuration.
There is a bug in schema, current examples contain 64-bit addressing as well as 32-bit addressing. The schema validation does pass incidentally considering one 64-bit reg address as two 32-bit reg address entries. If we change axi_ethernet_eth1 example node reg addressing to 32-bit schema validation reports:
Documentation/devicetree/bindings/net/xlnx,axi-ethernet.example.dtb:
ethernet@40000000: reg: [[1073741824, 262144]] is too short
To fix it add missing reg minItems constraints and to make things clearer stick to 32-bit addressing in examples.
--- Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml +2 -1
@@ -34,6 +34,7 @@ properties: and length of the AXI DMA controller IO space, unless axistream-connected is specified, in which case the reg attribute of the node referenced by it is used. + minItems: 1 maxItems: 2 interrupts:
@@ -181,7 +182,7 @@ examples: clock-names = "s_axi_lite_clk", "axis_clk", "ref_clk", "mgt_clk"; clocks = <&axi_clk>, <&axi_clk>, <&pl_enet_ref_clk>, <&mgt_clk>; phy-mode = "mii"; - reg = <0x00 0x40000000 0x00 0x40000>; + reg = <0x40000000 0x40000>; xlnx,rxcsum = <0x2>; xlnx,rxmem = <0x800>; xlnx,txcsum = <0x2>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/482 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ]
In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.
Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]
--- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/socket.c +3 -1
@@ -8552,8 +8552,10 @@ static int sctp_listen_start(struct sock *sk, int backlog)*/ inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) { -if (sctp_autobind (sk)) +if (sctp_autobind (sk)) { +inet_sk_set_state (sk,SCTP_SS_CLOSED );return -EAGAIN ; + } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) {inet_sk_set_state (sk,SCTP_SS_CLOSED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/482 selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Xu <[email protected]>
[ Upstream commit 072cd213b75eb01fcf40eff898f8d5c008ce1457 ]
the syscall remap accepts following:
mremap(src, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, dst)
when the src is sealed, the call will fail with error code:
EPERM
Previously, the test uses hard-coded 0xdeaddead as dst, and it will fail on the system with newer glibc installed.
This patch removes test's dependency on glibc for mremap(), also fix the test and remove the hardcoded address.
--- tools/testing/selftests/mm/mseal_test.c | 57 ++++++++++++++++--------- 1 file changed, 36 insertions(+), 21 deletions(-)
tools/testing/selftests/mm/mseal_test.c +36 -21
@@ -146,6 +146,16 @@ static int sys_madvise(void *start, size_t len, int types)return sret; } +static void *sys_mremap (void *addr,size_t old_len,size_t new_len, +unsigned long flags,void *new_addr) +{ +void *sret; + + errno =0 ; + sret = (void *)syscall (__NR_mremap, addr, old_len, new_len, flags, new_addr); +return sret; +} +static int sys_pkey_alloc (unsigned long flags,unsigned long init_val) {int ret =syscall (__NR_pkey_alloc, flags, init_val);
@@ -1151,12 +1161,12 @@ static void test_seal_mremap_shrink(bool seal) }/* shrink from 4 pages to 2 pages. */ - ret2 =mremap (ptr, size,2 * page_size,0 ,0 ); + ret2 =sys_mremap (ptr, size,2 * page_size,0 ,0 );if (seal) { -FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED ); +FAIL_TEST_IF_FALSE (ret2 == (void *)MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM ); }else { -FAIL_TEST_IF_FALSE (ret2 !=MAP_FAILED ); +FAIL_TEST_IF_FALSE (ret2 != (void *)MAP_FAILED ); }
@@ -1183,7 +1193,7 @@ static void test_seal_mremap_expand(bool seal) }/* expand from 2 page to 4 pages. */ - ret2 =mremap (ptr,2 * page_size,4 * page_size,0 ,0 ); + ret2 =sys_mremap (ptr,2 * page_size,4 * page_size,0 ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1216,7 +1226,7 @@ static void test_seal_mremap_move(bool seal) }/* move from ptr to fixed address. */ - ret2 =mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_FIXED , newPtr); + ret2 =sys_mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_FIXED , newPtr);if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1335,7 +1345,7 @@ static void test_seal_mremap_shrink_fixed(bool seal) }/* mremap to move and shrink to fixed address */ - ret2 =mremap (ptr, size,2 * page_size,MREMAP_MAYMOVE |MREMAP_FIXED , + ret2 =sys_mremap (ptr, size,2 * page_size,MREMAP_MAYMOVE |MREMAP_FIXED , newAddr);if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );
@@ -1366,7 +1376,7 @@ static void test_seal_mremap_expand_fixed(bool seal) }/* mremap to move and expand to fixed address */ - ret2 =mremap (ptr, page_size, size,MREMAP_MAYMOVE |MREMAP_FIXED , + ret2 =sys_mremap (ptr, page_size, size,MREMAP_MAYMOVE |MREMAP_FIXED , newAddr);if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );
@@ -1397,7 +1407,7 @@ static void test_seal_mremap_move_fixed(bool seal) }/* mremap to move to fixed address */ - ret2 =mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_FIXED , newAddr); + ret2 =sys_mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_FIXED , newAddr);if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM );
@@ -1426,14 +1436,13 @@ static void test_seal_mremap_move_fixed_zero(bool seal)/* * MREMAP_FIXED can move the mapping to zero address */ - ret2 =mremap (ptr, size,2 * page_size,MREMAP_MAYMOVE |MREMAP_FIXED , + ret2 =sys_mremap (ptr, size,2 * page_size,MREMAP_MAYMOVE |MREMAP_FIXED ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM ); }else {FAIL_TEST_IF_FALSE (ret2 ==0 ); - }TEST_END_CHECK ();
@@ -1456,13 +1465,13 @@ static void test_seal_mremap_move_dontunmap(bool seal) }/* mremap to move, and don't unmap src addr. */ - ret2 =mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_DONTUNMAP ,0 ); + ret2 =sys_mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_DONTUNMAP ,0 );if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM ); }else { +/* kernel will allocate a new address */ FAIL_TEST_IF_FALSE (ret2 !=MAP_FAILED ); - }TEST_END_CHECK ();
@@ -1470,7 +1479,7 @@ static void test_seal_mremap_move_dontunmap(bool seal)static void test_seal_mremap_move_dontunmap_anyaddr (bool seal) { -void *ptr; +void *ptr, *ptr2;unsigned long page_size =getpagesize ();unsigned long size =4 * page_size;int ret;
@@ -1485,24 +1494,30 @@ static void test_seal_mremap_move_dontunmap_anyaddr(bool seal) }/* -* The 0xdeaddead should not have effect on dest addr -* when MREMAP_DONTUNMAP is set. +* The new address is any address that not allocated. +* use allocate/free to similate that. */ - ret2 =mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_DONTUNMAP , -0xdeaddead ); +setup_single_address (size, &ptr2); +FAIL_TEST_IF_FALSE (ptr2 != (void *)-1 ); + ret =sys_munmap (ptr2, size); +FAIL_TEST_IF_FALSE (!ret); + +/* +* remap to any address. +*/ + ret2 =sys_mremap (ptr, size, size,MREMAP_MAYMOVE |MREMAP_DONTUNMAP , + (void *) ptr2);if (seal) {FAIL_TEST_IF_FALSE (ret2 ==MAP_FAILED );FAIL_TEST_IF_FALSE (errno ==EPERM ); }else { -FAIL_TEST_IF_FALSE (ret2 !=MAP_FAILED ); -FAIL_TEST_IF_FALSE ((long )ret2 !=0xdeaddead ); - +/* remap success and return ptr2 */ +FAIL_TEST_IF_FALSE (ret2 == ptr2); }TEST_END_CHECK (); } -static void test_seal_merge_and_split (void ) {void *ptr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/482 i2c: xiic: improve error message when transfer fails to start
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Ferland <[email protected]>
[ Upstream commit ee1691d0ae103ba7fd9439800ef454674fadad27 ]
xiic_start_xfer can fail for different reasons:
- EBUSY: bus is busy or i2c messages still in tx_msg or rx_msg
- ETIMEDOUT: timed-out trying to clear the RX fifo
- EINVAL: wrong clock settings
Both EINVAL and ETIMEDOUT will currently print a specific error message followed by a generic one, for example:
Failed to clear rx fifo
Error xiic_start_xfer
however EBUSY will simply output the generic message:
Error xiic_start_xfer
which is not really helpful.
This commit adds a new error message when a busy condition is detected and also removes the generic message since it does not provide any relevant information to the user.
Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
--- drivers/i2c/busses/i2c-xiic.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-xiic.c +5 -4
@@ -1105,8 +1105,11 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)mutex_lock (&i2c->lock); ret =xiic_busy (i2c); -if (ret) +if (ret) { +dev_err (i2c->adap.dev.parent, +"cannot start a transfer while busy\n" ); goto out; + } i2c->tx_msg = msgs; i2c->rx_msg =NULL ;
@@ -1164,10 +1167,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)return err; err =xiic_start_xfer (i2c, msgs, num); -if (err <0 ) { -dev_err (adap->dev.parent,"Error xiic_start_xfer\n" ); +if (err <0 ) goto out; - } err =wait_for_completion_timeout (&i2c->completion,XIIC_XFER_TIMEOUT );mutex_lock (&i2c->lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/482 netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 76f1ed087b562a469f2153076f179854b749c09a ]
Fix the comment which incorrectly defines it as NLA_U32.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1694,7 +1694,7 @@ enum nft_flowtable_flags {* * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) -* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) +* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED) * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/482 net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 09573b1cc76e7ff8f056ab29ea1cdc152ec8c653 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ieee802154/mcr20a.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ieee802154/mcr20a.c +1 -4
@@ -1302,16 +1302,13 @@ mcr20a_probe(struct spi_device *spi) irq_type =IRQF_TRIGGER_FALLING ; ret =devm_request_irq (&spi->dev, spi->irq, mcr20a_irq_isr, - irq_type,dev_name (&spi->dev), lp); + irq_type |IRQF_NO_AUTOEN ,dev_name (&spi->dev), lp);if (ret) {dev_err (&spi->dev,"could not request_irq for mcr20a\n" ); ret = -ENODEV ; goto free_dev; } -/* disable_irq by default and wait for starting hardware */ -disable_irq (spi->irq); - ret =ieee802154_register_hw (hw);if (ret) {dev_crit (&spi->dev,"ieee802154_register_hw failed\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/482 net: wwan: qcom_bam_dmux: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit d505d3593b52b6c43507f119572409087416ba28 ]
It's important to undo pm_runtime_use_autosuspend() with pm_runtime_dont_use_autosuspend() at driver exit time.
But the pm_runtime_disable() and pm_runtime_dont_use_autosuspend() is missing in the error path for bam_dmux_probe(). So add it.
Found by code review. Compile-tested only.
--- drivers/net/wwan/qcom_bam_dmux.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/net/wwan/qcom_bam_dmux.c +8 -3
@@ -823,17 +823,17 @@ static int bam_dmux_probe(struct platform_device *pdev) ret =devm_request_threaded_irq (dev, pc_ack_irq,NULL , bam_dmux_pc_ack_irq,IRQF_ONESHOT ,NULL , dmux);if (ret) -return ret; + goto err_disable_pm; ret =devm_request_threaded_irq (dev, dmux->pc_irq,NULL , bam_dmux_pc_irq,IRQF_ONESHOT ,NULL , dmux);if (ret) -return ret; + goto err_disable_pm; ret =irq_get_irqchip_state (dmux->pc_irq,IRQCHIP_STATE_LINE_LEVEL , &dmux->pc_state);if (ret) -return ret; + goto err_disable_pm;/* Check if remote finished initialization before us */ if (dmux->pc_state) {
@@ -844,6 +844,11 @@ static int bam_dmux_probe(struct platform_device *pdev) }return 0 ; + +err_disable_pm: +pm_runtime_disable (dev); +pm_runtime_dont_use_autosuspend (dev); +return ret; }static void bam_dmux_remove (struct platform_device *pdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/482 selftests: netfilter: Fix nft_audit.sh for newer nft binaries
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 8a89015644513ef69193a037eb966f2d55fe385a ]
As a side-effect of nftables' commit dbff26bfba833 ("cache: consolidate reset command"), audit logs changed when more objects were reset than fit into a single netlink message.
Since the objects' distribution in netlink messages is not relevant, implement a summarizing function which combines repeated audit logs into a single one with summed up 'entries=' value.
--- .../selftests/net/netfilter/nft_audit.sh | 57 ++++++++++--------- 1 file changed, 29 insertions(+), 28 deletions(-)
tools/testing/selftests/net/netfilter/nft_audit.sh +29 -28
@@ -48,12 +48,31 @@ logread_pid=$! trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT exec 3<"$logfile" +lsplit='s/^\(.*\) entries=\([^ ]*\) \(.*\)$/pfx="\1"\nval="\2"\nsfx="\3"/' +summarize_logs() { + sum=0 + while read line; do + eval $(sed "$lsplit" <<< "$line") + [[ $sum -gt 0 ]] && { + [[ "$pfx $sfx" == "$tpfx $tsfx" ]] && { + let "sum += val" + continue + } + echo "$tpfx entries=$sum $tsfx" + } + tpfx="$pfx" + tsfx="$sfx" + sum=$val + done + echo "$tpfx entries=$sum $tsfx" +} + do_test() { # (cmd, log) echo -n "testing for cmd: $1 ... " cat <&3 >/dev/null $1 >/dev/null || exit 1 sleep 0.1 - res=$(diff -a -u <(echo "$2") - <&3) + res=$(diff -a -u <(echo "$2") <(summarize_logs <&3)) [ $? -eq 0 ] && { echo "OK"; return; } echo "FAIL" grep -v '^\(---\|+++\|@@\)' <<< "$res"
@@ -152,31 +171,17 @@ do_test 'nft reset rules t1 c2' \ 'table=t1 family=2 entries=3 op=nft_reset_rule' do_test 'nft reset rules table t1' \ -'table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule' +'table=t1 family=2 entries=9 op=nft_reset_rule' do_test 'nft reset rules t2 c3' \ -'table=t2 family=2 entries=189 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=126 op=nft_reset_rule' +'table=t2 family=2 entries=503 op=nft_reset_rule' do_test 'nft reset rules t2' \ -'table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=186 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=129 op=nft_reset_rule' +'table=t2 family=2 entries=509 op=nft_reset_rule' do_test 'nft reset rules' \ -'table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t1 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=3 op=nft_reset_rule -table=t2 family=2 entries=180 op=nft_reset_rule -table=t2 family=2 entries=188 op=nft_reset_rule -table=t2 family=2 entries=135 op=nft_reset_rule' +'table=t1 family=2 entries=9 op=nft_reset_rule +table=t2 family=2 entries=509 op=nft_reset_rule' # resetting sets and elements
@@ -200,13 +205,11 @@ do_test 'nft reset counters t1' \ 'table=t1 family=2 entries=1 op=nft_reset_obj' do_test 'nft reset counters t2' \ -'table=t2 family=2 entries=342 op=nft_reset_obj -table=t2 family=2 entries=158 op=nft_reset_obj' +'table=t2 family=2 entries=500 op=nft_reset_obj' do_test 'nft reset counters' \ 'table=t1 family=2 entries=1 op=nft_reset_obj -table=t2 family=2 entries=341 op=nft_reset_obj -table=t2 family=2 entries=159 op=nft_reset_obj' +table=t2 family=2 entries=500 op=nft_reset_obj' # resetting quotas
@@ -217,13 +220,11 @@ do_test 'nft reset quotas t1' \ 'table=t1 family=2 entries=1 op=nft_reset_obj' do_test 'nft reset quotas t2' \ -'table=t2 family=2 entries=315 op=nft_reset_obj -table=t2 family=2 entries=185 op=nft_reset_obj' +'table=t2 family=2 entries=500 op=nft_reset_obj' do_test 'nft reset quotas' \ 'table=t1 family=2 entries=1 op=nft_reset_obj -table=t2 family=2 entries=314 op=nft_reset_obj -table=t2 family=2 entries=186 op=nft_reset_obj' +table=t2 family=2 entries=500 op=nft_reset_obj' # deleting rules
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/482 netfilter: nf_tables: prevent nf_skb_duplicated corruption
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ]
syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].
Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.
[1]
BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK>
--- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)
net/ipv4/netfilter/nf_dup_ipv4.c +5 -2
@@ -52,8 +52,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, {struct iphdr *iph; +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out;/* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has
@@ -61,7 +62,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,*/ skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )/* Avoid counting cloned packets towards the original connection. */
@@ -90,6 +91,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv4);
net/ipv6/netfilter/nf_dup_ipv6.c +5 -2
@@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,void nf_dup_ipv6 (struct net *net,struct sk_buff *skb,unsigned int hooknum,const struct in6_addr *gw,int oif) { +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out; skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )nf_reset_ct (skb);
@@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv6);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/482 selftests: netfilter: Add missing return value
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhang jiao <[email protected]>
[ Upstream commit 10dbd23633f0433f8d13c2803d687b36a675ef60 ]
There is no return value in count_entries, just add it.
--- tools/testing/selftests/net/netfilter/conntrack_dump_flush.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/netfilter/conntrack_dump_flush.c +1 -0
@@ -207,6 +207,7 @@ static int conntrack_data_generate_v6(struct mnl_socket *sock,static int count_entries (const struct nlmsghdr *nlh,void *data) { reply_counter++; +return MNL_CB_OK ; }static int conntracK_count_zone (struct mnl_socket *sock,uint16_t zone)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/482 net/mlx5: Fix error path in multi-packet WQE transmit
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 2bcae12c795f32ddfbf8c80d1b5f1d3286341c32 ]
Remove the erroneous unmap in case no DMA mapping was established
The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.
The erroneous behavior was seen in a stress-test environment that created memory pressure.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +0 -1
@@ -642,7 +642,6 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb,return ; err_unmap: -mlx5e_dma_unmap_wqe_err (sq,1 ); sq->stats->dropped++;dev_kfree_skb_any (skb);mlx5e_tx_flush (sq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/482 loop: dont set QUEUE_FLAG_NOMERGES
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 667ea36378cf7f669044b27871c496e1559c872a ]
QUEUE_FLAG_NOMERGES isn't really a driver interface, but a user tunable. There also isn't any good reason to set it in the loop driver.
The original commit adding it (5b5e20f421c0b6d "block: loop: set QUEUE_FLAG_NOMERGES for request queue of loop") claims that "It doesn't make sense to enable merge because the I/O submitted to backing file is handled page by page." which of course isn't true for multi-page bvec now, and it never has been for direct I/O, for which commit 40326d8a33d ("block/loop: allow request merge for directio mode") alredy disabled the nomerges flag.
--- drivers/block/loop.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)
drivers/block/loop.c +2 -13
@@ -211,13 +211,10 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)if (lo->lo_state == Lo_bound)blk_mq_freeze_queue (lo->lo_queue); lo->use_dio = use_dio; -if (use_dio) { -blk_queue_flag_clear (QUEUE_FLAG_NOMERGES , lo->lo_queue); +if (use_dio) lo->lo_flags |=LO_FLAGS_DIRECT_IO ; - }else { -blk_queue_flag_set (QUEUE_FLAG_NOMERGES , lo->lo_queue); +else lo->lo_flags &= ~LO_FLAGS_DIRECT_IO ; - }if (lo->lo_state == Lo_bound)blk_mq_unfreeze_queue (lo->lo_queue); }
@@ -2059,14 +2056,6 @@ static int loop_add(int i) } lo->lo_queue = lo->lo_disk->queue; -/* -* By default, we do buffer IO, so it doesn't make sense to enable -* merge because the I/O submitted to backing file is handled page by -* page. For directio mode, merge does help to dispatch bigger request -* to underlayer disk. We will enable merge once directio is enabled. -*/ -blk_queue_flag_set (QUEUE_FLAG_NOMERGES , lo->lo_queue); -/* * Disable partition scanning by default. The in-kernel partition * scanning can be requested individually per-device during its
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/482 ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
[ Upstream commit 47d7d3fd72afc7dcd548806291793ee6f3848215 ]
In most Linux distribution kernels, the SND is set to m, in such a case, when booting the kernel on i.MX8MP EVK board, there is a warning calltrace like below:
Call trace: snd_card_init+0x484/0x4cc [snd] snd_card_new+0x70/0xa8 [snd] snd_soc_bind_card+0x310/0xbd0 [snd_soc_core] snd_soc_register_card+0xf0/0x108 [snd_soc_core] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
That is because the card.owner is not set, a warning calltrace is raised in the snd_card_init() due to it.
--- sound/soc/fsl/imx-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-card.c +1 -0
@@ -713,6 +713,7 @@ static int imx_card_probe(struct platform_device *pdev) data->plat_data = plat_data; data->card.dev = &pdev->dev; + data->card.owner =THIS_MODULE ;dev_set_drvdata (&pdev->dev, &data->card);snd_soc_card_set_drvdata (&data->card, data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/482 drm/xe: Restore pci state upon resume
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit cffa8e83df9fe525afad1e1099097413f9174f57 ]
The pci state was saved, but not restored. Restore right after the power state transition request like every other driver.
v2: Use right fixes tag, since this was there initialy, but
accidentally removed.
--- drivers/gpu/drm/xe/xe_pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/xe/xe_pci.c +2 -0
@@ -868,6 +868,8 @@ static int xe_pci_resume(struct device *dev)if (err)return err; +pci_restore_state (pdev); + err =pci_enable_device (pdev);if (err)return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/482 drm/xe: Resume TDR after GT reset
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 1b30f87e088b499eb74298db256da5c98e8276e2 ]
Not starting the TDR after GT reset on exec queue which have been restarted can lead to jobs being able to be run forever. Fix this by restarting the TDR.
--- drivers/gpu/drm/xe/xe_gpu_scheduler.c | 5 +++++ drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 ++ drivers/gpu/drm/xe/xe_guc_submit.c | 1 + 3 files changed, 8 insertions(+)
drivers/gpu/drm/xe/xe_gpu_scheduler.c +5 -0
@@ -90,6 +90,11 @@ void xe_sched_submission_stop(struct xe_gpu_scheduler *sched)cancel_work_sync (&sched->work_process_msg); } +void xe_sched_submission_resume_tdr (struct xe_gpu_scheduler *sched) +{ +drm_sched_resume_timeout (&sched->base, sched->base.timeout); +} +void xe_sched_add_msg (struct xe_gpu_scheduler *sched,struct xe_sched_msg *msg) {
drivers/gpu/drm/xe/xe_gpu_scheduler.h +2 -0
@@ -22,6 +22,8 @@ void xe_sched_fini(struct xe_gpu_scheduler *sched);void xe_sched_submission_start (struct xe_gpu_scheduler *sched);void xe_sched_submission_stop (struct xe_gpu_scheduler *sched); +void xe_sched_submission_resume_tdr (struct xe_gpu_scheduler *sched); +void xe_sched_add_msg (struct xe_gpu_scheduler *sched,struct xe_sched_msg *msg);
drivers/gpu/drm/xe/xe_guc_submit.c +1 -0
@@ -1500,6 +1500,7 @@ static void guc_exec_queue_start(struct xe_exec_queue *q) }xe_sched_submission_start (sched); +xe_sched_submission_resume_tdr (sched); }int xe_guc_submit_start (struct xe_guc *guc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/482 drm/xe: Prevent null pointer access in xe_migrate_copy
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhanjun Dong <[email protected]>
[ Upstream commit 7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 ]
xe_migrate_copy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xe_migrate_copy. To avoid this situation, update lacks source flag to true for this case, the flag will trigger xe_migrate_clear rather than xe_migrate_copy.
Issue trace:
<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14,
sizes: 4194304 & 4194304
<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15,
sizes: 4194304 & 4194304
<1> [317.128055] BUG: kernel NULL pointer dereference, address:
0000000000000010
<1> [317.128064] #PF: supervisor read access in kernel mode <1> [317.128066] #PF: error_code(0x0000) - not-present page <6> [317.128069] PGD 0 P4D 0
<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted:
G U N 6.11.0-rc7-xe #1
<4> [317.128078] Tainted: [U]=USER, [N]=TEST
<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client
Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024
<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe] <4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8
fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31 ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff
<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246 <4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX:
0000000000000000
<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI:
0000000000000000
<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09:
0000000000000001
<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12:
ffff88814e7b1f08
<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15:
0000000000000001
<4> [317.128174] FS: 0000000000000000(0000) GS:ffff88846f280000(0000)
knlGS:0000000000000000
<4> [317.128176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4:
0000000000770ef0
<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:
0000000000000400
<4> [317.128184] PKRU: 55555554
<4> [317.128185] Call Trace:
<4> [317.128187] <TASK> <4> [317.128189] ? show_regs+0x67/0x70 <4> [317.128194] ? __die_body+0x20/0x70 <4> [317.128196] ? __die+0x2b/0x40 <4> [317.128198] ? page_fault_oops+0x15f/0x4e0 <4> [317.128203] ? do_user_addr_fault+0x3fb/0x970 <4> [317.128205] ? lock_acquire+0xc7/0x2e0 <4> [317.128209] ? exc_page_fault+0x87/0x2b0 <4> [317.128212] ? asm_exc_page_fault+0x27/0x30 <4> [317.128216] ? xe_migrate_copy+0x66/0x13e0 [xe] <4> [317.128263] ? __lock_acquire+0xb9d/0x26f0 <4> [317.128265] ? __lock_acquire+0xb9d/0x26f0 <4> [317.128267] ? sg_free_append_table+0x20/0x80 <4> [317.128271] ? lock_acquire+0xc7/0x2e0 <4> [317.128273] ? mark_held_locks+0x4d/0x80 <4> [317.128275] ? trace_hardirqs_on+0x1e/0xd0 <4> [317.128278] ? _raw_spin_unlock_irqrestore+0x31/0x60 <4> [317.128281] ? __pm_runtime_resume+0x60/0xa0 <4> [317.128284] xe_bo_move+0x682/0xc50 [xe] <4> [317.128315] ? lock_is_held_type+0xaa/0x120 <4> [317.128318] ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm] <4> [317.128324] ttm_bo_validate+0xd1/0x1a0 [ttm] <4> [317.128328] shrink_test_run_device+0x721/0xc10 [xe] <4> [317.128360] ? find_held_lock+0x31/0x90 <4> [317.128363] ? lock_release+0xd1/0x2a0 <4> [317.128365] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit] <4> [317.128370] xe_bo_shrink_kunit+0x11/0x20 [xe] <4> [317.128397] kunit_try_run_case+0x6e/0x150 [kunit] <4> [317.128400] ? trace_hardirqs_on+0x1e/0xd0 <4> [317.128402] ? _raw_spin_unlock_irqrestore+0x31/0x60 <4> [317.128404] kunit_generic_run_threadfn_adapter+0x1e/0x40 [kunit] <4> [317.128407] kthread+0xf5/0x130 <4> [317.128410] ? __pfx_kthread+0x10/0x10 <4> [317.128412] ret_from_fork+0x39/0x60 <4> [317.128415] ? __pfx_kthread+0x10/0x10 <4> [317.128416] ret_from_fork_asm+0x1a/0x30 <4> [317.128420] </TASK>
--- drivers/gpu/drm/xe/xe_bo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_bo.c +2 -2
@@ -653,8 +653,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, tt_has_data = ttm && (ttm_tt_is_populated (ttm) || (ttm->page_flags &TTM_TT_FLAG_SWAPPED )); - move_lacks_source = handle_system_ccs ? (!bo->ccs_cleared) : - (!mem_type_is_vram (old_mem_type) && !tt_has_data); + move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) : + (!mem_type_is_vram (old_mem_type) && !tt_has_data)); needs_clear = (ttm && ttm->page_flags &TTM_TT_FLAG_ZERO_ALLOC ) || (!ttm && ttm_bo->type == ttm_bo_type_device);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/482 cifs: Fix buffer overflow when parsing NFS reparse points
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit e2a8910af01653c1c268984855629d71fb81f404 ]
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
--- fs/smb/client/reparse.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/smb/client/reparse.c +14 -1
@@ -320,9 +320,16 @@ static int parse_reparse_posix(struct reparse_posix_data *buf,unsigned int len;u64 type; + len =le16_to_cpu (buf->ReparseDataLength); +if (len <sizeof (buf->InodeType)) { +cifs_dbg (VFS ,"srv returned malformed nfs buffer\n" ); +return -EIO ; + } + + len -=sizeof (buf->InodeType); +switch ((type =le64_to_cpu (buf->InodeType))) {case NFS_SPECFILE_LNK : - len =le16_to_cpu (buf->ReparseDataLength); data->symlink_target =cifs_strndup_from_utf16 (buf->DataBuffer, len, true, cifs_sb->local_nls);
@@ -482,12 +489,18 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,u32 tag = data->reparse.tag;if (tag ==IO_REPARSE_TAG_NFS && buf) { +if (le16_to_cpu (buf->ReparseDataLength) <sizeof (buf->InodeType)) +return false;switch (le64_to_cpu (buf->InodeType)) {case NFS_SPECFILE_CHR : +if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 ) +return false; fattr->cf_mode |=S_IFCHR ; fattr->cf_rdev =reparse_nfs_mkdev (buf);break ;case NFS_SPECFILE_BLK : +if (le16_to_cpu (buf->ReparseDataLength) !=sizeof (buf->InodeType) +8 ) +return false; fattr->cf_mode |=S_IFBLK ; fattr->cf_rdev =reparse_nfs_mkdev (buf);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/482 cifs: Do not convert delimiter when parsing NFS-style symlinks
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit d3a49f60917323228f8fdeee313260ef14f94df7 ]
NFS-style symlinks have target location always stored in NFS/UNIX form where backslash means the real UNIX backslash and not the SMB path separator.
So do not mangle slash and backslash content of NFS-style symlink during readlink() syscall as it is already in the correct Linux form.
This fixes interoperability of NFS-style symlinks with backslashes created by Linux NFS3 client throw Windows NFS server and retrieved by Linux SMB client throw Windows SMB server, where both Windows servers exports the same directory.
--- fs/smb/client/reparse.c | 1 - 1 file changed, 1 deletion(-)
fs/smb/client/reparse.c +0 -1
@@ -335,7 +335,6 @@ static int parse_reparse_posix(struct reparse_posix_data *buf, cifs_sb->local_nls);if (!data->symlink_target)return -ENOMEM ; -convert_delimiter (data->symlink_target,'/' );cifs_dbg (FYI ,"%s: target path: %s\n" , __func__, data->symlink_target);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/482 tools/rtla: Fix installation from out-of-tree build
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit f771d5369f1dbfe32c93bcb4f5d7ca8322b15389 ]
rtla now supports out-of-tree builds, but installation fails as it still tries to install the rtla binary from the source tree. Use the existing macro $(RTLA) to refer to the binary.
--- tools/tracing/rtla/Makefile.rtla | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/Makefile.rtla +1 -1
@@ -38,7 +38,7 @@ BINDIR := /usr/bin .PHONY: install install: doc_install @$(MKDIR) -p $(DESTDIR)$(BINDIR) - $(call QUIET_INSTALL,rtla)$(INSTALL) rtla -m 755 $(DESTDIR)$(BINDIR) + $(call QUIET_INSTALL,rtla)$(INSTALL) $(RTLA) -m 755 $(DESTDIR)$(BINDIR) @$(STRIP) $(DESTDIR)$(BINDIR)/rtla @test ! -f $(DESTDIR)$(BINDIR)/osnoise || $(RM) $(DESTDIR)$(BINDIR)/osnoise @$(LN) rtla $(DESTDIR)$(BINDIR)/osnoise
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/482 ALSA: gus: Fix some error handling paths related to get_bpos() usage
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 9df39a872c462ea07a3767ebd0093c42b2ff78a2 ]
If get_bpos() fails, it is likely that the corresponding error code should be returned.
--- sound/isa/gus/gus_pcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/isa/gus/gus_pcm.c +2 -2
@@ -378,7 +378,7 @@ static int snd_gf1_pcm_playback_copy(struct snd_pcm_substream *substream, bpos =get_bpos (pcmp, voice, pos, len);if (bpos <0 ) -return pos; +return bpos;if (copy_from_iter (runtime->dma_area + bpos, len, src) != len)return -EFAULT ;return playback_copy_ack (substream, bpos, len);
@@ -395,7 +395,7 @@ static int snd_gf1_pcm_playback_silence(struct snd_pcm_substream *substream, bpos =get_bpos (pcmp, voice, pos, len);if (bpos <0 ) -return pos; +return bpos;snd_pcm_format_set_silence (runtime->format, runtime->dma_area + bpos,bytes_to_samples (runtime, count));return playback_copy_ack (substream, bpos, len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/482 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
We received a regression report for System76 Pangolin (pang14) due to the recent fix for Tuxedo Sirius devices to support the top speaker. The reason was the conflicting PCI SSID, as often seen.
As a workaround, now the codec SSID is checked and the quirk is applied conditionally only to Sirius devices.
--- sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
sound/pci/hda/patch_conexant.c +19 -5
@@ -816,6 +816,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; +/* pincfg quirk for Tuxedo Sirius; +* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, +* which has incompatible pin setup, so we check the codec SSID (luckily +* different one!) and conditionally apply the quirk here +*/ +static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* ignore for incorrectly picked-up pang14 */ +if (codec->core.subsystem_id ==0x278212b3 ) +return ; +/* set up the top speaker pin */ +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) +snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); +} +static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -976,11 +993,8 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x1d ,0x82170111 }, - { } - }, + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/482 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 3f66f26703093886db81f0610b97a6794511917c ]
In 'ath9k_get_et_stats()', promote TX stats counters to 'u64' to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +2 -2
@@ -1325,11 +1325,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,struct ath_softc *sc = hw->priv;int i =0 ; - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_pkts_all); - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_bytes_all);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/482 drm/panthor: Fix race when converting group handle to group object
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit cac075706f298948898b1f63e81709df42afa75d ]
XArray provides it's own internal lock which protects the internal array when entries are being simultaneously added and removed. However there is still a race between retrieving the pointer from the XArray and incrementing the reference count.
To avoid this race simply hold the internal XArray lock when incrementing the reference count, this ensures there cannot be a racing call to xa_erase().
--- drivers/gpu/drm/panthor/panthor_sched.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/panthor/panthor_sched.c +14 -2
@@ -3242,6 +3242,18 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)return 0 ; } +static struct panthor_group *group_from_handle (struct panthor_group_pool *pool, +u32 group_handle) +{ +struct panthor_group *group; + +xa_lock (&pool->xa); + group =group_get (xa_load (&pool->xa, group_handle)); +xa_unlock (&pool->xa); + +return group; +} +int panthor_group_get_state (struct panthor_file *pfile,struct drm_panthor_group_get_state *get_state) {
@@ -3253,7 +3265,7 @@ int panthor_group_get_state(struct panthor_file *pfile,if (get_state->pad)return -EINVAL ; - group =group_get (xa_load (&gpool->xa, get_state->group_handle)); + group =group_from_handle (gpool, get_state->group_handle);if (!group)return -EINVAL ;
@@ -3384,7 +3396,7 @@ panthor_job_create(struct panthor_file *pfile, job->call_info.latest_flush = qsubmit->latest_flush;INIT_LIST_HEAD (&job->node); - job->group =group_get (xa_load (&gpool->xa, group_handle)); + job->group =group_from_handle (gpool, group_handle);if (!job->group) { ret = -EINVAL ; goto err_put_job;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/482 wifi: rtw89: avoid to add interface to list twice when SER
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 7dd5d2514a8ea58f12096e888b0bd050d7eae20a ]
If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_wow_resume() return failure, it will cause the add interface flow to be executed again, resulting in a double add list and causing a kernel panic. Therefore, we have added a check to prevent double adding of the list.
list_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.
------------[ cut here ]------------ kernel BUG at lib/list_debug.c:37! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W O 6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7 Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021 Workqueue: events_freezable ieee80211_restart_work [mac80211] RIP: 0010:__list_add_valid_or_report+0x5e/0xb0 Code: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12 RSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900 RDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0 R10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060 R13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010 FS: 0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0 Call Trace: <TASK> ? __die_body+0x1f/0x70 ? die+0x3d/0x60 ? do_trap+0xa4/0x110 ? __list_add_valid_or_report+0x5e/0xb0 ? do_error_trap+0x6d/0x90 ? __list_add_valid_or_report+0x5e/0xb0 ? handle_invalid_op+0x30/0x40 ? __list_add_valid_or_report+0x5e/0xb0 ? exc_invalid_op+0x3c/0x50 ? asm_exc_invalid_op+0x16/0x20 ? __list_add_valid_or_report+0x5e/0xb0 rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f] drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ? finish_wait+0x3e/0x90 ? synchronize_rcu_expedited+0x174/0x260 ? sync_rcu_exp_done_unlocked+0x50/0x50 ? wake_bit_function+0x40/0x40 ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] process_scheduled_works+0x1e5/0x480 worker_thread+0xea/0x1e0 kthread+0xdb/0x110 ? move_linked_works+0x90/0x90 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork+0x3b/0x50 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev gsmi: Log Shutdown Reason 0x03 ---[ end trace 0000000000000000 ]---
--- drivers/net/wireless/realtek/rtw89/mac80211.c | 4 +++- drivers/net/wireless/realtek/rtw89/util.h | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/mac80211.c +3 -1
@@ -126,7 +126,9 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, rtwvif->rtwdev = rtwdev; rtwvif->roc.state =RTW89_ROC_IDLE ; rtwvif->offchan = false; -list_add_tail (&rtwvif->list, &rtwdev->rtwvifs_list); +if (!rtw89_rtwvif_in_list (rtwdev, rtwvif)) +list_add_tail (&rtwvif->list, &rtwdev->rtwvifs_list); +INIT_WORK (&rtwvif->update_beacon_work, rtw89_core_update_beacon_work);INIT_DELAYED_WORK (&rtwvif->roc.roc_work, rtw89_roc_work);rtw89_leave_ps_mode (rtwdev);
drivers/net/wireless/realtek/rtw89/util.h +18 -0
@@ -14,6 +14,24 @@#define rtw89_for_each_rtwvif (rtwdev, rtwvif) \ list_for_each_entry(rtwvif, &(rtwdev)->rtwvifs_list, list) +/* Before adding rtwvif to list, we need to check if it already exist, beacase +* in some case such as SER L2 happen during WoWLAN flow, calling reconfig +* twice cause the list to be added twice. +*/ +static inline bool rtw89_rtwvif_in_list (struct rtw89_dev *rtwdev, +struct rtw89_vif *new) +{ +struct rtw89_vif *rtwvif; + +lockdep_assert_held (&rtwdev->mutex); + +rtw89_for_each_rtwvif (rtwdev, rtwvif) +if (rtwvif == new) +return true; + +return false; +} +/* The result of negative dividend and positive divisor is undefined, but it * should be one case of round-down or round-up. So, make it round-down if the * result is round-up.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/482 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ]
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -4
@@ -716,8 +716,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 );usb_anchor_urb (urb, &hif_dev->rx_submitted); ret =usb_submit_urb (urb,GFP_ATOMIC );
@@ -754,8 +753,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)case -ESHUTDOWN : goto free_skb;default : -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 ); goto resubmit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/482 crypto: x86/sha256 - Add parentheses around macros single arguments
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangrui Song <[email protected]>
[ Upstream commit 3363c460ef726ba693704dbcd73b7e7214ccc788 ]
The macros FOUR_ROUNDS_AND_SCHED and DO_4ROUNDS rely on an unexpected/undocumented behavior of the GNU assembler, which might change in the future
(https://sourceware.org/bugzilla/show_bug.cgi?id=32073).
M (1) (2) // 1 arg !? Future: 2 args
M 1 + 2 // 1 arg !? Future: 3 args
M 1 2 // 2 argsAdd parentheses around the single arguments to support future GNU assembler and LLVM integrated assembler (when the IsOperator hack from the following link is dropped).
--- arch/x86/crypto/sha256-avx2-asm.S | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/x86/crypto/sha256-avx2-asm.S +8 -8
@@ -592,22 +592,22 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) leaq K256+0*32(%rip), INP ## reuse INP as scratch reg vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 0*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 0*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 0*32) leaq K256+1*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 1*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 1*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 1*32) leaq K256+2*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 2*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 2*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 2*32) leaq K256+3*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 3*32+_XFER(%rsp, SRND) - FOUR_ROUNDS_AND_SCHED _XFER + 3*32 + FOUR_ROUNDS_AND_SCHED (_XFER + 3*32) add $4*32, SRND cmp $3*4*32, SRND
@@ -618,12 +618,12 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) leaq K256+0*32(%rip), INP vpaddd (INP, SRND), X0, XFER vmovdqa XFER, 0*32+_XFER(%rsp, SRND) - DO_4ROUNDS _XFER + 0*32 + DO_4ROUNDS (_XFER + 0*32) leaq K256+1*32(%rip), INP vpaddd (INP, SRND), X1, XFER vmovdqa XFER, 1*32+_XFER(%rsp, SRND) - DO_4ROUNDS _XFER + 1*32 + DO_4ROUNDS (_XFER + 1*32) add $2*32, SRND vmovdqa X2, X0
@@ -651,8 +651,8 @@ SYM_TYPED_FUNC_START(sha256_transform_rorx) xor SRND, SRND .align 16 .Lloop3: - DO_4ROUNDS _XFER + 0*32 + 16 - DO_4ROUNDS _XFER + 1*32 + 16 + DO_4ROUNDS (_XFER + 0*32 + 16) + DO_4ROUNDS (_XFER + 1*32 + 16) add $2*32, SRND cmp $4*4*32, SRND jb .Lloop3
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/482 crypto: octeontx - Fix authenc setkey
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 311eea7e37c4c0b44b557d0c100860a03b4eab65 ]
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm).
Finally accept all hash key lengths by running the digest over extra-long keys.
--- .../crypto/marvell/octeontx/otx_cptvf_algs.c | 261 +++++++----------- 1 file changed, 93 insertions(+), 168 deletions(-)
drivers/crypto/marvell/octeontx/otx_cptvf_algs.c +93 -168
@@ -17,7 +17,6 @@#include <crypto/sha2.h> #include <crypto/xts.h> #include <crypto/scatterwalk.h> -#include <linux/rtnetlink.h> #include <linux/sort.h> #include <linux/module.h> #include "otx_cptvf.h"
@@ -66,6 +65,8 @@ static struct cpt_device_table ae_devices = { .count = ATOMIC_INIT(0) }; +static struct otx_cpt_sdesc *alloc_sdesc (struct crypto_shash *alg); +static inline int get_se_device (struct pci_dev **pdev,int *cpu_num) {int count, ret =0 ;
@@ -509,44 +510,61 @@ static int cpt_aead_init(struct crypto_aead *tfm, u8 cipher_type, u8 mac_type) ctx->cipher_type = cipher_type; ctx->mac_type = mac_type; +switch (ctx->mac_type) { +case OTX_CPT_SHA1 : + ctx->hashalg =crypto_alloc_shash ("sha1" ,0 ,0 ); +break ; + +case OTX_CPT_SHA256 : + ctx->hashalg =crypto_alloc_shash ("sha256" ,0 ,0 ); +break ; + +case OTX_CPT_SHA384 : + ctx->hashalg =crypto_alloc_shash ("sha384" ,0 ,0 ); +break ; + +case OTX_CPT_SHA512 : + ctx->hashalg =crypto_alloc_shash ("sha512" ,0 ,0 ); +break ; + } + +if (IS_ERR (ctx->hashalg)) +return PTR_ERR (ctx->hashalg); + +crypto_aead_set_reqsize_dma (tfm,sizeof (struct otx_cpt_req_ctx )); + +if (!ctx->hashalg) +return 0 ; +/* * When selected cipher is NULL we use HMAC opcode instead of * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms * for calculating ipad and opad */ if (ctx->cipher_type !=OTX_CPT_CIPHER_NULL ) { -switch (ctx->mac_type) { -case OTX_CPT_SHA1 : - ctx->hashalg =crypto_alloc_shash ("sha1" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; - -case OTX_CPT_SHA256 : - ctx->hashalg =crypto_alloc_shash ("sha256" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; +int ss =crypto_shash_statesize (ctx->hashalg); -case OTX_CPT_SHA384 : - ctx->hashalg =crypto_alloc_shash ("sha384" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->ipad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->ipad) { +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } -case OTX_CPT_SHA512 : - ctx->hashalg =crypto_alloc_shash ("sha512" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->opad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->opad) { +kfree (ctx->ipad); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; } } -crypto_aead_set_reqsize_dma (tfm,sizeof (struct otx_cpt_req_ctx )); + ctx->sdesc =alloc_sdesc (ctx->hashalg); +if (!ctx->sdesc) { +kfree (ctx->opad); +kfree (ctx->ipad); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + }return 0 ; }
@@ -602,8 +620,7 @@ static void otx_cpt_aead_exit(struct crypto_aead *tfm)kfree (ctx->ipad);kfree (ctx->opad); -if (ctx->hashalg) -crypto_free_shash (ctx->hashalg); +crypto_free_shash (ctx->hashalg);kfree (ctx->sdesc); }
@@ -699,7 +716,7 @@ static inline void swap_data64(void *buf, u32 len) *dst =cpu_to_be64p (src); } -static int copy_pad (u8 mac_type,u8 *out_pad,u8 *in_pad) +static int swap_pad (u8 mac_type,u8 *pad) {struct sha512_state *sha512;struct sha256_state *sha256;
@@ -707,22 +724,19 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)switch (mac_type) {case OTX_CPT_SHA1 : - sha1 = (struct sha1_state *) in_pad; + sha1 = (struct sha1_state *)pad;swap_data32 (sha1->state,SHA1_DIGEST_SIZE ); -memcpy (out_pad, &sha1->state,SHA1_DIGEST_SIZE );break ;case OTX_CPT_SHA256 : - sha256 = (struct sha256_state *) in_pad; + sha256 = (struct sha256_state *)pad;swap_data32 (sha256->state,SHA256_DIGEST_SIZE ); -memcpy (out_pad, &sha256->state,SHA256_DIGEST_SIZE );break ;case OTX_CPT_SHA384 :case OTX_CPT_SHA512 : - sha512 = (struct sha512_state *) in_pad; + sha512 = (struct sha512_state *)pad;swap_data64 (sha512->state,SHA512_DIGEST_SIZE ); -memcpy (out_pad, &sha512->state,SHA512_DIGEST_SIZE );break ;default :
@@ -732,55 +746,53 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)return 0 ; } -static int aead_hmac_init (struct crypto_aead *cipher) +static int aead_hmac_init (struct crypto_aead *cipher, +struct crypto_authenc_keys *keys) {struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -int state_size =crypto_shash_statesize (ctx->hashalg);int ds =crypto_shash_digestsize (ctx->hashalg);int bs =crypto_shash_blocksize (ctx->hashalg); -int authkeylen = ctx->auth_key_len; +int authkeylen = keys->authkeylen;u8 *ipad =NULL , *opad =NULL ; -int ret =0 , icount =0 ; +int icount =0 ; +int ret; - ctx->sdesc =alloc_sdesc (ctx->hashalg); -if (!ctx->sdesc) -return -ENOMEM ; +if (authkeylen > bs) { + ret =crypto_shash_digest (&ctx->sdesc->shash, keys->authkey, + authkeylen, ctx->key); +if (ret) +return ret; + authkeylen = ds; + }else +memcpy (ctx->key, keys->authkey, authkeylen); - ctx->ipad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->ipad) { - ret = -ENOMEM ; - goto calc_fail; - } + ctx->enc_key_len = keys->enckeylen; + ctx->auth_key_len = authkeylen; - ctx->opad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->opad) { - ret = -ENOMEM ; - goto calc_fail; - } +if (ctx->cipher_type ==OTX_CPT_CIPHER_NULL ) +return keys->enckeylen ? -EINVAL :0 ; - ipad =kzalloc (state_size,GFP_KERNEL ); -if (!ipad) { - ret = -ENOMEM ; - goto calc_fail; +switch (keys->enckeylen) { +case AES_KEYSIZE_128 : + ctx->key_type =OTX_CPT_AES_128_BIT ; +break ; +case AES_KEYSIZE_192 : + ctx->key_type =OTX_CPT_AES_192_BIT ; +break ; +case AES_KEYSIZE_256 : + ctx->key_type =OTX_CPT_AES_256_BIT ; +break ; +default : +/* Invalid key length */ +return -EINVAL ; } - opad =kzalloc (state_size,GFP_KERNEL ); -if (!opad) { - ret = -ENOMEM ; - goto calc_fail; - } +memcpy (ctx->key + authkeylen, keys->enckey, keys->enckeylen); -if (authkeylen > bs) { - ret =crypto_shash_digest (&ctx->sdesc->shash, ctx->key, - authkeylen, ipad); -if (ret) - goto calc_fail; - - authkeylen = ds; - }else { -memcpy (ipad, ctx->key, authkeylen); - } + ipad = ctx->ipad; + opad = ctx->opad; +memcpy (ipad, ctx->key, authkeylen);memset (ipad + authkeylen,0 , bs - authkeylen);memcpy (opad, ipad, bs);
@@ -798,7 +810,7 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, ipad, bs);crypto_shash_export (&ctx->sdesc->shash, ipad); - ret =copy_pad (ctx->mac_type, ctx->ipad, ipad); + ret =swap_pad (ctx->mac_type, ipad);if (ret) goto calc_fail;
@@ -806,25 +818,9 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, opad, bs);crypto_shash_export (&ctx->sdesc->shash, opad); - ret =copy_pad (ctx->mac_type, ctx->opad, opad); -if (ret) - goto calc_fail; - -kfree (ipad); -kfree (opad); - -return 0 ; + ret =swap_pad (ctx->mac_type, opad); calc_fail: -kfree (ctx->ipad); - ctx->ipad =NULL ; -kfree (ctx->opad); - ctx->opad =NULL ; -kfree (ipad); -kfree (opad); -kfree (ctx->sdesc); - ctx->sdesc =NULL ; -return ret; }
@@ -832,57 +828,15 @@ static int otx_cpt_aead_cbc_aes_sha_setkey(struct crypto_aead *cipher, const unsigned char *key, unsigned int keylen) { -struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -int enckeylen =0 , authkeylen =0 ; -struct rtattr *rta = (void *)key; -int status = -EINVAL ; - -if (!RTA_OK (rta, keylen)) - goto badkey; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) - goto badkey; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) - goto badkey; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (keylen < enckeylen) - goto badkey; +struct crypto_authenc_keys authenc_keys; +int status; -if (keylen >OTX_CPT_MAX_KEY_SIZE ) - goto badkey; - - authkeylen = keylen - enckeylen; -memcpy (ctx->key, key, keylen); - -switch (enckeylen) { -case AES_KEYSIZE_128 : - ctx->key_type =OTX_CPT_AES_128_BIT ; -break ; -case AES_KEYSIZE_192 : - ctx->key_type =OTX_CPT_AES_192_BIT ; -break ; -case AES_KEYSIZE_256 : - ctx->key_type =OTX_CPT_AES_256_BIT ; -break ; -default : -/* Invalid key length */ - goto badkey; - } - - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = authkeylen; - - status =aead_hmac_init (cipher); + status =crypto_authenc_extractkeys (&authenc_keys, key, keylen);if (status) goto badkey; -return 0 ; + status =aead_hmac_init (cipher, &authenc_keys); + badkey:return status; }
@@ -891,36 +845,7 @@ static int otx_cpt_aead_ecb_null_sha_setkey(struct crypto_aead *cipher,const unsigned char *key, unsigned int keylen) { -struct otx_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -struct rtattr *rta = (void *)key; -int enckeylen =0 ; - -if (!RTA_OK (rta, keylen)) - goto badkey; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) - goto badkey; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) - goto badkey; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (enckeylen !=0 ) - goto badkey; - -if (keylen >OTX_CPT_MAX_KEY_SIZE ) - goto badkey; - -memcpy (ctx->key, key, keylen); - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = keylen; -return 0 ; -badkey: -return -EINVAL ; + return otx_cpt_aead_cbc_aes_sha_setkey(cipher, key, keylen); } static int otx_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/482 crypto: octeontx2 - Fix authenc setkey
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 7ccb750dcac8abbfc7743aab0db6a72c1c3703c7 ]
Use the generic crypto_authenc_extractkeys helper instead of custom parsing code that is slightly broken. Also fix a number of memory leaks by moving memory allocation from setkey to init_tfm (setkey can be called multiple times over the life of a tfm).
Finally accept all hash key lengths by running the digest over extra-long keys.
--- .../marvell/octeontx2/otx2_cptvf_algs.c | 254 +++++++----------- 1 file changed, 90 insertions(+), 164 deletions(-)
drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c +90 -164
@@ -11,7 +11,6 @@#include <crypto/xts.h> #include <crypto/gcm.h> #include <crypto/scatterwalk.h> -#include <linux/rtnetlink.h> #include <linux/sort.h> #include <linux/module.h> #include "otx2_cptvf.h"
@@ -55,6 +54,8 @@ static struct cpt_device_table se_devices = { .count = ATOMIC_INIT(0) }; +static struct otx2_cpt_sdesc *alloc_sdesc (struct crypto_shash *alg); +static inline int get_se_device (struct pci_dev **pdev,int *cpu_num) {int count;
@@ -598,40 +599,56 @@ static int cpt_aead_init(struct crypto_aead *atfm, u8 cipher_type, u8 mac_type) ctx->cipher_type = cipher_type; ctx->mac_type = mac_type; +switch (ctx->mac_type) { +case OTX2_CPT_SHA1 : + ctx->hashalg =crypto_alloc_shash ("sha1" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA256 : + ctx->hashalg =crypto_alloc_shash ("sha256" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA384 : + ctx->hashalg =crypto_alloc_shash ("sha384" ,0 ,0 ); +break ; + +case OTX2_CPT_SHA512 : + ctx->hashalg =crypto_alloc_shash ("sha512" ,0 ,0 ); +break ; + } + +if (IS_ERR (ctx->hashalg)) +return PTR_ERR (ctx->hashalg); + +if (ctx->hashalg) { + ctx->sdesc =alloc_sdesc (ctx->hashalg); +if (!ctx->sdesc) { +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } + } +/* * When selected cipher is NULL we use HMAC opcode instead of * FLEXICRYPTO opcode therefore we don't need to use HASH algorithms * for calculating ipad and opad */ -if (ctx->cipher_type !=OTX2_CPT_CIPHER_NULL ) { -switch (ctx->mac_type) { -case OTX2_CPT_SHA1 : - ctx->hashalg =crypto_alloc_shash ("sha1" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; - -case OTX2_CPT_SHA256 : - ctx->hashalg =crypto_alloc_shash ("sha256" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; +if (ctx->cipher_type !=OTX2_CPT_CIPHER_NULL && ctx->hashalg) { +int ss =crypto_shash_statesize (ctx->hashalg); -case OTX2_CPT_SHA384 : - ctx->hashalg =crypto_alloc_shash ("sha384" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->ipad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->ipad) { +kfree (ctx->sdesc); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; + } -case OTX2_CPT_SHA512 : - ctx->hashalg =crypto_alloc_shash ("sha512" ,0 , -CRYPTO_ALG_ASYNC ); -if (IS_ERR (ctx->hashalg)) -return PTR_ERR (ctx->hashalg); -break ; + ctx->opad =kzalloc (ss,GFP_KERNEL ); +if (!ctx->opad) { +kfree (ctx->ipad); +kfree (ctx->sdesc); +crypto_free_shash (ctx->hashalg); +return -ENOMEM ; } }switch (ctx->cipher_type) {
@@ -713,8 +730,7 @@ static void otx2_cpt_aead_exit(struct crypto_aead *tfm)kfree (ctx->ipad);kfree (ctx->opad); -if (ctx->hashalg) -crypto_free_shash (ctx->hashalg); +crypto_free_shash (ctx->hashalg);kfree (ctx->sdesc);if (ctx->fbk_cipher) {
@@ -788,7 +804,7 @@ static inline void swap_data64(void *buf, u32 len)cpu_to_be64s (src); } -static int copy_pad (u8 mac_type,u8 *out_pad,u8 *in_pad) +static int swap_pad (u8 mac_type,u8 *pad) {struct sha512_state *sha512;struct sha256_state *sha256;
@@ -796,22 +812,19 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)switch (mac_type) {case OTX2_CPT_SHA1 : - sha1 = (struct sha1_state *) in_pad; + sha1 = (struct sha1_state *)pad;swap_data32 (sha1->state,SHA1_DIGEST_SIZE ); -memcpy (out_pad, &sha1->state,SHA1_DIGEST_SIZE );break ;case OTX2_CPT_SHA256 : - sha256 = (struct sha256_state *) in_pad; + sha256 = (struct sha256_state *)pad;swap_data32 (sha256->state,SHA256_DIGEST_SIZE ); -memcpy (out_pad, &sha256->state,SHA256_DIGEST_SIZE );break ;case OTX2_CPT_SHA384 :case OTX2_CPT_SHA512 : - sha512 = (struct sha512_state *) in_pad; + sha512 = (struct sha512_state *)pad;swap_data64 (sha512->state,SHA512_DIGEST_SIZE ); -memcpy (out_pad, &sha512->state,SHA512_DIGEST_SIZE );break ;default :
@@ -821,55 +834,54 @@ static int copy_pad(u8 mac_type, u8 *out_pad, u8 *in_pad)return 0 ; } -static int aead_hmac_init (struct crypto_aead *cipher) +static int aead_hmac_init (struct crypto_aead *cipher, +struct crypto_authenc_keys *keys) {struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -int state_size =crypto_shash_statesize (ctx->hashalg);int ds =crypto_shash_digestsize (ctx->hashalg);int bs =crypto_shash_blocksize (ctx->hashalg); -int authkeylen = ctx->auth_key_len; +int authkeylen = keys->authkeylen;u8 *ipad =NULL , *opad =NULL ; -int ret =0 , icount =0 ; +int icount =0 ; +int ret; - ctx->sdesc =alloc_sdesc (ctx->hashalg); -if (!ctx->sdesc) -return -ENOMEM ; +if (authkeylen > bs) { + ret =crypto_shash_digest (&ctx->sdesc->shash, keys->authkey, + authkeylen, ctx->key); +if (ret) + goto calc_fail; - ctx->ipad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->ipad) { - ret = -ENOMEM ; - goto calc_fail; - } + authkeylen = ds; + }else +memcpy (ctx->key, keys->authkey, authkeylen); - ctx->opad =kzalloc (bs,GFP_KERNEL ); -if (!ctx->opad) { - ret = -ENOMEM ; - goto calc_fail; - } + ctx->enc_key_len = keys->enckeylen; + ctx->auth_key_len = authkeylen; - ipad =kzalloc (state_size,GFP_KERNEL ); -if (!ipad) { - ret = -ENOMEM ; - goto calc_fail; - } +if (ctx->cipher_type ==OTX2_CPT_CIPHER_NULL ) +return keys->enckeylen ? -EINVAL :0 ; - opad =kzalloc (state_size,GFP_KERNEL ); -if (!opad) { - ret = -ENOMEM ; - goto calc_fail; +switch (keys->enckeylen) { +case AES_KEYSIZE_128 : + ctx->key_type =OTX2_CPT_AES_128_BIT ; +break ; +case AES_KEYSIZE_192 : + ctx->key_type =OTX2_CPT_AES_192_BIT ; +break ; +case AES_KEYSIZE_256 : + ctx->key_type =OTX2_CPT_AES_256_BIT ; +break ; +default : +/* Invalid key length */ +return -EINVAL ; } -if (authkeylen > bs) { - ret =crypto_shash_digest (&ctx->sdesc->shash, ctx->key, - authkeylen, ipad); -if (ret) - goto calc_fail; +memcpy (ctx->key + authkeylen, keys->enckey, keys->enckeylen); - authkeylen = ds; - }else { -memcpy (ipad, ctx->key, authkeylen); - } + ipad = ctx->ipad; + opad = ctx->opad; +memcpy (ipad, ctx->key, authkeylen);memset (ipad + authkeylen,0 , bs - authkeylen);memcpy (opad, ipad, bs);
@@ -887,7 +899,7 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, ipad, bs);crypto_shash_export (&ctx->sdesc->shash, ipad); - ret =copy_pad (ctx->mac_type, ctx->ipad, ipad); + ret =swap_pad (ctx->mac_type, ipad);if (ret) goto calc_fail;
@@ -895,25 +907,9 @@ static int aead_hmac_init(struct crypto_aead *cipher)crypto_shash_init (&ctx->sdesc->shash);crypto_shash_update (&ctx->sdesc->shash, opad, bs);crypto_shash_export (&ctx->sdesc->shash, opad); - ret =copy_pad (ctx->mac_type, ctx->opad, opad); -if (ret) - goto calc_fail; - -kfree (ipad); -kfree (opad); - -return 0 ; + ret =swap_pad (ctx->mac_type, opad); calc_fail: -kfree (ctx->ipad); - ctx->ipad =NULL ; -kfree (ctx->opad); - ctx->opad =NULL ; -kfree (ipad); -kfree (opad); -kfree (ctx->sdesc); - ctx->sdesc =NULL ; -return ret; }
@@ -921,87 +917,17 @@ static int otx2_cpt_aead_cbc_aes_sha_setkey(struct crypto_aead *cipher, const unsigned char *key, unsigned int keylen) { -struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -int enckeylen =0 , authkeylen =0 ; -struct rtattr *rta = (void *)key; - -if (!RTA_OK (rta, keylen)) -return -EINVAL ; +struct crypto_authenc_keys authenc_keys; -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) -return -EINVAL ; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) -return -EINVAL ; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (keylen < enckeylen) -return -EINVAL ; - -if (keylen >OTX2_CPT_MAX_KEY_SIZE ) -return -EINVAL ; - - authkeylen = keylen - enckeylen; -memcpy (ctx->key, key, keylen); - -switch (enckeylen) { -case AES_KEYSIZE_128 : - ctx->key_type =OTX2_CPT_AES_128_BIT ; -break ; -case AES_KEYSIZE_192 : - ctx->key_type =OTX2_CPT_AES_192_BIT ; -break ; -case AES_KEYSIZE_256 : - ctx->key_type =OTX2_CPT_AES_256_BIT ; -break ; -default : -/* Invalid key length */ -return -EINVAL ; - } - - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = authkeylen; - -return aead_hmac_init (cipher); +return crypto_authenc_extractkeys (&authenc_keys, key, keylen) ?: +aead_hmac_init (cipher, &authenc_keys); }static int otx2_cpt_aead_ecb_null_sha_setkey (struct crypto_aead *cipher,const unsigned char *key,unsigned int keylen) { -struct otx2_cpt_aead_ctx *ctx =crypto_aead_ctx_dma (cipher); -struct crypto_authenc_key_param *param; -struct rtattr *rta = (void *)key; -int enckeylen =0 ; - -if (!RTA_OK (rta, keylen)) -return -EINVAL ; - -if (rta->rta_type !=CRYPTO_AUTHENC_KEYA_PARAM ) -return -EINVAL ; - -if (RTA_PAYLOAD (rta) <sizeof (*param)) -return -EINVAL ; - - param =RTA_DATA (rta); - enckeylen =be32_to_cpu (param->enckeylen); - key +=RTA_ALIGN (rta->rta_len); - keylen -=RTA_ALIGN (rta->rta_len); -if (enckeylen !=0 ) -return -EINVAL ; - -if (keylen >OTX2_CPT_MAX_KEY_SIZE ) -return -EINVAL ; - -memcpy (ctx->key, key, keylen); - ctx->enc_key_len = enckeylen; - ctx->auth_key_len = keylen; - -return 0 ; +return otx2_cpt_aead_cbc_aes_sha_setkey (cipher, key, keylen); } static int otx2_cpt_aead_gcm_aes_setkey(struct crypto_aead *cipher,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/482 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 62fdaf9e8056e9a9e6fe63aa9c816ec2122d60c6 ]
In ice_sched_add_root_node() and ice_sched_add_node() there are calls to devm_kcalloc() in order to allocate memory for array of pointers to 'ice_sched_node' structure. But incorrect types are used as sizeof() arguments in these calls (structures instead of pointers) which leads to over allocation of memory.
Adjust over allocation of memory by correcting types in devm_kcalloc() sizeof() arguments.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +2 -4
@@ -28,9 +28,8 @@ ice_sched_add_root_node(struct ice_port_info *pi,if (!root)return -ENOMEM ; -/* coverity[suspicious_sizeof] */ root->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[0 ], -sizeof (*root),GFP_KERNEL ); +sizeof (*root->children),GFP_KERNEL );if (!root->children) {devm_kfree (ice_hw_to_dev (hw), root);return -ENOMEM ;
@@ -186,10 +185,9 @@ ice_sched_add_node(struct ice_port_info *pi, u8 layer,if (!node)return -ENOMEM ;if (hw->max_children[layer]) { -/* coverity[suspicious_sizeof] */ node->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[layer], -sizeof (*node),GFP_KERNEL ); +sizeof (*node->children),GFP_KERNEL );if (!node->children) {devm_kfree (ice_hw_to_dev (hw), node);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/482 wifi: iwlwifi: mvm: Fix a race in scan abort flow
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 87c1c28a9aa149489e1667f5754fc24f4973d2d0 ]
When the upper layer requests to cancel an ongoing scan, a race is possible in which by the time the driver starts to handle the upper layers scan cancel flow, the FW already completed handling the scan request and the driver received the scan complete notification but still did not handle the notification. In such a case the FW will simply ignore the scan abort request coming from the driver, no notification would arrive from the FW and the entire abort flow would be considered a failure.
To better handle this, check the status code returned by the FW for the scan abort command. In case the status indicates that no scan was aborted, complete the scan abort flow with success, i.e., the scan was aborted, as the flow is expected to consume the scan complete notification.
--- .../net/wireless/intel/iwlwifi/fw/api/scan.h | 13 ++++++ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +++++++++++++++---- 2 files changed, 47 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h +13 -0
@@ -1132,6 +1132,19 @@ struct iwl_umac_scan_abort {__le32 flags; } __packed;/* SCAN_ABORT_CMD_UMAC_API_S_VER_1 */ +/** +* enum iwl_umac_scan_abort_status +* +* @IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS: scan was successfully aborted +* @IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS: scan abort is in progress +* @IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND: nothing to abort +*/ +enum iwl_umac_scan_abort_status { +IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS =0 , +IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS , +IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND , +}; +/** * struct iwl_umac_scan_complete * @uid: scan id, &enum iwl_umac_scan_uid_offsets
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +34 -8
83 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/482 wifi: iwlwifi: mvm: drop wrong STA selection in TX
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1c7e1068a7c9c39ed27636db93e71911e0045419 ]
This shouldn't happen at all, since in station mode all MMPDUs go through the TXQ for the STA, and not this function. There may or may not be a race in mac80211 through which this might happen for some frames while a station is being added, but in that case we can also just drop the frame and pretend the STA didn't exist yet.
Also, the code is simply wrong since it uses deflink, and it's not easy to fix it since the mvmvif->ap_sta pointer cannot be used without the mutex, and perhaps the right link might not even be known.
Just drop the frame at that point instead of trying to fix it up.
--- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +3 -13
@@ -834,20 +834,10 @@ void iwl_mvm_mac_tx(struct ieee80211_hw *hw,if (ieee80211_is_mgmt (hdr->frame_control)) sta =NULL ; -/* If there is no sta, and it's not offchannel - send through AP */ +/* this shouldn't even happen: just drop */ if (!sta && info->control.vif->type ==NL80211_IFTYPE_STATION && - !offchannel) { -struct iwl_mvm_vif *mvmvif = -iwl_mvm_vif_from_mac80211 (info->control.vif); -u8 ap_sta_id =READ_ONCE (mvmvif->deflink.ap_sta_id); - -if (ap_sta_id < mvm->fw->ucode_capa.num_stations) { -/* mac80211 holds rcu read lock */ - sta =rcu_dereference (mvm->fw_id_to_mac_id[ap_sta_id]); -if (IS_ERR_OR_NULL (sta)) - goto drop; - } - } + !offchannel) + goto drop;if (tmp_sta && !sta && link_id !=IEEE80211_LINK_UNSPECIFIED && !ieee80211_is_probe_resp (hdr->frame_control)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/482 wifi: cfg80211: Set correct chandef when starting CAC
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Issam Hamdi <[email protected]>
[ Upstream commit 20361712880396e44ce80aaeec2d93d182035651 ]
When starting CAC in a mode other than AP mode, it return a "WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]" caused by the chandef.chan being null at the end of CAC.
Solution: Ensure the channel definition is set for the different modes when starting CAC to avoid getting a NULL 'chan' at the end of CAC.
Call Trace: ? show_regs.part.0+0x14/0x16 ? __warn+0x67/0xc0 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? report_bug+0xa7/0x130 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x50 ? exc_invalid_op+0x18/0x60 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211] ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211] ? process_one_work+0x165/0x280 ? worker_thread+0x120/0x3f0 ? kthread+0xc2/0xf0 ? process_one_work+0x280/0x280 ? kthread_complete_and_exit+0x20/0x20 ? ret_from_fork+0x19/0x24
--- net/wireless/nl80211.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +14 -1
@@ -10024,7 +10024,20 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, err =rdev_start_radar_detection (rdev, dev, &chandef, cac_time_ms);if (!err) { - wdev->links[0 ].ap.chandef = chandef; +switch (wdev->iftype) { +case NL80211_IFTYPE_AP : +case NL80211_IFTYPE_P2P_GO : + wdev->links[0 ].ap.chandef = chandef; +break ; +case NL80211_IFTYPE_ADHOC : + wdev->u.ibss.chandef = chandef; +break ; +case NL80211_IFTYPE_MESH_POINT : + wdev->u.mesh.chandef = chandef; +break ; +default : +break ; + } wdev->cac_started = true; wdev->cac_start_time = jiffies; wdev->cac_time_ms = cac_time_ms;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/482 net/xen-netback: prevent UAF in xenvif_flush_hash()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ]
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to list_for_each_entry_safe.
--- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/xen-netback/hash.c +2 -3
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,static void xenvif_flush_hash (struct xenvif *vif) { -struct xenvif_hash_cache_entry *entry; +struct xenvif_hash_cache_entry *entry, *n;unsigned long flags;if (xenvif_hash_cache_size ==0 )
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)spin_lock_irqsave (&vif->hash.cache.lock, flags); -list_for_each_entry_rcu (entry, &vif->hash.cache.list, link, -lockdep_is_held (&vif->hash.cache.lock)) { +list_for_each_entry_safe (entry, n, &vif->hash.cache.list, link) {list_del_rcu (&entry->link); vif->hash.cache.count--;kfree_rcu (entry, rcu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/482 ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is uninitialized
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Simion <[email protected]>
[ Upstream commit 09cfc6a532d249a51d3af5022d37ebbe9c3d31f6 ]
Update the driver to prevent alsa-restore.service from failing when reading data from /var/lib/alsa/asound.state at boot. Ensure that the restoration of ALSA mixer configurations is skipped if substream->runtime is NULL.
--- sound/soc/atmel/mchp-pdmc.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/atmel/mchp-pdmc.c +3 -0
@@ -285,6 +285,9 @@ static int mchp_pdmc_chmap_ctl_put(struct snd_kcontrol *kcontrol,if (!substream)return -ENODEV ; +if (!substream->runtime) +return 0 ;/* just for avoiding error from alsactl restore */ + map =mchp_pdmc_chmap_get (substream, info);if (!map)return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/482 net: hisilicon: hip04: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 17555297dbd5bccc93a01516117547e26a61caf1 ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hip04_eth.c +1 -0
@@ -947,6 +947,7 @@ static int hip04_mac_probe(struct platform_device *pdev) priv->tx_coalesce_timer.function = tx_done; priv->map =syscon_node_to_regmap (arg.np); +of_node_put (arg.np);if (IS_ERR (priv->map)) {dev_warn (d,"no syscon hisilicon,hip04-ppe\n" ); ret =PTR_ERR (priv->map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/482 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11 ]
Driver is leaking OF node reference from of_parse_phandle_with_fixed_args() in hns_mac_get_info().
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +1 -0
@@ -933,6 +933,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb) mac_cb->cpld_ctrl =NULL ; }else { syscon =syscon_node_to_regmap (cpld_args.np); +of_node_put (cpld_args.np);if (IS_ERR_OR_NULL (syscon)) {dev_dbg (mac_cb->dev,"no cpld-syscon found!\n" ); mac_cb->cpld_ctrl =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/482 net: hisilicon: hns_mdio: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit e62beddc45f487b9969821fad3a0913d9bc18a2f ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -0
@@ -575,6 +575,7 @@ static int hns_mdio_probe(struct platform_device *pdev)MDIO_SC_RESET_ST ; } } +of_node_put (reg_args.np); }else {dev_warn (&pdev->dev,"find syscon ret = %#x\n" , ret); mdio_dev->subctrl_vbase =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/482 ACPI: PAD: fix crash in exit_round_robin()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Nishikawa <[email protected]>
[ Upstream commit 0a2ed70a549e61c5181bad5db418d223b68ae932 ]
The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory address.
----------
BUG: unable to handle kernel paging request at ffffffffe0740618
...
CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1
...
RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
? acpi_pad_add+0x120/0x120 [acpi_pad]
kthread+0x10b/0x130
? set_kthread_struct+0x50/0x50
ret_from_fork+0x1f/0x40
...CR2: ffffffffe0740618
crash> dis -lr ffffffffc0726923
...
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 1140xffffffffc0726918 <power_saving_thread+776>: mov %r12d,%r12d/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 3250xffffffffc072691b <power_saving_thread+779>: mov -0x3f8d7de0(,%r12,4),%eax/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 800xffffffffc0726923 <power_saving_thread+787>: lock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits>
crash> px tsk_in_cpu[14]
$66 = 0xffffffff
crash> px 0xffffffffc072692c+0x19cf4
$99 = 0xffffffffc0740620
crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
crash> px pad_busy_cpus_bits[0]
$42 = 0xfffc0
----------
To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu().
--- drivers/acpi/acpi_pad.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/acpi/acpi_pad.c +4 -2
@@ -132,8 +132,10 @@ static void exit_round_robin(unsigned int tsk_index) {struct cpumask *pad_busy_cpus =to_cpumask (pad_busy_cpus_bits); -cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); - tsk_in_cpu[tsk_index] =-1 ; +if (tsk_in_cpu[tsk_index] !=-1 ) { +cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); + tsk_in_cpu[tsk_index] =-1 ; + } }static unsigned int idle_pct =5 ;/* percentage */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/482 io_uring: fix memory leak when cache init fail
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guixin Liu <[email protected]>
[ Upstream commit 3a87e264290d71ec86a210ab3e8d23b715ad266d ]
Exit the percpu ref when cache init fails to free the data memory with in struct percpu_ref.
--- io_uring/io_uring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
io_uring/io_uring.c +4 -1
@@ -316,7 +316,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) sizeof(struct uring_cache)); ret |=io_futex_cache_init (ctx);if (ret) - goto err; + goto free_ref;init_completion (&ctx->ref_comp);xa_init_flags (&ctx->personalities,XA_FLAGS_ALLOC1 );mutex_init (&ctx->uring_lock);
@@ -344,6 +344,9 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)io_napi_init (ctx);return ctx; + +free_ref: +percpu_ref_exit (&ctx->refs); err:io_alloc_cache_free (&ctx->rsrc_node_cache, kfree);io_alloc_cache_free (&ctx->apoll_cache, kfree);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/482 ALSA: mixer_oss: Remove some incorrect kfree_const() usages
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 368e4663c557de4a33f321b44e7eeec0a21b2e4e ]
"assigned" and "assigned->name" are allocated in snd_mixer_oss_proc_write() using kmalloc() and kstrdup(), so there is no point in using kfree_const() to free these resources.
Switch to the more standard kfree() to free these resources.
This could avoid a memory leak.
--- sound/core/oss/mixer_oss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/mixer_oss.c +2 -2
@@ -901,8 +901,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)struct slot *p = chn->private_data;if (p) {if (p->allocated && p->assigned) { -kfree_const (p->assigned->name); -kfree_const (p->assigned); +kfree (p->assigned->name); +kfree (p->assigned); }kfree (p); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/482 ALSA: hda/realtek: Fix the push button function for the ALC257
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oder Chiou <[email protected]>
[ Upstream commit 05df9732a0894846c46d0062d4af535c5002799d ]
The headset push button cannot work properly in case of the ALC257. This patch reverted the previous commit to correct the side effect.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -583,6 +583,7 @@ static void alc_shutup_pins(struct hda_codec *codec)switch (codec->core.vendor_id) {case 0x10ec0236 :case 0x10ec0256 : +case 0x10ec0257 :case 0x19e58326 :case 0x10ec0283 :case 0x10ec0285 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/482 cifs: Remove intermediate object of failed create reparse call
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <[email protected]>
[ Upstream commit c9432ad5e32f066875b1bf95939c363bc46d6a45 ]
If CREATE was successful but SMB2_OP_SET_REPARSE failed then remove the intermediate object created by CREATE. Otherwise empty object stay on the server when reparse call failed.
This ensures that if the creating of special files is unsupported by the server then no empty file stay on the server as a result of unsupported operation.
--- fs/smb/client/smb2inode.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +22 -2
@@ -1205,9 +1205,12 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct cifsFileInfo *cfile;struct inode *new =NULL ; +int out_buftype[4 ] = {}; +struct kvec out_iov[4 ] = {};struct kvec in_iov[2 ];int cmds[2 ];int rc; +int i; oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, SYNCHRONIZE | DELETE |
@@ -1228,7 +1231,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, cmds[1 ] =SMB2_OP_POSIX_QUERY_INFO ;cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, - in_iov, cmds,2 , cfile,NULL ,NULL ,NULL ); + in_iov, cmds,2 , cfile, out_iov, out_buftype,NULL );if (!rc) { rc =smb311_posix_get_inode_info (&new, full_path, data, sb, xid);
@@ -1237,12 +1240,29 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data, cmds[1 ] =SMB2_OP_QUERY_INFO ;cifs_get_writable_path (tcon, full_path,FIND_WR_ANY , &cfile); rc =smb2_compound_op (xid, tcon, cifs_sb, full_path, &oparms, - in_iov, cmds,2 , cfile,NULL ,NULL ,NULL ); + in_iov, cmds,2 , cfile, out_iov, out_buftype,NULL );if (!rc) { rc =cifs_get_inode_info (&new, full_path, data, sb, xid,NULL ); } } + + +/* +* If CREATE was successful but SMB2_OP_SET_REPARSE failed then +* remove the intermediate object created by CREATE. Otherwise +* empty object stay on the server when reparse call failed. +*/ +if (rc && + out_iov[0 ].iov_base !=NULL && out_buftype[0 ] !=CIFS_NO_BUFFER && + ((struct smb2_hdr *)out_iov[0 ].iov_base)->Status ==STATUS_SUCCESS && + (out_iov[1 ].iov_base ==NULL || out_buftype[1 ] ==CIFS_NO_BUFFER || + ((struct smb2_hdr *)out_iov[1 ].iov_base)->Status !=STATUS_SUCCESS )) +smb2_unlink (xid, tcon, full_path, cifs_sb,NULL ); + +for (i =0 ; i <ARRAY_SIZE (out_buftype); i++) +free_rsp_buf (out_buftype[i], out_iov[i].iov_base); +return rc ?ERR_PTR (rc) : new; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/482 drm/panthor: Lock the VM resv before calling drm_gpuvm_bo_obtain_prealloc()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
[ Upstream commit fa998a9eac8809da4f219aad49836fcad2a9bf5c ]
drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our pre-allocated BO if the <BO,VM> association exists. Given we only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will be called immediately, and we have to hold the VM resv lock when calling this function.
--- drivers/gpu/drm/panthor/panthor_mmu.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/panthor/panthor_mmu.c +8 -0
@@ -1251,9 +1251,17 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx, goto err_cleanup; } +/* drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our +* pre-allocated BO if the <BO,VM> association exists. Given we +* only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will +* be called immediately, and we have to hold the VM resv lock when +* calling this function. +*/ +dma_resv_lock (panthor_vm_resv (vm),NULL );mutex_lock (&bo->gpuva_list_lock); op_ctx->map.vm_bo =drm_gpuvm_bo_obtain_prealloc (preallocated_vm_bo);mutex_unlock (&bo->gpuva_list_lock); +dma_resv_unlock (panthor_vm_resv (vm));/* If the a vm_bo for this <VM,BO> combination exists, it already * retains a pin ref, and we can release the one we took earlier.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/482 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
Some time ago, we introduced the obey_preferred_dacs flag for choosing the DAC/pin pairs specified by the driver instead of parsing the paths. This works as expected, per se, but there have been a few cases where we forgot to set this flag while preferred_dacs table is already set up. It ended up with incorrect wiring and made us wondering why it doesn't work.
Basically, when the preferred_dacs table is provided, it means that the driver really wants to wire up to follow that. That is, the presence of the preferred_dacs table itself is already a "do-it" flag.
In this patch, we simply replace the evaluation of obey_preferred_dacs flag with the presence of preferred_dacs table for fixing the misbehavior. Another patch to drop of the obsoleted flag will follow.
--- sound/pci/hda/hda_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -1383,7 +1383,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,struct nid_path *path;hda_nid_t pin = pins[i]; -if (!spec->obey_preferred_dacs) { +if (!spec->preferred_dacs) { path =snd_hda_get_path_from_idx (codec, path_idx[i]);if (path) { badness +=assign_out_path_ctls (codec, path);
@@ -1395,7 +1395,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,if (dacs[i]) {if (is_dac_already_used (codec, dacs[i])) badness += bad->shared_primary; - }else if (spec->obey_preferred_dacs) { + }else if (spec->preferred_dacs) { badness +=BAD_NO_PRIMARY_DAC ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/482 i2c: xiic: Try re-initialization on bus busy timeout
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hancock <[email protected]>
[ Upstream commit 1d4a1adbed2582444aaf97671858b7d12915bd05 ]
In the event that the I2C bus was powered down when the I2C controller driver loads, or some spurious pulses occur on the I2C bus, it's possible that the controller detects a spurious I2C "start" condition. In this situation it may continue to report the bus is busy indefinitely and block the controller from working.
The "single-master" DT flag can be specified to disable bus busy checks entirely, but this may not be safe to use in situations where other I2C masters may potentially exist.
In the event that the controller reports "bus busy" for too long when starting a transaction, we can try reinitializing the controller to see if the busy condition clears. This allows recovering from this scenario.
--- drivers/i2c/busses/i2c-xiic.c | 41 ++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 15 deletions(-)
drivers/i2c/busses/i2c-xiic.c +26 -15
@@ -844,23 +844,11 @@ static int xiic_bus_busy(struct xiic_i2c *i2c)return (sr &XIIC_SR_BUS_BUSY_MASK ) ? -EBUSY :0 ; } -static int xiic_busy (struct xiic_i2c *i2c) +static int xiic_wait_not_busy (struct xiic_i2c *i2c) {int tries =3 ;int err; -if (i2c->tx_msg || i2c->rx_msg) -return -EBUSY ; - -/* In single master mode bus can only be busy, when in use by this -* driver. If the register indicates bus being busy for some reason we -* should ignore it, since bus will never be released and i2c will be -* stuck forever. -*/ -if (i2c->singlemaster) { -return 0 ; - } -/* for instance if previous transfer was terminated due to TX error * it might be that the bus is on it's way to become available * give it at most 3 ms to wake
@@ -1104,13 +1092,36 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)mutex_lock (&i2c->lock); - ret =xiic_busy (i2c); -if (ret) { +if (i2c->tx_msg || i2c->rx_msg) {dev_err (i2c->adap.dev.parent,"cannot start a transfer while busy\n" ); + ret = -EBUSY ; goto out; } +/* In single master mode bus can only be busy, when in use by this +* driver. If the register indicates bus being busy for some reason we +* should ignore it, since bus will never be released and i2c will be +* stuck forever. +*/ +if (!i2c->singlemaster) { + ret =xiic_wait_not_busy (i2c); +if (ret) { +/* If the bus is stuck in a busy state, such as due to spurious low +* pulses on the bus causing a false start condition to be detected, +* then try to recover by re-initializing the controller and check +* again if the bus is still busy. +*/ +dev_warn (i2c->adap.dev.parent,"I2C bus busy timeout, reinitializing\n" ); + ret =xiic_reinit (i2c); +if (ret) + goto out; + ret =xiic_wait_not_busy (i2c); +if (ret) + goto out; + } + } + i2c->tx_msg = msgs; i2c->rx_msg =NULL ; i2c->nmsgs = num;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/482 ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit e6169a8ffee8a012badd8c703716e761ce851b15 ]
ACPICA commit 1280045754264841b119a5ede96cd005bc09b5a7
If acpi_ps_get_next_field() fails, the previously created field list needs to be properly disposed before returning the status code.
--- drivers/acpi/acpica/psargs.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/acpi/acpica/psargs.c +39 -0
@@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);static union acpi_parse_object *acpi_ps_get_next_field (struct acpi_parse_state *parser_state); +static void acpi_ps_free_field_list (union acpi_parse_object *start); +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_package_length
@@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_statereturn_PTR (field); } +/******************************************************************************* +* +* FUNCTION: acpi_ps_free_field_list +* +* PARAMETERS: start - First Op in field list +* +* RETURN: None. +* +* DESCRIPTION: Free all Op objects inside a field list. +* +******************************************************************************/ + +static void acpi_ps_free_field_list (union acpi_parse_object *start) +{ +union acpi_parse_object *cur = start; +union acpi_parse_object *next; +union acpi_parse_object *arg; + +while (cur) { + next = cur->common.next; + +/* AML_INT_CONNECTION_OP can have a single argument */ + + arg =acpi_ps_get_arg (cur,0 ); +if (arg) { +acpi_ps_free_op (arg); + } + +acpi_ps_free_op (cur); + cur = next; + } +} +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_arg
@@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,while (parser_state->aml < parser_state->pkg_end) { field =acpi_ps_get_next_field (parser_state);if (!field) { +if (arg) { +acpi_ps_free_field_list (arg); + } +return_ACPI_STATUS (AE_NO_MEMORY ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/482 ACPI: CPPC: Add support for setting EPP register in FFH
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit aaf21ac93909e08a12931173336bdb52ac8499f1 ]
Some Asus AMD systems are reported to not be able to change EPP values because the BIOS doesn't advertise support for the CPPC MSR and the PCC region is not configured.
However the ACPI 6.2 specification allows CPC registers to be declared in FFH:
``` Starting with ACPI Specification 6.2, all _CPC registers can be in PCC, System Memory, System IO, or Functional Fixed Hardware address spaces. OSPM support for this more flexible register space scheme is indicated by the “Flexible Address Space for CPPC Registers” _OSC bit. ```
If this _OSC has been set allow using FFH to configure EPP.
--- drivers/acpi/cppc_acpi.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +9 -1
@@ -103,6 +103,11 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); (cpc)->cpc_entry.reg.space_id == \ ACPI_ADR_SPACE_PLATFORM_COMM) +/* Check if a CPC register is in FFH */ +#define CPC_IN_FFH (cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ + (cpc)->cpc_entry.reg.space_id == \ + ACPI_ADR_SPACE_FIXED_HARDWARE) +/* Check if a CPC register is in SystemMemory */ #define CPC_IN_SYSTEM_MEMORY (cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ (cpc)->cpc_entry.reg.space_id == \
@@ -1519,9 +1524,12 @@ int cppc_set_epp_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls, bool enable)/* after writing CPC, transfer the ownership of PCC to platform */ ret =send_pcc_cmd (pcc_ss_id,CMD_WRITE );up_write (&pcc_ss_data->pcc_lock); + }else if (osc_cpc_flexible_adr_space_confirmed && +CPC_SUPPORTED (epp_set_reg) &&CPC_IN_FFH (epp_set_reg)) { + ret =cpc_write (cpu, epp_set_reg, perf_ctrls->energy_perf); }else { ret = -ENOTSUPP ; -pr_debug ("_CPC in PCC is not supported\n" ); +pr_debug ("_CPC in PCC and _CPC in FFH are not supported\n" ); }return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/482 blk_iocost: fix more out of bound shifts
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Ovsepian <[email protected]>
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits.
--- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/blk-iocost.c +5 -3
@@ -2076,7 +2076,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) {struct ioc_gq *iocg; -u64 dur, usage_pct, nr_cycles; +u64 dur, usage_pct, nr_cycles, nr_cycles_shift;/* if no debtor, reset the cycle */ if (!nr_debtors) {
@@ -2138,10 +2138,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift =min_t (u64, nr_cycles,BITS_PER_LONG -1 );if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?:1 ; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?:1 ; +if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?:1 ; + iocg->delay = iocg->delay >> nr_cycles_shift ?:1 ;iocg_kick_waitq (iocg, true, now);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/482 wifi: ath12k: fix array out-of-bound access in SoC stats
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit e106b7ad13c1d246adaa57df73edb8f8b8acb240 ]
Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() function access ath12k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp_rx.c +1 -1
@@ -2702,7 +2702,7 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id,if (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION ) {dev_kfree_skb_any (msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++;continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/482 wifi: ath11k: fix array out-of-bound access in SoC stats
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ]
Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -1
@@ -2697,7 +2697,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,if (unlikely (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION )) {dev_kfree_skb_any (msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++;continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/482 wifi: rtw88: select WANT_DEV_COREDUMP
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7e989b0c1e33210c07340bf5228aa83ea52515b5 ]
We have invoked device coredump when fw crash.
Should select WANT_DEV_COREDUMP by ourselves.
--- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw88/Kconfig +1 -0
@@ -12,6 +12,7 @@ if RTW88 config RTW88_CORE tristate + select WANT_DEV_COREDUMP config RTW88_PCI tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/482 ACPI: EC: Do not release locks during operation region accesses
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit dc171114926ec390ab90f46534545420ec03e458 ]
It is not particularly useful to release locks (the EC mutex and the ACPI global lock, if present) and re-acquire them immediately thereafter during EC address space accesses in acpi_ec_space_handler().
First, releasing them for a while before grabbing them again does not really help anyone because there may not be enough time for another thread to acquire them.
Second, if another thread successfully acquires them and carries out a new EC write or read in the middle if an operation region access in progress, it may confuse the EC firmware, especially after the burst mode has been enabled.
Finally, manipulating the locks after writing or reading every single byte of data is overhead that it is better to avoid.
Accordingly, modify the code to carry out EC address space accesses entirely without releasing the locks.
--- drivers/acpi/ec.c | 55 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 6 deletions(-)
drivers/acpi/ec.c +49 -6
@@ -783,6 +783,9 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,unsigned long tmp;int ret =0 ; +if (t->rdata) +memset (t->rdata,0 , t->rlen); +/* start transaction */ spin_lock_irqsave (&ec->lock, tmp);/* Enable GPE for command processing (IBF=0/OBF=1) */
@@ -819,8 +822,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))return -EINVAL ; -if (t->rdata) -memset (t->rdata,0 , t->rlen);mutex_lock (&ec->mutex);if (ec->global_lock) {
@@ -847,7 +848,7 @@ static int acpi_ec_burst_enable(struct acpi_ec *ec) .wdata = NULL, .rdata = &d, .wlen = 0, .rlen = 1}; -return acpi_ec_transaction (ec, &t); +return acpi_ec_transaction_unlocked (ec, &t); }static int acpi_ec_burst_disable (struct acpi_ec *ec)
@@ -857,7 +858,7 @@ static int acpi_ec_burst_disable(struct acpi_ec *ec) .wlen = 0, .rlen = 0};return (acpi_ec_read_status (ec) &ACPI_EC_FLAG_BURST ) ? -acpi_ec_transaction (ec, &t) :0 ; +acpi_ec_transaction_unlocked (ec, &t) :0 ; }static int acpi_ec_read (struct acpi_ec *ec,u8 address,u8 *data)
@@ -873,6 +874,19 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)return result; } +static int acpi_ec_read_unlocked (struct acpi_ec *ec,u8 address,u8 *data) +{ +int result; +u8 d; +struct transaction t = {.command =ACPI_EC_COMMAND_READ , + .wdata = &address, .rdata = &d, + .wlen =1 , .rlen =1 }; + + result =acpi_ec_transaction_unlocked (ec, &t); + *data = d; +return result; +} +static int acpi_ec_write (struct acpi_ec *ec,u8 address,u8 data) {u8 wdata[2 ] = { address, data };
@@ -883,6 +897,16 @@ static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)return acpi_ec_transaction (ec, &t); } +static int acpi_ec_write_unlocked (struct acpi_ec *ec,u8 address,u8 data) +{ +u8 wdata[2 ] = { address, data }; +struct transaction t = {.command =ACPI_EC_COMMAND_WRITE , + .wdata = wdata, .rdata =NULL , + .wlen =2 , .rlen =0 }; + +return acpi_ec_transaction_unlocked (ec, &t); +} +int ec_read (u8 addr,u8 *val) {int err;
@@ -1323,6 +1347,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,struct acpi_ec *ec = handler_context;int result =0 , i, bytes = bits /8 ;u8 *value = (u8 *)value64; +u32 glk;if ((address >0xFF ) || !value || !handler_context)return AE_BAD_PARAMETER ;
@@ -1330,13 +1355,25 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (function !=ACPI_READ && function !=ACPI_WRITE )return AE_BAD_PARAMETER ; +mutex_lock (&ec->mutex); + +if (ec->global_lock) { +acpi_status status; + + status =acpi_acquire_global_lock (ACPI_EC_UDELAY_GLK , &glk); +if (ACPI_FAILURE (status)) { + result = -ENODEV ; + goto unlock; + } + } +if (ec->busy_polling || bits >8 )acpi_ec_burst_enable (ec);for (i =0 ; i < bytes; ++i, ++address, ++value) { result = (function ==ACPI_READ ) ? -acpi_ec_read (ec, address, value) : -acpi_ec_write (ec, address, *value); +acpi_ec_read_unlocked (ec, address, value) : +acpi_ec_write_unlocked (ec, address, *value);if (result <0 )break ; }
@@ -1344,6 +1381,12 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (ec->busy_polling || bits >8 )acpi_ec_burst_disable (ec); +if (ec->global_lock) +acpi_release_global_lock (glk); + +unlock: +mutex_unlock (&ec->mutex); +switch (result) {case -EINVAL :return AE_BAD_PARAMETER ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/482 ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit a5242874488eba2b9062985bf13743c029821330 ]
ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0
ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause NULL pointer dereference later.
--- drivers/acpi/acpica/dbconvert.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/acpica/dbconvert.c +2 -0
@@ -174,6 +174,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object) elements =ACPI_ALLOCATE_ZEROED (DB_DEFAULT_PKG_ELEMENTS *sizeof (union acpi_object )); +if (!elements) +return (AE_NO_MEMORY ); this = string;for (i =0 ; i < (DB_DEFAULT_PKG_ELEMENTS -1 ); i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/482 tipc: guard against string buffer overrun
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ]
Smatch reports that copying media_name and if_name to name_parts may overwrite the destination.
.../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16) .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
This does seem to be the case so guard against this possibility by using strscpy() and failing if truncation occurs.
Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
Compile tested only.
--- net/tipc/bearer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/tipc/bearer.c +6 -2
@@ -163,8 +163,12 @@ static int bearer_name_validate(const char *name,/* return bearer name components, if necessary */ if (name_parts) { -strcpy (name_parts->media_name, media_name); -strcpy (name_parts->if_name, if_name); +if (strscpy (name_parts->media_name, media_name, +TIPC_MAX_MEDIA_NAME ) <0 ) +return 0 ; +if (strscpy (name_parts->if_name, if_name, +TIPC_MAX_IF_NAME ) <0 ) +return 0 ; }return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/482 net: mvpp2: Increase size of queue_name buffer
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 91d516d4de48532d967a77967834e00c8c53dfe6 ]
Increase size of queue_name buffer from 30 to 31 to accommodate the largest string written to it. This avoids truncation in the possibly unlikely case where the string is name is the maximum size.
Flagged by gcc-14:
.../mvpp2_main.c: In function 'mvpp2_probe':
.../mvpp2_main.c:7636:32: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ^
.../mvpp2_main.c:7635:9: note: 'snprintf' output between 10 and 31 bytes into a destination of size 30
7635 | snprintf(priv->queue_name, sizeof(priv->queue_name),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7637 | priv->port_count > 1 ? "+" : "");
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Introduced by commit 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics"). I am not flagging this as a bug as I am not aware that it is one.
Compile tested only.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2.h +1 -1
@@ -1088,7 +1088,7 @@ struct mvpp2 {unsigned int max_port_rxqs;/* Workqueue to gather hardware statistics */ -char queue_name[30 ]; +char queue_name[31 ];struct workqueue_struct *stats_queue;/* Debugfs root entry */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/482 bnxt_en: Extend maximum length of version string by 1 byte
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit ffff7ee843c351ce71d6e0d52f0f20bea35e18c9 ]
This corrects an out-by-one error in the maximum length of the package version string. The size argument of snprintf includes space for the trailing '\0' byte, so there is no need to allow extra space for it by reducing the value of the size argument by 1.
Found by inspection.
Compile tested only.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +1 -1
@@ -4146,7 +4146,7 @@ static void bnxt_get_pkgver(struct net_device *dev)if (!bnxt_get_pkginfo (dev, buf,sizeof (buf))) { len =strlen (bp->fw_ver_str); -snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len -1 , +snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len,"/pkg %s" , buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/482 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <[email protected]>
[ Upstream commit 7f7b850689ac06a62befe26e1fd1806799e7f152 ]
It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790 Modules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s mirror dm_region_hash dm_log dm_mod CPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:do_user_addr_fault+0x2a0/0x790 Code: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41 RSP: 0000:ffffc90000a575f0 EFLAGS: 00010046 RAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658 R13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000 FS: 00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x8d/0x190 ? do_user_addr_fault+0x2a0/0x790 ? report_bug+0x1c3/0x1d0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? do_user_addr_fault+0x2a0/0x790 ? exc_page_fault+0x31/0x200 exc_page_fault+0x68/0x200 <...snip...> BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: 0000000000001000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G W 6.10.0-rc2-lizhijian+ #492 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:dentry_name+0x1f4/0x440 <...snip...> ? dentry_name+0x2fa/0x440 vsnprintf+0x1f3/0x4f0 vprintk_store+0x23a/0x540 vprintk_emit+0x6d/0x330 _printk+0x58/0x80 dump_mapping+0x10b/0x1a0 ? __pfx_free_object_rcu+0x10/0x10 __dump_page+0x26b/0x3e0 ? vprintk_emit+0xe0/0x330 ? _printk+0x58/0x80 ? dump_page+0x17/0x50 dump_page+0x17/0x50 do_migrate_range+0x2f7/0x7f0 ? do_migrate_range+0x42/0x7f0 ? offline_pages+0x2f4/0x8c0 offline_pages+0x60a/0x8c0 memory_subsys_offline+0x9f/0x1c0 ? lockdep_hardirqs_on+0x77/0x100 ? _raw_spin_unlock_irqrestore+0x38/0x60 device_offline+0xe3/0x110 state_store+0x6e/0xc0 kernfs_fop_write_iter+0x143/0x200 vfs_write+0x39f/0x560 ksys_write+0x65/0xf0 do_syscall_64+0x62/0x130
Previously, some sanity check have been done in dump_mapping() before the print facility parsing '%pd' though, it's still possible to run into an invalid dentry.d_name.name.
Since dump_mapping() only needs to dump the filename only, retrieve it by itself in a safer way to prevent an unnecessary crash.
Note that either retrieving the filename with '%pd' or strncpy_from_kernel_nofault(), the filename could be unreliable.
--- fs/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/inode.c +7 -3
@@ -593,6 +593,7 @@ void dump_mapping(const struct address_space *mapping)struct hlist_node *dentry_first;struct dentry *dentry_ptr;struct dentry dentry; +char fname[64 ] = {};unsigned long ino;/*
@@ -629,11 +630,14 @@ void dump_mapping(const struct address_space *mapping)return ; } +if (strncpy_from_kernel_nofault (fname, dentry.d_name.name,63 ) <0 ) +strscpy (fname,"<invalid>" );/* -* if dentry is corrupted, the %pd handler may still crash, -* but it's unlikely that we reach here with a corrupt mapping +* Even if strncpy_from_kernel_nofault() succeeded, +* the fname could be unreliable */ -pr_warn ("aops:%ps ino:%lx dentry name:\"%pd\"\n" , a_ops, ino, &dentry); +pr_warn ("aops:%ps ino:%lx dentry name(?):\"%s\"\n" , + a_ops, ino, fname); }void clear_inode (struct inode *inode)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/482 ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e3af3d3c5b26c33a7950e34e137584f6056c4319 ]
dev->ip_ptr could be NULL if we set an invalid MTU.
Even then, if we issue ioctl(SIOCSIFADDR) for a new IPv4 address, devinet_ioctl() allocates struct in_ifaddr and fails later in inet_set_ifa() because in_dev is NULL.
Let's move the check earlier.
--- net/ipv4/devinet.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +2 -4
@@ -574,10 +574,6 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)ASSERT_RTNL (); -if (!in_dev) { -inet_free_ifa (ifa); -return -ENOBUFS ; - }ipv4_devconf_setall (in_dev);neigh_parms_data_state_setall (in_dev->arp_parms);if (ifa->ifa_dev != in_dev) {
@@ -1184,6 +1180,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)if (!ifa) { ret = -ENOBUFS ; +if (!in_dev) +break ; ifa =inet_alloc_ifa ();if (!ifa)break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/482 wifi: rtw89: correct base HT rate mask for firmware
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 45742881f9eee2a4daeb6008e648a460dd3742cd ]
Coverity reported that u8 rx_mask << 24 will become signed 32 bits, which casting to unsigned 64 bits will do sign extension. For example, putting 0x80000000 (signed 32 bits) to a u64 variable will become 0xFFFFFFFF_80000000.
The real case we meet is:
rx_mask[0...3] = ff ff 00 00
ra_mask = 0xffffffff_ff0ff000
After this fix:
rx_mask[0...3] = ff ff 00 00
ra_mask = 0x00000000_ff0ff000
Fortunately driver does bitwise-AND with incorrect ra_mask and supported rates (1ss and 2ss rate only) afterward, so the final rate mask of original code is still correct.
Addresses-Coverity-ID: 1504762 ("Unintended sign extension")
--- drivers/net/wireless/realtek/rtw89/phy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/phy.c +2 -2
@@ -352,8 +352,8 @@ static void rtw89_phy_ra_sta_update(struct rtw89_dev *rtwdev, csi_mode =RTW89_RA_RPT_MODE_HT ; ra_mask |= ((u64 )sta->deflink.ht_cap.mcs.rx_mask[3 ] <<48 ) | ((u64 )sta->deflink.ht_cap.mcs.rx_mask[2 ] <<36 ) | - (sta->deflink.ht_cap.mcs.rx_mask[1 ] <<24 ) | - (sta->deflink.ht_cap.mcs.rx_mask[0 ] <<12 ); + ((u64 )sta->deflink.ht_cap.mcs.rx_mask[1 ] <<24 ) | + ((u64 )sta->deflink.ht_cap.mcs.rx_mask[0 ] <<12 ); high_rate_masks = rtw89_ra_mask_ht_rates;if (sta->deflink.ht_cap.cap &IEEE80211_HT_CAP_RX_STBC ) stbc_en =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/482 ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 8fed54758cd248cd311a2b5c1e180abef1866237 ]
The NETLINK_FIB_LOOKUP netlink family can be used to perform a FIB lookup according to user provided parameters and communicate the result back to user space.
However, unlike other users of the FIB lookup API, the upper DSCP bits and the ECN bits of the DS field are not masked, which can result in the wrong result being returned.
Solve this by masking the upper DSCP bits and the ECN bits using IPTOS_RT_MASK.
The structure that communicates the request and the response is not exported to user space, so it is unlikely that this netlink family is actually in use [1].
[1] https://lore.kernel.org/netdev/ZpqpB8vJU%2FQ6LSqa@debian/
--- net/ipv4/fib_frontend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fib_frontend.c +1 -1
@@ -1343,7 +1343,7 @@ static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn)struct flowi4 fl4 = { .flowi4_mark = frn->fl_mark, .daddr = frn->fl_addr, - .flowi4_tos = frn->fl_tos, + .flowi4_tos = frn->fl_tos &IPTOS_RT_MASK , .flowi4_scope = frn->fl_scope, };struct fib_table *tb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/482 nvme-keyring: restrict match length for version 1 identifiers
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 79559c75332458985ab8a21f11b08bf7c9b833b0 ]
TP8018 introduced a new TLS PSK identifier version (version 1), which appended a PSK hash value to the existing identifier (cf NVMe TCP specification v1.1, section 3.6.1.3 'TLS PSK and PSK Identity Derivation').
An original (version 0) identifier has the form:
NVMe0<type><hmac> <hostnqn> <subsysnqn>
and a version 1 identifier has the form:
NVMe1<type><hmac> <hostnqn> <subsysnqn> <hash>
This patch modifies the lookup algorthm to compare only the first part of the identifier (excluding the hash value) to handle both version 0 and version 1 identifiers.
And the spec declares 'version 0' identifiers obsolete, so the lookup algorithm is modified to prever v1 identifiers.
--- drivers/nvme/common/keyring.c | 36 +++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/nvme/common/keyring.c +26 -10
@@ -36,14 +36,12 @@ static bool nvme_tls_psk_match(const struct key *key,pr_debug ("%s: no key description\n" , __func__);return false; } - match_len =strlen (key->description); -pr_debug ("%s: id %s len %zd\n" , __func__, key->description, match_len); -if (!match_data->raw_data) {pr_debug ("%s: no match data\n" , __func__);return false; } match_id = match_data->raw_data; + match_len =strlen (match_id);pr_debug ("%s: match '%s' '%s' len %zd\n" , __func__, match_id, key->description, match_len);return !memcmp (key->description, match_id, match_len);
@@ -71,7 +69,7 @@ static struct key_type nvme_tls_psk_key_type = {static struct key *nvme_tls_psk_lookup (struct key *keyring,const char *hostnqn,const char *subnqn, -int hmac,bool generated) +u8 hmac,u8 psk_ver,bool generated) {char *identity;size_t identity_len = (NVMF_NQN_SIZE ) *2 +11 ;
@@ -82,8 +80,8 @@ static struct key *nvme_tls_psk_lookup(struct key *keyring,if (!identity)return ERR_PTR (-ENOMEM ); -snprintf (identity, identity_len,"NVMe0%c%02d %s %s" , - generated ?'G' :'R' , hmac, hostnqn, subnqn); +snprintf (identity, identity_len,"NVMe%u%c%02u %s %s" , + psk_ver, generated ?'G' :'R' , hmac, hostnqn, subnqn);if (!keyring) keyring = nvme_keyring;
@@ -107,21 +105,38 @@ static struct key *nvme_tls_psk_lookup(struct key *keyring,/* * NVMe PSK priority list * -* 'Retained' PSKs (ie 'generated == false') -* should be preferred to 'generated' PSKs, -* and SHA-384 should be preferred to SHA-256. +* 'Retained' PSKs (ie 'generated == false') should be preferred to 'generated' +* PSKs, PSKs with hash (psk_ver 1) should be preferred to PSKs without hash +* (psk_ver 0), and SHA-384 should be preferred to SHA-256. */ static struct nvme_tls_psk_priority_list {bool generated; +u8 psk_ver;enum nvme_tcp_tls_cipher cipher; } nvme_tls_psk_prio[] = { { .generated = false, + .psk_ver =1 , + .cipher =NVME_TCP_TLS_CIPHER_SHA384 , }, + { .generated = false, + .psk_ver =1 , + .cipher =NVME_TCP_TLS_CIPHER_SHA256 , }, + { .generated = false, + .psk_ver =0 , .cipher =NVME_TCP_TLS_CIPHER_SHA384 , }, { .generated = false, + .psk_ver =0 , + .cipher =NVME_TCP_TLS_CIPHER_SHA256 , }, + { .generated = true, + .psk_ver =1 , + .cipher =NVME_TCP_TLS_CIPHER_SHA384 , }, + { .generated = true, + .psk_ver =1 , .cipher =NVME_TCP_TLS_CIPHER_SHA256 , }, { .generated = true, + .psk_ver =0 , .cipher =NVME_TCP_TLS_CIPHER_SHA384 , }, { .generated = true, + .psk_ver =0 , .cipher =NVME_TCP_TLS_CIPHER_SHA256 , }, };
@@ -137,10 +152,11 @@ key_serial_t nvme_tls_psk_default(struct key *keyring,for (prio =0 ; prio <ARRAY_SIZE (nvme_tls_psk_prio); prio++) {bool generated = nvme_tls_psk_prio[prio].generated; +u8 ver = nvme_tls_psk_prio[prio].psk_ver;enum nvme_tcp_tls_cipher cipher = nvme_tls_psk_prio[prio].cipher; tls_key =nvme_tls_psk_lookup (keyring, hostnqn, subnqn, - cipher, generated); + cipher, ver, generated);if (!IS_ERR (tls_key)) { tls_key_id = tls_key->serial;key_put (tls_key);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/482 nvme-tcp: sanitize TLS key handling
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 363895767fbfa05891b0b4d9e06ebde7a10c6a07 ]
There is a difference between TLS configured (ie the user has provisioned/requested a key) and TLS enabled (ie the connection is encrypted with TLS). This becomes important for secure concatenation, where the initial authentication is run on an unencrypted connection (ie with TLS configured, but not enabled), and then the queue is reset to run over TLS (ie TLS configured _and_ enabled).
So to differentiate between those two states store the generated key in opts->tls_key (as we're using the same TLS key for all queues), the key serial of the resulting TLS handshake in ctrl->tls_pskid (to signal that TLS on the admin queue is enabled), and a simple flag for the queues to indicated that TLS has been enabled.
--- drivers/nvme/host/core.c | 1 - drivers/nvme/host/nvme.h | 2 +- drivers/nvme/host/sysfs.c | 4 +-- drivers/nvme/host/tcp.c | 53 +++++++++++++++++++++++++++++---------- 4 files changed, 43 insertions(+), 17 deletions(-)
drivers/nvme/host/core.c +0 -1
@@ -4587,7 +4587,6 @@ static void nvme_free_ctrl(struct device *dev)if (!subsys || ctrl->instance != subsys->instance)ida_free (&nvme_instance_ida, ctrl->instance); -key_put (ctrl->tls_key);nvme_free_cels (ctrl);nvme_mpath_uninit (ctrl);cleanup_srcu_struct (&ctrl->srcu);
drivers/nvme/host/nvme.h +1 -1
@@ -375,7 +375,7 @@ struct nvme_ctrl {struct nvme_dhchap_key *ctrl_key;u16 transaction;#endif -struct key *tls_key; +key_serial_t tls_pskid;/* Power saving configuration */ u64 ps_max_latency_us;
drivers/nvme/host/sysfs.c +2 -2
@@ -671,9 +671,9 @@ static ssize_t tls_key_show(struct device *dev, {struct nvme_ctrl *ctrl =dev_get_drvdata (dev); -if (!ctrl->tls_key) +if (!ctrl->tls_pskid)return 0 ; -return sysfs_emit (buf,"%08x" ,key_serial (ctrl->tls_key)); +return sysfs_emit (buf,"%08x" , ctrl->tls_pskid); }static DEVICE_ATTR_RO (tls_key);#endif
drivers/nvme/host/tcp.c +40 -13
129 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/482 nvme-tcp: check for invalidated or revoked key
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <[email protected]>
[ Upstream commit 5bc46b49c828a6dfaab80b71ecb63fe76a1096d2 ]
key_lookup() will always return a key, even if that key is revoked or invalidated. So check for invalid keys before continuing.
--- drivers/nvme/common/keyring.c | 22 ++++++++++++++++++++++ drivers/nvme/host/Kconfig | 1 + drivers/nvme/host/fabrics.c | 2 +- drivers/nvme/host/tcp.c | 2 +- include/linux/nvme-keyring.h | 6 +++++- 5 files changed, 30 insertions(+), 3 deletions(-)
drivers/nvme/common/keyring.c +22 -0
@@ -20,6 +20,28 @@ key_serial_t nvme_keyring_id(void) }EXPORT_SYMBOL_GPL (nvme_keyring_id); +static bool nvme_tls_psk_revoked (struct key *psk) +{ +return test_bit (KEY_FLAG_REVOKED , &psk->flags) || +test_bit (KEY_FLAG_INVALIDATED , &psk->flags); +} + +struct key *nvme_tls_key_lookup (key_serial_t key_id) +{ +struct key *key =key_lookup (key_id); + +if (IS_ERR (key)) { +pr_err ("key id %08x not found\n" , key_id); +return key; + } +if (nvme_tls_psk_revoked (key)) { +pr_err ("key id %08x revoked\n" , key_id); +return ERR_PTR (-EKEYREVOKED ); + } +return key; +} +EXPORT_SYMBOL_GPL (nvme_tls_key_lookup); +static void nvme_tls_psk_describe (const struct key *key,struct seq_file *m) {seq_puts (m, key->description);
drivers/nvme/host/Kconfig +1 -0
@@ -110,6 +110,7 @@ config NVME_HOST_AUTH bool "NVMe over Fabrics In-Band Authentication in host side" depends on NVME_CORE select NVME_AUTH + select NVME_KEYRING if NVME_TCP_TLS help This provides support for NVMe over Fabrics In-Band Authentication in host side.
drivers/nvme/host/fabrics.c +1 -1
@@ -650,7 +650,7 @@ static struct key *nvmf_parse_key(int key_id)return ERR_PTR (-EINVAL ); } - key =key_lookup (key_id); + key =nvme_tls_key_lookup (key_id);if (IS_ERR (key))pr_err ("key id %08x not found\n" , key_id);else
drivers/nvme/host/tcp.c +1 -1
@@ -1596,7 +1596,7 @@ static void nvme_tcp_tls_done(void *data, int status, key_serial_t pskid) goto out_complete; } - tls_key =key_lookup (pskid); + tls_key =nvme_tls_key_lookup (pskid);if (IS_ERR (tls_key)) {dev_warn (ctrl->ctrl.device,"queue %d: Invalid key %x\n" , qid, pskid);
include/linux/nvme-keyring.h +5 -1
@@ -12,7 +12,7 @@ key_serial_t nvme_tls_psk_default(struct key *keyring, const char *hostnqn, const char *subnqn);key_serial_t nvme_keyring_id (void ); - +struct key *nvme_tls_key_lookup (key_serial_t key_id);#else static inline key_serial_t nvme_tls_psk_default(struct key *keyring,
@@ -24,5 +24,9 @@ static inline key_serial_t nvme_keyring_id(void) {return 0 ; } +static inline struct key *nvme_tls_key_lookup (key_serial_t key_id) +{ +return ERR_PTR (-ENOTSUPP ); +}#endif /* !CONFIG_NVME_KEYRING */ #endif /* _NVME_KEYRING_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/482 net: atlantic: Avoid warning about potential string truncation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 5874e0c9f25661c2faefe4809907166defae3d7f ]
W=1 builds with GCC 14.2.0 warn that:
.../aq_ethtool.c:278:59: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=]
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~.../aq_ethtool.c:278:56: note: directive argument in the range [-2147483641, 254]
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~~~~~~.../aq_ethtool.c:278:33: note: ‘snprintf’ output between 5 and 15 bytes into a destination of size 8
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~tc is always in the range 0 - cfg->tcs. And as cfg->tcs is a u8, the range is 0 - 255. Further, on inspecting the code, it seems that cfg->tcs will never be more than AQ_CFG_TCS_MAX (8), so the range is actually 0 - 8.
So, it seems that the condition that GCC flags will not occur. But, nonetheless, it would be nice if it didn't emit the warning.
It seems that this can be achieved by changing the format specifier from %d to %u, in which case I believe GCC recognises an upper bound on the range of tc of 0 - 255. After some experimentation I think this is due to the combination of the use of %u and the type of cfg->tcs (u8).
Empirically, updating the type of the tc variable to unsigned int has the same effect.
As both of these changes seem to make sense in relation to what the code is actually doing - iterating over unsigned values - do both.
Compile tested only.
--- drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c +2 -2
@@ -266,7 +266,7 @@ static void aq_ethtool_get_strings(struct net_device *ndev,const int rx_stat_cnt =ARRAY_SIZE (aq_ethtool_queue_rx_stat_names);const int tx_stat_cnt =ARRAY_SIZE (aq_ethtool_queue_tx_stat_names);char tc_string[8 ]; -int tc; +unsigned int tc;memset (tc_string,0 ,sizeof (tc_string)); memcpy(p, aq_ethtool_stat_names,
@@ -275,7 +275,7 @@ static void aq_ethtool_get_strings(struct net_device *ndev,for (tc =0 ; tc < cfg->tcs; tc++) {if (cfg->is_qos) -snprintf (tc_string,8 ,"TC%d " , tc); +snprintf (tc_string,8 ,"TC%u " , tc);for (i =0 ; i < cfg->vecs; i++) {for (si =0 ; si < rx_stat_cnt; si++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/482 crypto: simd - Do not call crypto_alloc_tfm during registration
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 3c44d31cb34ce4eb8311a2e73634d57702948230 ]
Algorithm registration is usually carried out during module init, where as little work as possible should be carried out. The SIMD code violated this rule by allocating a tfm, this then triggers a full test of the algorithm which may dead-lock in certain cases.
SIMD is only allocating the tfm to get at the alg object, which is in fact already available as it is what we are registering. Use that directly and remove the crypto_alloc_tfm call.
Also remove some obsolete and unused SIMD API.
--- arch/arm/crypto/aes-ce-glue.c | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- crypto/simd.c | 76 ++++++------------------------- include/crypto/internal/simd.h | 12 +---- 4 files changed, 19 insertions(+), 73 deletions(-)
arch/arm/crypto/aes-ce-glue.c +1 -1
@@ -711,7 +711,7 @@ static int __init aes_init(void) algname = aes_algs[i].base.cra_name +2 ; drvname = aes_algs[i].base.cra_driver_name +2 ; basename = aes_algs[i].base.cra_driver_name; - simd =simd_skcipher_create_compat (algname, drvname, basename); + simd =simd_skcipher_create_compat (aes_algs + i, algname, drvname, basename); err =PTR_ERR (simd);if (IS_ERR (simd)) goto unregister_simds;
arch/arm/crypto/aes-neonbs-glue.c +1 -1
@@ -539,7 +539,7 @@ static int __init aes_init(void) algname = aes_algs[i].base.cra_name +2 ; drvname = aes_algs[i].base.cra_driver_name +2 ; basename = aes_algs[i].base.cra_driver_name; - simd =simd_skcipher_create_compat (algname, drvname, basename); + simd =simd_skcipher_create_compat (aes_algs + i, algname, drvname, basename); err =PTR_ERR (simd);if (IS_ERR (simd)) goto unregister_simds;
crypto/simd.c +15 -61
149 lines not on this page · raw message
include/crypto/internal/simd.h +2 -10
@@ -14,11 +14,10 @@struct simd_skcipher_alg ;struct skcipher_alg ; -struct simd_skcipher_alg *simd_skcipher_create_compat (const char *algname, +struct simd_skcipher_alg *simd_skcipher_create_compat (struct skcipher_alg *ialg, +const char *algname,const char *drvname,const char *basename); -struct simd_skcipher_alg *simd_skcipher_create (const char *algname, -const char *basename);void simd_skcipher_free (struct simd_skcipher_alg *alg); int simd_register_skciphers_compat(struct skcipher_alg *algs, int count,
@@ -32,13 +31,6 @@ void simd_unregister_skciphers(struct skcipher_alg *algs, int count,struct simd_aead_alg ;struct aead_alg ; -struct simd_aead_alg *simd_aead_create_compat (const char *algname, -const char *drvname, -const char *basename); -struct simd_aead_alg *simd_aead_create (const char *algname, -const char *basename); -void simd_aead_free (struct simd_aead_alg *alg); -int simd_register_aeads_compat (struct aead_alg *algs,int count,struct simd_aead_alg **simd_algs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/482 netpoll: Ensure clean state on setup failures
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit ae5a0456e0b4cfd7e61619e55251ffdf1bc7adfb ]
Modify netpoll_setup() and __netpoll_setup() to ensure that the netpoll structure (np) is left in a clean state if setup fails for any reason. This prevents carrying over misconfigured fields in case of partial setup success.
Key changes:
- np->dev is now set only after successful setup, ensuring it's always NULL if netpoll is not configured or if netpoll_setup() fails.
- np->local_ip is zeroed if netpoll setup doesn't complete successfully.
- Added DEBUG_NET_WARN_ON_ONCE() checks to catch unexpected states.
- Reordered some operations in __netpoll_setup() for better logical flow.
These changes improve the reliability of netpoll configuration, since it assures that the structure is fully initialized or totally unset.
--- net/core/netpoll.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
net/core/netpoll.c +10 -5
@@ -626,12 +626,9 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)const struct net_device_ops *ops;int err; - np->dev = ndev; -strscpy (np->dev_name, ndev->name,IFNAMSIZ ); -if (ndev->priv_flags &IFF_DISABLE_NETPOLL ) {np_err (np,"%s doesn't support polling, aborting\n" , - np->dev_name); + ndev->name); err = -ENOTSUPP ; goto out; }
@@ -649,7 +646,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)refcount_set (&npinfo->refcnt,1 ); - ops = np->dev->netdev_ops; + ops = ndev->netdev_ops;if (ops->ndo_netpoll_setup) { err = ops->ndo_netpoll_setup (ndev, npinfo);if (err)
@@ -660,6 +657,8 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)refcount_inc (&npinfo->refcnt); } + np->dev = ndev; +strscpy (np->dev_name, ndev->name,IFNAMSIZ ); npinfo->netpoll = np;/* last thing to do is link it to the net device structure */
@@ -677,6 +676,7 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);int netpoll_setup (struct netpoll *np) {struct net_device *ndev =NULL ; +bool ip_overwritten = false;struct in_device *in_dev;int err;
@@ -741,6 +741,7 @@ int netpoll_setup(struct netpoll *np) } np->local_ip.ip = ifa->ifa_local; + ip_overwritten = true;np_info (np,"local IP %pI4\n" , &np->local_ip.ip); }else {#if IS_ENABLED (CONFIG_IPV6 )
@@ -757,6 +758,7 @@ int netpoll_setup(struct netpoll *np) !!(ipv6_addr_type(&np->remote_ip.in6) & IPV6_ADDR_LINKLOCAL)) continue; np->local_ip.in6 = ifp->addr; + ip_overwritten = true; err =0 ;break ; }
@@ -787,6 +789,9 @@ int netpoll_setup(struct netpoll *np)return 0 ; put: +DEBUG_NET_WARN_ON_ONCE (np->dev); +if (ip_overwritten) +memset (&np->local_ip,0 ,sizeof (np->local_ip));netdev_put (ndev, &np->dev_tracker); unlock:rtnl_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/482 tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 0d9e5df4a257afc3a471a82961ace9a22b88295a ]
We found that one close-wait socket was reset by the other side due to a new connection reusing the same port which is beyond our expectation, so we have to investigate the underlying reason.
The following experiment is conducted in the test environment. We limit the port range from 40000 to 40010 and delay the time to close() after receiving a fin from the active close side, which can help us easily reproduce like what happened in production.
Here are three connections captured by tcpdump:
127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965525191 127.0.0.1.9999 > 127.0.0.1.40002: Flags [S.], seq 2769915070 127.0.0.1.40002 > 127.0.0.1.9999: Flags [.], ack 1 127.0.0.1.40002 > 127.0.0.1.9999: Flags [F.], seq 1, ack 1 // a few seconds later, within 60 seconds 127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965590730 127.0.0.1.9999 > 127.0.0.1.40002: Flags [.], ack 2 127.0.0.1.40002 > 127.0.0.1.9999: Flags [R], seq 2965525193 // later, very quickly
127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965590730 127.0.0.1.9999 > 127.0.0.1.40002: Flags [S.], seq 3120990805 127.0.0.1.40002 > 127.0.0.1.9999: Flags [.], ack 1
As we can see, the first flow is reset because:
1) client starts a new connection, I mean, the second one
2) client tries to find a suitable port which is a timewait socket (its state is timewait, substate is fin_wait2)
3) client occupies that timewait port to send a SYN
4) server finds a corresponding close-wait socket in ehash table, then replies with a challenge ack
5) client sends an RST to terminate this old close-wait socket.
I don't think the port selection algo can choose a FIN_WAIT2 socket when we turn on tcp_tw_reuse because on the server side there remain unread data. In some cases, if one side haven't call close() yet, we should not consider it as expendable and treat it at will.
Even though, sometimes, the server isn't able to call close() as soon as possible like what we expect, it can not be terminated easily, especially due to a second unrelated connection happening.
After this patch, we can see the expected failure if we start a connection when all the ports are occupied in fin_wait2 state:
"Ncat: Cannot assign requested address."
--- net/ipv4/tcp_ipv4.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/tcp_ipv4.c +3 -0
@@ -118,6 +118,9 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)struct tcp_sock *tp =tcp_sk (sk);int ts_recent_stamp; +if (tw->tw_substate ==TCP_FIN_WAIT2 ) + reuse =0 ; +if (reuse ==2 ) {/* Still does not detect *everything* that goes through * lo, since we require a loopback src or dst address
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/482 e1000e: avoid failing the system during pm_suspend
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Lifshits <[email protected]>
[ Upstream commit 0a6ad4d9e1690c7faa3a53f762c877e477093657 ]
Occasionally when the system goes into pm_suspend, the suspend might fail due to a PHY access error on the network adapter. Previously, this would have caused the whole system to fail to go to a low power state. An example of this was reported in the following Bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=205015
[ 1663.694828] e1000e 0000:00:19.0 eth0: Failed to disable ULP [ 1664.731040] asix 2-3:1.0 eth1: link up, 100Mbps, full-duplex, lpa 0xC1E1 [ 1665.093513] e1000e 0000:00:19.0 eth0: Hardware Error [ 1665.596760] e1000e 0000:00:19.0: pci_pm_resume+0x0/0x80 returned 0 after 2975399 usecs
and then the system never recovers from it, and all the following suspend failed due to this
[22909.393854] PM: pci_pm_suspend(): e1000e_pm_suspend+0x0/0x760 [e1000e] returns -2 [22909.393858] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -2 [22909.393861] PM: Device 0000:00:1f.6 failed to suspend async: error -2
This can be avoided by changing the return values of __e1000_shutdown and e1000e_pm_suspend functions so that they always return 0 (success). This is consistent with what other drivers do.
If the e1000e driver encounters a hardware error during suspend, potential side effects include slightly higher power draw or non-working wake on LAN. This is preferred to a system-level suspend failure, and a warning message is written to the system log, so that the user can be aware that the LAN controller experienced a problem during suspend.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +11 -8
@@ -6671,8 +6671,10 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)if (adapter->flags2 &FLAG2_HAS_PHY_WAKEUP ) {/* enable wakeup by the PHY */ retval =e1000_init_phy_wakeup (adapter, wufc); -if (retval) -return retval; +if (retval) { +e_err ("Failed to enable wakeup\n" ); + goto skip_phy_configurations; + } }else {/* enable wakeup by the MAC */ ew32 (WUFC , wufc);
@@ -6693,8 +6695,10 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)* or broadcast. */ retval =e1000_enable_ulp_lpt_lp (hw, !runtime); -if (retval) -return retval; +if (retval) { +e_err ("Failed to enable ULP\n" ); + goto skip_phy_configurations; + } } }
@@ -6726,6 +6730,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) hw->phy.ops.release (hw); } +skip_phy_configurations:/* Release control of h/w to f/w. If f/w is AMT enabled, this * would have already happened in close and is redundant. */
@@ -6968,15 +6973,13 @@ static int e1000e_pm_suspend(struct device *dev)e1000e_pm_freeze (dev); rc =__e1000_shutdown (pdev, false); -if (rc) { -e1000e_pm_thaw (dev); - }else { +if (!rc) {/* Introduce S0ix implementation */ if (adapter->flags2 &FLAG2_ENABLE_S0IX_FLOWS )e1000e_s0ix_entry_flow (adapter); } -return rc; +return 0 ; }static int e1000e_pm_resume (struct device *dev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/482 wifi: iwlwifi: mvm: use correct key iteration
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 4f1591d292277eec51d027405a92f0d4ef5e299e ]
In the cases changed here, key iteration isn't done from an RCU critical section, but rather using the wiphy lock as protection. Therefore, just use ieee80211_iter_keys(). The link switch case can therefore also use sync commands.
--- drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c +6 -6
@@ -144,7 +144,7 @@ static void iwl_mvm_mld_update_sta_key(struct ieee80211_hw *hw,if (sta != data->sta || key->link_id >=0 )return ; - err =iwl_mvm_send_cmd_pdu (mvm, cmd_id,CMD_ASYNC ,sizeof (cmd), &cmd); + err =iwl_mvm_send_cmd_pdu (mvm, cmd_id,0 ,sizeof (cmd), &cmd);if (err) data->err = err;
@@ -162,8 +162,8 @@ int iwl_mvm_mld_update_sta_keys(struct iwl_mvm *mvm, .new_sta_mask = new_sta_mask, }; -ieee80211_iter_keys_rcu (mvm->hw, vif, iwl_mvm_mld_update_sta_key, - &data); +ieee80211_iter_keys (mvm->hw, vif, iwl_mvm_mld_update_sta_key, + &data);return data.err; }
@@ -402,7 +402,7 @@ void iwl_mvm_sec_key_remove_ap(struct iwl_mvm *mvm,if (!sec_key_ver)return ; -ieee80211_iter_keys_rcu (mvm->hw, vif, - iwl_mvm_sec_key_remove_ap_iter, - (void *)(uintptr_t )link_id); +ieee80211_iter_keys (mvm->hw, vif, + iwl_mvm_sec_key_remove_ap_iter, + (void *)(uintptr_t )link_id); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/482 wifi: iwlwifi: allow only CN mcc from WRDD
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anjaneyulu <[email protected]>
[ Upstream commit ff5aabe7c2a4a4b089a9ced0cb3d0e284963a7dd ]
Block other mcc expect CN from WRDD ACPI.
--- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++ drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 2 ++ drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/uefi.h | 2 -- 4 files changed, 8 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/acpi.c +5 -0
@@ -356,6 +356,11 @@ int iwl_acpi_get_mcc(struct iwl_fw_runtime *fwrt, char *mcc) } mcc_val = wifi_pkg->package.elements[1 ].integer.value; +if (mcc_val !=BIOS_MCC_CHINA ) { + ret = -EINVAL ; +IWL_DEBUG_RADIO (fwrt,"ACPI WRDD is supported only for CN\n" ); + goto out_free; + } mcc[0 ] = (mcc_val >>8 ) &0xff ; mcc[1 ] = mcc_val &0xff ;
drivers/net/wireless/intel/iwlwifi/fw/regulatory.h +2 -0
@@ -45,6 +45,8 @@#define IWL_WTAS_ENABLE_IEC_MSK 0x4#define IWL_WTAS_USA_UHB_MSK BIT(16) +#define BIOS_MCC_CHINA 0x434e +/* * The profile for revision 2 is a superset of revision 1, which is in * turn a superset of revision 0. So we can store all revisions
drivers/net/wireless/intel/iwlwifi/fw/uefi.c +1 -1
@@ -638,7 +638,7 @@ int iwl_uefi_get_mcc(struct iwl_fw_runtime *fwrt, char *mcc) goto out; } -if (data->mcc !=UEFI_MCC_CHINA ) { +if (data->mcc !=BIOS_MCC_CHINA ) { ret = -EINVAL ;IWL_DEBUG_RADIO (fwrt,"UEFI WRDD is supported only for CN\n" ); goto out;
drivers/net/wireless/intel/iwlwifi/fw/uefi.h +0 -2
@@ -149,8 +149,6 @@ struct uefi_cnv_var_splc {u32 default_pwr_limit; } __packed; -#define UEFI_MCC_CHINA 0x434e -/* struct uefi_cnv_var_wrdd - WRDD table as defined in UEFI * @revision: the revision of the table * @mcc: country identifier as defined in ISO/IEC 3166-1 Alpha 2 code
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/482 wifi: iwlwifi: mvm: avoid NULL pointer dereference
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 557a6cd847645e667f3b362560bd7e7c09aac284 ]
iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL.
It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer.
If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer.
Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn't either.
--- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +7 -5
@@ -1195,6 +1195,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,bool is_ampdu = false;int hdrlen; +if (WARN_ON_ONCE (!sta)) +return -1 ; + mvmsta =iwl_mvm_sta_from_mac80211 (sta); fc = hdr->frame_control; hdrlen =ieee80211_hdrlen (fc);
@@ -1202,9 +1205,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,if (IWL_MVM_NON_TRANSMITTING_AP &&ieee80211_is_probe_resp (fc))return -1 ; -if (WARN_ON_ONCE (!mvmsta)) -return -1 ; -if (WARN_ON_ONCE (mvmsta->deflink.sta_id ==IWL_MVM_INVALID_STA ))return -1 ;
@@ -1335,7 +1335,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,int iwl_mvm_tx_skb_sta (struct iwl_mvm *mvm,struct sk_buff *skb,struct ieee80211_sta *sta) { -struct iwl_mvm_sta *mvmsta =iwl_mvm_sta_from_mac80211 (sta); +struct iwl_mvm_sta *mvmsta;struct ieee80211_tx_info info;struct sk_buff_head mpdus_skbs;struct ieee80211_vif *vif;
@@ -1344,9 +1344,11 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,struct sk_buff *orig_skb = skb;const u8 *addr3; -if (WARN_ON_ONCE (!mvmsta)) +if (WARN_ON_ONCE (!sta))return -1 ; + mvmsta =iwl_mvm_sta_from_mac80211 (sta); +if (WARN_ON_ONCE (mvmsta->deflink.sta_id ==IWL_MVM_INVALID_STA ))return -1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/482 wifi: mac80211: fix RCU list iterations
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit ac35180032fbc5d80b29af00ba4881815ceefcb6 ]
There are a number of places where RCU list iteration is used, but that aren't (always) called with RCU held. Use just list_for_each_entry() in most, and annotate iface iteration with the required locks.
--- net/mac80211/chan.c | 4 +++- net/mac80211/mlme.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/util.c | 4 +++- 4 files changed, 8 insertions(+), 4 deletions(-)
net/mac80211/chan.c +3 -1
@@ -281,7 +281,9 @@ ieee80211_get_max_required_bw(struct ieee80211_link_data *link)enum nl80211_chan_width max_bw =NL80211_CHAN_WIDTH_20_NOHT ;struct sta_info *sta; -list_for_each_entry_rcu (sta, &sdata->local->sta_list, list) { +lockdep_assert_wiphy (sdata->local->hw.wiphy); + +list_for_each_entry (sta, &sdata->local->sta_list, list) {if (sdata != sta->sdata && !(sta->sdata->bss && sta->sdata->bss == sdata->bss))continue ;
net/mac80211/mlme.c +1 -1
@@ -1020,7 +1020,7 @@ static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,bool disable_mu_mimo = false;struct ieee80211_sub_if_data *other; -list_for_each_entry_rcu (other, &local->interfaces, list) { +list_for_each_entry (other, &local->interfaces, list) {if (other->vif.bss_conf.mu_mimo_owner) { disable_mu_mimo = true;break ;
net/mac80211/scan.c +1 -1
@@ -504,7 +504,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)* the scan was in progress; if there was none this will * just be a no-op for the particular interface. */ -list_for_each_entry_rcu (sdata, &local->interfaces, list) { +list_for_each_entry (sdata, &local->interfaces, list) {if (ieee80211_sdata_running (sdata))wiphy_work_queue (sdata->local->hw.wiphy, &sdata->work); }
net/mac80211/util.c +3 -1
@@ -751,7 +751,9 @@ static void __iterate_interfaces(struct ieee80211_local *local,struct ieee80211_sub_if_data *sdata;bool active_only = iter_flags &IEEE80211_IFACE_ITER_ACTIVE ; -list_for_each_entry_rcu (sdata, &local->interfaces, list) { +list_for_each_entry_rcu (sdata, &local->interfaces, list, +lockdep_is_held (&local->iflist_mtx) || +lockdep_is_held (&local->hw.wiphy->mtx)) {switch (sdata->vif.type) {case NL80211_IFTYPE_MONITOR :if (!(sdata->u.mntr.flags &MONITOR_FLAG_ACTIVE ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/482 ACPI: resource: Skip IRQ override on Asus Vivobook Go E1404GAB
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <[email protected]>
[ Upstream commit 49e9cc315604972cc14868cb67831e3e8c3f1470 ]
Like other Asus Vivobooks, the Asus Vivobook Go E1404GAB has a DSDT that describes IRQ 1 as ActiveLow, while the kernel overrides to Edge_High.
This override prevents the internal keyboard from working.
Fix the problem by adding this laptop to the table that prevents the kernel from overriding the IRQ.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -503,6 +503,13 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = { DMI_MATCH(DMI_BOARD_NAME, "B2502FBA"), }, }, + { +/* Asus Vivobook Go E1404GAB */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "E1404GAB"), + }, + }, {/* Asus Vivobook E1504GA */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/482 wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 256cbd26fbafb30ba3314339106e5c594e9bd5f9 ]
Avoids firmware race condition.
--- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +7 -3
@@ -690,13 +690,17 @@ int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev, {struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;struct mt7915_vif *mvif = msta->vif; +int ret; +mt76_worker_disable (&dev->mt76.tx_worker);if (enable && !params->amsdu) msta->wcid.amsdu = false; + ret =mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, +MCU_EXT_CMD (STA_REC_UPDATE ), + enable, true); +mt76_worker_enable (&dev->mt76.tx_worker); -return mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, -MCU_EXT_CMD (STA_REC_UPDATE ), - enable, true); +return ret; } int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/482 net: sched: consistently use rcu_replace_pointer() in taprio_change()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d5c4546062fd6f5dbce575c7ea52ad66d1968678 ]
According to Vinicius (and carefully looking through the whole
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
once again), txtime branch of 'taprio_change()' is not going to race against 'advance_sched()'. But using 'rcu_replace_pointer()' in the former may be a good idea as well.
--- net/sched/sch_taprio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sched/sch_taprio.c +3 -1
@@ -1952,7 +1952,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, goto unlock; } -rcu_assign_pointer (q->admin_sched, new_admin); +/* Not going to race against advance_sched(), but still */ + admin =rcu_replace_pointer (q->admin_sched, new_admin, +lockdep_rtnl_is_held ());if (admin)call_rcu (&admin->rcu, taprio_free_sched_cb); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/482 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit bdf9557f70e7512bb2f754abf90d9e9958745316 ]
Add the support ID (0x0489, 0xe122) to usb_device_id table for Realtek RTL8852C.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e122 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -539,6 +539,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, /* Realtek 8852BE Bluetooth devices */ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/482 Bluetooth: btrtl: Set msft ext address filter quirk for RTL8852B
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit 9a0570948c5def5c59e588dc0e009ed850a1f5a1 ]
For tracking multiple devices concurrently with a condition. The patch enables the HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER quirk on RTL8852B controller.
The quirk setting is based on commit 9e14606d8f38 ("Bluetooth: msft:
Extended monitor tracking by address filter")
With this setting, when a pattern monitor detects a device, this feature issues an address monitor for tracking that device. Let the original pattern monitor keep monitor new devices.
--- drivers/bluetooth/btrtl.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btrtl.c +1 -0
@@ -1296,6 +1296,7 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)btrealtek_set_flag (hdev,REALTEK_ALT6_CONTINUOUS_TX_CHIP );if (btrtl_dev->project_id ==CHIP_ID_8852A || + btrtl_dev->project_id ==CHIP_ID_8852B || btrtl_dev->project_id ==CHIP_ID_8852C )set_bit (HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER , &hdev->quirks);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/482 ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit eb7b0f12e13ba99e64e3a690c2166895ed63b437 ]
The Panasonic Toughbook CF-18 advertises both native and vendor backlight control interfaces. But only the vendor one actually works.
acpi_video_get_backlight_type() will pick the non working native backlight by default, add a quirk to select the working vendor backlight instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -254,6 +254,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "PCG-FRV35"), }, }, + { + .callback = video_detect_force_vendor, + /* Panasonic Toughbook CF-18 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Matsushita Electric Industrial"), + DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"), + }, + },/* * Toshiba models with Transflective display, these need to use
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/482 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]
ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361
If acpi_ps_get_next_namepath() fails, the previously allocated union acpi_parse_object needs to be freed before returning the status code.
The issue was first being reported on the Linux ACPI mailing list:
--- drivers/acpi/acpica/psargs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/acpica/psargs.c +8 -0
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_NOT_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + } }else {/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_POSSIBLE_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + }if (arg->common.aml_opcode ==AML_INT_METHODCALL_OP ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/482 proc: add config & param to block forcing mem writes
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ratiu <[email protected]>
[ Upstream commit 41e8149c8892ed1962bd15350b3c3e6e90cba7f4 ]
This adds a Kconfig option and boot param to allow removing the FOLL_FORCE flag from /proc/pid/mem write calls because it can be abused.
The traditional forcing behavior is kept as default because it can break GDB and some other use cases.
Previously we tried a more sophisticated approach allowing distributions to fine-tune /proc/pid/mem behavior, however that got NAK-ed by Linus [1], who prefers this simpler approach with semantics also easier to understand for users.
--- .../admin-guide/kernel-parameters.txt | 10 +++ fs/proc/base.c | 61 ++++++++++++++++++- security/Kconfig | 32 ++++++++++ 3 files changed, 102 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +10 -0
@@ -4791,6 +4791,16 @@ printk.time= Show timing data prefixed to each printk message line Format: <bool> (1/Y/y=enable, 0/N/n=disable) + proc_mem.force_override= [KNL] + Format: {always | ptrace | never} + Traditionally /proc/pid/mem allows memory permissions to be + overridden without restrictions. This option may be set to + restrict that. Can be one of: + - 'always': traditional behavior always allows mem overrides. + - 'ptrace': only allow mem overrides for active ptracers. + - 'never': never allow mem overrides. + If not specified, default is the CONFIG_PROC_MEM_* choice. + processor.max_cstate= [HW,ACPI] Limit processor to maximum C-state max_cstate=9 overrides any DMI blacklist limit.
fs/proc/base.c +60 -1
85 lines not on this page · raw message
security/Kconfig +32 -0
@@ -19,6 +19,38 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +choice + prompt "Allow /proc/pid/mem access override" + default PROC_MEM_ALWAYS_FORCE + help + Traditionally /proc/pid/mem allows users to override memory + permissions for users like ptrace, assuming they have ptrace + capability. + + This allows people to limit that - either never override, or + require actual active ptrace attachment. + + Defaults to the traditional behavior (for now) + +config PROC_MEM_ALWAYS_FORCE + bool "Traditional /proc/pid/mem behavior" + help + This allows /proc/pid/mem accesses to override memory mapping + permissions if you have ptrace access rights. + +config PROC_MEM_FORCE_PTRACE + bool "Require active ptrace() use for access override" + help + This allows /proc/pid/mem accesses to override memory mapping + permissions for active ptracers like gdb. + +config PROC_MEM_NO_FORCE + bool "Never" + help + Never override memory mapping permissions + +endchoice + config SECURITY bool "Enable different security models" depends on SYSFS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/482 x86/bugs: Fix handling when SRSO mitigation is disabled
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <[email protected]>
[ Upstream commit 1dbb6b1495d472806fef1f4c94f5b3e4c89a3c1d ]
When the SRSO mitigation is disabled, either via mitigations=off or spec_rstack_overflow=off, the warning about the lack of IBPB-enhancing microcode is printed anyway.
This is unnecessary since the user has turned off the mitigation.
[ bp: Massage, drop SBPB rationale as it doesn't matter because when
mitigations are disabled x86_pred_cmd is not being used anyway. ]
--- arch/x86/kernel/cpu/bugs.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/bugs.c +5 -9
@@ -2545,10 +2545,9 @@ static void __init srso_select_mitigation(void) {bool has_microcode =boot_cpu_has (X86_FEATURE_IBPB_BRTYPE ); -if (cpu_mitigations_off ()) -return ; - -if (!boot_cpu_has_bug (X86_BUG_SRSO )) { +if (!boot_cpu_has_bug (X86_BUG_SRSO ) || +cpu_mitigations_off () || + srso_cmd ==SRSO_CMD_OFF ) {if (boot_cpu_has (X86_FEATURE_SBPB )) x86_pred_cmd =PRED_CMD_SBPB ;return ;
@@ -2579,11 +2578,6 @@ static void __init srso_select_mitigation(void) }switch (srso_cmd) { -case SRSO_CMD_OFF : -if (boot_cpu_has (X86_FEATURE_SBPB )) - x86_pred_cmd =PRED_CMD_SBPB ; -return ; -case SRSO_CMD_MICROCODE :if (has_microcode) { srso_mitigation =SRSO_MITIGATION_MICROCODE ;
@@ -2637,6 +2631,8 @@ static void __init srso_select_mitigation(void)pr_err ("WARNING: kernel not compiled with MITIGATION_SRSO.\n" ); }break ; +default : +break ; } out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/482 net: napi: Prevent overflow of napi_defer_hard_irqs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Damato <[email protected]>
[ Upstream commit 08062af0a52107a243f7608fd972edb54ca5b7f8 ]
In commit 6f8b12d661d0 ("net: napi: add hard irqs deferral feature") napi_defer_irqs was added to net_device and napi_defer_irqs_count was added to napi_struct, both as type int.
This value never goes below zero, so there is not reason for it to be a signed int. Change the type for both from int to u32, and add an overflow check to sysfs to limit the value to S32_MAX.
The limit of S32_MAX was chosen because the practical limit before this patch was S32_MAX (anything larger was an overflow) and thus there are no behavioral changes introduced. If the extra bit is needed in the future, the limit can be raised.
Before this patch:
$ sudo bash -c 'echo 2147483649 > /sys/class/net/eth4/napi_defer_hard_irqs' $ cat /sys/class/net/eth4/napi_defer_hard_irqs -2147483647
After this patch:
$ sudo bash -c 'echo 2147483649 > /sys/class/net/eth4/napi_defer_hard_irqs' bash: line 0: echo: write error: Numerical result out of range
Similarly, /sys/class/net/XXXXX/tx_queue_len is defined as unsigned:
include/linux/netdevice.h: unsigned int tx_queue_len;
And has an overflow check:
dev_change_tx_queue_len(..., unsigned long new_len):
if (new_len != (unsigned int)new_len)
return -ERANGE;
--- Documentation/networking/net_cachelines/net_device.rst | 2 +- include/linux/netdevice.h | 4 ++-- net/core/net-sysfs.c | 6 +++++- 3 files changed, 8 insertions(+), 4 deletions(-)
Documentation/networking/net_cachelines/net_device.rst +1 -1
@@ -98,7 +98,7 @@ unsigned_int num_rx_queues unsigned_int real_num_rx_queues - read_mostly get_rps_cpu struct_bpf_prog* xdp_prog - read_mostly netif_elide_gro() unsigned_long gro_flush_timeout - read_mostly napi_complete_done -int napi_defer_hard_irqs - read_mostly napi_complete_done +u32 napi_defer_hard_irqs - read_mostly napi_complete_done unsigned_int gro_max_size - read_mostly skb_gro_receive unsigned_int gro_ipv4_max_size - read_mostly skb_gro_receive rx_handler_func_t* rx_handler read_mostly - __netif_receive_skb_core
include/linux/netdevice.h +2 -2
@@ -354,7 +354,7 @@ struct napi_struct {unsigned long state;int weight; -int defer_hard_irqs_count; +u32 defer_hard_irqs_count;unsigned long gro_bitmask;int (*poll)(struct napi_struct *,int );#ifdef CONFIG_NETPOLL
@@ -2089,7 +2089,7 @@ struct net_device {unsigned int real_num_rx_queues;struct netdev_rx_queue *_rx;unsigned long gro_flush_timeout; -int napi_defer_hard_irqs; +u32 napi_defer_hard_irqs;unsigned int gro_max_size;unsigned int gro_ipv4_max_size;rx_handler_func_t __rcu *rx_handler;
net/core/net-sysfs.c +5 -1
@@ -32,6 +32,7 @@#ifdef CONFIG_SYSFS static const char fmt_hex[] ="%#x\n" ;static const char fmt_dec[] ="%d\n" ; +static const char fmt_uint[] ="%u\n" ;static const char fmt_ulong[] ="%lu\n" ;static const char fmt_u64[] ="%llu\n" ;
@@ -425,6 +426,9 @@ NETDEVICE_SHOW_RW(gro_flush_timeout, fmt_ulong);static int change_napi_defer_hard_irqs (struct net_device *dev,unsigned long val) { +if (val >S32_MAX ) +return -ERANGE ; +WRITE_ONCE (dev->napi_defer_hard_irqs, val);return 0 ; }
@@ -438,7 +442,7 @@ static ssize_t napi_defer_hard_irqs_store(struct device *dev,return netdev_store (dev, attr, buf, len, change_napi_defer_hard_irqs); } -NETDEVICE_SHOW_RW (napi_defer_hard_irqs, fmt_dec); +NETDEVICE_SHOW_RW (napi_defer_hard_irqs, fmt_uint);static ssize_t ifalias_store (struct device *dev,struct device_attribute *attr,const char *buf,size_t len)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/482 crypto: hisilicon - fix missed error branch
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shen <[email protected]>
[ Upstream commit f386dc64e1a5d3dcb84579119ec350ab026fea88 ]
If an error occurs in the process after the SGL is mapped successfully, it need to unmap the SGL.
Otherwise, memory problems may occur.
--- drivers/crypto/hisilicon/sgl.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/crypto/hisilicon/sgl.c +10 -4
@@ -225,7 +225,7 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev,dma_addr_t curr_sgl_dma =0 ;struct acc_hw_sge *curr_hw_sge;struct scatterlist *sg; -int sg_n; +int sg_n, ret;if (!dev || !sgl || !pool || !hw_sgl_dma || index >= pool->count)return ERR_PTR (-EINVAL );
@@ -240,14 +240,15 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev,if (sg_n_mapped > pool->sge_nr) {dev_err (dev,"the number of entries in input scatterlist is bigger than SGL pool setting.\n" ); -return ERR_PTR (-EINVAL ); + ret = -EINVAL ; + goto err_unmap; } curr_hw_sgl =acc_get_sgl (pool, index, &curr_sgl_dma);if (IS_ERR (curr_hw_sgl)) {dev_err (dev,"Get SGL error!\n" ); -dma_unmap_sg (dev, sgl, sg_n,DMA_BIDIRECTIONAL ); -return ERR_PTR (-ENOMEM ); + ret = -ENOMEM ; + goto err_unmap; } curr_hw_sgl->entry_length_in_sgl =cpu_to_le16 (pool->sge_nr); curr_hw_sge = curr_hw_sgl->sge_entries;
@@ -262,6 +263,11 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev, *hw_sgl_dma = curr_sgl_dma;return curr_hw_sgl; + +err_unmap: +dma_unmap_sg (dev, sgl, sg_n,DMA_BIDIRECTIONAL ); + +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (hisi_acc_sg_buf_map_to_hw_sgl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/482 wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11 fragmentation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Lin <[email protected]>
[ Upstream commit f2cc859149240d910fdc6405717673e0b84bfda8 ]
Currently, CONNAC2 series do not support encryption for fragmented Tx frames. Therefore, add dummy function mt7915_set_frag_threshold() to prevent SW IEEE 802.11 fragmentation.
--- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 1 + drivers/net/wireless/mediatek/mt76/mt7915/main.c | 7 +++++++ 2 files changed, 8 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7915/init.c +1 -0
@@ -400,6 +400,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)ieee80211_hw_set (hw,SUPPORTS_RX_DECAP_OFFLOAD );ieee80211_hw_set (hw,SUPPORTS_MULTI_BSSID );ieee80211_hw_set (hw,WANT_MONITOR_VIF ); +ieee80211_hw_set (hw,SUPPORTS_TX_FRAG ); hw->max_tx_fragments =4 ;
drivers/net/wireless/mediatek/mt76/mt7915/main.c +7 -0
@@ -1577,6 +1577,12 @@ mt7915_twt_teardown_request(struct ieee80211_hw *hw,mutex_unlock (&dev->mt76.mutex); } +static int +mt7915_set_frag_threshold (struct ieee80211_hw *hw,u32 val) +{ +return 0 ; +} +static int mt7915_set_radar_background (struct ieee80211_hw *hw,struct cfg80211_chan_def *chandef)
@@ -1707,6 +1713,7 @@ const struct ieee80211_ops mt7915_ops = { .sta_set_decap_offload = mt7915_sta_set_decap_offload, .add_twt_setup = mt7915_mac_add_twt_setup, .twt_teardown_request = mt7915_twt_teardown_request, + .set_frag_threshold = mt7915_set_frag_threshold, CFG80211_TESTMODE_CMD(mt76_testmode_cmd) CFG80211_TESTMODE_DUMP(mt76_testmode_dump)#ifdef CONFIG_MAC80211_DEBUGFS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/482 wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 8f7152f10cb434f954aeff85ca1be9cd4d01912b ]
Prevent racing against other functions disabling the same worker
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +3 -1
@@ -1537,12 +1537,14 @@ void mt7915_mac_reset_work(struct work_struct *work)set_bit (MT76_RESET , &phy2->mt76->state);cancel_delayed_work_sync (&phy2->mt76->mac_work); } + +mutex_lock (&dev->mt76.mutex); +mt76_worker_disable (&dev->mt76.tx_worker);mt76_for_each_q_rx (&dev->mt76, i)napi_disable (&dev->mt76.napi[i]);napi_disable (&dev->mt76.tx_napi); -mutex_lock (&dev->mt76.mutex);if (mtk_wed_device_active (&dev->mt76.mmio.wed))mtk_wed_device_stop (&dev->mt76.mmio.wed);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/482 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 498365e52bebcbc36a93279fe7e9d6aec8479cee ]
Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.
With this, fix the following warning:
elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]
--- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
@@ -1587,7 +1587,7 @@ struct host_cmd_ds_802_11_scan_rsp {struct host_cmd_ds_802_11_scan_ext {u32 reserved; -u8 tlv_buffer[1 ]; +u8 tlv_buffer[]; } __packed;struct mwifiex_ie_types_bss_mode {
drivers/net/wireless/marvell/mwifiex/scan.c +1 -2
@@ -2530,8 +2530,7 @@ int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv, ext_scan_resp = &resp->params.ext_scan; tlv = (void *)ext_scan_resp->tlv_buffer; - buf_left =le16_to_cpu (resp->size) - (sizeof (*ext_scan_resp) +S_DS_GEN - -1 ); + buf_left =le16_to_cpu (resp->size) - (sizeof (*ext_scan_resp) +S_DS_GEN );while (buf_left >=sizeof (struct mwifiex_ie_types_header )) { type =le16_to_cpu (tlv->type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/482 netfs: Cancel dirty folios that have no storage destination
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 8f246b7c0a1be0882374f2ff831a61f0dbe77678 ]
Kafs wants to be able to cache the contents of directories (and symlinks), but whilst these are downloaded from the server with the FS.FetchData RPC op and similar, the same as for regular files, they can't be updated by FS.StoreData, but rather have special operations (FS.MakeDir, etc.).
Now, rather than redownloading a directory's content after each change made to that directory, kafs modifies the local blob. This blob can be saved out to the cache, and since it's using netfslib, kafs just marks the folios dirty and lets ->writepages() on the directory take care of it, as for an regular file.
This is fine as long as there's a cache as although the upload stream is disabled, there's a cache stream to drive the procedure. But if the cache goes away in the meantime, suddenly there's no way do any writes and the code gets confused, complains "R=%x: No submit" to dmesg and leaves the dirty folio hanging.
Fix this by just cancelling the store of the folio if neither stream is active. (If there's no cache at the time of dirtying, we should just not mark the folio dirty).
--- fs/netfs/write_issue.c | 6 +++++- include/trace/events/netfs.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
fs/netfs/write_issue.c +5 -1
@@ -408,13 +408,17 @@ static int netfs_write_folio(struct netfs_io_request *wreq,folio_unlock (folio);if (fgroup ==NETFS_FOLIO_COPY_TO_CACHE ) { -if (!fscache_resources_valid (&wreq->cache_resources)) { +if (!cache->avail) {trace_netfs_folio (folio, netfs_folio_trace_cancel_copy);netfs_issue_write (wreq, upload);netfs_folio_written_back (folio);return 0 ; }trace_netfs_folio (folio, netfs_folio_trace_store_copy); + }else if (!upload->avail && !cache->avail) { +trace_netfs_folio (folio, netfs_folio_trace_cancel_store); +netfs_folio_written_back (folio); +return 0 ; }else if (!upload->construct) {trace_netfs_folio (folio, netfs_folio_trace_store); }else {
include/trace/events/netfs.h +1 -0
@@ -140,6 +140,7 @@EM (netfs_streaming_cont_filled_page,"mod-streamw-f+" ) \ /* The rest are for writeback */ \ EM(netfs_folio_trace_cancel_copy, "cancel-copy") \ + EM(netfs_folio_trace_cancel_store, "cancel-store") \ EM(netfs_folio_trace_clear, "clear") \ EM(netfs_folio_trace_clear_cc, "clear-cc") \EM (netfs_folio_trace_clear_g,"clear-g" ) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/482 nfp: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit daaba19d357f0900b303a530ced96c78086267ea ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/netronome/nfp/nfp_net_common.c +2 -3
@@ -821,14 +821,13 @@ nfp_net_prepare_vector(struct nfp_net *nn, struct nfp_net_r_vector *r_vec,snprintf (r_vec->name,sizeof (r_vec->name),"%s-rxtx-%d" ,nfp_net_name (nn), idx); - err =request_irq (r_vec->irq_vector, r_vec->handler,0 , r_vec->name, - r_vec); + err =request_irq (r_vec->irq_vector, r_vec->handler,IRQF_NO_AUTOEN , + r_vec->name, r_vec);if (err) {nfp_net_napi_del (&nn->dp, r_vec);nn_err (nn,"Error requesting IRQ %d\n" , r_vec->irq_vector);return err; } -disable_irq (r_vec->irq_vector);irq_set_affinity_hint (r_vec->irq_vector, &r_vec->affinity_mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/482 ALSA: usb-audio: Add input value sanity checks for standard types
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 901e85677ec0bb9a69fb9eab1feafe0c4eb7d07e ]
For an invalid input value that is out of the given range, currently USB-audio driver corrects the value silently and accepts without errors. This is no wrong behavior, per se, but the recent kselftest rather wants to have an error in such a case, hence a different behavior is expected now.
This patch adds a sanity check at each control put for the standard mixer types and returns an error if an invalid value is given.
Note that this covers only the standard mixer types. The mixer quirks that have own control callbacks would need different coverage.
--- sound/usb/mixer.c | 35 +++++++++++++++++++++++++++-------- sound/usb/mixer.h | 1 + 2 files changed, 28 insertions(+), 8 deletions(-)
sound/usb/mixer.c +27 -8
@@ -1377,6 +1377,19 @@ static int get_min_max_with_quirks(struct usb_mixer_elem_info *cval,#define get_min_max (cval, def) get_min_max_with_quirks(cval, def, NULL) +/* get the max value advertised via control API */ +static int get_max_exposed (struct usb_mixer_elem_info *cval) +{ +if (!cval->max_exposed) { +if (cval->res) + cval->max_exposed = +DIV_ROUND_UP (cval->max - cval->min, cval->res); +else + cval->max_exposed = cval->max - cval->min; + } +return cval->max_exposed; +} +/* get a feature/mixer unit info */ static int mixer_ctl_feature_info (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_info *uinfo)
@@ -1389,11 +1402,8 @@ static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol,else uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; uinfo->count = cval->channels; -if (cval->val_type ==USB_MIXER_BOOLEAN || - cval->val_type ==USB_MIXER_INV_BOOLEAN ) { - uinfo->value.integer.min =0 ; - uinfo->value.integer.max =1 ; - }else { +if (cval->val_type !=USB_MIXER_BOOLEAN && + cval->val_type !=USB_MIXER_INV_BOOLEAN ) {if (!cval->initialized) {get_min_max_with_quirks (cval,0 , kcontrol);if (cval->initialized && cval->dBmin >= cval->dBmax) {
@@ -1405,10 +1415,10 @@ static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol, &kcontrol->id); } } - uinfo->value.integer.min =0 ; - uinfo->value.integer.max = -DIV_ROUND_UP (cval->max - cval->min, cval->res); } + + uinfo->value.integer.min =0 ; + uinfo->value.integer.max =get_max_exposed (cval);return 0 ; }
@@ -1449,6 +1459,7 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) {struct usb_mixer_elem_info *cval = kcontrol->private_data; +int max_val =get_max_exposed (cval);int c, cnt, val, oval, err;int changed =0 ;
@@ -1461,6 +1472,8 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[cnt]; +if (val <0 || val > max_val) +return -EINVAL ; val =get_abs_value (cval, val);if (oval != val) {snd_usb_set_cur_mix_value (cval, c +1 , cnt, val);
@@ -1474,6 +1487,8 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[0 ]; +if (val <0 || val > max_val) +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {snd_usb_set_cur_mix_value (cval,0 ,0 , val);
@@ -2337,6 +2352,8 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[0 ]; +if (val <0 || val >get_max_exposed (cval)) +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {set_cur_ctl_value (cval, cval->control <<8 , val);
@@ -2699,6 +2716,8 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.enumerated.item[0 ]; +if (val <0 || val >= cval->max)/* here cval->max = # elements */ +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {set_cur_ctl_value (cval, cval->control <<8 , val);
sound/usb/mixer.h +1 -0
@@ -88,6 +88,7 @@ struct usb_mixer_elem_info {int channels;int val_type;int min, max, res; +int max_exposed;/* control API exposes the value in 0..max_exposed */ int dBmin, dBmax;int cached;int cache_val[MAX_CHANNELS ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/482 x86/ioapic: Handle allocation failures gracefully
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 830802a0fea8fb39d3dc9fb7d6b5581e1343eb1f ]
Breno observed panics when using failslab under certain conditions during runtime:
can not alloc irq_pin_list (-1,0,20)
Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed panic+0x4e9/0x590 mp_irqdomain_alloc+0x9ab/0xa80 irq_domain_alloc_irqs_locked+0x25d/0x8d0 __irq_domain_alloc_irqs+0x80/0x110 mp_map_pin_to_irq+0x645/0x890 acpi_register_gsi_ioapic+0xe6/0x150 hpet_open+0x313/0x480
That's a pointless panic which is a leftover of the historic IO/APIC code which panic'ed during early boot when the interrupt allocation failed.
The only place which might justify panic is the PIT/HPET timer_check() code which tries to figure out whether the timer interrupt is delivered through the IO/APIC. But that code does not require to handle interrupt allocation failures. If the interrupt cannot be allocated then timer delivery fails and it either panics due to that or falls back to legacy mode.
Cure this by removing the panic wrapper around __add_pin_to_irq_node() and making mp_irqdomain_alloc() aware of the failure condition and handle it as any other failure in this function gracefully.
--- arch/x86/kernel/apic/io_apic.c | 46 ++++++++++++++++------------------ 1 file changed, 22 insertions(+), 24 deletions(-)
arch/x86/kernel/apic/io_apic.c +22 -24
@@ -352,27 +352,26 @@ static void ioapic_mask_entry(int apic, int pin)* shared ISA-space IRQs, so we have to support them. We are super * fast in the common case, and fast for shared ISA-space IRQs. */ -static int __add_pin_to_irq_node (struct mp_chip_data *data, -int node,int apic,int pin) +static bool add_pin_to_irq_node (struct mp_chip_data *data,int node,int apic,int pin) {struct irq_pin_list *entry; -/* don't allow duplicates */ -for_each_irq_pin (entry, data->irq_2_pin) +/* Don't allow duplicates */ +for_each_irq_pin (entry, data->irq_2_pin) {if (entry->apic == apic && entry->pin == pin) -return 0 ; +return true; + } entry =kzalloc_node (sizeof (struct irq_pin_list ),GFP_ATOMIC , node);if (!entry) { -pr_err ("can not alloc irq_pin_list (%d,%d,%d)\n" , - node, apic, pin); -return -ENOMEM ; +pr_err ("Cannot allocate irq_pin_list (%d,%d,%d)\n" , node, apic, pin); +return false; } + entry->apic = apic; entry->pin = pin;list_add_tail (&entry->list, &data->irq_2_pin); - -return 0 ; +return true; }static void __remove_pin_from_irq (struct mp_chip_data *data,int apic,int pin)
@@ -387,13 +386,6 @@ static void __remove_pin_from_irq(struct mp_chip_data *data, int apic, int pin) } } -static void add_pin_to_irq_node (struct mp_chip_data *data, -int node,int apic,int pin) -{ -if (__add_pin_to_irq_node (data, node, apic, pin)) -panic ("IO-APIC: failed to add irq-pin. Can not proceed\n" ); -} -/* * Reroute an IRQ to a different pin. */
@@ -1002,8 +994,7 @@ static int alloc_isa_irq_from_domain(struct irq_domain *domain,if (irq_data && irq_data->parent_data) {if (!mp_check_pin_attr (irq, info))return -EBUSY ; -if (__add_pin_to_irq_node (irq_data->chip_data, node, ioapic, - info->ioapic.pin)) +if (!add_pin_to_irq_node (irq_data->chip_data, node, ioapic, info->ioapic.pin))return -ENOMEM ; }else { info->flags |=X86_IRQ_ALLOC_LEGACY ;
@@ -3017,10 +3008,8 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,return -ENOMEM ; ret =irq_domain_alloc_irqs_parent (domain, virq, nr_irqs, info); -if (ret <0 ) { -kfree (data); -return ret; - } +if (ret <0 ) + goto free_data;INIT_LIST_HEAD (&data->irq_2_pin); irq_data->hwirq = info->ioapic.pin;
@@ -3029,7 +3018,10 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, irq_data->chip_data = data;mp_irqdomain_get_attr (mp_pin_to_gsi (ioapic, pin), data, info); -add_pin_to_irq_node (data,ioapic_alloc_attr_node (info), ioapic, pin); +if (!add_pin_to_irq_node (data,ioapic_alloc_attr_node (info), ioapic, pin)) { + ret = -ENOMEM ; + goto free_irqs; + }mp_preconfigure_entry (data);mp_register_handler (virq, data->is_level);
@@ -3044,6 +3036,12 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, ioapic,mpc_ioapic_id (ioapic), pin, virq, data->is_level, data->active_low);return 0 ; + +free_irqs: +irq_domain_free_irqs_parent (domain, virq, nr_irqs); +free_data: +kfree (data); +return ret; } void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/482 drivers/perf: arm_spe: Use perf_allow_kernel() for permissions
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
[ Upstream commit 5e9629d0ae977d6f6916d7e519724804e95f0b07 ]
Use perf_allow_kernel() for 'pa_enable' (physical addresses), 'pct_enable' (physical timestamps) and context IDs. This means that perf_event_paranoid is now taken into account and LSM hooks can be used, which is more consistent with other perf_event_open calls. For example PERF_SAMPLE_PHYS_ADDR uses perf_allow_kernel() rather than just perfmon_capable().
This also indirectly fixes the following error message which is misleading because perf_event_paranoid is not taken into account by perfmon_capable():
$ perf record -e arm_spe/pa_enable/
Error:
Access to performance monitoring and observability operations is limited. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting ...
--- drivers/perf/arm_spe_pmu.c | 9 ++++----- include/linux/perf_event.h | 8 +------- kernel/events/core.c | 9 +++++++++ 3 files changed, 14 insertions(+), 12 deletions(-)
drivers/perf/arm_spe_pmu.c +4 -5
@@ -41,7 +41,7 @@/* * Cache if the event is allowed to trace Context information. -* This allows us to perform the check, i.e, perfmon_capable(), +* This allows us to perform the check, i.e, perf_allow_kernel(), * in the context of the event owner, once, during the event_init(). */ #define SPE_PMU_HW_FLAGS_CX 0x00001
@@ -50,7 +50,7 @@ static_assert((PERF_EVENT_FLAG_ARCH & SPE_PMU_HW_FLAGS_CX) == SPE_PMU_HW_FLAGS_Cstatic void set_spe_event_has_cx (struct perf_event *event) { -if (IS_ENABLED (CONFIG_PID_IN_CONTEXTIDR ) &&perfmon_capable ()) +if (IS_ENABLED (CONFIG_PID_IN_CONTEXTIDR ) && !perf_allow_kernel (&event->attr)) event->hw.flags |=SPE_PMU_HW_FLAGS_CX ; }
@@ -745,9 +745,8 @@ static int arm_spe_pmu_event_init(struct perf_event *event)set_spe_event_has_cx (event); reg =arm_spe_event_to_pmscr (event); -if (!perfmon_capable () && - (reg & (PMSCR_EL1_PA |PMSCR_EL1_PCT ))) -return -EACCES ; +if (reg & (PMSCR_EL1_PA |PMSCR_EL1_PCT )) +return perf_allow_kernel (&event->attr);return 0 ; }
include/linux/perf_event.h +1 -7
@@ -1608,13 +1608,7 @@ static inline int perf_is_paranoid(void)return sysctl_perf_event_paranoid >-1 ; } -static inline int perf_allow_kernel (struct perf_event_attr *attr) -{ -if (sysctl_perf_event_paranoid >1 && !perfmon_capable ()) -return -EACCES ; - -return security_perf_event_open (attr,PERF_SECURITY_KERNEL ); -} +int perf_allow_kernel (struct perf_event_attr *attr);static inline int perf_allow_cpu (struct perf_event_attr *attr) {
kernel/events/core.c +9 -0
@@ -13362,6 +13362,15 @@ const struct perf_event_attr *perf_event_attrs(struct perf_event *event)return &event->attr; } +int perf_allow_kernel (struct perf_event_attr *attr) +{ +if (sysctl_perf_event_paranoid >1 && !perfmon_capable ()) +return -EACCES ; + +return security_perf_event_open (attr,PERF_SECURITY_KERNEL ); +} +EXPORT_SYMBOL_GPL (perf_allow_kernel); +/* * Inherit an event from parent task to child task. *
Signature · 1 line
2.43.0