5.15.195-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.15.195-rc1 review
This is the start of the stable review cycle for the 5.15.195 release. There are 276 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.195-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.195-rc1
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate C-flag + def limit
Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: in-kernel: usable client side with C-flag
Dan Carpenter <[email protected]>
mm/slab: make __free(kfree) accept error pointers
Mikhail Kobuk <[email protected]>
media: pci: ivtv: Add check for DMA map result
Jason Andryuk <[email protected]>
xen/events: Update virq_to_irq on migration
Thomas Fourier <[email protected]>
media: pci: ivtv: Add missing check after DMA map
Christophe JAILLET <[email protected]>
media: pci/ivtv: switch from 'pci_' to 'dma_' API
Catalin Marinas <[email protected]>
arm64: mte: Do not flag the zero page as PG_mte_tagged
Thomas Fourier <[email protected]>
media: cx18: Add missing check after DMA map
Christophe JAILLET <[email protected]>
media: switch from 'pci_' to 'dma_' API
Jan Kara <[email protected]>
writeback: Avoid excessively long inode switching times
Jan Kara <[email protected]>
writeback: Avoid softlockup when switching many inodes
Tetsuo Handa <[email protected]>
cramfs: Verify inode mode when loading from disk
Lichen Liu <[email protected]>
fs: Add 'initramfs_options' to set initramfs mount options
Oleg Nesterov <[email protected]>
pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers
gaoxiang17 <[email protected]>
pid: Add a judgment for ns null in pid_nr_ns
Tetsuo Handa <[email protected]>
minixfs: Verify inode mode when loading from disk
David Laight <[email protected]>
minmax.h: remove some #defines that are only expanded once
David Laight <[email protected]>
minmax.h: simplify the variants of clamp()
David Laight <[email protected]>
minmax.h: move all the clamp() definitions after the min/max() ones
David Laight <[email protected]>
minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
David Laight <[email protected]>
minmax.h: reduce the #define expansion of min(), max() and clamp()
David Laight <[email protected]>
minmax.h: update some comments
David Laight <[email protected]>
minmax.h: add whitespace around operators and after commas
Linus Torvalds <[email protected]>
minmax: fix up min3() and max3() too
Linus Torvalds <[email protected]>
minmax: improve macro expansion and type checking
Linus Torvalds <[email protected]>
minmax: simplify min()/max()/clamp() implementation
Linus Torvalds <[email protected]>
minmax: don't use max() in situations that want a C constant expression
Linus Torvalds <[email protected]>
minmax: make generic MIN() and MAX() macros available everywhere
Linus Torvalds <[email protected]>
minmax: simplify and clarify min_t()/max_t() implementation
Linus Torvalds <[email protected]>
minmax: add a few more MIN_T/MAX_T users
Linus Torvalds <[email protected]>
minmax: avoid overly complicated constant expressions in VM code
David Laight <[email protected]>
minmax: fix indentation of __cmp_once() and __clamp_once()
Andy Shevchenko <[email protected]>
minmax: deduplicate __unconst_integer_typeof()
Herve Codina <[email protected]>
minmax: Introduce {min,max}_array()
Stephan Gerhold <[email protected]>
arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
Qu Wenruo <[email protected]>
btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
Aleksa Sarai <[email protected]>
fscontext: do not consume log entries when returning -EMSGSIZE
Peter Zijlstra <[email protected]>
locking: Introduce __cleanup() based infrastructure
Zheng Qixing <[email protected]>
dm: fix NULL pointer dereference in __dm_suspend()
Yuan Chen <[email protected]>
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
Matvey Kovalev <[email protected]>
ksmbd: fix error code overwriting in smb2_get_info_filesystem()
Oleksij Rempel <[email protected]>
net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
Andy Shevchenko <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
Hans de Goede <[email protected]>
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Edward Adam Davis <[email protected]>
media: mc: Clear minor number before put device
Phillip Lougher <[email protected]>
Squashfs: reject negative file sizes in squashfs_read_inode()
Phillip Lougher <[email protected]>
Squashfs: add additional inode sanity checking
Ma Ke <[email protected]>
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wcd934x: Simplify with dev_err_probe
Sean Christopherson <[email protected]>
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
Nathan Chancellor <[email protected]>
lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
Jan Kara <[email protected]>
ext4: free orphan info with kvfree
Ahmet Eray Karadag <[email protected]>
ext4: guard against EA inode refcount underflow in xattr update
Ojaswin Mujoo <[email protected]>
ext4: correctly handle queries for metadata mappings
Yongjian Sun <[email protected]>
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
Jan Kara <[email protected]>
ext4: verify orphan file size is not too big
Olga Kornievskaia <[email protected]>
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
Thorsten Blum <[email protected]>
NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
Thadeu Lima de Souza Cascardo <[email protected]>
mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
Sean Christopherson <[email protected]>
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
Sean Christopherson <[email protected]>
x86/umip: Check that the instruction opcode is at least two bytes
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before DAC access
Pratyush Yadav <[email protected]>
spi: cadence-quadspi: Flush posted register writes before INDAC access
Niklas Cassel <[email protected]>
PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
Siddharth Vadapalli <[email protected]>
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
Lukas Wunner <[email protected]>
PCI/AER: Support errors introduced by PCIe r6.0
Niklas Schnelle <[email protected]>
PCI/AER: Fix missing uevent on recovery when a reset is requested
Lukas Wunner <[email protected]>
PCI/ERR: Fix uevent on failure to recover
Niklas Schnelle <[email protected]>
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
Brian Norris <[email protected]>
PCI/sysfs: Ensure devices are powered for config reads
Sean Christopherson <[email protected]>
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
Esben Haabendal <[email protected]>
rtc: interface: Fix long-standing race when setting alarm
Esben Haabendal <[email protected]>
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
Zhen Ni <[email protected]>
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
Rex Chen <[email protected]>
mmc: core: SPI mode remove cmd7
Linus Walleij <[email protected]>
mtd: rawnand: fsmc: Default to autodetect buswidth
Ma Ke <[email protected]>
sparc: fix error handling in scan_one_device()
Anthony Yznaga <[email protected]>
sparc64: fix hugetlb for sun4u
Eric Biggers <[email protected]>
sctp: Fix MAC comparison to be constant-time
Thorsten Blum <[email protected]>
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
Jisheng Zhang <[email protected]>
pwm: berlin: Fix wrong register in suspend/resume
Nam Cao <[email protected]>
powerpc/pseries/msi: Fix potential underflow and leak issue
Nam Cao <[email protected]>
powerpc/powernv/pci: Fix underflow and leak issue
Georg Gottleuber <[email protected]>
nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
Sam James <[email protected]>
parisc: don't reference obsolete termio struct for TC* constants
Askar Safin <[email protected]>
openat2: don't trigger automounts with RESOLVE_NO_XDEV
Johan Hovold <[email protected]>
lib/genalloc: fix device leak in of_gen_pool_get()
Eric Biggers <[email protected]>
KEYS: trusted_tpm1: Compare HMAC values in constant time
Lu Baolu <[email protected]>
iommu/vt-d: PRS isn't usable if PDS isn't supported
Sean Nyekjaer <[email protected]>
iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
Huacai Chen <[email protected]>
init: handle bootloader identifier in kernel parameters
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix prescaler usage.
Qianfeng Rong <[email protected]>
iio: dac: ad5421: use int type to store negative error codes
Qianfeng Rong <[email protected]>
iio: dac: ad5360: use int type to store negative error codes
Haoxiang Li <[email protected]>
fs/ntfs3: Fix a resource leak bug in wnd_extend()
Thomas Fourier <[email protected]>
crypto: atmel - Fix dma_unmap_sg() direction
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
Simon Schuster <[email protected]>
copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
Adam Xue <[email protected]>
bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
Anderson Nascimento <[email protected]>
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
Shuhao Fu <[email protected]>
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
Qianfeng Rong <[email protected]>
media: i2c: mt9v111: fix incorrect type for ret
Johan Hovold <[email protected]>
firmware: meson_sm: fix device leak at probe
Lukas Wunner <[email protected]>
xen/manage: Fix suspend error path
Jason Andryuk <[email protected]>
xen/events: Cleanup find_virq() return codes
Miaoqian Lin <[email protected]>
ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Add missing MDSS reset
Amir Mohammad Jahangirzad <[email protected]>
ACPI: debug: fix signedness issues in read/write helpers
Daniel Tang <[email protected]>
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
KaFai Wan <[email protected]>
bpf: Avoid RCU context warning when unpinning htab with internal structs
Bartosz Golaszewski <[email protected]>
gpio: wcd934x: mark the GPIO controller as sleeping
Andy Shevchenko <[email protected]>
gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
Gunnar Kudrjavets <[email protected]>
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
Herbert Xu <[email protected]>
crypto: essiv - Check ssize for decryption and in-place encryption
Eric Woudstra <[email protected]>
bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
Timur Kristóf <[email protected]>
drm/amd/display: Properly disable scaling on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
Timur Kristóf <[email protected]>
drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
Alex Deucher <[email protected]>
drm/amdgpu: Add additional DCE6 SCL registers
Daniel Borkmann <[email protected]>
bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
Harini T <[email protected]>
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
Leo Yan <[email protected]>
tools build: Align warning options with perf
Erick Karanja <[email protected]>
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
Kuniyuki Iwashima <[email protected]>
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
Alexandr Sapozhnikov <[email protected]>
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix Use-after-free in validation
Thomas Zimmermann <[email protected]>
drm/vmwgfx: Copy DRM hash-table code into driver
Vineeth Vijayan <[email protected]>
s390/cio: Update purge function to unregister the unused subchannels
Vineeth Vijayan <[email protected]>
s390/cio: unregister the subchannel while purging
Dan Carpenter <[email protected]>
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
Duoming Zhou <[email protected]>
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
John Garry <[email protected]>
scsi: mvsas: Use sas_task_find_rq() for tagging
John Garry <[email protected]>
scsi: mvsas: Delete mvs_tag_init()
John Garry <[email protected]>
scsi: libsas: Add sas_task_find_rq()
Aaron Kling <[email protected]>
cpufreq: tegra186: Set target frequency for all cpus in policy
Alok Tiwari <[email protected]>
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
Brian Masney <[email protected]>
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
Ian Rogers <[email protected]>
perf test: Don't leak workload gopipe in PERF_RECORD_*
Leo Yan <[email protected]>
perf session: Fix handling when buffer exceeds 2 GiB
Leo Yan <[email protected]>
perf arm_spe: Correct memory level for remote access
Leo Yan <[email protected]>
perf arm-spe: Rename the common data source encoding
German Gomez <[email protected]>
perf arm-spe: Refactor arm-spe to support operation packet type
Jing Zhang <[email protected]>
perf arm-spe: augment the data source type with neoverse_spe list
Leo Yan <[email protected]>
perf arm_spe: Correct setting remote access
Ali Saidi <[email protected]>
perf arm-spe: Use SPE data source for neoverse cores
German Gomez <[email protected]>
perf arm-spe: Save context ID in record
Rob Herring (Arm) <[email protected]>
rtc: x1205: Fix Xicor X1205 vendor prefix
Yunseong Kim <[email protected]>
perf util: Fix compression checks returning -1 as bool
Brian Masney <[email protected]>
clk: at91: peripheral: fix return value
Ian Rogers <[email protected]>
libperf event: Ensure tracing data is multiple of 8 sized
Ian Rogers <[email protected]>
perf evsel: Avoid container_of on a NULL leader
Michael Hennerich <[email protected]>
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
Zhen Ni <[email protected]>
clocksource/drivers/clps711x: Fix resource leaks in error paths
Thomas Weißschuh <[email protected]>
fs: always return zero on success from replace_fd()
Miaoqian Lin <[email protected]>
usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
Salah Triki <[email protected]>
bus: fsl-mc: Check return value of platform_get_resource()
Bartosz Golaszewski <[email protected]>
pinctrl: check the return value of pinmux_ops::get_function_name()
Zhen Ni <[email protected]>
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Marek Vasut <[email protected]>
Input: atmel_mxt_ts - allow reset GPIO to sleep
Guangshuo Li <[email protected]>
nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Yang Shi <[email protected]>
mm: hugetlb: avoid soft lockup when mprotect to large memory area
Jan Kara <[email protected]>
ext4: fix checks for orphan inodes
Bartosz Golaszewski <[email protected]>
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Deepak Sharma <[email protected]>
net: nfc: nci: Add parameter validation for packet data
Larshin Sergey <[email protected]>
fs: udf: fix OOB read in lengthAllocDescs handling
Naman Jain <[email protected]>
uio_hv_generic: Let userspace take care of interrupt mask
Phillip Lougher <[email protected]>
Squashfs: fix uninit-value in squashfs_get_parent
Jakub Kicinski <[email protected]>
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Yeounsu Moon <[email protected]>
net: dlink: handle copy_thresh allocation failure
Kohei Enju <[email protected]>
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Kohei Enju <[email protected]>
nfp: fix RSS hash key size when RSS is not supported
Donet Tom <[email protected]>
drivers/base/node: fix double free in register_one_node()
Dan Carpenter <[email protected]>
ocfs2: fix double free in user_cluster_connect()
Nishanth Menon <[email protected]>
hwrng: ks-sa - fix division by zero in ks_sa_rng_init
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
I Viswanath <[email protected]>
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Bernard Metzler <[email protected]>
RDMA/siw: Always report immediate post SQ errors
Cristian Ciocaltea <[email protected]>
usb: vhci-hcd: Prevent suspending virtually attached devices
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Slavin Liu <[email protected]>
ipvs: Defer ip_vs_ftp unregister during netns cleanup
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix backchannel max_resp_sz verification check
Leo Yan <[email protected]>
coresight: trbe: Return NULL pointer for allocation failures
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Michael Karcher <[email protected]>
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
Baochen Qiang <[email protected]>
wifi: ath10k: avoid unnecessary wait for service ready message
Bagas Sanjaya <[email protected]>
Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
Vlad Dumitrescu <[email protected]>
IB/sa: Fix sa_local_svc_timeout_ms read race
Parav Pandit <[email protected]>
RDMA/core: Resolve MAC of next-hop device without ARP support
Michal Pecio <[email protected]>
Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
Qianfeng Rong <[email protected]>
scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Qianfeng Rong <[email protected]>
scsi: qla2xxx: edif: Fix incorrect sign of error code
Colin Ian King <[email protected]>
ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
Abdun Nihaal <[email protected]>
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Håkon Bugge <[email protected]>
RDMA/cm: Rate limit destroy CM ID timeout error message
Donet Tom <[email protected]>
drivers/base/node: handle error properly in register_one_node()
Christophe Leroy <[email protected]>
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Zhen Ni <[email protected]>
netfilter: ipset: Remove unused htable_bits in macro ahash_region
Hans de Goede <[email protected]>
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Vitaly Grigoryev <[email protected]>
fs: ntfs3: Fix integer overflow in run_unpack()
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Takashi Iwai <[email protected]>
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Wang Liang <[email protected]>
pps: fix warning in pps_register_cdev when register device fail
Colin Ian King <[email protected]>
misc: genwqe: Fix incorrect cmd field being reported in error
William Wu <[email protected]>
usb: gadget: configfs: Correctly set use_os_string at bind
Xichao Zhao <[email protected]>
usb: phy: twl6030: Fix incorrect type for ret
Qianfeng Rong <[email protected]>
drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
Eric Dumazet <[email protected]>
tcp: fix __tcp_close() to only send RST when required
Alok Tiwari <[email protected]>
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
Stefan Kerkmann <[email protected]>
wifi: mwifiex: send world regulatory domain to driver
Timur Kristóf <[email protected]>
drm/amdgpu: Power up UVD 3 for FW validation (v2)
Qianfeng Rong <[email protected]>
ALSA: lx_core: use int type to store negative error codes
Zhang Shurong <[email protected]>
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Thomas Fourier <[email protected]>
scsi: myrs: Fix dma_alloc_coherent() error check
Niklas Cassel <[email protected]>
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Dan Carpenter <[email protected]>
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Brahmajit Das <[email protected]>
drm/radeon/r600_cs: clean up of dead code in r600_cs
Kunihiko Hayashi <[email protected]>
i2c: designware: Add disabling clocks when probe fails
Leilk.Liu <[email protected]>
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Dmitry Baryshkov <[email protected]>
thermal/drivers/qcom/lmh: Add missing IRQ includes
Dmitry Baryshkov <[email protected]>
thermal/drivers/qcom: Make LMH select QCOM_SCM
Zhouyi Zhou <[email protected]>
tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
Rafael J. Wysocki <[email protected]>
smp: Fix up and expand the smp_call_function_many() kerneldoc
Paul Chaignon <[email protected]>
bpf: Explicitly check accesses to bpf_sock_addr
Akhilesh Patil <[email protected]>
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Stanley Chu <[email protected]>
i3c: master: svc: Recycle unused IBI slot
Daniel Wagner <[email protected]>
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Uwe Kleine-König <[email protected]>
pwm: tiehrpwm: Fix corner case in clock divisor calculation
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
Johan Hovold <[email protected]>
firmware: firmware: meson-sm: fix compile-test default
Qianfeng Rong <[email protected]>
pinctrl: renesas: Use int type to store negative error codes
Rafael J. Wysocki <[email protected]>
PM: sleep: core: Clear power.must_resume in noirq suspend error path
Qianfeng Rong <[email protected]>
block: use int to store blk_stack_limits() return value
Qianfeng Rong <[email protected]>
regulator: scmi: Use int type to store negative error codes
Nicolas Ferre <[email protected]>
ARM: at91: pm: fix MCKx restore routine
Li Nan <[email protected]>
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Da Xue <[email protected]>
pinctrl: meson-gxl: add missing i2c_d pinmux
Sneh Mankad <[email protected]>
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Huisong Li <[email protected]>
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Florian Fainelli <[email protected]>
cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
Yureka Lilian <[email protected]>
libbpf: Fix reuse of DEVMAP
Geert Uytterhoeven <[email protected]>
regmap: Remove superfluous check for !config in __regmap_init()
Uros Bizjak <[email protected]>
x86/vdso: Fix output operand size of RDPID
Leo Yan <[email protected]>
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Leo Yan <[email protected]>
coresight: trbe: Prevent overflow in PERF_IDX2OFF()
Bala-Vignesh-Reddy <[email protected]>
selftests: arm64: Check fread return value in exec_target
Jeff Layton <[email protected]>
filelock: add FL_RECLAIM to show_fl_flags() macro
Nalivayko Sergey <[email protected]>
net/9p: fix double req put in p9_fd_cancelled
Matthew Wilcox (Oracle) <[email protected]>
minmax: add in_range() macro
Herbert Xu <[email protected]>
crypto: rng - Ensure set_ent is always present
Hans de Goede <[email protected]>
platform/x86: int3472: Check for adev == NULL
Rafael J. Wysocki <[email protected]>
driver core/PM: Set power.no_callbacks along with power.no_pm
Ovidiu Panait <[email protected]>
staging: axis-fifo: flush RX FIFO on read errors
Ovidiu Panait <[email protected]>
staging: axis-fifo: fix maximum TX packet length check
Raphael Gallais-Pou <[email protected]>
serial: stm32: allow selecting console when the driver is module
Arnaud Lecomte <[email protected]>
hid: fix I2C read buffer overflow in raw_event() for mcp2221
hupu <[email protected]>
perf subcmd: avoid crash in exclude_cmds when excludes is empty
Mikulas Patocka <[email protected]>
dm-integrity: limit MAX_TAG_SIZE to 255
Bitterblue Smith <[email protected]>
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
Xiaowei Li <[email protected]>
USB: serial: option: add SIMCom 8230C compositions
Duoming Zhou <[email protected]>
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Duoming Zhou <[email protected]>
media: tuner: xc5000: Fix use-after-free in xc5000_release
Ricardo Ribalda <[email protected]>
media: tunner: xc5000: Refactor firmware load
Kuniyuki Iwashima <[email protected]>
udp: Fix memory accounting leak.
Will Deacon <[email protected]>
KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
Larshin Sergey <[email protected]>
media: rc: fix races with imon_disconnect()
Duoming Zhou <[email protected]>
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Wang Haoran <[email protected]>
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Vasant Hegde <[email protected]>
iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 + Documentation/gpu/todo.rst | 11 + Documentation/trace/histogram-design.rst | 4 +- Makefile | 4 +- arch/arm/mach-at91/pm_suspend.S | 4 +- arch/arm/mach-omap2/pm33xx-core.c | 6 +- arch/arm/mm/pageattr.c | 6 +- arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 +- arch/arm64/kernel/cpufeature.c | 10 +- arch/arm64/kernel/fpsimd.c | 8 +- arch/arm64/kernel/mte.c | 3 +- arch/parisc/include/uapi/asm/ioctls.h | 8 +- arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/sparc/kernel/of_device_32.c | 1 + arch/sparc/kernel/of_device_64.c | 1 + arch/sparc/lib/M7memcpy.S | 20 +- arch/sparc/lib/Memcpy_utils.S | 9 + arch/sparc/lib/NG4memcpy.S | 2 +- arch/sparc/lib/NGmemcpy.S | 29 ++- arch/sparc/lib/U1memcpy.S | 19 +- arch/sparc/lib/U3memcpy.S | 2 +- arch/sparc/mm/hugetlbpage.c | 20 ++ arch/um/drivers/mconsole_user.c | 2 + arch/x86/include/asm/segment.h | 8 +- arch/x86/kernel/umip.c | 15 +- arch/x86/kvm/emulate.c | 11 +- arch/x86/kvm/kvm_emulate.h | 2 +- arch/x86/kvm/x86.c | 9 +- arch/x86/mm/pgtable.c | 2 +- block/blk-mq-sysfs.c | 6 +- block/blk-settings.c | 3 +- crypto/essiv.c | 14 +- crypto/rng.c | 8 + drivers/acpi/acpi_dbg.c | 26 +- drivers/acpi/acpi_tad.c | 3 + drivers/acpi/nfit/core.c | 2 +- drivers/acpi/processor_idle.c | 3 + drivers/base/node.c | 4 + drivers/base/power/main.c | 14 +- drivers/base/regmap/regmap.c | 2 +- drivers/bus/fsl-mc/fsl-mc-bus.c | 3 + drivers/bus/mhi/host/init.c | 5 +- drivers/char/hw_random/ks-sa-rng.c | 4 + drivers/char/tpm/tpm_tis_core.c | 4 +- drivers/clk/at91/clk-peripheral.c | 7 +- drivers/clk/nxp/clk-lpc18xx-cgu.c | 20 +- drivers/clocksource/clps711x-timer.c | 23 +- drivers/cpufreq/intel_pstate.c | 8 +- drivers/cpufreq/scmi-cpufreq.c | 10 + drivers/cpufreq/tegra186-cpufreq.c | 8 +- drivers/crypto/atmel-tdes.c | 2 +- drivers/dma/ioat/dma.c | 12 +- drivers/edac/sb_edac.c | 4 +- drivers/edac/skx_common.h | 1 - drivers/firmware/meson/Kconfig | 2 +- drivers/firmware/meson/meson_sm.c | 7 +- drivers/gpio/gpio-wcd934x.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 + drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 ++- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 21 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 4 + .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 2 + .../gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 + .../drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 + drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppevvmath.h | 14 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 2 + drivers/gpu/drm/arm/display/include/malidp_utils.h | 2 +- .../drm/arm/display/komeda/komeda_pipeline_state.c | 24 +- drivers/gpu/drm/drm_color_mgmt.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 6 - drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 2 + drivers/gpu/drm/radeon/r600_cs.c | 4 +- drivers/gpu/drm/vmwgfx/Makefile | 2 +- drivers/gpu/drm/vmwgfx/ttm_object.c | 52 ++-- drivers/gpu/drm/vmwgfx/ttm_object.h | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 24 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c | 199 ++++++++++++++++ drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h | 83 +++++++ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 26 +- drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 7 +- drivers/hid/hid-mcp2221.c | 4 + drivers/hwmon/adt7475.c | 24 +- drivers/hwtracing/coresight/coresight-trbe.c | 9 +- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + drivers/i2c/busses/i2c-mt65xx.c | 17 +- drivers/i3c/master/svc-i3c-master.c | 1 + drivers/iio/dac/ad5360.c | 2 +- drivers/iio/dac/ad5421.c | 2 +- drivers/iio/frequency/adf4350.c | 20 +- drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 - drivers/iio/inkern.c | 2 +- drivers/infiniband/core/addr.c | 10 +- drivers/infiniband/core/cm.c | 4 +- drivers/infiniband/core/sa_query.c | 6 +- drivers/infiniband/sw/siw/siw_verbs.c | 25 +- drivers/input/misc/uinput.c | 1 + drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- drivers/input/touchscreen/cyttsp4_core.c | 2 +- drivers/iommu/amd/iommu.c | 3 +- drivers/iommu/intel/iommu.c | 2 +- drivers/irqchip/irq-sun6i-r.c | 2 +- drivers/mailbox/zynqmp-ipi-mailbox.c | 7 +- drivers/md/dm-integrity.c | 6 +- drivers/md/dm.c | 7 +- drivers/media/dvb-frontends/stv0367_priv.h | 3 + drivers/media/i2c/mt9v111.c | 2 +- drivers/media/i2c/rj54n1cb0c.c | 9 +- drivers/media/i2c/tc358743.c | 4 +- drivers/media/mc/mc-devnode.c | 6 +- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- drivers/media/pci/cobalt/cobalt-driver.c | 4 +- drivers/media/pci/cx18/cx18-driver.c | 2 +- drivers/media/pci/cx18/cx18-queue.c | 20 +- drivers/media/pci/cx18/cx18-streams.c | 16 +- drivers/media/pci/ddbridge/ddbridge-main.c | 4 +- drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 2 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/ivtv/ivtv-irq.c | 2 +- drivers/media/pci/ivtv/ivtv-queue.c | 18 +- drivers/media/pci/ivtv/ivtv-streams.c | 22 +- drivers/media/pci/ivtv/ivtv-udma.c | 27 ++- drivers/media/pci/ivtv/ivtv-yuv.c | 24 +- drivers/media/pci/ivtv/ivtvfb.c | 6 +- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 2 +- drivers/media/pci/pluto2/pluto2.c | 20 +- drivers/media/pci/pt1/pt1.c | 2 +- drivers/media/pci/tw5864/tw5864-core.c | 2 +- drivers/media/rc/imon.c | 27 ++- drivers/media/tuners/xc5000.c | 41 ++-- drivers/memory/samsung/exynos-srom.c | 10 +- drivers/mfd/intel_soc_pmic_chtdc_ti.c | 5 +- drivers/mfd/vexpress-sysreg.c | 6 +- drivers/misc/genwqe/card_ddcb.c | 2 +- drivers/mmc/core/sdio.c | 6 +- drivers/mtd/nand/raw/fsmc_nand.c | 6 +- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 18 +- drivers/net/ethernet/dlink/dl2k.c | 7 +- drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 17 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- drivers/net/fjes/fjes_main.c | 4 +- drivers/net/usb/asix_devices.c | 35 ++- drivers/net/usb/rtl8150.c | 2 - drivers/net/wireless/ath/ath10k/wmi.c | 39 ++- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - drivers/nfc/pn544/i2c.c | 2 - drivers/nvme/host/pci.c | 2 + drivers/nvme/target/fc.c | 19 +- drivers/pci/controller/dwc/pci-keystone.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 4 +- drivers/pci/controller/pci-tegra.c | 2 +- drivers/pci/iov.c | 5 + drivers/pci/pci-driver.c | 1 + drivers/pci/pci-sysfs.c | 20 +- drivers/pci/pcie/aer.c | 12 +- drivers/pci/pcie/err.c | 8 +- drivers/perf/arm_spe_pmu.c | 3 +- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 + drivers/pinctrl/pinmux.c | 2 +- drivers/pinctrl/renesas/pinctrl.c | 3 +- drivers/platform/x86/intel/int3472/discrete.c | 3 + drivers/platform/x86/intel/int3472/tps68470.c | 3 + drivers/platform/x86/sony-laptop.c | 1 - drivers/pps/kapi.c | 5 +- drivers/pps/pps.c | 5 +- drivers/pwm/pwm-berlin.c | 4 +- drivers/pwm/pwm-tiehrpwm.c | 4 +- drivers/regulator/scmi-regulator.c | 3 +- drivers/remoteproc/qcom_q6v5.c | 3 - drivers/rtc/interface.c | 27 +++ drivers/rtc/rtc-x1205.c | 2 +- drivers/s390/cio/device.c | 35 ++- drivers/scsi/hpsa.c | 21 +- drivers/scsi/isci/init.c | 6 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 13 +- drivers/scsi/mvsas/mv_sas.c | 42 ++-- drivers/scsi/mvsas/mv_sas.h | 8 +- drivers/scsi/myrs.c | 8 +- drivers/scsi/pm8001/pm8001_sas.c | 9 +- drivers/scsi/qla2xxx/qla_edif.c | 4 +- drivers/scsi/qla2xxx/qla_init.c | 4 +- drivers/soc/qcom/rpmh-rsc.c | 7 +- drivers/spi/spi-cadence-quadspi.c | 5 + drivers/staging/axis-fifo/axis-fifo.c | 32 ++- .../pci/hive_isp_css_include/math_support.h | 5 - drivers/target/target_core_configfs.c | 2 +- drivers/thermal/qcom/Kconfig | 3 +- drivers/thermal/qcom/lmh.c | 2 + drivers/tty/serial/Kconfig | 2 +- drivers/uio/uio_hv_generic.c | 7 +- drivers/usb/cdns3/cdnsp-pci.c | 5 +- drivers/usb/gadget/configfs.c | 2 + drivers/usb/host/max3421-hcd.c | 2 +- drivers/usb/host/xhci-ring.c | 11 +- drivers/usb/phy/phy-twl6030-usb.c | 3 +- drivers/usb/serial/option.c | 6 + drivers/usb/usbip/vhci_hcd.c | 22 ++ drivers/virt/acrn/ioreq.c | 4 +- drivers/watchdog/mpc8xxx_wdt.c | 2 + drivers/xen/events/events_base.c | 20 +- drivers/xen/manage.c | 3 +- fs/btrfs/export.c | 8 +- fs/btrfs/extent_io.c | 14 +- fs/btrfs/misc.h | 2 - fs/btrfs/tree-checker.c | 2 +- fs/cramfs/inode.c | 11 +- fs/erofs/zdata.h | 2 +- fs/ext2/balloc.c | 2 - fs/ext4/ext4.h | 12 +- fs/ext4/file.c | 2 +- fs/ext4/fsmap.c | 14 +- fs/ext4/inode.c | 12 +- fs/ext4/orphan.c | 23 +- fs/ext4/super.c | 4 +- fs/ext4/xattr.c | 15 +- fs/file.c | 5 +- fs/fs-writeback.c | 32 ++- fs/fsopen.c | 70 +++--- fs/ksmbd/smb2pdu.c | 3 +- fs/minix/inode.c | 8 +- fs/namei.c | 8 + fs/namespace.c | 11 +- fs/nfs/nfs4proc.c | 2 +- fs/nfsd/lockd.c | 15 ++ fs/nfsd/nfs4proc.c | 2 +- fs/ntfs3/bitmap.c | 1 + fs/ntfs3/run.c | 12 +- fs/ocfs2/stack_user.c | 1 + fs/squashfs/inode.c | 31 ++- fs/squashfs/squashfs_fs_i.h | 2 +- fs/udf/inode.c | 3 + fs/ufs/util.h | 6 - include/linux/cleanup.h | 171 +++++++++++++ include/linux/compiler-clang.h | 9 + include/linux/compiler.h | 9 + include/linux/compiler_attributes.h | 6 + include/linux/device.h | 10 + include/linux/file.h | 6 + include/linux/iio/frequency/adf4350.h | 2 +- include/linux/irqflags.h | 7 + include/linux/minmax.h | 264 +++++++++++++++------ include/linux/mutex.h | 4 + include/linux/percpu.h | 4 + include/linux/preempt.h | 47 ++++ include/linux/rcupdate.h | 3 + include/linux/rwsem.h | 8 + include/linux/sched/task.h | 2 + include/linux/slab.h | 3 + include/linux/spinlock.h | 32 +++ include/linux/srcu.h | 5 + include/scsi/libsas.h | 18 ++ include/trace/events/filelock.h | 3 +- init/main.c | 14 ++ kernel/bpf/inode.c | 4 +- kernel/fork.c | 2 +- kernel/pid.c | 5 +- kernel/smp.c | 11 +- kernel/trace/preemptirq_delay_test.c | 2 - kernel/trace/trace_kprobe.c | 11 +- kernel/trace/trace_probe.h | 9 +- kernel/trace/trace_uprobe.c | 12 +- lib/btree.c | 1 - lib/crypto/Makefile | 4 + lib/decompress_unlzma.c | 2 + lib/genalloc.c | 5 +- lib/logic_pio.c | 3 - lib/vsprintf.c | 2 +- lib/zstd/zstd_internal.h | 2 - mm/hugetlb.c | 2 + mm/page_alloc.c | 2 +- mm/zsmalloc.c | 1 - net/9p/trans_fd.c | 8 +- net/bluetooth/mgmt.c | 10 +- net/bridge/br_vlan.c | 2 +- net/core/filter.c | 18 +- net/ipv4/proc.c | 2 +- net/ipv4/tcp.c | 9 +- net/ipv4/tcp_input.c | 1 - net/ipv4/udp.c | 16 +- net/ipv6/proc.c | 2 +- net/mptcp/pm.c | 7 +- net/mptcp/pm_netlink.c | 49 +++- net/mptcp/protocol.h | 8 + net/netfilter/ipset/ip_set_hash_gen.h | 8 +- net/netfilter/ipvs/ip_vs_ftp.c | 4 +- net/netfilter/nf_nat_core.c | 6 +- net/nfc/nci/ntf.c | 135 ++++++++--- net/sctp/sm_make_chunk.c | 3 +- net/sctp/sm_statefuns.c | 6 +- net/tipc/core.h | 2 +- net/tipc/link.c | 10 +- scripts/checkpatch.pl | 2 +- security/keys/trusted-keys/trusted_tpm1.c | 7 +- sound/pci/lx6464es/lx_core.c | 4 +- sound/soc/codecs/wcd934x.c | 30 ++- sound/soc/intel/boards/bytcht_es8316.c | 20 +- sound/soc/intel/boards/bytcr_rt5640.c | 7 +- sound/soc/intel/boards/bytcr_rt5651.c | 26 +- tools/build/feature/Makefile | 4 +- tools/include/nolibc/std.h | 2 +- tools/lib/bpf/libbpf.c | 10 + tools/lib/perf/include/perf/event.h | 1 + tools/lib/subcmd/help.c | 3 + tools/perf/tests/perf-record.c | 4 + tools/perf/util/arm-spe-decoder/arm-spe-decoder.c | 33 ++- tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 60 ++++- tools/perf/util/arm-spe.c | 146 ++++++++++-- tools/perf/util/evsel.c | 2 + tools/perf/util/lzma.c | 2 +- tools/perf/util/session.c | 2 +- tools/perf/util/zlib.c | 2 +- tools/testing/nvdimm/test/ndtest.c | 13 +- tools/testing/selftests/arm64/pauth/exec_target.c | 7 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 + tools/testing/selftests/rseq/rseq.c | 8 +- tools/testing/selftests/vm/mremap_test.c | 2 + tools/testing/selftests/watchdog/watchdog-test.c | 6 + 333 files changed, 2761 insertions(+), 1057 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/276 iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasant Hegde <[email protected]>
commit 6b080c4e815ceba3c08ffa980c858595c07e786a upstream.
Implement the map_pages() and unmap_pages() callback for the AMD IOMMU driver to allow calls from iommu core to map and unmap multiple pages. Also deprecate map/unmap callbacks.
Finally gatherer is not updated by iommu_v1_unmap_pages(). Hence pass NULL instead of gather to iommu_v1_unmap_pages.
[ partial bacport of the original patch, just what is needed to fix a
bug in 5.15.y only ]
--- drivers/iommu/amd/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +2 -1
@@ -2121,7 +2121,8 @@ static size_t amd_iommu_unmap(struct iom r = (ops->unmap) ? ops->unmap (ops, iova, page_size, gather) :0 ; -amd_iommu_iotlb_gather_add_page (dom, gather, iova, page_size); +if (r) +amd_iommu_iotlb_gather_add_page (dom, gather, iova, r);return r; }
Greg Kroah-Hartman
maintainerPATCH 2/276 scsi: target: target_core_configfs: Add length check to avoid buffer overflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Haoran <[email protected]>
commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.
A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes).
snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes.
Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error.
An additional check of the return value of snprintf() can avoid this buffer overflow.
--- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/target/target_core_configfs.c +1 -1
@@ -2679,7 +2679,7 @@ static ssize_t target_lu_gp_members_show config_item_name(&dev->dev_group.cg_item)); cur_len++;/* Extra byte for NULL terminator */ -if ((cur_len + len) >PAGE_SIZE ) { +if ((cur_len + len) >PAGE_SIZE || cur_len >LU_GROUP_NAME_BUF ) {pr_warn ("Ran out of lu_gp_show_attr" "_members buffer\n" );break ;
Greg Kroah-Hartman
maintainerPATCH 3/276 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
commit 01e03fb7db419d39e18d6090d4873c1bff103914 upstream.
The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
flexcop_pci_remove() | flexcop_pci_irq_check_work()
cancel_delayed_work() |
flexcop_device_kfree(fc_pci->fc_dev) |
| fc = fc_pci->fc_dev; // UAFThis is confirmed by a KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated.
This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug.
--- drivers/media/pci/b2c2/flexcop-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/b2c2/flexcop-pci.c +1 -1
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pcstruct flexcop_pci *fc_pci =pci_get_drvdata (pdev);if (irq_chk_intv >0 ) -cancel_delayed_work (&fc_pci->irq_check_work); +cancel_delayed_work_sync (&fc_pci->irq_check_work);flexcop_pci_dma_exit (fc_pci);flexcop_device_exit (fc_pci->fc_dev);
Greg Kroah-Hartman
maintainerPATCH 4/276 media: rc: fix races with imon_disconnect()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <[email protected]>
commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb upstream.
Syzbot reports a KASAN issue as below:
BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device.
Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage.
As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer.
Thread 1 vfd_write Thread 2 imon_disconnect
...
if
usb_put_dev(ictx->usbdev_intf0)
else
usb_put_dev(ictx->usbdev_intf1)
...
while
send_packet
if
pipe = usb_sndintpipe(
ictx->usbdev_intf0) UAF
else
pipe = usb_sndctrlpipe(
ictx->usbdev_intf0, 0) UAFGuard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present.
Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations.
Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/media/rc/imon.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/media/rc/imon.c +20 -7
@@ -536,7 +536,9 @@ static int display_open(struct inode *inmutex_lock (&ictx->lock); -if (!ictx->display_supported) { +if (ictx->disconnected) { + retval = -ENODEV ; + }else if (!ictx->display_supported) {pr_err ("display not supported by device\n" ); retval = -ENODEV ; }else if (ictx->display_isopen) {
@@ -598,6 +600,9 @@ static int send_packet(struct imon_conteint retval =0 ;struct usb_ctrlrequest *control_req =NULL ; +if (ictx->disconnected) +return -ENODEV ; +/* Check if we need to use control or interrupt urb */ if (!ictx->tx_control) { pipe = usb_sndintpipe(ictx->usbdev_intf0,
@@ -951,12 +956,14 @@ static ssize_t vfd_write(struct file *fistatic const unsigned char vfd_packet6[] = {0x01 ,0x00 ,0x00 ,0x00 ,0x00 ,0xFF ,0xFF }; -if (ictx->disconnected) -return -ENODEV ; -if (mutex_lock_interruptible (&ictx->lock))return -ERESTARTSYS ; +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->dev_present_intf0) {pr_err_ratelimited ("no iMON device present\n" ); retval = -ENODEV ;
@@ -1031,11 +1038,13 @@ static ssize_t lcd_write(struct file *fiint retval =0 ;struct imon_context *ictx = file->private_data; -if (ictx->disconnected) -return -ENODEV ; -mutex_lock (&ictx->lock); +if (ictx->disconnected) { + retval = -ENODEV ; + goto exit; + } +if (!ictx->display_supported) {pr_err_ratelimited ("no iMON display present\n" ); retval = -ENODEV ;
@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_iint ifnum; ictx =usb_get_intfdata (interface); + +mutex_lock (&ictx->lock); ictx->disconnected = true; +mutex_unlock (&ictx->lock); + dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
Greg Kroah-Hartman
maintainerPATCH 5/276 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
Stable commit 23249dade24e ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix") fixed a kernel BUG() caused by a bad backport of upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") by ensuring that softirqs are disabled/enabled across the fpsimd register save operation.
Unfortunately, although this fixes the original issue, it can now lead to deadlock when re-enabling softirqs causes pending softirqs to be handled with locks already held:
| BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616 | lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7 | CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G O 6.1.152 #1 | Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023 | Call trace: | dump_backtrace+0xe4/0x110 | show_stack+0x20/0x30 | dump_stack_lvl+0x6c/0x88 | dump_stack+0x18/0x34 | spin_dump+0x98/0xac | do_raw_spin_lock+0x70/0x128 | _raw_spin_lock+0x18/0x28 | raw_spin_rq_lock_nested+0x18/0x28 | update_blocked_averages+0x70/0x550 | run_rebalance_domains+0x50/0x70 | handle_softirqs+0x198/0x328 | __do_softirq+0x1c/0x28 | ____do_softirq+0x18/0x28 | call_on_irq_stack+0x30/0x48 | do_softirq_own_stack+0x24/0x30 | do_softirq+0x74/0x90 | __local_bh_enable_ip+0x64/0x80 | fpsimd_save_and_flush_cpu_state+0x5c/0x68 | kvm_arch_vcpu_put_fp+0x4c/0x88 | kvm_arch_vcpu_put+0x28/0x88 | kvm_sched_out+0x38/0x58 | __schedule+0x55c/0x6c8 | schedule+0x60/0xa8
Take a tiny step towards the upstream fix in 9b19700e623f ("arm64:
fpsimd: Drop unneeded 'busy' flag") by additionally disabling hardirqs while saving the fpsimd registers.
--- arch/arm64/kernel/fpsimd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/arm64/kernel/fpsimd.c +6 -2
@@ -1300,13 +1300,17 @@ static void fpsimd_flush_cpu_state(void)*/ void fpsimd_save_and_flush_cpu_state (void ) { +unsigned long flags; +if (!system_supports_fpsimd ())return ;WARN_ON (preemptible ()); -get_cpu_fpsimd_context (); +local_irq_save (flags); +__get_cpu_fpsimd_context ();fpsimd_save ();fpsimd_flush_cpu_state (); -put_cpu_fpsimd_context (); +__put_cpu_fpsimd_context (); +local_irq_restore (flags); }#ifdef CONFIG_KERNEL_MODE_NEON
Greg Kroah-Hartman
maintainerPATCH 6/276 udp: Fix memory accounting leak.
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d upstream.
Matt Dowling reported a weird UDP memory usage issue.
Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops.
We can reproduce the issue with the script below [0]:
1. /proc/net/sockstat reports 0 pages
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 02. Run the script till the report reaches 524,288
# python3 test.py & sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT3. Kill the socket and confirm the number never drops
# pkill python3 && sleep 5
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 524288 4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
# python3 test.py & sleep 1 && pkill python3
5. The number doubles
# cat /proc/net/sockstat | grep UDP:
UDP: inuse 1 mem 1048577The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release().
When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable.
The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow.
Then, the released amount is calculated as follows:
1) Add size to sk->sk_forward_alloc.
2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount.
3) Subtract amount from sk->sk_forward_alloc.
4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't see a warning in inet_sock_destruct(). However, udp_memory_allocated ends up doubling at 4).
Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated"), memory usage no longer doubles immediately after a socket is close()d because __sk_mem_reduce_allocated() caches the amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP socket receives a packet, the subtraction takes effect, causing UDP memory usage to double.
This issue makes further memory allocation fail once the socket's sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet drops.
To prevent this issue, let's use unsigned int for the calculation and call sk_forward_alloc_add() only once for the small delta.
Note that first_packet_length() also potentially has the same problem.
[0]:
from socket import *
SO_RCVBUFFORCE = 33INT_MAX = (2 ** 31) - 1
s = socket(AF_INET, SOCK_DGRAM)s.bind(('', 0))s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
c = socket(AF_INET, SOCK_DGRAM)
c.connect(s.getsockname())
data = b'a' * 100
while True:
c.send(data)
--- net/ipv4/udp.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/ipv4/udp.c +7 -9
@@ -1459,12 +1459,12 @@ static bool udp_skb_has_head_state(struc }/* fully reclaim rmem/fwd memory allocated for skb */ -static void udp_rmem_release (struct sock *sk,int size,int partial, -bool rx_queue_lock_held) +static void udp_rmem_release (struct sock *sk,unsigned int size, +int partial,bool rx_queue_lock_held) {struct udp_sock *up =udp_sk (sk);struct sk_buff_head *sk_queue; -int amt; +unsigned int amt;if (likely (partial)) { up->forward_deficit += size;
@@ -1484,10 +1484,8 @@ static void udp_rmem_release(struct sockif (!rx_queue_lock_held)spin_lock (&sk_queue->lock); - - sk->sk_forward_alloc += size; - amt = (sk->sk_forward_alloc - partial) & ~(SK_MEM_QUANTUM -1 ); - sk->sk_forward_alloc -= amt; + amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE -1 ); + sk->sk_forward_alloc += size - amt;if (amt)__sk_mem_reduce_allocated (sk, amt >>SK_MEM_QUANTUM_SHIFT );
@@ -1671,7 +1669,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp);static struct sk_buff *__first_packet_length (struct sock *sk,struct sk_buff_head *rcvq, -int *total) +unsigned int *total) {struct sk_buff *skb;
@@ -1704,8 +1702,8 @@ static int first_packet_length(struct so {struct sk_buff_head *rcvq = &udp_sk (sk)->reader_queue;struct sk_buff_head *sk_queue = &sk->sk_receive_queue; +unsigned int total =0 ;struct sk_buff *skb; -int total =0 ;int res;spin_lock_bh (&rcvq->lock);
Greg Kroah-Hartman
maintainerPATCH 7/276 media: tunner: xc5000: Refactor firmware load
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 8e1f5da59dd4a1966f859639860b803a7e8b8bfb ]
Make sure the firmware is released when we leavexc_load_fw_and_init_tuner()
This change makes smatch happy:drivers/media/tuners/xc5000.c:1213 xc_load_fw_and_init_tuner() warn: 'fw' from request_firmware() not released on lines: 1213.
Stable-dep-of: 40b7a19f321e ("media: tuner: xc5000: Fix use-after-free in xc5000_release")
--- drivers/media/tuners/xc5000.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-)
drivers/media/tuners/xc5000.c +18 -23
@@ -58,7 +58,7 @@ struct xc5000_priv {struct dvb_frontend *fe;struct delayed_work timer_sleep; -const struct firmware *firmware; +bool inited; };/* Misc Defines */
@@ -1110,23 +1110,19 @@ static int xc_load_fw_and_init_tuner(strif (!force &&xc5000_is_firmware_loaded (fe) ==0 )return 0 ; -if (!priv->firmware) { - ret =request_firmware (&fw, desired_fw->name, - priv->i2c_props.adap->dev.parent); -if (ret) { -pr_err ("xc5000: Upload failed. rc %d\n" , ret); -return ret; - } -dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); - -if (fw->size != desired_fw->size) { -pr_err ("xc5000: Firmware file with incorrect size\n" ); -release_firmware (fw); -return -EINVAL ; - } - priv->firmware = fw; - }else - fw = priv->firmware; + ret =request_firmware (&fw, desired_fw->name, + priv->i2c_props.adap->dev.parent); +if (ret) { +pr_err ("xc5000: Upload failed. rc %d\n" , ret); +return ret; + } +dprintk (1 ,"firmware read %zu bytes.\n" , fw->size); + +if (fw->size != desired_fw->size) { +pr_err ("xc5000: Firmware file with incorrect size\n" ); +release_firmware (fw); +return -EINVAL ; + }/* Try up to 5 times to load firmware */ for (i =0 ; i <5 ; i++) {
@@ -1204,6 +1200,7 @@ static int xc_load_fw_and_init_tuner(str } err: +release_firmware (fw);if (!ret)printk (KERN_INFO "xc5000: Firmware %s loaded and running.\n" , desired_fw->name);
@@ -1274,7 +1271,7 @@ static int xc5000_resume(struct dvb_fron/* suspended before firmware is loaded. Avoid firmware load in resume path. */ -if (!priv->firmware) +if (!priv->inited)return 0 ;return xc5000_set_params (fe);
@@ -1293,6 +1290,8 @@ static int xc5000_init(struct dvb_fronteif (debug)xc_debug_dump (priv); + priv->inited = true; +return 0 ; }
@@ -1306,10 +1305,6 @@ static void xc5000_release(struct dvb_frif (priv) {cancel_delayed_work (&priv->timer_sleep); -if (priv->firmware) { -release_firmware (priv->firmware); - priv->firmware =NULL ; - }hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 8/276 media: tuner: xc5000: Fix use-after-free in xc5000_release
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 40b7a19f321e65789612ebaca966472055dab48c ]
The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv.
A typical race condition is illustrated below:
CPU 0 (release thread) | CPU 1 (delayed work callback)
xc5000_release() | xc5000_do_timer_sleep()
cancel_delayed_work() |
hybrid_tuner_release_state(priv) |
kfree(priv) |
| priv = container_of() // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated.
A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here.
This bug was initially identified through static analysis.
--- drivers/media/tuners/xc5000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/tuners/xc5000.c +1 -1
@@ -1304,7 +1304,7 @@ static void xc5000_release(struct dvb_frmutex_lock (&xc5000_list_mutex);if (priv) { -cancel_delayed_work (&priv->timer_sleep); +cancel_delayed_work_sync (&priv->timer_sleep);hybrid_tuner_release_state (priv); }
Greg Kroah-Hartman
maintainerPATCH 9/276 media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 79d10f4f21a92e459b2276a77be62c59c1502c9d ]
The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing. During probe failure after timer initialization, these may continue running as orphans and reference the already-freed tc358743_state object through tc358743_irq_poll_timer.
The following is the trace captured by KASAN.
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ>
...
Allocated by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync() to ensure proper termination of timer and work items before resource cleanup.
This bug was initially identified through static analysis. For reproduction and testing, I created a functional emulation of the tc358743 device via a kernel module and introduced faults through the debugfs interface.
--- drivers/media/i2c/tc358743.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/tc358743.c +2 -2
@@ -2201,10 +2201,10 @@ static int tc358743_probe(struct i2c_cli err_work_queues:cec_unregister_adapter (state->cec_adap);if (!state->i2c_client->irq) { -del_timer (&state->timer); +timer_delete_sync (&state->timer);flush_work (&state->work_i2c_poll); } -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);mutex_destroy (&state->confctl_mutex); err_hdl:media_entity_cleanup (&sd->entity);
Greg Kroah-Hartman
maintainerPATCH 10/276 USB: serial: option: add SIMCom 8230C compositions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaowei Li <[email protected]>
commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 upstream.
Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.
USB Device Listings:
0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9078 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb
T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=907b Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01
I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -2114,6 +2114,12 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ .driver_info = RSVD(7) }, + { USB_DEVICE(0x1e0e, 0x9071), /* Simcom SIM8230 RMNET mode */ + .driver_info = RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff), /* Simcom SIM8230 ECM mode */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff), /* Simcom SIM8230 RNDIS mode */ + .driver_info = RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
Greg Kroah-Hartman
maintainerPATCH 11/276 wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <[email protected]>
commit e798f2ac6040f46a04795d7de977341fa9aeabae upstream.
This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver for RTL8188SU. The r8712u driver from staging used to handle this ID.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c +0 -1
@@ -296,7 +296,6 @@ static const struct usb_device_id rtl819 {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/ {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/ {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/ - {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/ {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
Greg Kroah-Hartman
maintainerPATCH 12/276 dm-integrity: limit MAX_TAG_SIZE to 255
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size = ic->tag_size" assignment. We need to limit it to 255.
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -124,7 +124,7 @@ struct journal_sector {commit_id_t commit_id; }; -#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) +#define MAX_TAG_SIZE 255#define METADATA_PADDING_SECTORS 8
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/276 perf subcmd: avoid crash in exclude_cmds when excludes is empty
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: hupu <[email protected]>
[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
When cross-compiling the perf tool for ARM64, perf help may crash with the following assertion failure:
help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
This happens when the perf binary is not named exactly "perf" or when multiple "perf-*" binaries exist in the same directory. In such cases, the excludes command list can be empty, which leads to the final assertion in exclude_cmds() being triggered.
Add a simple guard at the beginning of exclude_cmds() to return early if excludes->cnt is zero, preventing the crash.
--- tools/lib/subcmd/help.c | 3 +++ 1 file changed, 3 insertions(+)
tools/lib/subcmd/help.c +3 -0
@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)size_t ci, cj, ei;int cmp; +if (!excludes->cnt) +return ; + ci = cj = ei =0 ;while (ci < cmds->cnt && ei < excludes->cnt) { cmp =strcmp (cmds->names[ci]->name, excludes->names[ei]->name);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/276 hid: fix I2C read buffer overflow in raw_event() for mcp2221
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Lecomte <[email protected]>
commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 upstream.
As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit.
--- drivers/hid/hid-mcp2221.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/hid-mcp2221.c +4 -0
@@ -791,6 +791,10 @@ static int mcp2221_raw_event(struct hid_ }if (data[2 ] ==MCP2221_I2C_READ_COMPL || data[2 ] ==MCP2221_I2C_READ_PARTIAL ) { +if (!mcp->rxbuf || mcp->rxbuf_idx <0 || data[3 ] >60 ) { + mcp->status = -EINVAL ; +break ; + } buf = mcp->rxbuf;memcpy (&buf[mcp->rxbuf_idx], &data[4 ], data[3 ]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3 ];
Greg Kroah-Hartman
maintainerPATCH 15/276 serial: stm32: allow selecting console when the driver is module
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Gallais-Pou <[email protected]>
commit cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a upstream.
Console can be enabled on the UART compile as module.
Change dependency to allow console mode when the driver is built as module.
--- drivers/tty/serial/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/Kconfig +1 -1
@@ -1438,7 +1438,7 @@ config SERIAL_STM32 config SERIAL_STM32_CONSOLE bool "Support for console on STM32" - depends on SERIAL_STM32=y + depends on SERIAL_STM32 select SERIAL_CORE_CONSOLE config SERIAL_MVEBU_UART
Greg Kroah-Hartman
maintainerPATCH 16/276 staging: axis-fifo: fix maximum TX packet length check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 52ff2b840bc723f3be1f096f8017c78e0515858c upstream.
Since commit 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation"), write() operations with packets larger than 'tx_fifo_depth - 4' words are no longer rejected with -EINVAL.
Fortunately, the packets are not actually getting transmitted to hardware, otherwise they would be raising a 'Transmit Packet Overrun Error' interrupt, which requires a reset of the TX circuit to recover from.
Instead, the request times out inside wait_event_interruptible_timeout() and always returns -EAGAIN, since the wake up condition can never be true for these packets. But still, they unnecessarily block other tasks from writing to the FIFO and the EAGAIN return code signals userspace to retry the write() call, even though it will always fail and time out.
According to the AXI4-Stream FIFO reference manual (PG080), the maximum valid packet length is 'tx_fifo_depth - 4' words, so attempting to send larger packets is invalid and should not be happening in the first place:
Quoted 2 lines
The maximum packet that can be transmitted is limited by the size of the FIFO, which is (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes.
Therefore, bring back the old behavior and outright reject packets larger than 'tx_fifo_depth - 4' with -EINVAL. Add a comment to explain why the check is necessary. The dev_err() message was removed to avoid cluttering the dmesg log if an invalid packet is received from userspace.
--- drivers/staging/axis-fifo/axis-fifo.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +10 -4
@@ -494,11 +494,17 @@ static ssize_t axis_fifo_write(struct fireturn -EINVAL ; } -if (words_to_write > fifo->tx_fifo_depth) { -dev_err (fifo->dt_device,"tried to write more words [%u] than slots in the fifo buffer [%u]\n" , - words_to_write, fifo->tx_fifo_depth); +/* +* In 'Store-and-Forward' mode, the maximum packet that can be +* transmitted is limited by the size of the FIFO, which is +* (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. +* +* Do not attempt to send a packet larger than 'tx_fifo_depth - 4', +* otherwise a 'Transmit Packet Overrun Error' interrupt will be +* raised, which requires a reset of the TX circuit to recover. +*/ +if (words_to_write > (fifo->tx_fifo_depth -4 ))return -EINVAL ; - }if (fifo->write_flags &O_NONBLOCK ) {/*
Greg Kroah-Hartman
maintainerPATCH 17/276 staging: axis-fifo: flush RX FIFO on read errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
commit 82a051e2553b9e297cba82a975d9c538b882c79e upstream.
Flush stale data from the RX FIFO in case of errors, to avoid reading old data when new packets arrive.
Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") removed full FIFO resets from the read error paths, which fixed potential TX data losses, but introduced this RX issue.
--- drivers/staging/axis-fifo/axis-fifo.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/staging/axis-fifo/axis-fifo.c +11 -7
@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available =ioread32 (fifo->base_addr +XLLF_RLR_OFFSET ); + words_available = bytes_available /sizeof (u32);if (!bytes_available) {dev_err (fifo->dt_device,"received a packet of length 0\n" ); ret = -EIO ;
@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fildev_err (fifo->dt_device,"user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n" , bytes_available, len); ret = -EINVAL ; - goto end_unlock; + goto err_flush_rx; }if (bytes_available %sizeof (u32)) {
@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil*/ dev_err (fifo->dt_device,"received a packet that isn't word-aligned\n" ); ret = -EIO ; - goto end_unlock; + goto err_flush_rx; } - words_available = bytes_available /sizeof (u32); -/* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */
@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] =ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); } + words_available -= copy;if (copy_to_user (buf + copied *sizeof (u32), tmp_buf, copy *sizeof (u32))) { ret = -EFAULT ; - goto end_unlock; + goto err_flush_rx; } copied += copy; - words_available -= copy; } +mutex_unlock (&fifo->read_lock); + +return bytes_available; - ret = bytes_available; +err_flush_rx: +while (words_available--) +ioread32 (fifo->base_addr +XLLF_RDFD_OFFSET ); end_unlock:mutex_unlock (&fifo->read_lock);
Greg Kroah-Hartman
maintainerPATCH 18/276 driver core/PM: Set power.no_callbacks along with power.no_pm
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
commit c2ce2453413d429e302659abc5ace634e873f6f5 upstream.
Devices with power.no_pm set are not expected to need any power management at all, so modify device_set_pm_not_required() to set power.no_callbacks for them too in case runtime PM will be enabled for any of them (which in principle may be done for convenience if such a device participates in a dependency chain).
Since device_set_pm_not_required() must be called before device_add() or it would not have any effect, it can update power.no_callbacks without locking, unlike pm_runtime_no_callbacks() that can be called after registering the target device.
--- include/linux/device.h | 3 +++ 1 file changed, 3 insertions(+)
include/linux/device.h +3 -0
@@ -736,6 +736,9 @@ static inline bool device_pm_not_requirestatic inline void device_set_pm_not_required (struct device *dev) { dev->power.no_pm = true; +#ifdef CONFIG_PM + dev->power.no_callbacks = true; +#endif }static inline void dev_pm_syscore_device (struct device *dev,bool val)
Greg Kroah-Hartman
maintainerPATCH 19/276 platform/x86: int3472: Check for adev == NULL
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit cd2fd6eab480dfc247b737cf7a3d6b009c4d0f1c upstream.
Not all devices have an ACPI companion fwnode, so adev might be NULL. This can e.g. (theoretically) happen when a user manually binds one of the int3472 drivers to another i2c/platform device through sysfs.
Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().
--- drivers/platform/x86/intel/int3472/discrete.c | 3 +++ drivers/platform/x86/intel/int3472/tps68470.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/platform/x86/intel/int3472/discrete.c +3 -0
@@ -345,6 +345,9 @@ static int skl_int3472_discrete_probe(ststruct int3472_cldb cldb;int ret; +if (!adev) +return -ENODEV ; + ret =skl_int3472_fill_cldb (adev, &cldb);if (ret) {dev_err (&pdev->dev,"Couldn't fill CLDB structure\n" );
drivers/platform/x86/intel/int3472/tps68470.c +3 -0
@@ -102,6 +102,9 @@ static int skl_int3472_tps68470_probe(stint device_type;int ret; +if (!adev) +return -ENODEV ; + regmap =devm_regmap_init_i2c (client, &tps68470_regmap_config);if (IS_ERR (regmap)) {dev_err (&client->dev,"Failed to create regmap: %ld\n" ,PTR_ERR (regmap));
Greg Kroah-Hartman
maintainerPATCH 20/276 crypto: rng - Ensure set_ent is always present
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit c0d36727bf39bb16ef0a67ed608e279535ebf0da upstream.
Ensure that set_ent is always set since only drbg provides it.
--- crypto/rng.c | 8 ++++++++ 1 file changed, 8 insertions(+)
crypto/rng.c +8 -0
@@ -174,6 +174,11 @@ out:EXPORT_SYMBOL_GPL (crypto_del_default_rng);#endif +static void rng_default_set_ent (struct crypto_rng *tfm,const u8 *data, +unsigned int len) +{ +} +int crypto_register_rng (struct rng_alg *alg) {struct crypto_alg *base = &alg->base;
@@ -185,6 +190,9 @@ int crypto_register_rng(struct rng_alg * base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK ; base->cra_flags |=CRYPTO_ALG_TYPE_RNG ; +if (!alg->set_ent) + alg->set_ent = rng_default_set_ent; +return crypto_register_alg (base); }EXPORT_SYMBOL_GPL (crypto_register_rng);
Greg Kroah-Hartman
maintainerPATCH 21/276 minmax: add in_range() macro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit f9bff0e31881d03badf191d3b0005839391f5f2b upstream.
Patch series "New page table range API", v6.
This patchset changes the API used by the MM to set up page table entries. The four APIs are:
set_ptes(mm, addr, ptep, pte, nr)
update_mmu_cache_range(vma, addr, ptep, nr)
flush_dcache_folio(folio)
flush_icache_pages(vma, page, nr)
flush_dcache_folio() isn't technically new, but no architecture implemented it, so I've done that for them. The old APIs remain around but are mostly implemented by calling the new interfaces.
The new APIs are based around setting up N page table entries at once. The N entries belong to the same PMD, the same folio and the same VMA, so ptep++ is a legitimate operation, and locking is taken care of for you. Some architectures can do a better job of it than just a loop, but I have hesitated to make too deep a change to architectures I don't understand well.
One thing I have changed in every architecture is that PG_arch_1 is now a per-folio bit instead of a per-page bit when used for dcache clean/dirty tracking. This was something that would have to happen eventually, and it makes sense to do it now rather than iterate over every page involved in a cache flush and figure out if it needs to happen.
The point of all this is better performance, and Fengwei Yin has measured improvement on x86. I suspect you'll see improvement on your architecture too. Try the new will-it-scale test mentioned here:
https://lore.kernel.org/linux-mm/[email protected]/
You'll need to run it on an XFS filesystem and have CONFIG_TRANSPARENT_HUGEPAGE set.
This patchset is the basis for much of the anonymous large folio work being done by Ryan, so it's received quite a lot of testing over the last few months.
This patch (of 38):
Determine if a value lies within a range more efficiently (subtraction + comparison vs two comparisons and an AND). It also has useful (under some circumstances) behaviour if the range exceeds the maximum value of the type. Convert all the conflicting definitions of in_range() within the kernel; some can use the generic definition while others need their own definition.
--- arch/arm/mm/pageattr.c | 6 +- drivers/gpu/drm/arm/display/include/malidp_utils.h | 2 drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c | 24 +++++------ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 6 -- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 18 ++++---- drivers/virt/acrn/ioreq.c | 4 - fs/btrfs/misc.h | 2 fs/ext2/balloc.c | 2 fs/ext4/ext4.h | 2 fs/ufs/util.h | 6 -- include/linux/minmax.h | 27 +++++++++++++ lib/logic_pio.c | 3 - net/netfilter/nf_nat_core.c | 6 +- net/tipc/core.h | 2 net/tipc/link.c | 10 ++-- 15 files changed, 63 insertions(+), 57 deletions(-)
arch/arm/mm/pageattr.c +3 -3
@@ -25,7 +25,7 @@ static int change_page_range(pte_t *ptepreturn 0 ; } -static bool in_range (unsigned long start,unsigned long size, +static bool range_in_range (unsigned long start,unsigned long size,unsigned long range_start,unsigned long range_end) { return start >= range_start && start < range_end &&
@@ -46,8 +46,8 @@ static int change_memory_common(unsignedif (!size)return 0 ; -if (!in_range (start, size,MODULES_VADDR ,MODULES_END ) && - !in_range (start, size,VMALLOC_START ,VMALLOC_END )) +if (!range_in_range (start, size,MODULES_VADDR ,MODULES_END ) && + !range_in_range (start, size,VMALLOC_START ,VMALLOC_END ))return -EINVAL ; data.set_mask = set_mask;
drivers/gpu/drm/arm/display/include/malidp_utils.h +1 -1
@@ -35,7 +35,7 @@ static inline void set_range(struct mali rg->end = end; } -static inline bool in_range (struct malidp_range *rg,u32 v) +static inline bool malidp_in_range (struct malidp_range *rg,u32 v) {return (v >= rg->start) && (v <= rg->end); }
drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c +12 -12
@@ -305,12 +305,12 @@ komeda_layer_check_cfg(struct komeda_layif (komeda_fb_check_src_coords (kfb, src_x, src_y, src_w, src_h))return -EINVAL ; -if (!in_range (&layer->hsize_in, src_w)) { +if (!malidp_in_range (&layer->hsize_in, src_w)) {DRM_DEBUG_ATOMIC ("invalidate src_w %d.\n" , src_w);return -EINVAL ; } -if (!in_range (&layer->vsize_in, src_h)) { +if (!malidp_in_range (&layer->vsize_in, src_h)) {DRM_DEBUG_ATOMIC ("invalidate src_h %d.\n" , src_h);return -EINVAL ; }
@@ -452,14 +452,14 @@ komeda_scaler_check_cfg(struct komeda_sc hsize_out = dflow->out_w; vsize_out = dflow->out_h; -if (!in_range (&scaler->hsize, hsize_in) || - !in_range (&scaler->hsize, hsize_out)) { +if (!malidp_in_range (&scaler->hsize, hsize_in) || + !malidp_in_range (&scaler->hsize, hsize_out)) {DRM_DEBUG_ATOMIC ("Invalid horizontal sizes" );return -EINVAL ; } -if (!in_range (&scaler->vsize, vsize_in) || - !in_range (&scaler->vsize, vsize_out)) { +if (!malidp_in_range (&scaler->vsize, vsize_in) || + !malidp_in_range (&scaler->vsize, vsize_out)) {DRM_DEBUG_ATOMIC ("Invalid vertical sizes" );return -EINVAL ; }
@@ -574,13 +574,13 @@ komeda_splitter_validate(struct komeda_sreturn -EINVAL ; } -if (!in_range (&splitter->hsize, dflow->in_w)) { +if (!malidp_in_range (&splitter->hsize, dflow->in_w)) {DRM_DEBUG_ATOMIC ("split in_w:%d is out of the acceptable range.\n" , dflow->in_w);return -EINVAL ; } -if (!in_range (&splitter->vsize, dflow->in_h)) { +if (!malidp_in_range (&splitter->vsize, dflow->in_h)) {DRM_DEBUG_ATOMIC ("split in_h: %d exceeds the acceptable range.\n" , dflow->in_h);return -EINVAL ;
@@ -624,13 +624,13 @@ komeda_merger_validate(struct komeda_merreturn -EINVAL ; } -if (!in_range (&merger->hsize_merged, output->out_w)) { +if (!malidp_in_range (&merger->hsize_merged, output->out_w)) {DRM_DEBUG_ATOMIC ("merged_w: %d is out of the accepted range.\n" , output->out_w);return -EINVAL ; } -if (!in_range (&merger->vsize_merged, output->out_h)) { +if (!malidp_in_range (&merger->vsize_merged, output->out_h)) {DRM_DEBUG_ATOMIC ("merged_h: %d is out of the accepted range.\n" , output->out_h);return -EINVAL ;
@@ -866,8 +866,8 @@ void komeda_complete_data_flow_cfg(struc* input/output range. */ if (dflow->en_scaling && scaler) - dflow->en_split = !in_range (&scaler->hsize, dflow->in_w) || - !in_range (&scaler->hsize, dflow->out_w); + dflow->en_split = !malidp_in_range (&scaler->hsize, dflow->in_w) || + !malidp_in_range (&scaler->hsize, dflow->out_w); } static bool merger_is_available(struct komeda_pipeline *pipe,
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +0 -6
@@ -676,12 +676,6 @@ struct block_header {u32 data[]; }; -/* this should be a general kernel helper */ -static int in_range (u32 addr,u32 start,u32 size) -{ -return addr >= start && addr < start + size; -} -static bool fw_block_mem (struct a6xx_gmu_bo *bo,const struct block_header *blk) {if (!in_range (blk->addr, bo->iova, bo->size))
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +9 -9
@@ -2135,7 +2135,7 @@ static const struct ethtool_ops cxgb_eth .set_link_ksettings = set_link_ksettings, }; -static int in_range (int val,int lo,int hi) +static int cxgb_in_range (int val,int lo,int hi) {return val <0 || (val <= hi && val >= lo); }
@@ -2171,19 +2171,19 @@ static int cxgb_siocdevprivate(struct nereturn -EINVAL ;if (t.qset_idx >=SGE_QSETS )return -EINVAL ; -if (!in_range (t.intr_lat,0 ,M_NEWTIMER ) || - !in_range (t.cong_thres,0 ,255 ) || - !in_range (t.txq_size[0 ],MIN_TXQ_ENTRIES , +if (!cxgb_in_range (t.intr_lat,0 ,M_NEWTIMER ) || + !cxgb_in_range (t.cong_thres,0 ,255 ) || + !cxgb_in_range (t.txq_size[0 ],MIN_TXQ_ENTRIES ,MAX_TXQ_ENTRIES ) || - !in_range (t.txq_size[1 ],MIN_TXQ_ENTRIES , + !cxgb_in_range (t.txq_size[1 ],MIN_TXQ_ENTRIES ,MAX_TXQ_ENTRIES ) || - !in_range (t.txq_size[2 ],MIN_CTRL_TXQ_ENTRIES , + !cxgb_in_range (t.txq_size[2 ],MIN_CTRL_TXQ_ENTRIES ,MAX_CTRL_TXQ_ENTRIES ) || - !in_range (t.fl_size[0 ],MIN_FL_ENTRIES , + !cxgb_in_range (t.fl_size[0 ],MIN_FL_ENTRIES ,MAX_RX_BUFFERS ) || - !in_range (t.fl_size[1 ],MIN_FL_ENTRIES , + !cxgb_in_range (t.fl_size[1 ],MIN_FL_ENTRIES ,MAX_RX_JUMBO_BUFFERS ) || - !in_range (t.rspq_size,MIN_RSPQ_ENTRIES , + !cxgb_in_range (t.rspq_size,MIN_RSPQ_ENTRIES ,MAX_RSPQ_ENTRIES ))return -EINVAL ;
drivers/virt/acrn/ioreq.c +2 -2
@@ -356,7 +356,7 @@ static bool handle_cf8cfc(struct acrn_vmreturn is_handled; } -static bool in_range (struct acrn_ioreq_range *range, +static bool acrn_in_range (struct acrn_ioreq_range *range,struct acrn_io_request *req) {bool ret = false;
@@ -394,7 +394,7 @@ static struct acrn_ioreq_client *find_iolist_for_each_entry (client, &vm->ioreq_clients, list) {read_lock_bh (&client->range_lock);list_for_each_entry (range, &client->range_list, list) { -if (in_range (range, req)) { +if (acrn_in_range (range, req)) { found = client;break ; }
fs/btrfs/misc.h +0 -2
@@ -8,8 +8,6 @@#include <linux/math64.h> #include <linux/rbtree.h> -#define in_range (b, first, len) ((b) >= (first) && (b) < (first) + (len)) -static inline void cond_wake_up (struct wait_queue_head *wq) {/*
fs/ext2/balloc.c +0 -2
@@ -36,8 +36,6 @@*/ -#define in_range (b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1) -struct ext2_group_desc *ext2_get_group_desc (struct super_block * sb,unsigned int block_group,struct buffer_head ** bh)
fs/ext4/ext4.h +0 -2
@@ -3830,8 +3830,6 @@ static inline void set_bitmap_uptodate(sset_bit (BH_BITMAP_UPTODATE , &(bh)->b_state); } -#define in_range (b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1) -/* For ioend & aio unwritten conversion wait queues */ #define EXT4_WQ_HASH_SZ 37#define ext4_ioend_wq (v) (&ext4__ioend_wq[((unsigned long)(v)) %\
fs/ufs/util.h +0 -6
@@ -11,12 +11,6 @@#include <linux/fs.h> #include "swab.h" - -/* -* some useful macros -*/ -#define in_range (b,first,len) ((b)>=(first)&&(b)<(first)+(len)) -/* * functions used for retyping */
include/linux/minmax.h +27 -0
@@ -5,6 +5,7 @@#include <linux/build_bug.h> #include <linux/compiler.h> #include <linux/const.h> +#include <linux/types.h> /* * min()/max()/clamp() macros must accomplish three things:
@@ -192,6 +193,32 @@*/ #define clamp_val (val, lo, hi) clamp_t(typeof(val), val, lo, hi) +static inline bool in_range64 (u64 val,u64 start,u64 len) +{ +return (val - start) < len; +} + +static inline bool in_range32 (u32 val,u32 start,u32 len) +{ +return (val - start) < len; +} + +/** +* in_range - Determine if a value lies within a range. +* @val: Value to test. +* @start: First value in range. +* @len: Number of values in range. +* +* This is more efficient than "if (start <= val && val < (start + len))". +* It also gives a different answer if @start + @len overflows the size of +* the type by a sufficient amount to encompass @val. Decide for yourself +* which behaviour you want, or prove that start + len never overflow. +* Do not blindly replace one form with the other. +*/ +#define in_range (val, start, len) \ + ((sizeof(start) | sizeof(len) | sizeof(val)) <= sizeof(u32) ? \ + in_range32(val, start, len) : in_range64(val, start, len)) +/** * swap - swap values of @a and @b * @a: first value
lib/logic_pio.c +0 -3
@@ -20,9 +20,6 @@static LIST_HEAD (io_range_list);static DEFINE_MUTEX (io_range_mutex); -/* Consider a kernel general helper for this */ -#define in_range (b, first, len) ((b) >= (first) && (b) < (first) + (len)) -/** * logic_pio_register_range - register logical PIO range for a host * @new_range: pointer to the IO range to be registered.
net/netfilter/nf_nat_core.c +3 -3
@@ -242,7 +242,7 @@ static bool l4proto_in_range(const struc/* If we source map this tuple so reply looks like reply_tuple, will * that meet the constraints of range. */ -static int in_range (const struct nf_conntrack_tuple *tuple, +static int nf_in_range (const struct nf_conntrack_tuple *tuple,const struct nf_nat_range2 *range) {/* If we are supposed to map IPs, then we must be in the
@@ -291,7 +291,7 @@ find_appropriate_src(struct net *net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple); result->dst = tuple->dst; -if (in_range (result, range)) +if (nf_in_range (result, range))return 1 ; } }
@@ -523,7 +523,7 @@ get_unique_tuple(struct nf_conntrack_tupif (maniptype ==NF_NAT_MANIP_SRC && !(range->flags &NF_NAT_RANGE_PROTO_RANDOM_ALL )) {/* try the original tuple first */ -if (in_range (orig_tuple, range)) { +if (nf_in_range (orig_tuple, range)) {if (!nf_nat_used_tuple (orig_tuple, ct)) { *tuple = *orig_tuple;return ;
net/tipc/core.h +1 -1
@@ -197,7 +197,7 @@ static inline int less(u16 left, u16 rigreturn less_eq (left, right) && (mod (right) !=mod (left)); } -static inline int in_range (u16 val,u16 min,u16 max) +static inline int tipc_in_range (u16 val,u16 min,u16 max) {return !less (val, min) && !more (val, max); }
net/tipc/link.c +5 -5
@@ -1623,7 +1623,7 @@ next_gap_ack: last_ga->bgack_cnt); }/* Check against the last Gap ACK block */ -if (in_range (seqno, start, end)) +if (tipc_in_range (seqno, start, end))continue ;/* Update/release the packet peer is acking */ bc_has_acked = true;
@@ -2251,12 +2251,12 @@ static int tipc_link_proto_rcv(struct tistrncpy (if_name, data,TIPC_MAX_IF_NAME );/* Update own tolerance if peer indicates a non-zero value */ -if (in_range (peers_tol,TIPC_MIN_LINK_TOL ,TIPC_MAX_LINK_TOL )) { +if (tipc_in_range (peers_tol,TIPC_MIN_LINK_TOL ,TIPC_MAX_LINK_TOL )) { l->tolerance = peers_tol; l->bc_rcvlink->tolerance = peers_tol; }/* Update own priority if peer's priority is higher */ -if (in_range (peers_prio, l->priority +1 ,TIPC_MAX_LINK_PRI )) +if (tipc_in_range (peers_prio, l->priority +1 ,TIPC_MAX_LINK_PRI )) l->priority = peers_prio;/* If peer is going down we want full re-establish cycle */
@@ -2299,13 +2299,13 @@ static int tipc_link_proto_rcv(struct ti l->rcv_nxt_state =msg_seqno (hdr) +1 ;/* Update own tolerance if peer indicates a non-zero value */ -if (in_range (peers_tol,TIPC_MIN_LINK_TOL ,TIPC_MAX_LINK_TOL )) { +if (tipc_in_range (peers_tol,TIPC_MIN_LINK_TOL ,TIPC_MAX_LINK_TOL )) { l->tolerance = peers_tol; l->bc_rcvlink->tolerance = peers_tol; }/* Update own prio if peer indicates a different value */ if ((peers_prio != l->priority) && -in_range (peers_prio,1 ,TIPC_MAX_LINK_PRI )) { +tipc_in_range (peers_prio,1 ,TIPC_MAX_LINK_PRI )) { l->priority = peers_prio; rc =tipc_link_fsm_evt (l,LINK_FAILURE_EVT ); }
Greg Kroah-Hartman
maintainerPATCH 22/276 net/9p: fix double req put in p9_fd_cancelled
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nalivayko Sergey <[email protected]>
commit 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 upstream.
Syzkaller reports a KASAN issue as below:
general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734 Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
This happens because of a race condition between:
- The 9p client sending an invalid flush request and later cleaning it up;
- The 9p client in p9_read_work() canceled all pending requests.
Thread 1 Thread 2
...
p9_client_create()
...
p9_fd_create()
...
p9_conn_create()
...
// start Thread 2
INIT_WORK(&m->rq, p9_read_work);
p9_read_work()
...
p9_client_rpc()
...
...
p9_conn_cancel()
...
spin_lock(&m->req_lock);
...
p9_fd_cancelled()
...
...
spin_unlock(&m->req_lock);
// status rewrite
p9_client_cb(m->client, req, REQ_STATUS_ERROR)
// first remove
list_del(&req->req_list);
...
spin_lock(&m->req_lock)
...
// second remove
list_del(&req->req_list);
spin_unlock(&m->req_lock)...
Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD.
Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Message-ID: <[email protected]>
--- net/9p/trans_fd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/9p/trans_fd.c +4 -4
@@ -722,10 +722,10 @@ static int p9_fd_cancelled(struct p9_clip9_debug (P9_DEBUG_TRANS ,"client %p req %p\n" , client, req);spin_lock (&m->req_lock); -/* Ignore cancelled request if message has been received -* before lock. -*/ -if (req->status ==REQ_STATUS_RCVD ) { +/* Ignore cancelled request if status changed since the request was +* processed in p9_client_flush() +*/ +if (req->status !=REQ_STATUS_SENT ) {spin_unlock (&m->req_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/276 filelock: add FL_RECLAIM to show_fl_flags() macro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
Show the FL_RECLAIM flag symbolically in tracepoints.
--- include/trace/events/filelock.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/trace/events/filelock.h +2 -1
@@ -27,7 +27,8 @@ { FL_SLEEP, "FL_SLEEP" }, \ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ - { FL_OFDLCK, "FL_OFDLCK" }) + { FL_OFDLCK, "FL_OFDLCK" }, \ + { FL_RECLAIM, "FL_RECLAIM"}) #define show_fl_type(val) \ __print_symbolic(val, \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/276 selftests: arm64: Check fread return value in exec_target
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bala-Vignesh-Reddy <[email protected]>
[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
Fix -Wunused-result warning generated when compiled with gcc 13.3.0, by checking fread's return value and handling errors, preventing potential failures when reading from stdin.
Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute 'warn_unused_result' [-Wunused-result]
--- tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
tools/testing/selftests/arm64/pauth/exec_target.c +6 -1
@@ -13,7 +13,12 @@ int main(void)unsigned long hwcaps;size_t val; -fread (&val,sizeof (size_t ),1 , stdin); +size_t size =fread (&val,sizeof (size_t ),1 , stdin); + +if (size !=1 ) { +fprintf (stderr,"Could not read input from stdin\n" ); +return EXIT_FAILURE ; + }/* don't try to execute illegal (unimplemented) instructions) caller * should have checked this and keep worker simple
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/276 coresight: trbe: Prevent overflow in PERF_IDX2OFF()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
--- drivers/hwtracing/coresight/coresight-trbe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-trbe.c +2 -1
@@ -18,7 +18,8 @@#include <asm/barrier.h> #include "coresight-trbe.h" -#define PERF_IDX2OFF (idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) +#define PERF_IDX2OFF (idx, buf) \ + ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))/* * A padding packet that will help the user space tools
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/276 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
--- drivers/perf/arm_spe_pmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/perf/arm_spe_pmu.c +2 -1
@@ -93,7 +93,8 @@ struct arm_spe_pmu {#define to_spe_pmu (p) (container_of(p, struct arm_spe_pmu, pmu))/* Convert a free-running index from perf into an SPE buffer offset */ -#define PERF_IDX2OFF (idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) +#define PERF_IDX2OFF (idx, buf) \ + ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))/* Keep track of our dynamic hotplug state */ static enum cpuhp_state arm_spe_pmu_online;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/276 x86/vdso: Fix output operand size of RDPID
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
RDPID instruction outputs to a word-sized register (64-bit on x86_64 and 32-bit on x86_32). Use an unsigned long variable to store the correct size.
LSL outputs to 32-bit register, use %k operand prefix to always print the 32-bit name of the register.
Use RDPID insn mnemonic while at it as the minimum binutils version of 2.30 supports it.
[ bp: Merge two patches touching the same function into a single one. ]
--- arch/x86/include/asm/segment.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/include/asm/segment.h +4 -4
@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)static inline void vdso_read_cpunode (unsigned *cpu,unsigned *node) { -unsigned int p; +unsigned long p;/* * Load CPU and node number from the GDT. LSL is faster than RDTSCP
@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)* * If RDPID is available, use it. */ -alternative_io ("lsl %[seg],%[p]" , -".byte 0xf3,0x0f,0xc7,0xf8" ,/* RDPID %eax/rax */ +alternative_io ("lsl %[seg],%k[p]" , +"rdpid %[p]" , X86_FEATURE_RDPID, - [p] "=a" (p), [seg] "r" (__CPUNODE_SEG)); + [p] "=r" (p), [seg] "r" (__CPUNODE_SEG)); if (cpu) *cpu = (p & VDSO_CPUNODE_MASK);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/276 regmap: Remove superfluous check for !config in __regmap_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
The first thing __regmap_init() do is check if config is non-NULL, so there is no need to check for this again later.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -888,7 +888,7 @@ struct regmap *__regmap_init(struct device *dev, map->read_flag_mask = bus->read_flag_mask; } -if (config && config->read && config->write) { +if (config->read && config->write) { map->reg_read = _regmap_bus_read;/* Bulk read/write */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/276 libbpf: Fix reuse of DEVMAP
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yureka Lilian <[email protected]>
[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
Previously, re-using pinned DEVMAP maps would always fail, because get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set, but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from get_map_info when checking for compatibility with an existing DEVMAP.
The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930
--- tools/lib/bpf/libbpf.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
tools/lib/bpf/libbpf.c +10 -0
@@ -4485,6 +4485,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)return false; } +/* +* bpf_get_map_info_by_fd() for DEVMAP will always return flags with +* BPF_F_RDONLY_PROG set, but it generally is not set at map creation time. +* Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from +* bpf_get_map_info_by_fd() when checking for compatibility with an +* existing DEVMAP. +*/ +if (map->def.type ==BPF_MAP_TYPE_DEVMAP || map->def.type ==BPF_MAP_TYPE_DEVMAP_HASH ) + map_info.map_flags &= ~BPF_F_RDONLY_PROG ; + return (map_info.type == map->def.type && map_info.key_size == map->def.key_size && map_info.value_size == map->def.value_size &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/276 cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
Broadcom STB platforms were early adopters (2017) of the SCMI framework and as a result, not all deployed systems have a Device Tree entry where SCMI protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the CPU Device Tree node(s) referencing protocol 0x13 as their clock provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
For those platforms, we allow the checks done by scmi_dev_used_by_cpus() to continue, and in the event of not having done an early return, we key off the documented compatible string and give them a pass to continue to use scmi-cpufreq.
--- drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/cpufreq/scmi-cpufreq.c +10 -0
@@ -15,6 +15,7 @@#include <linux/energy_model.h> #include <linux/export.h> #include <linux/module.h> +#include <linux/of.h> #include <linux/pm_opp.h> #include <linux/slab.h> #include <linux/scmi_protocol.h>
@@ -319,6 +320,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)return true; } +/* +* Older Broadcom STB chips had a "clocks" property for CPU node(s) +* that did not match the SCMI performance protocol node, if we got +* there, it means we had such an older Device Tree, therefore return +* true to preserve backwards compatibility. +*/ +if (of_machine_is_compatible ("brcm,brcmstb" )) +return true; +return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/276 ACPI: processor: idle: Fix memory leak when register cpuidle device failed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huisong Li <[email protected]>
[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
The cpuidle device's memory is leaked when cpuidle device registration fails in acpi_processor_power_init(). Free it as appropriate.
--- drivers/acpi/processor_idle.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/processor_idle.c +3 -0
@@ -1403,6 +1403,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)if (retval) {if (acpi_processor_registered ==0 )cpuidle_unregister_driver (&acpi_idle_driver); + +per_cpu (acpi_cpuidle_device, pr->id) =NULL ; +kfree (dev);return retval; } acpi_processor_registered++;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/276 soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sneh Mankad <[email protected]>
[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a transaction completes. Previously this bit was only cleared when a wake TCS was borrowed as an AMC TCS but not for dedicated AMC TCS. Leaving this bit set for AMC TCS and entering deeper low power modes can generate a false completion IRQ.
Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER bit upon receiving a completion IRQ.
--- drivers/soc/qcom/rpmh-rsc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/soc/qcom/rpmh-rsc.c +2 -5
@@ -415,13 +415,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)trace_rpmh_tx_done (drv, i, req, err); -/* -* If wake tcs was re-purposed for sending active -* votes, clear AMC trigger & enable modes and +/* Clear AMC trigger & enable modes and * disable interrupt for this TCS */ -if (!drv->tcs[ACTIVE_TCS ].num_tcs) -__tcs_set_trigger (drv, i, false); +__tcs_set_trigger (drv, i, false); skip:/* Reclaim the TCS */ write_tcs_reg (drv,RSC_DRV_CMD_ENABLE , i,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/276 pinctrl: meson-gxl: add missing i2c_d pinmux
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Da Xue <[email protected]>
[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
--- drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/pinctrl/meson/pinctrl-meson-gxl.c +10 -0
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };static const unsigned int i2c_sck_c_dv19_pins[] = {GPIODV_19 };static const unsigned int i2c_sda_c_dv18_pins[] = {GPIODV_18 }; +static const unsigned int i2c_sck_d_pins[] = {GPIOX_11 }; +static const unsigned int i2c_sda_d_pins[] = {GPIOX_10 }; +static const unsigned int eth_mdio_pins[] = {GPIOZ_0 };static const unsigned int eth_mdc_pins[] = {GPIOZ_1 };static const unsigned int eth_clk_rx_clk_pins[] = {GPIOZ_2 };
@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {GPIO_GROUP (GPIO_TEST_N ),/* Bank X */ +GROUP (i2c_sda_d,5 ,5 ), +GROUP (i2c_sck_d,5 ,4 ),GROUP (sdio_d0,5 ,31 ),GROUP (sdio_d1,5 ,30 ), GROUP(sdio_d2, 5, 29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = { "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19", }; +static const char *const i2c_d_groups[] = { +"i2c_sck_d" ,"i2c_sda_d" , +}; +static const char *const eth_groups[] = {"eth_mdio" ,"eth_mdc" ,"eth_clk_rx_clk" ,"eth_rx_dv" ,"eth_rxd0" ,"eth_rxd1" ,"eth_rxd2" ,"eth_rxd3" ,
@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {FUNCTION (i2c_a),FUNCTION (i2c_b),FUNCTION (i2c_c), +FUNCTION (i2c_d),FUNCTION (eth),FUNCTION (pwm_a), FUNCTION(pwm_b),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/276 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning:
kernfs: can not remove 'nr_tags', no directory
WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk]
kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it.
--- block/blk-mq-sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
block/blk-mq-sysfs.c +4 -2
@@ -178,9 +178,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)return ;hctx_for_each_ctx (hctx, ctx, i) -kobject_del (&ctx->kobj); +if (ctx->kobj.state_in_sysfs) +kobject_del (&ctx->kobj); -kobject_del (&hctx->kobj); +if (hctx->kobj.state_in_sysfs) +kobject_del (&hctx->kobj); }static int blk_mq_register_hctx (struct blk_mq_hw_ctx *hctx)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/276 ARM: at91: pm: fix MCKx restore routine
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
The at91_mckx_ps_restore() assembly function is responsible for setting back MCKx system bus clocks after exiting low power modes.
Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx to previously saved state.
Tmp2 was used without the needed changes in CSS and DIV. Moreover the required bit 7, telling that MCR register's content is to be changed (CMD/write), was not set.
Fix function comment to match tmp variables actually used.
--- arch/arm/mach-at91/pm_suspend.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-at91/pm_suspend.S +2 -2
@@ -868,7 +868,7 @@ e_done: /** * at91_mckx_ps_restore: restore MCK1..4 settings * - * Side effects: overwrites tmp1, tmp2 + * Side effects: overwrites tmp1, tmp2 and tmp3 */ .macro at91_mckx_ps_restore #ifdef CONFIG_SOC_SAMA7
@@ -912,7 +912,7 @@ r_ps: bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK orr tmp3, tmp3, tmp1 orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD - str tmp2, [pmc, #AT91_PMC_MCR_V2] + str tmp3, [pmc, #AT91_PMC_MCR_V2] wait_mckrdy tmp1
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/276 regulator: scmi: Use int type to store negative error codes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
Change the 'ret' variable from u32 to int to store negative error codes or zero returned by of_property_read_u32().
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- drivers/regulator/scmi-regulator.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/regulator/scmi-regulator.c +2 -1
@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,struct device_node *np, struct scmi_regulator_info *rinfo) { - u32 dom, ret; + u32 dom; +int ret; ret =of_property_read_u32 (np,"reg" , &dom);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/276 block: use int to store blk_stack_limits() return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
Change the 'ret' variable in blk_stack_limits() from unsigned int to int, as it needs to store negative value -1.
Storing the negative error codes in unsigned type, or performing equality comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- block/blk-settings.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-settings.c +2 -1
@@ -514,7 +514,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbint blk_stack_limits (struct queue_limits *t,struct queue_limits *b,sector_t start) { -unsigned int top, bottom, alignment, ret =0 ; +unsigned int top, bottom, alignment; +int ret =0 ; t->max_sectors =min_not_zero (t->max_sectors, b->max_sectors); t->max_hw_sectors =min_not_zero (t->max_hw_sectors, b->max_hw_sectors);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/276 PM: sleep: core: Clear power.must_resume in noirq suspend error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet.
If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume).
Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state.
--- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/base/power/main.c +13 -1
@@ -601,8 +601,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool aif (dev->power.syscore || dev->power.direct_complete) goto Out; -if (!dev->power.is_noirq_suspended) +if (!dev->power.is_noirq_suspended) { +/* +* This means that system suspend has been aborted in the noirq +* phase before invoking the noirq suspend callback for the +* device, so if device_suspend_late() has left it in suspend, +* device_resume_early() should leave it in suspend either in +* case the early resume of it depends on the noirq resume that +* has not run. +*/ +if (dev_pm_skip_suspend (dev)) + dev->power.must_resume = false; + goto Out; + }if (!dpm_wait_for_superior (dev, async)) goto Out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/276 pinctrl: renesas: Use int type to store negative error codes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned int to int, as it needs to store either negative error codes or zero returned by sh_pfc_pinconf_set().
No effect on runtime.
--- drivers/pinctrl/renesas/pinctrl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/renesas/pinctrl.c +2 -1
@@ -755,7 +755,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,struct sh_pfc_pinctrl *pmx =pinctrl_dev_get_drvdata (pctldev);const unsigned int *pins;unsigned int num_pins; -unsigned int i, ret; +unsigned int i; +int ret; pins = pmx->pfc->info->groups[group].pins; num_pins = pmx->pfc->info->groups[group].nr_pins;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/276 firmware: firmware: meson-sm: fix compile-test default
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
Enabling compile testing should not enable every individual driver (we have "allyesconfig" for that).
--- drivers/firmware/meson/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/meson/Kconfig +1 -1
@@ -5,7 +5,7 @@ config MESON_SM tristate "Amlogic Secure Monitor driver" depends on ARCH_MESON || COMPILE_TEST - default y + default ARCH_MESON depends on ARM64_4K_PAGES help Say y here to enable the Amlogic secure monitor driver
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/276 arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
This devicetree contained only the SoC compatible but lacked the machine specific one: add a "mediatek,mt8516-pumpkin" compatible to the list to fix dtbs_check warnings.
--- arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts +1 -1
@@ -11,7 +11,7 @@ / { model = "Pumpkin MT8516"; - compatible = "mediatek,mt8516"; + compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516"; memory@40000000 { device_type = "memory";
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/276 pwm: tiehrpwm: Fix corner case in clock divisor calculation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
The function set_prescale_div() is responsible for calculating the clock divisor settings such that the input clock rate is divided down such that the required period length is at most 0x10000 clock ticks. If period_cycles is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is good enough. So round up in the calculation of the required divisor and compare it using >= instead of >.
--- drivers/pwm/pwm-tiehrpwm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pwm/pwm-tiehrpwm.c +2 -2
@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div, *prescale_div = (1 << clkdiv) * (hspclkdiv ? (hspclkdiv *2 ) :1 ); -if (*prescale_div > rqst_prescaler) { +if (*prescale_div >= rqst_prescaler) { *tb_clk_div = (clkdiv <<TBCTL_CLKDIV_SHIFT ) | (hspclkdiv <<TBCTL_HSPCLKDIV_SHIFT );return 0 ;
@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, pc->period_cycles[pwm->hwpwm] = period_cycles;/* Configure clock prescaler to support Low frequency PWM wave */ -if (set_prescale_div (period_cycles/PERIOD_MAX , &ps_divval, +if (set_prescale_div (DIV_ROUND_UP (period_cycles,PERIOD_MAX ), &ps_divval, &tb_divval)) {dev_err (chip->dev,"Unsupported values\n" );return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/276 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
In the current code, only one put work item is queued at a time, which results in a leaked reference.
To fix this, move the work item to the nvmet_fc_ls_req_op struct, which already tracks all resources related to the command.
--- drivers/nvme/target/fc.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/nvme/target/fc.c +9 -10
@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */int ls_error;struct list_head lsreq_list;/* tgtport->ls_req_list */ bool req_queued; + +struct work_struct put_work; };
@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {struct nvmet_fc_port_entry *pe;struct kref ref;u32 max_sg_cnt; - -struct work_struct put_work; };struct nvmet_fc_port_entry {
@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);static void nvmet_fc_tgt_q_put (struct nvmet_fc_tgt_queue *queue);static int nvmet_fc_tgt_q_get (struct nvmet_fc_tgt_queue *queue);static void nvmet_fc_tgtport_put (struct nvmet_fc_tgtport *tgtport); -static void nvmet_fc_put_tgtport_work (struct work_struct *work) +static void nvmet_fc_put_lsop_work (struct work_struct *work) { -struct nvmet_fc_tgtport *tgtport = - container_of(work, struct nvmet_fc_tgtport, put_work); +struct nvmet_fc_ls_req_op *lsop = + container_of(work, struct nvmet_fc_ls_req_op, put_work); -nvmet_fc_tgtport_put (tgtport); +nvmet_fc_tgtport_put (lsop->tgtport); +kfree (lsop); }static int nvmet_fc_tgtport_get (struct nvmet_fc_tgtport *tgtport); static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) DMA_BIDIRECTIONAL); out_putwork: -queue_work (nvmet_wq, &tgtport->put_work); +queue_work (nvmet_wq, &lsop->put_work); } static int
@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport, lsreq->done = done; lsop->req_queued = false;INIT_LIST_HEAD (&lsop->lsreq_list); +INIT_WORK (&lsop->put_work, nvmet_fc_put_lsop_work); lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr, lsreq->rqstlen + lsreq->rsplen,
@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)__nvmet_fc_finish_ls_req (lsop);/* fc-nvme target doesn't care about success or failure of cmd */ - -kfree (lsop); }/*
@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,kref_init (&newrec->ref);ida_init (&newrec->assoc_cnt); newrec->max_sg_cnt = template->max_sgl_segments; -INIT_WORK (&newrec->put_work, nvmet_fc_put_tgtport_work); ret =nvmet_fc_alloc_ls_iodlist (newrec);if (ret) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/276 i3c: master: svc: Recycle unused IBI slot
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <[email protected]>
[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool to store the IBI payload. However, when an error condition is encountered, the function returns without recycling the IBI slot, resulting in an IBI slot leak.
--- drivers/i3c/master/svc-i3c-master.c | 1 + 1 file changed, 1 insertion(+)
drivers/i3c/master/svc-i3c-master.c +1 -0
@@ -308,6 +308,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);if (ret) {dev_err (master->dev,"Timeout when polling for COMPLETE\n" ); +i3c_generic_ibi_recycle_slot (data->ibi_pool, slot);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/276 selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhilesh Patil <[email protected]>
[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
Check if watchdog device supports WDIOF_KEEPALIVEPING option before entering keep_alive() ping test loop. Fix watchdog-test silently looping if ioctl based ping is not supported by the device. Exit from test in such case instead of getting stuck in loop executing failing keep_alive()
watchdog_info:
identity: m41t93 rtc Watchdog
firmware_version: 0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.WDIOC_KEEPALIVE not supported by this device
without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)
Updated change log at commit time:
Shuah Khan <[email protected]>
--- tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/watchdog/watchdog-test.c +6 -0
@@ -240,6 +240,12 @@ int main(int argc, char *argv[])if (oneshot) goto end; +/* Check if WDIOF_KEEPALIVEPING is supported */ +if (!(info.options &WDIOF_KEEPALIVEPING )) { +printf ("WDIOC_KEEPALIVE not supported by this device\n" ); + goto end; + } +printf ("Watchdog Ticking Away!\n" );/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/276 bpf: Explicitly check accesses to bpf_sock_addr
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <[email protected]>
[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
Syzkaller found a kernel warning on the following sock_addr program:
0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exitwhich triggers:
verifier bug: error during ctx access conversion (0)
This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access.
This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access.
I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
--- net/core/filter.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/core/filter.c +10 -6
@@ -8595,13 +8595,17 @@ static bool sock_addr_is_valid_access(int off, int size,return false; info->reg_type =PTR_TO_SOCKET ;break ; -default : -if (type ==BPF_READ ) { -if (size != size_default) -return false; - }else { + case bpf_ctx_range(struct bpf_sock_addr, user_family): + case bpf_ctx_range(struct bpf_sock_addr, family): + case bpf_ctx_range(struct bpf_sock_addr, type): + case bpf_ctx_range(struct bpf_sock_addr, protocol): +if (type !=BPF_READ )return false; - } +if (size != size_default) +return false; +break ; +default : +return false; }return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/276 smp: Fix up and expand the smp_call_function_many() kerneldoc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
The smp_call_function_many() kerneldoc comment got out of sync with the function definition (bool parameter "wait" is incorrectly described as a bitmask in it), so fix it up by copying the "wait" description from the smp_call_function() kerneldoc and add information regarding the handling of the local CPU to it.
--- kernel/smp.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
kernel/smp.c +5 -6
@@ -976,16 +976,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,* @mask: The set of cpus to run on (only runs on online subset). * @func: The function to run. This must be fast and non-blocking. * @info: An arbitrary pointer to pass to the function. -* @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait -* (atomically) until function has completed on other CPUs. If -* %SCF_RUN_LOCAL is set, the function will also be run locally -* if the local CPU is set in the @cpumask. -* -* If @wait is true, then returns once @func has returned. +* @wait: If true, wait (atomically) until function has completed +* on other CPUs. * * You must not call this function with disabled interrupts or from a * hardware interrupt handler or from a bottom half handler. Preemption * must be disabled when calling this function. +* +* @func is not called on the local CPU even if @mask contains it. Consider +* using on_each_cpu_cond_mask() instead if this is not desirable. */ void smp_call_function_many (const struct cpumask *mask,smp_call_func_t func,void *info,bool wait)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/276 tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyi Zhou <[email protected]>
[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t") made nolibc use the kernel's time type so that time_t matches timespec::tv_sec on all ABIs (notably x32).
But since __kernel_old_time_t is fairly new, notably from 2020 in commit 94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"), nolibc builds that rely on host headers may fail.
Switch to __kernel_time_t, which is the same as __kernel_old_time_t and has existed for longer.
Tested in PPC VM of Open Source Lab of Oregon State University (./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
--- tools/include/nolibc/std.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/include/nolibc/std.h +1 -1
@@ -46,6 +46,6 @@ typedef unsigned long nlink_t;typedef signed long off_t ;typedef signed long blksize_t ;typedef signed long blkcnt_t ; -typedef __kernel_old_time_t time_t ; +typedef __kernel_time_t time_t ;#endif /* _NOLIBC_STD_H */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/276 thermal/drivers/qcom: Make LMH select QCOM_SCM
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
The QCOM_SCM symbol is not user-visible, so it makes little sense to depend on it. Make LMH driver select QCOM_SCM as all other drivers do and, as the dependecy is now correctly handled, enable || COMPILE_TEST in order to include the driver into broader set of build tests.
--- drivers/thermal/qcom/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/thermal/qcom/Kconfig +2 -1
@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM config QCOM_LMH tristate "Qualcomm Limits Management Hardware" - depends on ARCH_QCOM && QCOM_SCM + depends on ARCH_QCOM || COMPILE_TEST + select QCOM_SCM help This enables initialization of Qualcomm limits management hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/276 thermal/drivers/qcom/lmh: Add missing IRQ includes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
As reported by LKP, the Qualcomm LMH driver needs to include several IRQ-related headers, which decrlare necessary IRQ functionality. Currently driver builds on ARM64 platforms, where the headers are pulled in implicitly by other headers, but fails to build on other platforms.
--- drivers/thermal/qcom/lmh.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/thermal/qcom/lmh.c +2 -0
@@ -5,6 +5,8 @@*/ #include <linux/module.h> #include <linux/interrupt.h> +#include <linux/irq.h> +#include <linux/irqdesc.h> #include <linux/irqdomain.h> #include <linux/err.h> #include <linux/platform_device.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/276 i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leilk.Liu <[email protected]>
[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
The old IC does not support the I2C_MASTER_WRRD (write-then-read) function, but the current code’s handling of i2c->auto_restart may potentially lead to entering the I2C_MASTER_WRRD software flow, resulting in unexpected bugs.
Instead of repurposing the auto_restart flag, add a separate flag to signal I2C_MASTER_WRRD operations.
Also fix handling of msgs. If the operation (i2c->op) is I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. For all other operations, msgs is simply incremented by 1.
--- drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/i2c/busses/i2c-mt65xx.c +10 -7
@@ -1067,6 +1067,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap, {int ret;int left_num = num; +bool write_then_read_en = false;struct mtk_i2c *i2c =i2c_get_adapdata (adap); ret =mtk_i2c_clock_enable (i2c);
@@ -1080,6 +1081,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (!(msgs[0 ].flags &I2C_M_RD ) && (msgs[1 ].flags &I2C_M_RD ) && msgs[0 ].addr == msgs[1 ].addr) { i2c->auto_restart =0 ; + write_then_read_en = true; } }
@@ -1104,12 +1106,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,else i2c->op =I2C_MASTER_WR ; -if (!i2c->auto_restart) { -if (num >1 ) { -/* combined two messages into one transaction */ - i2c->op =I2C_MASTER_WRRD ; - left_num--; - } +if (write_then_read_en) { +/* combined two messages into one transaction */ + i2c->op =I2C_MASTER_WRRD ; + left_num--; }/* always use DMA mode. */
@@ -1117,7 +1117,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,if (ret <0 ) goto err_exit; - msgs++; +if (i2c->op ==I2C_MASTER_WRRD ) + msgs +=2 ; +else + msgs++; }/* the return value is number of executed messages */ ret = num;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/276 i2c: designware: Add disabling clocks when probe fails
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <[email protected]>
[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is called. However, this function doesn't disable clocks and the clock-enable count keeps increasing. Should disable these clocks explicitly.
--- drivers/i2c/busses/i2c-designware-platdrv.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-designware-platdrv.c +1 -0
@@ -322,6 +322,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev) exit_probe:dw_i2c_plat_pm_cleanup (dev); +i2c_dw_prepare_clk (dev, false); exit_reset:reset_control_assert (dev->rst);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/276 drm/radeon/r600_cs: clean up of dead code in r600_cs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
GCC 16 enables -Werror=unused-but-set-variable= which results in build error with the following message.
drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
1411 | unsigned offset, i, level;
| ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
level although is set, but in never used in the function r600_texture_size. Thus resulting in dead code and this error getting triggered.
--- drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/r600_cs.c +2 -2
@@ -1410,7 +1410,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, unsigned block_align, unsigned height_align, unsigned base_align, unsigned *l0_size, unsigned *mipmap_size) { - unsigned offset, i, level; + unsigned offset, i;unsigned width, height, depth, size;unsigned blocksize;unsigned nbx, nby;
@@ -1422,7 +1422,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel, w0 =r600_mip_minify (w0,0 ); h0 =r600_mip_minify (h0,0 ); d0 =r600_mip_minify (d0,0 ); -for (i =0 , offset =0 , level = blevel; i < nlevels; i++, level++) { +for (i =0 , offset =0 ; i < nlevels; i++) { width =r600_mip_minify (w0, i); nbx =r600_fmt_get_nblocksx (format, width);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/276 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.
--- drivers/usb/host/max3421-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/max3421-hcd.c +1 -1
@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)if (hcd) {kfree (max3421_hcd->tx);kfree (max3421_hcd->rx); -if (max3421_hcd->spi_thread) +if (!IS_ERR_OR_NULL (max3421_hcd->spi_thread))kthread_stop (max3421_hcd->spi_thread);usb_put_hcd (hcd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/276 scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports:
UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]'
on rmmod when using an expander.
For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id.
I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander).
E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30.
The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander.
Thus, we can only clear phy_attached for devices that are directly attached.
--- drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_sas.c +8 -1
@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)unsigned long flags =0 ;struct pm8001_hba_info *pm8001_ha;struct pm8001_device *pm8001_dev = dev->lldd_dev; +struct domain_device *parent_dev = dev->parent; pm8001_ha =pm8001_find_ha_by_dev (dev);spin_lock_irqsave (&pm8001_ha->lock, flags);
@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)spin_lock_irqsave (&pm8001_ha->lock, flags); }PM8001_CHIP_DISP ->dereg_dev_req (pm8001_ha, device_id); - pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ; + +/* +* The phy array only contains local phys. Thus, we cannot clear +* phy_attached for a device behind an expander. +*/ +if (!(parent_dev &&dev_is_expander (parent_dev->dev_type))) + pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached =0 ;pm8001_free_dev (pm8001_dev); }else {pm8001_dbg (pm8001_ha,DISC ,"Found dev has gone.\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/276 scsi: myrs: Fix dma_alloc_coherent() error check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
Check for NULL return value with dma_alloc_coherent(), because DMA address is not always set by dma_alloc_coherent() on failure.
--- drivers/scsi/myrs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/myrs.c +4 -4
@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,/* Temporary dma mapping, used only in the scope of this function */ mbox =dma_alloc_coherent (&pdev->dev,sizeof (union myrs_cmd_mbox ), &mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, mbox_addr)) +if (!mbox)return false;/* These are the base addresses for the command memory mailbox array */ cs->cmd_mbox_size =MYRS_MAX_CMD_MBOX *sizeof (union myrs_cmd_mbox ); cmd_mbox =dma_alloc_coherent (&pdev->dev, cs->cmd_mbox_size, &cs->cmd_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->cmd_mbox_addr)) { +if (!cmd_mbox) {dev_err (&pdev->dev,"Failed to map command mailbox\n" ); goto out_free; }
@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->stat_mbox_size =MYRS_MAX_STAT_MBOX *sizeof (struct myrs_stat_mbox ); stat_mbox =dma_alloc_coherent (&pdev->dev, cs->stat_mbox_size, &cs->stat_mbox_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->stat_mbox_addr)) { +if (!stat_mbox) {dev_err (&pdev->dev,"Failed to map status mailbox\n" ); goto out_free; }
@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs, cs->fwstat_buf =dma_alloc_coherent (&pdev->dev,sizeof (struct myrs_fwstat ), &cs->fwstat_addr,GFP_KERNEL ); -if (dma_mapping_error (&pdev->dev, cs->fwstat_addr)) { +if (!cs->fwstat_buf) {dev_err (&pdev->dev,"Failed to map firmware health buffer\n" ); cs->fwstat_buf =NULL ; goto out_free;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/276 media: rj54n1cb0c: Fix memleak in rj54n1_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
rj54n1_probe() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
--- drivers/media/i2c/rj54n1cb0c.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/media/i2c/rj54n1cb0c.c +6 -3
@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client, V4L2_CID_GAIN, 0, 127, 1, 66);v4l2_ctrl_new_std (&rj54n1->hdl, &rj54n1_ctrl_ops,V4L2_CID_AUTO_WHITE_BALANCE ,0 ,1 ,1 ,1 ); - rj54n1->subdev.ctrl_handler = &rj54n1->hdl; -if (rj54n1->hdl.error) -return rj54n1->hdl.error; +if (rj54n1->hdl.error) { + ret = rj54n1->hdl.error; + goto err_free_ctrl; + } + + rj54n1->subdev.ctrl_handler = &rj54n1->hdl; rj54n1->clk_div = clk_div; rj54n1->rect.left =RJ54N1_COLUMN_SKIP ; rj54n1->rect.top =RJ54N1_ROW_SKIP ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/276 ALSA: lx_core: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
Change the 'ret' variable from u16 to int to store negative error codes or zero returned by lx_message_send_atomic().
Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but it's ugly as pants. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
No effect on runtime.
--- sound/pci/lx6464es/lx_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/lx6464es/lx_core.c +2 -2
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)/* low-level dsp access */ int lx_dsp_get_version (struct lx6464es *chip,u32 *rdsp_version) { -u16 ret; +int ret;mutex_lock (&chip->msg_lock);
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)int lx_dsp_get_clock_frequency (struct lx6464es *chip,u32 *rfreq) { -u16 ret =0 ;u32 freq_raw =0 ;u32 freq =0 ;u32 frequency =0 ; +int ret;mutex_lock (&chip->msg_lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/276 drm/amdgpu: Power up UVD 3 for FW validation (v2)
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
Unlike later versions, UVD 3 has firmware validation. For this to work, the UVD should be powered up correctly.
When DPM is enabled and the display clock is off, the SMU may choose a power state which doesn't power the UVD, which can result in failure to initialize UVD.
v2:
Add code comments to explain about the UVD power state and how UVD clock is turned on/off.
--- drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +25 -4
@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,* * @handle: handle used to pass amdgpu_device pointer * -* Initialize the hardware, boot up the VCPU and do some testing +* Initialize the hardware, boot up the VCPU and do some testing. +* +* On SI, the UVD is meant to be used in a specific power state, +* or alternatively the driver can manually enable its clock. +* In amdgpu we use the dedicated UVD power state when DPM is enabled. +* Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state +* for the SMU and afterwards enables the UVD clock. +* This is automatically done by amdgpu_uvd_ring_begin_use when work +* is submitted to the UVD ring. Here, we have to call it manually +* in order to power up UVD before firmware validation. +* +* Note that we must not disable the UVD clock here, as that would +* cause the ring test to fail. However, UVD is powered off +* automatically after the ring test: amdgpu_uvd_ring_end_use calls +* the UVD idle work handler which will disable the UVD clock when +* all fences are signalled. */ static int uvd_v3_1_hw_init (void *handle) {
@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)int r;uvd_v3_1_mc_resume (adev); +uvd_v3_1_enable_mgcg (adev, true); + +/* Make sure UVD is powered during FW validation. +* It's going to be automatically powered off after the ring test. +*/ +if (adev->pm.dpm_enabled) +amdgpu_dpm_enable_uvd (adev, true); +else +amdgpu_asic_set_uvd_clocks (adev,53300 ,40000 ); r =uvd_v3_1_fw_validate (adev);if (r) {
@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)return r; } -uvd_v3_1_enable_mgcg (adev, true); -amdgpu_asic_set_uvd_clocks (adev,53300 ,40000 ); -uvd_v3_1_start (adev); r =amdgpu_ring_test_helper (ring);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/276 wifi: mwifiex: send world regulatory domain to driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Kerkmann <[email protected]>
[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
The world regulatory domain is a restrictive subset of channel configurations which allows legal operation of the adapter all over the world. Changing to this domain should not be prevented.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +3 -4
@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,return ; } -/* Don't send world or same regdom info to firmware */ -if (strncmp (request->alpha2,"00" ,2 ) && -strncmp (request->alpha2, adapter->country_code, -sizeof (request->alpha2))) { +/* Don't send same regdom info to firmware */ +if (strncmp (request->alpha2, adapter->country_code, +sizeof (request->alpha2)) !=0 ) {memcpy (adapter->country_code, request->alpha2,sizeof (request->alpha2));mwifiex_send_domain_info_cmd_fw (wiphy);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/276 PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
Fix incorrect argument order in devm_kcalloc() when allocating port->phys. The original call used sizeof(phy) as the number of elements and port->lanes as the element size, which is reversed. While this happens to produce the correct total allocation size with current pointer size and lane counts, the argument order is wrong.
--- drivers/pci/controller/pci-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-tegra.c +1 -1
@@ -1346,7 +1346,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)unsigned int i;int err; - port->phys =devm_kcalloc (dev,sizeof (phy), port->lanes,GFP_KERNEL ); + port->phys =devm_kcalloc (dev, port->lanes,sizeof (phy),GFP_KERNEL );if (!port->phys)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/276 tcp: fix __tcp_close() to only send RST when required
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
If the receive queue contains payload that was already received, __tcp_close() can send an unexpected RST.
Refine the code to take tp->copied_seq into account, as we already do in tcp recvmsg().
--- net/ipv4/tcp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp.c +5 -4
@@ -2747,8 +2747,8 @@ bool tcp_check_oom(struct sock *sk, int shift)void __tcp_close (struct sock *sk,long timeout) { +bool data_was_unread = false;struct sk_buff *skb; -int data_was_unread =0 ;int state;WRITE_ONCE (sk->sk_shutdown,SHUTDOWN_MASK );
@@ -2767,11 +2767,12 @@ void __tcp_close(struct sock *sk, long timeout)* reader process may not have drained the data yet! */ while ((skb =__skb_dequeue (&sk->sk_receive_queue)) !=NULL ) { -u32 len =TCP_SKB_CB (skb)->end_seq -TCP_SKB_CB (skb)->seq; +u32 end_seq =TCP_SKB_CB (skb)->end_seq;if (TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ) - len--; - data_was_unread += len; + end_seq--; +if (after (end_seq,tcp_sk (sk)->copied_seq)) + data_was_unread = true;__kfree_skb (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/276 drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
Use negative error code -EINVAL instead of positive EINVAL in the default case of svm_ioctl() to conform to Linux kernel error code conventions.
--- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_svm.c +1 -1
@@ -3228,7 +3228,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start, r =svm_range_get_attr (p, start, size, nattrs, attrs);break ;default : - r =EINVAL ; + r = -EINVAL ;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/276 usb: phy: twl6030: Fix incorrect type for ret
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xichao Zhao <[email protected]>
[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
In the twl6030_usb_probe(), the variable ret is declared as a u32 type. However, since ret may receive -ENODEV when accepting the return value of omap_usb2_set_comparator().Therefore, its type should be changed to int.
--- drivers/usb/phy/phy-twl6030-usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/phy/phy-twl6030-usb.c +1 -2
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)static int twl6030_usb_probe (struct platform_device *pdev) { -u32 ret;struct twl6030_usb *twl; -int status, err; +int status, err, ret;struct device_node *np = pdev->dev.of_node;struct device *dev = &pdev->dev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/276 usb: gadget: configfs: Correctly set use_os_string at bind
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
Once the use_os_string flag is set to true for some functions (e.g. adb/mtp) which need to response the OS string, and then if we re-bind the ConfigFS gadget to use the other functions (e.g. hid) which should not to response the OS string, however, because the use_os_string flag is still true, so the usb gadget response the OS string descriptor incorrectly, this can cause the USB device to be unrecognizable on the Windows system.
An example of this as follows:
echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC #succeed
stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0 echo "<udc device>" > UDC #fail to connect on Windows
This patch sets the use_os_string flag to false at bind if the functions not support OS Descriptors.
--- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/configfs.c +2 -0
@@ -1364,6 +1364,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget, cdev->use_os_string = true; cdev->b_vendor_code = gi->b_vendor_code;memcpy (cdev->qw_sign, gi->qw_sign,OS_STRING_QW_SIGN_LEN ); + }else { + cdev->use_os_string = false; }if (gadget_is_otg (gadget) && !otg_desc[0 ]) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/276 misc: genwqe: Fix incorrect cmd field being reported in error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
There is a dev_err message that is reporting the value of cmd->asiv_length when it should be reporting cmd->asv_length instead. Fix this.
--- drivers/misc/genwqe/card_ddcb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/genwqe/card_ddcb.c +1 -1
@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd, }if (cmd->asv_length >DDCB_ASV_LENGTH ) {dev_err (&pci_dev->dev,"[%s] err: wrong asv_length of %d\n" , - __func__, cmd->asiv_length); + __func__, cmd->asv_length);return -EINVAL ; } rc =__genwqe_enqueue_ddcb (cd, req, f_flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/276 pps: fix warning in pps_register_cdev when register device fail
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <[email protected]>
[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen.
------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK>
Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it.
Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
--- drivers/pps/kapi.c | 5 +---- drivers/pps/pps.c | 5 ++--- 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/pps/kapi.c +1 -4
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,if (err <0 ) {pr_err ("%s: unable to create char device\n" , info->name); - goto kfree_pps; + goto pps_register_source_exit; }dev_dbg (&pps->dev,"new PPS source %s\n" , info->name);return pps; -kfree_pps: -kfree (pps); - pps_register_source_exit:pr_err ("%s: unable to register source\n" , info->name);
drivers/pps/pps.c +2 -3
@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps) pps->info.name); err = -EBUSY ; } +kfree (pps); goto out_unlock; } pps->id = err;
@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps) pps->dev.devt =MKDEV (pps_major, pps->id);dev_set_drvdata (&pps->dev, pps);dev_set_name (&pps->dev,"pps%d" , pps->id); + pps->dev.release = pps_device_destruct; err =device_register (&pps->dev);if (err) goto free_idr; -/* Override the release function with our own */ - pps->dev.release = pps_device_destruct; -pr_debug ("source %s got cdev (%d:%d)\n" , pps->info.name, pps_major, pps->id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/276 ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
When an invalid value is passed via quirk option, currently bytcht_es8316 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
sound/soc/intel/boards/bytcht_es8316.c +17 -3
@@ -46,7 +46,8 @@ enum { BYT_CHT_ES8316_INTMIC_IN2_MAP, }; -#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0) +#define BYT_CHT_ES8316_MAP (quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)#define BYT_CHT_ES8316_SSP0 BIT(16)#define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)#define BYT_CHT_ES8316_JD_INVERTED BIT(18)
@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN1_MAP ) +int map; + + map =BYT_CHT_ES8316_MAP (quirk); +switch (map) { +case BYT_CHT_ES8316_INTMIC_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_CHT_ES8316_MAP (quirk) ==BYT_CHT_ES8316_INTMIC_IN2_MAP ) +break ; +case BYT_CHT_ES8316_INTMIC_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n" , map); + quirk &= ~BYT_CHT_ES8316_MAP_MASK ; + quirk |=BYT_CHT_ES8316_INTMIC_IN1_MAP ; +break ; + } +if (quirk &BYT_CHT_ES8316_SSP0 )dev_info (dev,"quirk SSP0 enabled" );if (quirk &BYT_CHT_ES8316_MONO_SPEAKER )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/276 ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access.
This patch corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/soc/intel/boards/bytcr_rt5640.c +5 -2
@@ -65,7 +65,8 @@ enum { BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13), }; -#define BYT_RT5640_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5640_MAP_MASK GENMASK(3, 0) +#define BYT_RT5640_MAP (quirk) ((quirk) & BYT_RT5640_MAP_MASK)#define BYT_RT5640_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5640_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5640_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -134,7 +135,9 @@ static void log_quirks(struct device *dev)dev_info (dev,"quirk NO_INTERNAL_MIC_MAP enabled\n" );break ;default : -dev_err (dev,"quirk map 0x%x is not supported, microphone input will not work\n" , map); +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n" , map); + byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK ; + byt_rt5640_quirk |=BYT_RT5640_DMIC1_MAP ;break ; }if (byt_rt5640_quirk &BYT_RT5640_HSMIC2_ON_IN1 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/276 ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access.
This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed.
Message-ID: <[email protected]>
--- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
sound/soc/intel/boards/bytcr_rt5651.c +21 -5
@@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP (quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP (quirk) ((quirk) & BYT_RT5651_MAP_MASK)#define BYT_RT5651_JDSRC (quirk) (((quirk) & GENMASK(7, 4)) >> 4)#define BYT_RT5651_OVCD_TH (quirk) (((quirk) & GENMASK(12, 8)) >> 8)#define BYT_RT5651_OVCD_SF (quirk) (((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");static void log_quirks (struct device *dev) { -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_DMIC_MAP ) +int map; + + map =BYT_RT5651_MAP (byt_rt5651_quirk); +switch (map) { +case BYT_RT5651_DMIC_MAP :dev_info (dev,"quirk DMIC_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_MAP ) +break ; +case BYT_RT5651_IN1_MAP :dev_info (dev,"quirk IN1_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN2_MAP ) +break ; +case BYT_RT5651_IN2_MAP :dev_info (dev,"quirk IN2_MAP enabled" ); -if (BYT_RT5651_MAP (byt_rt5651_quirk) ==BYT_RT5651_IN1_IN2_MAP ) +break ; +case BYT_RT5651_IN1_IN2_MAP :dev_info (dev,"quirk IN1_IN2_MAP enabled" ); +break ; +default : +dev_warn_once (dev,"quirk sets invalid input map: 0x%x, default to DMIC_MAP\n" , map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK ; + byt_rt5651_quirk |=BYT_RT5651_DMIC_MAP ; +break ; + } +if (BYT_RT5651_JDSRC (byt_rt5651_quirk)) {dev_info (dev,"quirk realtek,jack-detect-source %ld\n" ,BYT_RT5651_JDSRC (byt_rt5651_quirk));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/276 fs: ntfs3: Fix integer overflow in run_unpack()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Grigoryev <[email protected]>
[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of all Call Stack paths showed that the values of the runlist array, from which LCNs are calculated, are not validated before run_unpack function.
The run_unpack function decodes the compressed runlist data format from MFT attributes (for example, $DATA), converting them into a runs_tree structure, which describes the mapping of virtual clusters (VCN) to logical clusters (LCN). The NTFS3 subsystem also has a shortcut for deleting files from MFT records - in this case, the RUN_DEALLOCATE command is sent to the run_unpack input, and the function logic provides that all data transferred to the runlist about file or directory is deleted without creating a runs_tree structure.
Substituting the runlist in the $DATA attribute of the MFT record for an arbitrary file can lead either to access to arbitrary data on the disk bypassing access checks to them (since the inode access check occurs above) or to destruction of arbitrary data on the disk.
Add overflow check for addition operation.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/ntfs3/run.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/ntfs3/run.c +9 -3
@@ -9,6 +9,7 @@#include <linux/blkdev.h> #include <linux/fs.h> #include <linux/log2.h> +#include <linux/overflow.h> #include "debug.h" #include "ntfs.h"
@@ -935,12 +936,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,if (!dlcn)return -EINVAL ; - lcn = prev_lcn + dlcn; + +if (check_add_overflow (prev_lcn, dlcn, &lcn)) +return -EINVAL ; prev_lcn = lcn; }else return -EINVAL ; - next_vcn = vcn64 + len; +if (check_add_overflow (vcn64, len, &next_vcn)) +return -EINVAL ; +/* Check boundary. */ if (next_vcn > evcn +1 )return -EINVAL ;
@@ -1101,7 +1106,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)return -EINVAL ; run_buf += size_size + offset_size; - vcn64 += len; +if (check_add_overflow (vcn64, len, &vcn64)) +return -EINVAL ;#ifndef CONFIG_NTFS3_64BIT_CLUSTER if (vcn64 >0x100000000ull )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/276 iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
Fix iio_convert_raw_to_processed() offset handling for channels without a scale attribute.
The offset has been applied to the raw64 value not to the original raw value. Use the raw64 value so that the offset is taken into account.
--- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/inkern.c +1 -1
@@ -619,7 +619,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,* If no channel scaling is available apply consumer scale to * raw value and return. */ - *processed = raw * scale; + *processed = raw64 * scale;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/276 netfilter: ipset: Remove unused htable_bits in macro ahash_region
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
Since the ahash_region() macro was redefined to calculate the region index solely from HTABLE_REGION_BITS, the htable_bits parameter became unused.
Remove the unused htable_bits argument and its call sites, simplifying the code without changing semantics.
--- net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/ipset/ip_set_hash_gen.h +4 -4
@@ -62,7 +62,7 @@ struct hbucket { : jhash_size((htable_bits) - HTABLE_REGION_BITS))#define ahash_sizeof_regions (htable_bits) \ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) -#define ahash_region (n, htable_bits) \ +#define ahash_region (n) \ ((n) / jhash_size(HTABLE_REGION_BITS))#define ahash_bucket_start (h, htable_bits) \ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried)#endif key =HKEY (data, h->initval, htable_bits); m =__ipset_dereference (hbucket (t, key)); - nr =ahash_region (key, htable_bits); + nr =ahash_region (key);if (!m) { m = kzalloc(sizeof(*m) + AHASH_INIT_SIZE * dsize,
@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref); elements = t->hregion[r].elements; maxelem = t->maxelem;
@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,rcu_read_lock_bh (); t =rcu_dereference_bh (h->table); key =HKEY (value, h->initval, t->htable_bits); - r =ahash_region (key, t->htable_bits); + r =ahash_region (key);atomic_inc (&t->uref);rcu_read_unlock_bh ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/276 watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
When the watchdog gets enabled with this driver, it leaves enough time for the core watchdog subsystem to start pinging it. But when the watchdog is already started by hardware or by the boot loader, little time remains before it fires and it happens that the core watchdog subsystem doesn't have time to start pinging it.
Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function") pinging was managed by the driver itself and the watchdog was immediately pinged by setting the timer expiry to 0.
So restore similar behaviour by pinging it when enabling it so that if it was already enabled the watchdog timer counter is reloaded.
--- drivers/watchdog/mpc8xxx_wdt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/mpc8xxx_wdt.c +2 -0
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w) ddata->swtc = tmp >>16 ;set_bit (WDOG_HW_RUNNING , &ddata->wdd.status); +mpc8xxx_wdt_keepalive (ddata); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/276 drivers/base/node: handle error properly in register_one_node()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
If register_node() returns an error, it is not handled correctly. The function will proceed further and try to register CPUs under the node, which is not correct.
So, in this patch, if register_node() returns an error, we return immediately from the function.
--- drivers/base/node.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/base/node.c +5 -0
@@ -983,6 +983,11 @@ int __register_one_node(int nid)return -ENOMEM ; error =register_node (node_devices[nid], nid); +if (error) { + node_devices[nid] =NULL ; +kfree (node); +return error; + }/* link cpu under this node */ for_each_present_cpu (cpu) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/276 RDMA/cm: Rate limit destroy CM ID timeout error message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Håkon Bugge <[email protected]>
[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
When the destroy CM ID timeout kicks in, you typically get a storm of them which creates a log flooding. Hence, change pr_err() to pr_err_ratelimited() in cm_destroy_id_wait_timeout().
--- drivers/infiniband/core/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/core/cm.c +2 -2
@@ -1039,8 +1039,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,struct cm_id_private *cm_id_priv; cm_id_priv = container_of(cm_id, struct cm_id_private, id); -pr_err ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, - cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); +pr_err_ratelimited ("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n" , __func__, + cm_id, old_state, cm_id->state,refcount_read (&cm_id_priv->refcount)); }static void cm_destroy_id (struct ib_cm_id *cm_id,int err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/276 wifi: mt76: fix potential memory leak in mt76_wmac_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory is allocated for both struct ieee80211_hw and a workqueue. However, on the error path, the workqueue is not freed. Fix that by calling mt76_free_device() on the error path.
--- drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7603/soc.c +1 -1
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)return 0 ; error: -ieee80211_free_hw (mt76_hw (dev)); +mt76_free_device (mdev);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/276 ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
There appears to be a cut-n-paste error with the incorrect field ndr_desc->numa_node being reported for the target node. Fix this by using ndr_desc->target_node instead.
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -3021,7 +3021,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,if (ndr_desc->target_node ==NUMA_NO_NODE ) { ndr_desc->target_node =phys_to_target_node (spa->address);dev_info (acpi_desc->dev,"changing target node from %d to %d for nfit region [%pa-%pa]" , -NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); +NUMA_NO_NODE , ndr_desc->target_node, &res.start, &res.end); }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/276 scsi: qla2xxx: edif: Fix incorrect sign of error code
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and qla_edif_process_els() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors.
Message-ID: <[email protected]>
--- drivers/scsi/qla2xxx/qla_edif.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_edif.c +2 -2
@@ -1539,7 +1539,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)switch (rval) {case QLA_SUCCESS :break ; -case EAGAIN : +case -EAGAIN :msleep (EDIF_MSLEEP_INTERVAL ); cnt++;if (cnt <EDIF_RETRY_COUNT )
@@ -3525,7 +3525,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job) p->e.extra_rx_xchg_address, p->e.extra_control_flags, sp->handle, sp->remap.req.len, bsg_job);break ; -case EAGAIN : +case -EAGAIN :msleep (EDIF_MSLEEP_INTERVAL ); cnt++;if (cnt <EDIF_RETRY_COUNT )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/276 scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS, preventing logical errors. Additionally, the '_rval' variable should store negative error codes to conform to Linux kernel error code conventions.
Message-ID: <[email protected]>
--- drivers/scsi/qla2xxx/qla_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/qla2xxx/qla_init.c +2 -2
@@ -2061,11 +2061,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)int cnt =5 ; \ do { \ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\ - _rval = EINVAL; \ + _rval = -EINVAL; \ break; \ } \ _rval = qla2x00_start_sp(_sp); \ - if (_rval == EAGAIN) \ + if (_rval == -EAGAIN) \ msleep(1); \ else \ break; \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/276 Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Pecio <[email protected]>
[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
No actual HW bugs are known where Endpoint Context shows Running state but Stop Endpoint fails repeatedly with Context State Error and leaves the endpoint state unchanged. Stop Endpoint retries on Running EPs have been performed since early 2021 with no such issues reported so far.
Trying to handle this hypothetical case brings a more realistic danger:
if Stop Endpoint fails on an endpoint which hasn't yet started after a doorbell ring and enough latency occurs before this completion event is handled, the driver may time out and begin removing cancelled TDs from a running endpoint, even though one more retry would stop it reliably.
Such high latency is rare but not impossible, and removing TDs from a running endpoint can cause more damage than not giving back a cancelled URB (which wasn't happening anyway). So err on the side of caution and revert to the old policy of always retrying if the EP appears running.
[Remove stable tag as we are dealing with theoretical cases -Mathias]
--- drivers/usb/host/xhci-ring.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/usb/host/xhci-ring.c +4 -7
@@ -1183,19 +1183,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,* Stopped state, but it will soon change to Running. * * Assume this bug on unexpected Stop Endpoint failures. -* Keep retrying until the EP starts and stops again. +* Keep retrying until the EP starts and stops again, on +* chips where this is known to help. Wait for 100ms. */ +if (time_is_before_jiffies (ep->stop_time +msecs_to_jiffies (100 ))) +break ; fallthrough;case EP_STATE_RUNNING :/* Race, HW handled stop ep cmd before ep was running */ xhci_dbg (xhci,"Stop ep completion ctx error, ctx_state %d\n" ,GET_EP_CTX_STATE (ep_ctx)); -/* -* Don't retry forever if we guessed wrong or a defective HC never starts -* the EP or says 'Running' but fails the command. We must give back TDs. -*/ -if (time_is_before_jiffies (ep->stop_time +msecs_to_jiffies (100 ))) -break ; command =xhci_alloc_command (xhci, false,GFP_ATOMIC );if (!command)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/276 RDMA/core: Resolve MAC of next-hop device without ARP support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
Currently, if the next-hop netdevice does not support ARP resolution, the destination MAC address is silently set to zero without reporting an error. This leads to incorrect behavior and may result in packet transmission failures.
Fix this by deferring MAC resolution to the IP stack via neighbour lookup, allowing proper resolution or error reporting as appropriate.
--- drivers/infiniband/core/addr.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
drivers/infiniband/core/addr.c +3 -7
@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst, {int ret =0 ; -if (ndev_flags &IFF_LOOPBACK ) { +if (ndev_flags &IFF_LOOPBACK )memcpy (addr->dst_dev_addr, addr->src_dev_addr,MAX_ADDR_LEN ); - }else { -if (!(ndev_flags &IFF_NOARP )) { -/* If the device doesn't do ARP internally */ - ret =fetch_ha (dst, addr, dst_in, seq); - } - } +else + ret =fetch_ha (dst, addr, dst_in, seq);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/276 IB/sa: Fix sa_local_svc_timeout_ms read race
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dumitrescu <[email protected]>
[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
When computing the delta, the sa_local_svc_timeout_ms is read without ib_nl_request_lock held. Though unlikely in practice, this can cause a race condition if multiple local service threads are managing the timeout.
--- drivers/infiniband/core/sa_query.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/sa_query.c +4 -2
@@ -982,6 +982,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (timeout >IB_SA_LOCAL_SVC_TIMEOUT_MAX ) timeout =IB_SA_LOCAL_SVC_TIMEOUT_MAX ; +spin_lock_irqsave (&ib_nl_request_lock, flags); + delta = timeout - sa_local_svc_timeout_ms;if (delta <0 ) abs_delta = -delta;
@@ -989,7 +991,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb, abs_delta = delta;if (delta !=0 ) { -spin_lock_irqsave (&ib_nl_request_lock, flags); sa_local_svc_timeout_ms = timeout;list_for_each_entry (query, &ib_nl_request_list, list) {if (delta <0 && abs_delta > query->timeout)
@@ -1007,9 +1008,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,if (delay)mod_delayed_work (ib_nl_wq, &ib_nl_timed_work, (unsigned long )delay); -spin_unlock_irqrestore (&ib_nl_request_lock, flags); } +spin_unlock_irqrestore (&ib_nl_request_lock, flags); + settimeout_out:return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/276 Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
Section heading for sched_waking histogram is shown as normal paragraph instead due to codeblock marker for the following diagram being in the same line as the section underline. Separate them.
Message-ID: <[email protected]>
--- Documentation/trace/histogram-design.rst | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Documentation/trace/histogram-design.rst +3 -1
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking trigger above. sched_waking histogram -----------------------:: +---------------------- + +.. code-block:: +------------------+ | hist_data |<-------------------------------------------------------+
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/276 wifi: ath10k: avoid unnecessary wait for service ready message
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing") works around the failure in waiting for the service ready message by active polling. Note the polling is triggered after initial wait timeout, which means that the wait-till-timeout can not be avoided even the message is ready.
A possible fix is to do polling once before wait as well, however this can not handle the race that the message arrives right after polling. So the solution is to do periodic polling until timeout.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++-------------- 1 file changed, 19 insertions(+), 20 deletions(-)
drivers/net/wireless/ath/ath10k/wmi.c +19 -20
@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,int ath10k_wmi_wait_for_service_ready (struct ath10k *ar) { +unsigned long timeout = jiffies +WMI_SERVICE_READY_TIMEOUT_HZ ;unsigned long time_left, i; - time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -/* Sometimes the PCI HIF doesn't receive interrupt -* for the service ready message even if the buffer -* was completed. PCIe sniffer shows that it's -* because the corresponding CE ring doesn't fires -* it. Workaround here by polling CE rings once. -*/ -ath10k_warn (ar,"failed to receive service ready completion, polling..\n" ); - +/* Sometimes the PCI HIF doesn't receive interrupt +* for the service ready message even if the buffer +* was completed. PCIe sniffer shows that it's +* because the corresponding CE ring doesn't fires +* it. Workaround here by polling CE rings. Since +* the message could arrive at any time, continue +* polling until timeout. +*/ +do {for (i =0 ; i <CE_COUNT ; i++)ath10k_hif_send_complete_check (ar, i,1 ); +/* The 100 ms granularity is a tradeoff considering scheduler +* overhead and response latency +*/ time_left =wait_for_completion_timeout (&ar->wmi.service_ready, -WMI_SERVICE_READY_TIMEOUT_HZ ); -if (!time_left) { -ath10k_warn (ar,"polling timed out\n" ); -return -ETIMEDOUT ; - } - -ath10k_warn (ar,"service ready completion received, continuing normally\n" ); - } +msecs_to_jiffies (100 )); +if (time_left) +return 0 ; + }while (time_before (jiffies, timeout)); -return 0 ; +ath10k_warn (ar,"failed to receive service ready completion\n" ); +return -ETIMEDOUT ; }int ath10k_wmi_wait_for_unified_ready (struct ath10k *ar)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/276 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/sparc/lib/U1memcpy.S +10 -9
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) retl add %o0, %o2, %o0 ENDPROC(U1_gs_40_fp) -ENTRY(U1_g3_0_fp) - VISExitHalf - retl - add %g3, %o2, %o0 -ENDPROC(U1_g3_0_fp) ENTRY(U1_g3_8_fp) VISExitHalf add %g3, 8, %g3 retl add %g3, %o2, %o0 ENDPROC(U1_g3_8_fp) +ENTRY(U1_g3_16_fp) + VISExitHalf + add %g3, 16, %g3 + retl + add %g3, %o2, %o0 +ENDPROC(U1_g3_16_fp) ENTRY(U1_o2_0_fp) VISExitHalf retl
@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ 62: FINISH_VISCHUNK(o0, f44, f46) 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) -93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) +93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f0, %f2, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bl,pn %xcc, 95f add %o0, 8, %o0 - EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) + EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f2, %f0, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bge,pt %xcc, 93b add %o0, 8, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/276 sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy.
The BUG_ON has been reported in
https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/U3memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/U3memcpy.S +1 -1
@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ faligndata %f10, %f12, %f26 EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) + and %o2, 0x3f, %o2 subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE add %o1, 0x40, %o1 bgu,pt %XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ * Also notice how this code is careful not to perform a * load past the end of the src buffer. */ - and %o2, 0x3f, %o2 andcc %o2, 0x38, %g2 be,pn %XCC, 2f subcc %g2, 0x8, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/276 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
arch/sparc/lib/NGmemcpy.S +18 -11
@@ -80,8 +80,8 @@ #ifndef EX_RETVAL #define EX_RETVAL(x) x __restore_asi: - ret wr %g0, ASI_AIUS, %asi + ret restore ENTRY(NG_ret_i2_plus_i4_plus_1) ba,pt %xcc, __restore_asi
@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56) ba,pt %xcc, __restore_asi add %i2, %g1, %i0 ENDPROC(NG_ret_i2_plus_g1_minus_56) -ENTRY(NG_ret_i2_plus_i4) +ENTRY(NG_ret_i2_plus_i4_plus_16) + add %i4, 16, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4) -ENTRY(NG_ret_i2_plus_i4_minus_8) - sub %i4, 8, %i4 +ENDPROC(NG_ret_i2_plus_i4_plus_16) +ENTRY(NG_ret_i2_plus_i4_plus_8) + add %i4, 8, %i4 ba,pt %xcc, __restore_asi add %i2, %i4, %i0 -ENDPROC(NG_ret_i2_plus_i4_minus_8) +ENDPROC(NG_ret_i2_plus_i4_plus_8) ENTRY(NG_ret_i2_plus_8) ba,pt %xcc, __restore_asi add %i2, 8, %i0
@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4) ba,pt %xcc, __restore_asi add %i2, %i4, %i0 ENDPROC(NG_ret_i2_and_7_plus_i4) +ENTRY(NG_ret_i2_and_7_plus_i4_plus_8) + and %i2, 7, %i2 + add %i4, 8, %i4 + ba,pt %xcc, __restore_asi + add %i2, %i4, %i0 +ENDPROC(NG_ret_i2_and_7_plus_i4) #endif .align 64
@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ andn %i2, 0xf, %i4 and %i2, 0xf, %i2 1: subcc %i4, 0x10, %i4 - EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16) add %i1, 0x08, %i1 - EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) + EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16) sub %i1, 0x08, %i1 - EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) + EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16) add %i1, 0x8, %i1 - EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) + EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8) bgu,pt %XCC, 1b add %i1, 0x8, %i1 73: andcc %i2, 0x8, %g0
@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ subcc %i4, 0x8, %i4 srlx %g3, %i3, %i5 or %i5, %g2, %i5 - EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) + EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8) add %o0, 0x8, %o0 bgu,pt %icc, 1b sllx %g3, %g1, %g2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/276 sparc: fix accurate exception reporting in copy_to_user for Niagara 4
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a bad calculation. This will fix the return value of copy_to_user in a specific faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/NG4memcpy.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/lib/NG4memcpy.S +1 -1
@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %icc, 1b add %o0, 0x20, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/276 sparc: fix accurate exception reporting in copy_{from,to}_user for M7
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Karcher <[email protected]>
[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
--- arch/sparc/lib/M7memcpy.S | 20 ++++++++++---------- arch/sparc/lib/Memcpy_utils.S | 9 +++++++++ 2 files changed, 19 insertions(+), 10 deletions(-)
arch/sparc/lib/M7memcpy.S +10 -10
@@ -696,16 +696,16 @@ FUNC_NAME: EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40) faligndata %f24, %f26, %f10 EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40) - EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32) faligndata %f26, %f28, %f12 - EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32) add %o4, 64, %o4 - EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40) + EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24) faligndata %f28, %f30, %f14 - EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40) - EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24) + EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16) add %o0, 64, %o0 - EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40) + EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f30, %f14 bgu,pt %xcc, .Lunalign_sloop prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME: add %o4, 8, %o4 faligndata %f0, %f2, %f16 subcc %o5, 8, %o5 - EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5) + EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8) fsrc2 %f2, %f0 bgu,pt %xcc, .Lunalign_by8 add %o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME: subcc %o5, 0x20, %o5 EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32) EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24) - EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24) + EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16) EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8) bne,pt %xcc, 1b add %o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME: brz,pt %o3, 2f sub %o2, %o3, %o2 -1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1) +1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3) add %o1, 1, %o1 subcc %o3, 1, %o3 add %o0, 1, %o0 bne,pt %xcc, 1b - EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1) + EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1) 2: and %o1, 0x7, %o3 brz,pn %o3, .Lmedium_noprefetch_cp
arch/sparc/lib/Memcpy_utils.S +9 -0
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8) ba,pt %xcc, __restore_asi add %o2, 8, %o0 ENDPROC(memcpy_retl_o2_plus_63_8) +ENTRY(memcpy_retl_o2_plus_o3) + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3) +ENTRY(memcpy_retl_o2_plus_o3_plus_1) + add %o3, 1, %o3 + ba,pt %xcc, __restore_asi + add %o2, %o3, %o0 +ENDPROC(memcpy_retl_o2_plus_o3_plus_1) ENTRY(memcpy_retl_o2_plus_o5) ba,pt %xcc, __restore_asi add %o2, %o5, %o0
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/276 remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
enable_irq() and disable_irq() are reference counted, so we must make sure that each enable_irq() is always paired with a single disable_irq(). If we call disable_irq() twice followed by just a single enable_irq(), the IRQ will remain disabled forever.
For the error handling path in qcom_q6v5_wait_for_start(), disable_irq() will end up being called twice, because disable_irq() also happens in qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more sense to have the rollback handled always by qcom_q6v5_unprepare().
--- drivers/remoteproc/qcom_q6v5.c | 3 --- 1 file changed, 3 deletions(-)
drivers/remoteproc/qcom_q6v5.c +0 -3
@@ -116,9 +116,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)int ret; ret =wait_for_completion_timeout (&q6v5->start_done, timeout); -if (!ret) -disable_irq (q6v5->handover_irq); -return !ret ? -ETIMEDOUT :0 ; }EXPORT_SYMBOL_GPL (qcom_q6v5_wait_for_start);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/276 coresight: trbe: Return NULL pointer for allocation failures
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etm_setup_aux() only checks for a NULL pointer, so it misses the error. As a result, the driver continues and eventually causes a kernel panic.
Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on allocation failures. This allows that the callers can properly handle the failure.
--- drivers/hwtracing/coresight/coresight-trbe.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwtracing/coresight/coresight-trbe.c +3 -3
@@ -503,12 +503,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev, buf =kzalloc_node (sizeof (*buf),GFP_KERNEL ,trbe_alloc_node (event));if (!buf) -return ERR_PTR (-ENOMEM ); +return NULL ; pglist =kcalloc (nr_pages,sizeof (*pglist),GFP_KERNEL );if (!pglist) {kfree (buf); -return ERR_PTR (-ENOMEM ); +return NULL ; }for (i =0 ; i < nr_pages; i++)
@@ -518,7 +518,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,if (!buf->trbe_base) {kfree (pglist);kfree (buf); -return ERR_PTR (-ENOMEM ); +return NULL ; } buf->trbe_limit = buf->trbe_base + nr_pages *PAGE_SIZE ; buf->trbe_write = buf->trbe_base;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/276 NFSv4.1: fix backchannel max_resp_sz verification check
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
When the client max_resp_sz is larger than what the server encodes in its reply, the nfs4_verify_back_channel_attrs() check fails and this causes nfs4_proc_create_session() to fail, in cases where the client page size is larger than that of the server and the server does not want to negotiate upwards.
While this is not a problem with the linux nfs server that will reflect the proposed value in its reply irrespective of the local page size, other nfs server implementations may insist on their own max_resp_sz value, which could be smaller.
Fix this by accepting smaller max_resp_sz values from the server, as this does not violate the protocol. The server is allowed to decrease but not increase proposed the size, and as such values smaller than the client-proposed ones are valid.
--- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4proc.c +1 -1
@@ -9117,7 +9117,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args goto out;if (rcvd->max_rqst_sz > sent->max_rqst_sz)return -EINVAL ; -if (rcvd->max_resp_sz < sent->max_resp_sz) +if (rcvd->max_resp_sz > sent->max_resp_sz)return -EINVAL ;if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)return -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/276 ipvs: Defer ip_vs_ftp unregister during netns cleanup
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slavin Liu <[email protected]>
[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free.
Fix this by introducing a global exiting_module flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
--- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/ipvs/ip_vs_ftp.c +3 -1
@@ -53,6 +53,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module;/* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port.
@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net) {struct netns_ipvs *ipvs =net_ipvs (net); -if (!ipvs) +if (!ipvs || !exiting_module)return ;unregister_ip_vs_app (ipvs, &ip_vs_ftp);
@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)*/ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true;unregister_pernet_subsys (&ip_vs_ftp_ops);/* rcu_barrier() is called by netns */ }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/276 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.
Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.
[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_transport.c +3 -5
@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,list_for_each_entry_safe (mpt3sas_phy, next_phy, &mpt3sas_port->phy_list, port_siblings) {if ((ioc->logging_level &MPT_DEBUG_TRANSPORT )) -dev_printk (KERN_INFO , &mpt3sas_port->port->dev, -"remove: sas_addr(0x%016llx), phy(%d)\n" , - (unsigned long long ) - mpt3sas_port->remote_identify.sas_address, - mpt3sas_phy->phy_id); +ioc_info (ioc,"remove: sas_addr(0x%016llx), phy(%d)\n" , + (unsigned long long ) mpt3sas_port->remote_identify.sas_address, + mpt3sas_phy->phy_id); mpt3sas_phy->phy_belongs_to_port =0 ;if (!ioc->remove_host) sas_port_delete_phy(mpt3sas_port->port,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/276 usb: vhci-hcd: Prevent suspending virtually attached devices
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
The VHCI platform driver aims to forbid entering system suspend when at least one of the virtual USB ports are bound to an active USB/IP connection.
However, in some cases, the detection logic doesn't work reliably, i.e. when all devices attached to the virtual root hub have been already suspended, leading to a broken suspend state, with unrecoverable resume.
Ensure the virtually attached devices do not enter suspend by setting the syscore PM flag. Note this is currently limited to the client side only, since the server side doesn't implement system suspend prevention.
--- drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/usb/usbip/vhci_hcd.c +22 -0
@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag ctrlreq->wValue, vdev->rhport); vdev->udev =usb_get_dev (urb->dev); +/* +* NOTE: A similar operation has been done via +* USB_REQ_GET_DESCRIPTOR handler below, which is +* supposed to always precede USB_REQ_SET_ADDRESS. +* +* It's not entirely clear if operating on a different +* usb_device instance here is a real possibility, +* otherwise this call and vdev->udev assignment above +* should be dropped. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old);spin_lock (&vdev->ud.lock);
@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n"); vdev->udev =usb_get_dev (urb->dev); +/* +* Set syscore PM flag for the virtually attached +* devices to ensure they will not enter suspend on +* the client side. +* +* Note this doesn't have any impact on the physical +* devices attached to the host system on the server +* side, hence there is no need to undo the operation +* on disconnect. +*/ +dev_pm_syscore_device (&vdev->udev->dev, true);usb_put_dev (old); goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/276 RDMA/siw: Always report immediate post SQ errors
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernard Metzler <[email protected]>
[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
In siw_post_send(), any immediate error encountered during processing of the work request list must be reported to the caller, even if previous work requests in that list were just accepted and added to the send queue.
Not reporting those errors confuses the caller, which would wait indefinitely for the failing and potentially subsequently aborted work requests completion.
This fixes a case where immediate errors were overwritten by subsequent code in siw_post_send().
--- drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
drivers/infiniband/sw/siw/siw_verbs.c +14 -11
@@ -759,7 +759,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,struct siw_wqe *wqe =tx_wqe (qp);unsigned long flags; -int rv =0 ; +int rv =0 , imm_err =0 ;if (wr && !rdma_is_kernel_res (&qp->base_qp.res)) {siw_dbg_qp (qp,"wr must be empty for user mapped sq\n" );
@@ -945,9 +945,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,* Send directly if SQ processing is not in progress. * Eventual immediate errors (rv < 0) do not affect the involved * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ -* processing, if new work is already pending. But rv must be passed -* to caller. +* processing, if new work is already pending. But rv and pointer +* to failed work request must be passed to caller. */ +if (unlikely (rv <0 )) { +/* +* Immediate error +*/ +siw_dbg_qp (qp,"Immediate error %d\n" , rv); + imm_err = rv; + *bad_wr = wr; + }if (wqe->wr_status !=SIW_WR_IDLE ) {spin_unlock_irqrestore (&qp->sq_lock, flags); goto skip_direct_sending;
@@ -972,15 +980,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,up_read (&qp->state_lock); -if (rv >=0 ) -return 0 ; -/* -* Immediate error -*/ -siw_dbg_qp (qp,"error %d\n" , rv); +if (unlikely (imm_err)) +return imm_err; - *bad_wr = wr; -return rv; +return (rv >=0 ) ?0 : rv; }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/276 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: I Viswanath <[email protected]>
[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning:
rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb);
}rtl8150_set_multicast() {
netif_stop_queue();
netif_wake_queue(); <-- wakes up TX queue before URB is done
}rtl8150_start_xmit() {
netif_stop_queue();
usb_submit_urb(dev->tx_urb); <-- double submission
}rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization.
The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks.
--- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/rtl8150.c +0 -2
@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)rtl8150_t *dev =netdev_priv (netdev);u16 rx_creg =0x9e ; -netif_stop_queue (netdev);if (netdev->flags &IFF_PROMISC ) { rx_creg |=0x0001 ;dev_info (&netdev->dev,"%s: promiscuous mode\n" , netdev->name);
@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &=0x00fc ; }async_set_registers (dev,RCR ,sizeof (rx_creg), rx_creg); -netif_wake_queue (netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/276 Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO was not called with a specific index which breaks the likes of bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an adapter is plugged, so instead of depending hdev not to be set just enable the UUID on any index like it was done with iso_sock_uuid.
--- net/bluetooth/mgmt.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
net/bluetooth/mgmt.c +4 -6
@@ -3824,13 +3824,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,memset (&buf,0 ,sizeof (buf));#ifdef CONFIG_BT_FEATURE_DEBUG -if (!hdev) { - flags =bt_dbg_get () ?BIT (0 ) :0 ; + flags =bt_dbg_get () ?BIT (0 ) :0 ; -memcpy (rp->features[idx].uuid, debug_uuid,16 ); - rp->features[idx].flags =cpu_to_le32 (flags); - idx++; - } +memcpy (rp->features[idx].uuid, debug_uuid,16 ); + rp->features[idx].flags =cpu_to_le32 (flags); + idx++;#endif if (hdev) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/276 hwrng: ks-sa - fix division by zero in ks_sa_rng_init
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <[email protected]>
[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values.
Add clock initialization code before using the clock.
drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- drivers/char/hw_random/ks-sa-rng.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/char/hw_random/ks-sa-rng.c +4 -0
@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)return -EINVAL ; } + ks_sa_rng->clk =devm_clk_get_enabled (dev,NULL ); +if (IS_ERR (ks_sa_rng->clk)) +return dev_err_probe (dev,PTR_ERR (ks_sa_rng->clk),"Failed to get clock\n" ); +pm_runtime_enable (dev); ret =pm_runtime_resume_and_get (dev);if (ret <0 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/276 ocfs2: fix double free in user_cluster_connect()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.
--- fs/ocfs2/stack_user.c | 1 + 1 file changed, 1 insertion(+)
fs/ocfs2/stack_user.c +1 -0
@@ -1030,6 +1030,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)printk (KERN_ERR "ocfs2: Could not determine" " locking version\n" );user_cluster_disconnect (conn); + lc =NULL ; goto out; }wait_event (lc->oc_wait, (atomic_read (&lc->oc_this_node) >0 ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/276 drivers/base/node: fix double free in register_one_node()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom <[email protected]>
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to prevent the double free.
--- drivers/base/node.c | 1 - 1 file changed, 1 deletion(-)
drivers/base/node.c +0 -1
@@ -985,7 +985,6 @@ int __register_one_node(int nid) error =register_node (node_devices[nid], nid);if (error) { node_devices[nid] =NULL ; -kfree (node);return error; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/276 nfp: fix RSS hash key size when RSS is not supported
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when devices don't support RSS, and callers treat the negative value as a large positive value since the return type is u32.
Return 0 when devices don't support RSS, aligning with the ethtool interface .get_rxfh_key_size() that requires returning 0 in such cases.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +1 -1
@@ -1001,7 +1001,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)struct nfp_net *nn =netdev_priv (netdev);if (!(nn->cap &NFP_NET_CFG_CTRL_RSS_ANY )) -return -EOPNOTSUPP ; +return 0 ;return nfp_net_rss_key_sz (nn); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/276 net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
In EC2 instances where the RSS hash key is not configurable, ethtool shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally returns ENA_HASH_KEY_SIZE.
Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") added proper handling for devices that don't support RSS hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
When the RSS hash key is not configurable, return 0 instead of ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
Tested on m5 instance families.
Without patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
With patch:
# ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: Operation not supported
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +4 -1
@@ -688,7 +688,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)static u32 ena_get_rxfh_key_size (struct net_device *netdev) { -return ENA_HASH_KEY_SIZE ; +struct ena_adapter *adapter =netdev_priv (netdev); +struct ena_rss *rss = &adapter->ena_dev->rss; + +return rss->hash_key ?ENA_HASH_KEY_SIZE :0 ; } static int ena_indirection_table_set(struct ena_adapter *adapter,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/276 net: dlink: handle copy_thresh allocation failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
The driver did not handle failure of netdev_alloc_skb_ip_align(). If the allocation failed, dereferencing skb->protocol could lead to a NULL pointer dereference.
This patch tries to allocate skb. If the allocation fails, it falls back to the normal path.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/dlink/dl2k.c +5 -2
@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev) }else {struct sk_buff *skb; + skb =NULL ;/* Small skbuffs for short packets */ -if (pkt_len > copy_thresh) { +if (pkt_len <= copy_thresh) + skb =netdev_alloc_skb_ip_align (dev, pkt_len); +if (!skb) {dma_unmap_single (&np->pdev->dev,desc_to_dma (desc), np->rx_buf_sz,DMA_FROM_DEVICE );skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] =NULL ; - }else if ((skb =netdev_alloc_skb_ip_align (dev, pkt_len))) { + }else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/276 Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
Commit in question breaks the mapping of PGs to pools for some SKUs. Specifically multi-host NICs seem to be shipped with a custom buffer configuration which maps the lossy PG to pool 4. But the bad commit overrides this with pool 0 which does not have sufficient buffer space reserved. Resulting in ~40% packet loss. The commit also breaks BMC / OOB connection completely (100% packet loss).
Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set""). The breakage is exactly the same, the only difference is that quoted commit would break the NIC immediately on boot, and the currently reverted commit only when MTU is changed.
Note: "good" kernels do not restore the configuration, so downgrade isn't enough to recover machines. A NIC power cycle seems to be necessary to return to a healthy state (or overriding the relevant registers using a custom patch).
--- .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +---------------- 2 files changed, 1 insertion(+), 28 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +0 -12
@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER ]; }; -#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); -#else -static inline int -mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, -u32 change,unsigned int mtu, -void *pfc, -u32 *buffer_size, -u8 *prio2buffer) -{ -return 0 ; -} -#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -16
@@ -42,7 +42,6 @@#include "eswitch.h" #include "en.h" #include "en/txrx.h" -#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2243,11 +2242,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu, prev_mtu; +u16 mtu;int err; -mlx5e_query_mtu (mdev, params, &prev_mtu); - err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2257,18 +2254,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); -if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { - err =mlx5e_port_manual_buffer_config (priv,0 , mtu, -NULL ,NULL ,NULL ); -if (err) { -netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , - __func__, mtu, err, prev_mtu); - -mlx5e_set_mtu (mdev, params, prev_mtu); -return err; - } - } - params->sw_mtu = mtu;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/276 Squashfs: fix uninit-value in squashfs_get_parent
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Lougher <[email protected]>
commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned.
Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0.
--- fs/squashfs/inode.c | 7 +++++++ fs/squashfs/squashfs_fs_i.h | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-)
fs/squashfs/inode.c +7 -0
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le32_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *insquashfs_i (inode)->start =le64_to_cpu (sqsh_ino->start_block);squashfs_i (inode)->block_list_start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFLNK ;squashfs_i (inode)->start = block;squashfs_i (inode)->offset = offset; +squashfs_i (inode)->parent =0 ;if (type ==SQUASHFS_LSYMLINK_TYPE ) {__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inset_nlink (inode,le32_to_cpu (sqsh_ino->nlink)); rdev =le32_to_cpu (sqsh_ino->rdev);init_special_inode (inode, inode->i_mode,new_decode_dev (rdev)); +squashfs_i (inode)->parent =0 ;TRACE ("Device inode %x:%x, rdev %x\n" ,SQUASHFS_INODE_BLK (ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in inode->i_mode |=S_IFSOCK ;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }case SQUASHFS_LFIFO_TYPE :
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in inode->i_op = &squashfs_inode_ops;set_nlink (inode,le32_to_cpu (sqsh_ino->nlink));init_special_inode (inode, inode->i_mode,0 ); +squashfs_i (inode)->parent =0 ;break ; }default :
fs/squashfs/squashfs_fs_i.h +1 -1
@@ -16,6 +16,7 @@ struct squashfs_inode_info {u64 xattr;unsigned int xattr_size;int xattr_count; +int parent; union { struct { u64 fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {u64 dir_idx_start;int dir_idx_offset;int dir_idx_cnt; -int parent; }; };struct inode vfs_inode;
Greg Kroah-Hartman
maintainerPATCH 108/276 uio_hv_generic: Let userspace take care of interrupt mask
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naman Jain <[email protected]>
commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.
Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang.
For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt.
Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens:
* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever.
This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0.
Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang.
Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX.
--- drivers/uio/uio_hv_generic.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/uio/uio_hv_generic.c +1 -6
@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *contstruct hv_device *hv_dev = chan->device_obj;struct hv_uio_private_data *pdata =hv_get_drvdata (hv_dev); - chan->inbound.ring_buffer->interrupt_mask =1 ;virt_mb ();uio_event_notify (&pdata->info);
@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channelreturn ; } -/* Disable interrupts on sub channel */ - new_sc->inbound.ring_buffer->interrupt_mask =1 ;set_channel_read_mode (new_sc,HV_CALL_ISR ); ret =sysfs_create_bin_file (&new_sc->kobj, &ring_buffer_bin_attr);
@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struc ret =vmbus_connect_ring (dev->channel, hv_uio_channel_cb, dev->channel); -if (ret ==0 ) - dev->channel->inbound.ring_buffer->interrupt_mask =1 ; -else +if (ret)atomic_dec (&pdata->refcnt);return ret;
Greg Kroah-Hartman
maintainerPATCH 109/276 fs: udf: fix OOB read in lengthAllocDescs handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larshin Sergey <[email protected]>
commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 upstream.
When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read.
BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Validate the computed total length against epos->bh->b_size.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/udf/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/udf/inode.c +3 -0
@@ -2109,6 +2109,9 @@ int8_t udf_current_aext(struct inode *inif (check_add_overflow (sizeof (struct allocExtDesc ),le32_to_cpu (header->lengthAllocDescs), &alen))return -1 ; + +if (alen > epos->bh->b_size) +return -1 ; }switch (iinfo->i_alloc_type) {
Greg Kroah-Hartman
maintainerPATCH 110/276 net: nfc: nci: Add parameter validation for packet data
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepak Sharma <[email protected]>
commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 upstream.
Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' ofgit://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").
This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of skb_buff->data which is not assigned anything yet.
Following the same silent drop of packets of invalid sizes at nic_valid_size(), add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in nci_nft_packet and effectively do a silent drop
Possible TODO: because we silently drop the packets, the call to nci_request will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export nci_request_cancel (or propagate error handling from the nft packets handlers).
--- net/nfc/nci/ntf.c | 135 +++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 99 insertions(+), 36 deletions(-)
net/nfc/nci/ntf.c +99 -36
@@ -27,11 +27,16 @@/* Handle NCI Notification packets */ -static void nci_core_reset_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_core_reset_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) {/* Handle NCI 2.x core reset notification */ -const struct nci_core_reset_ntf *ntf = (void *)skb->data; +const struct nci_core_reset_ntf *ntf; + +if (skb->len <sizeof (struct nci_core_reset_ntf )) +return -EINVAL ; + + ntf = (struct nci_core_reset_ntf *)skb->data; ndev->nci_ver = ntf->nci_ver; pr_debug("nci_ver 0x%x, config_status 0x%x\n",
@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(st__le32_to_cpu (ntf->manufact_specific_info);nci_req_complete (ndev,NCI_STATUS_OK ); + +return 0 ; } -static void nci_core_conn_credits_ntf_packet (struct nci_dev *ndev, -struct sk_buff *skb) +static int nci_core_conn_credits_ntf_packet (struct nci_dev *ndev, +struct sk_buff *skb) { -struct nci_core_conn_credit_ntf *ntf = (void *) skb->data; +struct nci_core_conn_credit_ntf *ntf;struct nci_conn_info *conn_info;int i; +if (skb->len <sizeof (struct nci_core_conn_credit_ntf )) +return -EINVAL ; + + ntf = (struct nci_core_conn_credit_ntf *)skb->data; +pr_debug ("num_entries %d\n" , ntf->num_entries);if (ntf->num_entries >NCI_MAX_NUM_CONN )
@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_pa conn_info =nci_get_conn_info_by_conn_id (ndev, ntf->conn_entries[i].conn_id);if (!conn_info) -return ; +return 0 ;atomic_add (ntf->conn_entries[i].credits, &conn_info->credits_cnt);
@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_pa/* trigger the next tx */ if (!skb_queue_empty (&ndev->tx_q))queue_work (ndev->tx_wq, &ndev->tx_work); + +return 0 ; } -static void nci_core_generic_error_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_core_generic_error_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) { -__u8 status = skb->data[0 ]; +__u8 status; + +if (skb->len <1 ) +return -EINVAL ; + + status = skb->data[0 ];pr_debug ("status 0x%x\n" , status);
@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_p(the state remains the same) */ nci_req_complete (ndev, status); } + +return 0 ; } -static void nci_core_conn_intf_error_ntf_packet (struct nci_dev *ndev, -struct sk_buff *skb) +static int nci_core_conn_intf_error_ntf_packet (struct nci_dev *ndev, +struct sk_buff *skb) { -struct nci_core_intf_error_ntf *ntf = (void *) skb->data; +struct nci_core_intf_error_ntf *ntf; + +if (skb->len <sizeof (struct nci_core_intf_error_ntf )) +return -EINVAL ; + + ntf = (struct nci_core_intf_error_ntf *)skb->data; ntf->conn_id =nci_conn_id (&ntf->conn_id);
@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf/* complete the data exchange transaction, if exists */ if (test_bit (NCI_DATA_EXCHANGE , &ndev->flags))nci_data_exchange_complete (ndev,NULL , ntf->conn_id, -EIO ); + +return 0 ; } static const __u8 *
@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_de ndev->n_targets =0 ; } -static void nci_rf_discover_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_rf_discover_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) {struct nci_rf_discover_ntf ntf; -const __u8 *data = skb->data; +const __u8 *data;bool add_target = true; +if (skb->len <sizeof (struct nci_rf_discover_ntf )) +return -EINVAL ; + + data = skb->data; + ntf.rf_discovery_id = *data++; ntf.rf_protocol = *data++; ntf.rf_tech_and_mode = *data++;
@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(snfc_targets_found (ndev->nfc_dev, ndev->targets, ndev->n_targets); } + +return 0 ; } static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
@@ -531,14 +566,19 @@ static int nci_store_general_bytes_nfc_dreturn NCI_STATUS_OK ; } -static void nci_rf_intf_activated_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_rf_intf_activated_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) {struct nci_conn_info *conn_info;struct nci_rf_intf_activated_ntf ntf; -const __u8 *data = skb->data; +const __u8 *data;int err =NCI_STATUS_OK ; +if (skb->len <sizeof (struct nci_rf_intf_activated_ntf )) +return -EINVAL ; + + data = skb->data; + ntf.rf_discovery_id = *data++; ntf.rf_interface = *data++; ntf.rf_protocol = *data++;
@@ -645,7 +685,7 @@ exit:if (err ==NCI_STATUS_OK ) { conn_info = ndev->rf_conn_info;if (!conn_info) -return ; +return 0 ; conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size; conn_info->initial_num_credits = ntf.initial_num_credits;
@@ -691,19 +731,26 @@ listen:pr_err ("error when signaling tm activation\n" ); } } + +return 0 ; } -static void nci_rf_deactivate_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_rf_deactivate_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) {const struct nci_conn_info *conn_info; -const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data; +const struct nci_rf_deactivate_ntf *ntf; + +if (skb->len <sizeof (struct nci_rf_deactivate_ntf )) +return -EINVAL ; + + ntf = (struct nci_rf_deactivate_ntf *)skb->data;pr_debug ("entry, type 0x%x, reason 0x%x\n" , ntf->type, ntf->reason); conn_info = ndev->rf_conn_info;if (!conn_info) -return ; +return 0 ;/* drop tx data queue */ skb_queue_purge (&ndev->tx_q);
@@ -735,14 +782,20 @@ static void nci_rf_deactivate_ntf_packet }nci_req_complete (ndev,NCI_STATUS_OK ); + +return 0 ; } -static void nci_nfcee_discover_ntf_packet (struct nci_dev *ndev, -const struct sk_buff *skb) +static int nci_nfcee_discover_ntf_packet (struct nci_dev *ndev, +const struct sk_buff *skb) {u8 status =NCI_STATUS_OK ; -const struct nci_nfcee_discover_ntf *nfcee_ntf = - (struct nci_nfcee_discover_ntf *)skb->data; +const struct nci_nfcee_discover_ntf *nfcee_ntf; + +if (skb->len <sizeof (struct nci_nfcee_discover_ntf )) +return -EINVAL ; + + nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data;pr_debug ("\n" );
@@ -755,6 +808,8 @@ static void nci_nfcee_discover_ntf_packe ndev->cur_params.id = nfcee_ntf->nfcee_id;nci_req_complete (ndev, status); + +return 0 ; } static void nci_nfcee_action_ntf_packet(struct nci_dev *ndev,
@@ -787,35 +842,43 @@ void nci_ntf_packet(struct nci_dev *ndevswitch (ntf_opcode) {case NCI_OP_CORE_RESET_NTF : -nci_core_reset_ntf_packet (ndev, skb); +if (nci_core_reset_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_CORE_CONN_CREDITS_NTF : -nci_core_conn_credits_ntf_packet (ndev, skb); +if (nci_core_conn_credits_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_CORE_GENERIC_ERROR_NTF : -nci_core_generic_error_ntf_packet (ndev, skb); +if (nci_core_generic_error_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_CORE_INTF_ERROR_NTF : -nci_core_conn_intf_error_ntf_packet (ndev, skb); +if (nci_core_conn_intf_error_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_RF_DISCOVER_NTF : -nci_rf_discover_ntf_packet (ndev, skb); +if (nci_rf_discover_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_RF_INTF_ACTIVATED_NTF : -nci_rf_intf_activated_ntf_packet (ndev, skb); +if (nci_rf_intf_activated_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_RF_DEACTIVATE_NTF : -nci_rf_deactivate_ntf_packet (ndev, skb); +if (nci_rf_deactivate_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_NFCEE_DISCOVER_NTF : -nci_nfcee_discover_ntf_packet (ndev, skb); +if (nci_nfcee_discover_ntf_packet (ndev, skb)) + goto end;break ;case NCI_OP_RF_NFCEE_ACTION_NTF :
Greg Kroah-Hartman
maintainerPATCH 111/276 mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.
Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells") removed the return value check from the call to gpiochip_add_data() (or rather gpiochip_add() back then and later converted to devres) with no explanation. This function however can still fail, so check the return value and bail-out if it does.
--- drivers/mfd/vexpress-sysreg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mfd/vexpress-sysreg.c +5 -1
@@ -98,6 +98,7 @@ static int vexpress_sysreg_probe(structstruct resource *mem;void __iomem *base;struct gpio_chip *mmc_gpio_chip; +int ret; mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!mem)
@@ -118,7 +119,10 @@ static int vexpress_sysreg_probe(structbgpio_init (mmc_gpio_chip, &pdev->dev,0x4 , base +SYS_MCI ,NULL ,NULL ,NULL ,NULL ,0 ); mmc_gpio_chip->ngpio =2 ; -devm_gpiochip_add_data (&pdev->dev, mmc_gpio_chip,NULL ); + + ret =devm_gpiochip_add_data (&pdev->dev, mmc_gpio_chip,NULL ); +if (ret) +return ret; return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, vexpress_sysreg_cells,
Greg Kroah-Hartman
maintainerPATCH 112/276 ext4: fix checks for orphan inodes
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.
When orphan file feature is enabled, inode can be tracked as orphan either in the standard orphan list or in the orphan file. The first can be tested by checking ei->i_orphan list head, the second is recorded by EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where we want to check whether inode is tracked as orphan and only some of them properly check for both possibilities. Luckily the consequences are mostly minor, the worst that can happen is that we track an inode as orphan although we don't need to and e2fsck then complains (resulting in occasional ext4/307 xfstest failures). Fix the problem by introducing a helper for checking whether an inode is tracked as orphan and use it in appropriate places.
Message-ID: <[email protected]>
--- fs/ext4/ext4.h | 10 ++++++++++ fs/ext4/file.c | 2 +- fs/ext4/inode.c | 2 +- fs/ext4/orphan.c | 6 +----- fs/ext4/super.c | 4 ++-- 5 files changed, 15 insertions(+), 9 deletions(-)
fs/ext4/ext4.h +10 -0
@@ -1944,6 +1944,16 @@ static inline bool ext4_verity_in_progre#define NEXT_ORPHAN (inode) EXT4_I(inode)->i_dtime/* +* Check whether the inode is tracked as orphan (either in orphan file or +* orphan list). +*/ +static inline bool ext4_inode_orphan_tracked (struct inode *inode) +{ +return ext4_test_inode_state (inode,EXT4_STATE_ORPHAN_FILE ) || + !list_empty (&EXT4_I (inode)->i_orphan); +} + +/* * Codes for operating systems */ #define EXT4_OS_LINUX 0
fs/ext4/file.c +1 -1
@@ -327,7 +327,7 @@ static void ext4_inode_extension_cleanup* to cleanup the orphan list in ext4_handle_inode_extension(). Do it * now. */ -if (!list_empty (&EXT4_I (inode)->i_orphan) && inode->i_nlink) { +if (ext4_inode_orphan_tracked (inode) && inode->i_nlink) {handle_t *handle =ext4_journal_start (inode,EXT4_HT_INODE ,2 );if (IS_ERR (handle)) {
fs/ext4/inode.c +1 -1
@@ -5122,7 +5122,7 @@ static int ext4_do_update_inode(handle_t* old inodes get re-used with the upper 16 bits of the * uid/gid intact. */ -if (ei->i_dtime &&list_empty (&ei->i_orphan)) { +if (ei->i_dtime && !ext4_inode_orphan_tracked (inode)) { raw_inode->i_uid_high =0 ; raw_inode->i_gid_high =0 ; }else {
fs/ext4/orphan.c +1 -5
@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, stWARN_ON_ONCE (!(inode->i_state & (I_NEW |I_FREEING )) && !inode_is_locked (inode)); -/* -* Inode orphaned in orphan file or in orphan list? -*/ -if (ext4_test_inode_state (inode,EXT4_STATE_ORPHAN_FILE ) || - !list_empty (&EXT4_I (inode)->i_orphan)) +if (ext4_inode_orphan_tracked (inode))return 0 ;/*
fs/ext4/super.c +2 -2
@@ -1352,9 +1352,9 @@ static void ext4_free_in_core_inode(strustatic void ext4_destroy_inode (struct inode *inode) { -if (!list_empty (&(EXT4_I (inode)->i_orphan))) { +if (ext4_inode_orphan_tracked (inode)) {ext4_msg (inode->i_sb,KERN_ERR , -"Inode %lu (%p): orphan list check failed!" , +"Inode %lu (%p): inode tracked as orphan!" , inode->i_ino,EXT4_I (inode)); print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4, EXT4_I(inode), sizeof(struct ext4_inode_info),
Greg Kroah-Hartman
maintainerPATCH 113/276 mm: hugetlb: avoid soft lockup when mprotect to large memory area
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.
When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:
watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000
Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8
Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.
Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.
So add cond_resched() for hugetlb to avoid soft lockup.
--- mm/hugetlb.c | 2 ++ 1 file changed, 2 insertions(+)
mm/hugetlb.c +2 -0
@@ -5714,6 +5714,8 @@ unsigned long hugetlb_change_protection( pages++; }spin_unlock (ptl); + +cond_resched (); }/* * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare
Greg Kroah-Hartman
maintainerPATCH 114/276 nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit a9e6aa994917ee602798bbb03180a194b37865bb upstream.
devm_kcalloc() may fail. ndtest_probe() allocates three DMA address arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses them in ndtest_nvdimm_init(), which can lead to a NULL pointer dereference under low-memory conditions.
Check all three allocations and return -ENOMEM if any allocation fails, jumping to the common error path. Do not emit an extra error message since the allocator already warns on allocation failure.
--- tools/testing/nvdimm/test/ndtest.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
tools/testing/nvdimm/test/ndtest.c +12 -1
@@ -981,11 +981,22 @@ static int ndtest_probe(struct platform_ p->dcr_dma =devm_kcalloc (&p->pdev.dev,NUM_DCR ,sizeof (dma_addr_t),GFP_KERNEL ); +if (!p->dcr_dma) { + rc = -ENOMEM ; + goto err; + } p->label_dma =devm_kcalloc (&p->pdev.dev,NUM_DCR ,sizeof (dma_addr_t),GFP_KERNEL ); +if (!p->label_dma) { + rc = -ENOMEM ; + goto err; + } p->dimm_dma =devm_kcalloc (&p->pdev.dev,NUM_DCR ,sizeof (dma_addr_t),GFP_KERNEL ); - +if (!p->dimm_dma) { + rc = -ENOMEM ; + goto err; + } rc =ndtest_nvdimm_init (p);if (rc) goto err;
Greg Kroah-Hartman
maintainerPATCH 115/276 Input: atmel_mxt_ts - allow reset GPIO to sleep
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.
The reset GPIO is not toggled in any critical section where it couldn't sleep, allow the reset GPIO to sleep. This allows the driver to operate reset GPIOs connected to I2C GPIO expanders.
--- drivers/input/touchscreen/atmel_mxt_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/atmel_mxt_ts.c +1 -1
@@ -3239,7 +3239,7 @@ static int mxt_probe(struct i2c_client *if (data->reset_gpio) {/* Wait a while and then de-assert the RESET GPIO line */ msleep (MXT_RESET_GPIO_TIME ); -gpiod_set_value (data->reset_gpio,0 ); +gpiod_set_value_cansleep (data->reset_gpio,0 );msleep (MXT_RESET_INVALID_CHG ); }
Greg Kroah-Hartman
maintainerPATCH 116/276 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.
Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace.
Initialize ff_up_compat to zero before filling valid fields.
--- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/misc/uinput.c +1 -0
@@ -741,6 +741,7 @@ static int uinput_ff_upload_to_user(charif (in_compat_syscall ()) {struct uinput_ff_upload_compat ff_up_compat; +memset (&ff_up_compat,0 ,sizeof (ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval;/*
Greg Kroah-Hartman
maintainerPATCH 117/276 pinctrl: check the return value of pinmux_ops::get_function_name()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.
While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions.
--- drivers/pinctrl/pinmux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinmux.c +1 -1
@@ -328,7 +328,7 @@ static int pinmux_func_name_to_selector(while (selector < nfuncs) {const char *fname = ops->get_function_name (pctldev, selector); -if (!strcmp (function, fname)) +if (fname && !strcmp (function, fname))return selector; selector++;
Greg Kroah-Hartman
maintainerPATCH 118/276 bus: fsl-mc: Check return value of platform_get_resource()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salah Triki <[email protected]>
commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.
platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference.
--- drivers/bus/fsl-mc/fsl-mc-bus.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bus/fsl-mc/fsl-mc-bus.c +3 -0
@@ -1169,6 +1169,9 @@ static int fsl_mc_bus_probe(struct platf* Get physical address of MC portal for the root DPRC: */ plat_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!plat_res) +return -EINVAL ; + mc_portal_phys_addr = plat_res->start; mc_portal_size =resource_size (plat_res); mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff ;
Greg Kroah-Hartman
maintainerPATCH 119/276 usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit e9c206324eeb213957a567a9d066bdeb355c7491 upstream.
The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device, which means the device will be automatically disabled on driver detach through the managed device framework. The manual pci_disable_device() call in the error path is therefore redundant.
Found via static anlaysis and this is similar to commit 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload").
--- drivers/usb/cdns3/cdnsp-pci.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/usb/cdns3/cdnsp-pci.c +1 -4
@@ -90,7 +90,7 @@ static int cdnsp_pci_probe(struct pci_de cdnsp =kzalloc (sizeof (*cdnsp),GFP_KERNEL );if (!cdnsp) { ret = -ENOMEM ; - goto disable_pci; + goto put_pci; } }
@@ -173,9 +173,6 @@ free_cdnsp:if (!pci_is_enabled (func))kfree (cdnsp); -disable_pci: -pci_disable_device (pdev); - put_pci:pci_dev_put (func);
Greg Kroah-Hartman
maintainerPATCH 120/276 fs: always return zero on success from replace_fd()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 708c04a5c2b78e22f56e2350de41feba74dfccd9 upstream.
replace_fd() returns the number of the new file descriptor through the return value of do_dup2(). However its callers never care about the specific returned number. In fact the caller in receive_fd_replace() treats any non-zero return value as an error and therefore never calls __receive_sock() for most file descriptors, which is a bug.
To fix the bug in receive_fd_replace() and to avoid the same issue happening in future callers, signal success through a plain zero.
--- fs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/file.c +4 -1
@@ -1154,7 +1154,10 @@ int replace_fd(unsigned fd, struct file err =expand_files (files, fd);if (unlikely (err <0 )) goto out_unlock; -return do_dup2 (files, file, fd, flags); + err =do_dup2 (files, file, fd, flags); +if (err <0 ) +return err; +return 0 ; out_unlock:spin_unlock (&files->file_lock);
Greg Kroah-Hartman
maintainerPATCH 121/276 clocksource/drivers/clps711x: Fix resource leaks in error paths
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <[email protected]>
commit cd32e596f02fc981674573402c1138f616df1728 upstream.
The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths.
--- drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/clocksource/clps711x-timer.c +16 -7
@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(stunsigned int irq =irq_of_parse_and_map (np,0 );struct clk *clock =of_clk_get (np,0 );void __iomem *base =of_iomap (np,0 ); +int ret =0 ;if (!base)return -ENOMEM ; -if (!irq) -return -EINVAL ; -if (IS_ERR (clock)) -return PTR_ERR (clock); +if (!irq) { + ret = -EINVAL ; + goto unmap_io; + } +if (IS_ERR (clock)) { + ret =PTR_ERR (clock); + goto unmap_io; + }switch (of_alias_get_id (np,"timer" )) {case CLPS711X_CLKSRC_CLOCKSOURCE :clps711x_clksrc_init (clock, base);break ;case CLPS711X_CLKSRC_CLOCKEVENT : -return _clps711x_clkevt_init (clock, base, irq); + ret =_clps711x_clkevt_init (clock, base, irq); +break ;default : -return -EINVAL ; + ret = -EINVAL ; +break ; } -return 0 ; +unmap_io: +iounmap (base); +return ret; }TIMER_OF_DECLARE (clps711x,"cirrus,ep7209-timer" , clps711x_timer_init);
Greg Kroah-Hartman
maintainerPATCH 122/276 iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <[email protected]>
commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it accordingly.
--- include/linux/iio/frequency/adf4350.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iio/frequency/adf4350.h +1 -1
@@ -51,7 +51,7 @@/* REG3 Bit Definitions */ #define ADF4350_REG3_12BIT_CLKDIV (x) ((x) << 3) -#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 16) +#define ADF4350_REG3_12BIT_CLKDIV_MODE (x) ((x) << 15)#define ADF4350_REG3_12BIT_CSR_EN (1 << 18)#define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)#define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
Greg Kroah-Hartman
maintainerPATCH 123/276 perf evsel: Avoid container_of on a NULL leader
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
An evsel should typically have a leader of itself, however, in tests like 'Sample parsing' a NULL leader may occur and the container_of will return a corrupt pointer.
Avoid this with an explicit NULL test.
--- tools/perf/util/evsel.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/util/evsel.c +2 -0
@@ -2930,6 +2930,8 @@ bool evsel__is_hybrid(struct evsel *evsel)struct evsel *evsel__leader (struct evsel *evsel) { +if (evsel->core.leader ==NULL ) +return NULL ; return container_of(evsel->core.leader, struct evsel, core); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/276 libperf event: Ensure tracing data is multiple of 8 sized
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
Perf's synthetic-events.c will ensure 8-byte alignment of tracing data, writing it after a perf_record_header_tracing_data event.
Add padding to struct perf_record_header_tracing_data to make it 16-byte rather than 12-byte sized.
--- tools/lib/perf/include/perf/event.h | 1 + 1 file changed, 1 insertion(+)
tools/lib/perf/include/perf/event.h +1 -0
@@ -211,6 +211,7 @@ struct perf_record_header_event_type {struct perf_record_header_tracing_data {struct perf_event_header header;__u32 size; +__u32 pad; };#define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/276 clk: at91: peripheral: fix return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
determine_rate() is expected to return an error code, or 0 on success. clk_sam9x5_peripheral_determine_rate() has a branch that returns the parent rate on a certain case. This is the behavior of round_rate(), so let's go ahead and fix this by setting req->rate.
--- drivers/clk/at91/clk-peripheral.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/clk/at91/clk-peripheral.c +5 -2
@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,long best_diff =LONG_MIN ;u32 shift; -if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) -return parent_rate; +if (periph->id <PERIPHERAL_ID_MIN || !periph->range.max) { + req->rate = parent_rate; + +return 0 ; + }/* Fist step: check the available dividers. */ for (shift =0 ; shift <=PERIPHERAL_MAX_SHIFT ; shift++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/276 perf util: Fix compression checks returning -1 as bool
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
The lzma_is_compressed and gzip_is_compressed functions are declared to return a "bool" type, but in case of an error (e.g., file open failure), they incorrectly returned -1.
A bool type is a boolean value that is either true or false. Returning -1 for a bool return type can lead to unexpected behavior and may violate strict type-checking in some compilers.
Fix the return value to be false in error cases, ensuring the function adheres to its declared return type improves for preventing potential bugs related to type mismatch.
--- tools/perf/util/lzma.c | 2 +- tools/perf/util/zlib.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/lzma.c +1 -1
@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
tools/perf/util/zlib.c +1 -1
@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)ssize_t rc;if (fd <0 ) -return -1 ; +return false; rc =read (fd, buf,sizeof (buf));close (fd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/276 rtc: x1205: Fix Xicor X1205 vendor prefix
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired by Intersil. Since the I2C subsystem drops the vendor prefix for driver matching, the vendor prefix hasn't mattered.
--- drivers/rtc/rtc-x1205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-x1205.c +1 -1
@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {MODULE_DEVICE_TABLE (i2c, x1205_id);static const struct of_device_id x1205_dt_ids[] = { - { .compatible ="xircom,x1205" , }, + { .compatible ="xicor,x1205" , }, {}, };MODULE_DEVICE_TABLE (of, x1205_dt_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/276 perf arm-spe: Save context ID in record
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: German Gomez <[email protected]>
[ Upstream commit 169de64f5dc22d9984d45c1f119fb644fa16d64a ]
This patch is to save context ID in record, this will be used to set TID for samples.
Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access")
--- tools/perf/util/arm-spe-decoder/arm-spe-decoder.c | 2 ++ tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 1 + 2 files changed, 3 insertions(+)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +2 -0
@@ -151,6 +151,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)u64 payload, ip;memset (&decoder->record,0x0 ,sizeof (decoder->record)); + decoder->record.context_id = (u64)-1 ;while (1 ) { err =arm_spe_get_next_packet (decoder);
@@ -180,6 +181,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)case ARM_SPE_COUNTER :break ;case ARM_SPE_CONTEXT : + decoder->record.context_id = payload;break ;case ARM_SPE_OP_TYPE :if (idx ==SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC ) {
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +1 -0
@@ -38,6 +38,7 @@ struct arm_spe_record {u64 timestamp;u64 virt_addr;u64 phys_addr; +u64 context_id; };struct arm_spe_insn ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/276 perf arm-spe: Use SPE data source for neoverse cores
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ali Saidi <[email protected]>
[ Upstream commit 4e6430cbb1a9f1dc0a698f93026b6178da437798 ]
When synthesizing data from SPE, augment the type with source information for Arm Neoverse cores. The field is IMPLDEF but the Neoverse cores all use the same encoding. I can't find encoding information for any other SPE implementations to unify their choices with Arm's thus that is left for future work.
This change populates the mem_lvl_num for Neoverse cores as well as the deprecated mem_lvl namespace.
Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.c | 1 + .../util/arm-spe-decoder/arm-spe-decoder.h | 12 ++ tools/perf/util/arm-spe.c | 130 +++++++++++++++--- 3 files changed, 127 insertions(+), 16 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +1 -0
@@ -218,6 +218,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)break ;case ARM_SPE_DATA_SOURCE : + decoder->record.source = payload;break ;case ARM_SPE_BAD :break ;
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +12 -0
@@ -29,6 +29,17 @@ enum arm_spe_op_type { ARM_SPE_ST = 1 << 1, }; +enum arm_spe_neoverse_data_source { +ARM_SPE_NV_L1D =0x0 , +ARM_SPE_NV_L2 =0x8 , +ARM_SPE_NV_PEER_CORE =0x9 , +ARM_SPE_NV_LOCAL_CLUSTER =0xa , +ARM_SPE_NV_SYS_CACHE =0xb , +ARM_SPE_NV_PEER_CLUSTER =0xc , +ARM_SPE_NV_REMOTE =0xd , +ARM_SPE_NV_DRAM =0xe , +}; +struct arm_spe_record {enum arm_spe_sample_type type;int err;
@@ -39,6 +50,7 @@ struct arm_spe_record {u64 virt_addr;u64 phys_addr;u64 context_id; +u16 source; };struct arm_spe_insn ;
tools/perf/util/arm-spe.c +114 -16
180 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/276 perf arm_spe: Correct setting remote access
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
Set the mem_remote field for a remote access to appropriately represent the event.
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -417,7 +417,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco }if (record->type &ARM_SPE_REMOTE_ACCESS ) - data_src->mem_lvl |=PERF_MEM_LVL_REM_CCE1 ; + data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; }static u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/276 perf arm-spe: augment the data source type with neoverse_spe list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Zhang <[email protected]>
[ Upstream commit 74a61d53a6d1ca1172d85964d15c83c2cc3670b3 ]
When synthesizing event with SPE data source, commit 4e6430cbb1a9("perf
arm-spe: Use SPE data source for neoverse cores") augment the type with source information by MIDR. However, is_midr_in_range only compares the first entry in neoverse_spe.
Change is_midr_in_range to is_midr_in_range_list to traverse the neoverse_spe array so that all neoverse cores synthesize event with data source packet.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- tools/perf/util/arm-spe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/arm-spe.c +1 -1
@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) {union perf_mem_data_src data_src = {0 }; -bool is_neoverse =is_midr_in_range (midr, neoverse_spe); +bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe);if (record->op ==ARM_SPE_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/276 perf arm-spe: Refactor arm-spe to support operation packet type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: German Gomez <[email protected]>
[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ]
Extend the decoder of Arm SPE records to support more fields from the operation packet type.
Not all fields are being decoded by this commit. Only those needed to support the use-case SVE load/store/other operations.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++-- .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++---- tools/perf/util/arm-spe.c | 8 ++-- 3 files changed, 67 insertions(+), 18 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.c +26 -4
@@ -184,11 +184,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder) decoder->record.context_id = payload;break ;case ARM_SPE_OP_TYPE : -if (idx ==SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC ) { -if (payload &0x1 ) - decoder->record.op =ARM_SPE_ST ; +switch (idx) { +case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC : + decoder->record.op |=ARM_SPE_OP_LDST ; +if (payload &SPE_OP_PKT_ST ) + decoder->record.op |=ARM_SPE_OP_ST ;else - decoder->record.op =ARM_SPE_LD ; + decoder->record.op |=ARM_SPE_OP_LD ; +if (SPE_OP_PKT_IS_LDST_SVE (payload)) + decoder->record.op |=ARM_SPE_OP_SVE_LDST ; +break ; +case SPE_OP_PKT_HDR_CLASS_OTHER : + decoder->record.op |=ARM_SPE_OP_OTHER ; +if (SPE_OP_PKT_IS_OTHER_SVE_OP (payload)) + decoder->record.op |=ARM_SPE_OP_SVE_OTHER ; +break ; +case SPE_OP_PKT_HDR_CLASS_BR_ERET : + decoder->record.op |=ARM_SPE_OP_BRANCH_ERET ; +break ; +default : +pr_err ("Get packet error!\n" ); +return -1 ; }break ;case ARM_SPE_EVENTS :
@@ -216,6 +232,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)if (payload &BIT (EV_MISPRED )) decoder->record.type |=ARM_SPE_BRANCH_MISS ; +if (payload &BIT (EV_PARTIAL_PREDICATE )) + decoder->record.type |=ARM_SPE_SVE_PARTIAL_PRED ; + +if (payload &BIT (EV_EMPTY_PREDICATE )) + decoder->record.type |=ARM_SPE_SVE_EMPTY_PRED ; +break ;case ARM_SPE_DATA_SOURCE : decoder->record.source = payload;
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +37 -10
56 lines not on this page · raw message
tools/perf/util/arm-spe.c +4 -4
@@ -336,7 +336,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We have no data on the hit level or data source for stores in the * Neoverse SPE records. */ -if (record->op &ARM_SPE_ST ) { +if (record->op &ARM_SPE_OP_ST ) { data_src->mem_lvl =PERF_MEM_LVL_NA ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_snoop =PERF_MEM_SNOOP_NA ;
@@ -422,12 +422,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) { -union perf_mem_data_src data_src = {0 }; +union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA };bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); -if (record->op ==ARM_SPE_LD ) +if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ; -else if (record->op ==ARM_SPE_ST ) +else if (record->op &ARM_SPE_OP_ST ) data_src.mem_op =PERF_MEM_OP_STORE ;else return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/276 perf arm-spe: Rename the common data source encoding
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
The Neoverse CPUs follow the common data source encoding, and other CPU variants can share the same format.
Rename the CPU list and data source definitions as common data source names. This change prepares for appending more CPU variants.
Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
--- .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------ tools/perf/util/arm-spe.c | 28 +++++++++---------- 2 files changed, 23 insertions(+), 23 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-decoder.h +9 -9
@@ -56,15 +56,15 @@ enum arm_spe_op_type { ARM_SPE_OP_BR_INDIRECT = 1 << 17, }; -enum arm_spe_neoverse_data_source { -ARM_SPE_NV_L1D =0x0 , -ARM_SPE_NV_L2 =0x8 , -ARM_SPE_NV_PEER_CORE =0x9 , -ARM_SPE_NV_LOCAL_CLUSTER =0xa , -ARM_SPE_NV_SYS_CACHE =0xb , -ARM_SPE_NV_PEER_CLUSTER =0xc , -ARM_SPE_NV_REMOTE =0xd , -ARM_SPE_NV_DRAM =0xe , +enum arm_spe_common_data_source { +ARM_SPE_COMMON_DS_L1D =0x0 , +ARM_SPE_COMMON_DS_L2 =0x8 , +ARM_SPE_COMMON_DS_PEER_CORE =0x9 , +ARM_SPE_COMMON_DS_LOCAL_CLUSTER =0xa , +ARM_SPE_COMMON_DS_SYS_CACHE =0xb , +ARM_SPE_COMMON_DS_PEER_CLUSTER =0xc , +ARM_SPE_COMMON_DS_REMOTE =0xd , +ARM_SPE_COMMON_DS_DRAM =0xe , };struct arm_spe_record {
tools/perf/util/arm-spe.c +14 -14
@@ -314,15 +314,15 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq,return arm_spe_deliver_synth_event (spe, speq, event, &sample); } -static const struct midr_range neoverse_spe[] = { +static const struct midr_range common_ds_encoding_cpus[] = {MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N1 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_N2 ),MIDR_ALL_VERSIONS (MIDR_NEOVERSE_V1 ), {}, }; -static void arm_spe__synth_data_source_neoverse (const struct arm_spe_record *record, -union perf_mem_data_src *data_src) +static void arm_spe__synth_data_source_common (const struct arm_spe_record *record, +union perf_mem_data_src *data_src) {/* * Even though four levels of cache hierarchy are possible, no known
@@ -344,17 +344,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec }switch (record->source) { -case ARM_SPE_NV_L1D : +case ARM_SPE_COMMON_DS_L1D : data_src->mem_lvl =PERF_MEM_LVL_L1 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L1 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_L2 : +case ARM_SPE_COMMON_DS_L2 : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;break ; -case ARM_SPE_NV_PEER_CORE : +case ARM_SPE_COMMON_DS_PEER_CORE : data_src->mem_lvl =PERF_MEM_LVL_L2 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L2 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -363,8 +363,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know if this is L1, L2 but we do know it was a cache-2-cache * transfer, so set SNOOPX_PEER */ -case ARM_SPE_NV_LOCAL_CLUSTER : -case ARM_SPE_NV_PEER_CLUSTER : +case ARM_SPE_COMMON_DS_LOCAL_CLUSTER : +case ARM_SPE_COMMON_DS_PEER_CLUSTER : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;
@@ -372,7 +372,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec/* * System cache is assumed to be L3 */ -case ARM_SPE_NV_SYS_CACHE : +case ARM_SPE_COMMON_DS_SYS_CACHE : data_src->mem_lvl =PERF_MEM_LVL_L3 |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_L3 ; data_src->mem_snoop =PERF_MEM_SNOOP_HIT ;
@@ -381,13 +381,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec* We don't know what level it hit in, except it came from the other * socket */ -case ARM_SPE_NV_REMOTE : +case ARM_SPE_COMMON_DS_REMOTE : data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ; -case ARM_SPE_NV_DRAM : +case ARM_SPE_COMMON_DS_DRAM : data_src->mem_lvl =PERF_MEM_LVL_LOC_RAM |PERF_MEM_LVL_HIT ; data_src->mem_lvl_num =PERF_MEM_LVLNUM_RAM ; data_src->mem_snoop =PERF_MEM_SNOOP_NONE ;
@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *recostatic u64 arm_spe__synth_data_source (const struct arm_spe_record *record,u64 midr) {union perf_mem_data_src data_src = { .mem_op =PERF_MEM_OP_NA }; -bool is_neoverse =is_midr_in_range_list (midr, neoverse_spe); +bool is_common =is_midr_in_range_list (midr, common_ds_encoding_cpus);if (record->op &ARM_SPE_OP_LD ) data_src.mem_op =PERF_MEM_OP_LOAD ;
@@ -432,8 +432,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 melse return 0 ; -if (is_neoverse) -arm_spe__synth_data_source_neoverse (record, &data_src); +if (is_common) +arm_spe__synth_data_source_common (record, &data_src);else arm_spe__synth_data_source_generic (record, &data_src);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/276 perf arm_spe: Correct memory level for remote access
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
For remote accesses, the data source packet does not contain information about the memory level. To avoid misinformation, set the memory level to NA (Not Available).
--- tools/perf/util/arm-spe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/arm-spe.c +2 -2
@@ -382,8 +382,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor* socket */ case ARM_SPE_COMMON_DS_REMOTE : - data_src->mem_lvl =PERF_MEM_LVL_REM_CCE1 ; - data_src->mem_lvl_num =PERF_MEM_LVLNUM_ANY_CACHE ; + data_src->mem_lvl =PERF_MEM_LVL_NA ; + data_src->mem_lvl_num =PERF_MEM_LVLNUM_NA ; data_src->mem_remote =PERF_MEM_REMOTE_REMOTE ; data_src->mem_snoopx =PERF_MEM_SNOOPX_PEER ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/276 perf session: Fix handling when buffer exceeds 2 GiB
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
If a user specifies an AUX buffer larger than 2 GiB, the returned size may exceed 0x80000000. Since the err variable is defined as a signed 32-bit integer, such a value overflows and becomes negative.
As a result, the perf record command reports an error:
0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
Change the type of the err variable to a signed 64-bit integer to accommodate large buffer sizes correctly.
--- tools/perf/util/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/session.c +1 -1
@@ -1598,7 +1598,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,struct perf_tool *tool = session->tool;struct perf_sample sample = { .time =0 , };int fd =perf_data__fd (session->data); -int err; +s64 err;if (event->header.type !=PERF_RECORD_COMPRESSED || tool->compressed == perf_session__process_compressed_event_stub)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 136/276 perf test: Dont leak workload gopipe in PERF_RECORD_*
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
The test starts a workload and then opens events. If the events fail to open, for example because of perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.
Before:
```
$ perf test -vv 7
7: PERF_RECORD_* events & perf_sample fields:
--- start ---
test child forked, pid 1189568
Using CPUID GenuineIntel-6-B7-1
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
------------------------------------------------------------
perf_event_attr:
type 0 (PERF_TYPE_HARDWARE)
config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
disabled 1
exclude_kernel 1
------------------------------------------------------------
sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
Attempt to add: software/cpu-clock/
..after resolving event: software/config=0/
cpu-clock -> software/cpu-clock/
------------------------------------------------------------
perf_event_attr:
type 1 (PERF_TYPE_SOFTWARE)
size 136
config 0x9 (PERF_COUNT_SW_DUMMY)
sample_type IP|TID|TIME|CPU
read_format ID|LOST
disabled 1
inherit 1
mmap 1
comm 1
enable_on_exec 1
task 1
sample_id_all 1
mmap2 1
comm_exec 1
ksymbol 1
bpf_event 1
{ wakeup_events, wakeup_watermark } 1
------------------------------------------------------------
sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
sys_perf_event_open failed, error -13
perf_evlist__open: Permission denied
---- end(-2) ----
Leak of file descriptor 6 that opened: 'pipe:[14200347]'
---- unexpected signal (6) ----
iFailed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
Failed to read build ID for //anon
#0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
#1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
#2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
#3 0x7f29ce849cc2 in raise raise.c:27
#4 0x7f29ce8324ac in abort abort.c:81
#5 0x565358f662d4 in check_leaks builtin-test.c:226
#6 0x565358f6682e in run_test_child builtin-test.c:344
#7 0x565358ef7121 in start_command run-command.c:128
#8 0x565358f67273 in start_test builtin-test.c:545
#9 0x565358f6771d in __cmd_test builtin-test.c:647
#10 0x565358f682bd in cmd_test builtin-test.c:849
#11 0x565358ee5ded in run_builtin perf.c:349
#12 0x565358ee6085 in handle_internal_command perf.c:401
#13 0x565358ee61de in run_argv perf.c:448
#14 0x565358ee6527 in main perf.c:555
#15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
#16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#17 0x565358e391c1 in _start perf[851c1]
7: PERF_RECORD_* events & perf_sample fields : FAILED!
```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```
--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/perf/tests/perf-record.c +4 -0
@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
Signature · 1 line
2.51.0
Re: [PATCH 5.15 136/276] perf test: Dont leak workload gopipe in PERF_RECORD_*
Quoted 191 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit
48918cacefd226af44373e914e63304927c0e7dc]The test starts a workload and then opens events. If the events fail to open, for example because of
perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.Before:
``` $ perf test -vv 7 7: PERF_RECORD_* events & perf_sample fields: --- start --- test child forked, pid 1189568 Using CPUID GenuineIntel-6-B7-1 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 Attempt to add: software/cpu-clock/ ..after resolving event: software/config=0/ cpu-clock -> software/cpu-clock/ ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0x9 (PERF_COUNT_SW_DUMMY) sample_type IP|TID|TIME|CPU read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 enable_on_exec 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 { wakeup_events, wakeup_watermark } 1 ------------------------------------------------------------ sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 perf_evlist__open: Permission denied ---- end(-2) ---- Leak of file descriptor 6 that opened: 'pipe:[14200347]' ---- unexpected signal (6) ---- iFailed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 #3 0x7f29ce849cc2 in raise raise.c:27 #4 0x7f29ce8324ac in abort abort.c:81 #5 0x565358f662d4 in check_leaks builtin-test.c:226 #6 0x565358f6682e in run_test_child builtin-test.c:344 #7 0x565358ef7121 in start_command run-command.c:128 #8 0x565358f67273 in start_test builtin-test.c:545 #9 0x565358f6771d in __cmd_test builtin-test.c:647 #10 0x565358f682bd in cmd_test builtin-test.c:849 #11 0x565358ee5ded in run_builtin perf.c:349 #12 0x565358ee6085 in handle_internal_command perf.c:401 #13 0x565358ee61de in run_argv perf.c:448 #14 0x565358ee6527 in main perf.c:555 #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #17 0x565358e391c1 in _start perf[851c1] 7: PERF_RECORD_* events & perf_sample fields : FAILED! ```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```Fixes 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")Signed-off-by Ian Rogers <[email protected]>Cc Adrian Hunter <[email protected]>Cc Alexander Shishkin <[email protected]>Cc Athira Rajeev <[email protected]>Cc Chun-Tse Shao <[email protected]>Cc Howard Chu <[email protected]>Cc Ingo Molnar <[email protected]>Cc James Clark <[email protected]>Cc Jiri Olsa <[email protected]>Cc Kan Liang <[email protected]>Cc Mark Rutland <[email protected]>Cc Namhyung Kim <[email protected]>Cc Peter Zijlstra <[email protected]>Signed-off-by Arnaldo Carvalho de Melo <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)tools/perf/tests/perf-record.c +3
-0@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
tools/perf/tests/perf-record.c int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus · line 158
Quoted 7 lines
tools/perf/tests/perf-record.c +1
-0@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }
it seems that this commit breaks building perf followingly with v5.15.195:
| /usr/bin/ld: perf-in.o: in function `test__PERF_RECORD': | /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:142: undefined reference to `evlist__cancel_workload' | /usr/bin/ld: /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:130: undefined reference to `evlist__cancel_workload'
The 'evlist__cancel_workload' seems to be introduced in commit e880a70f8046 ("perf stat: Close cork_fd when create_perf_stat_counter() failed") which is currently not included in the 5.15.y stable series.
BR, Niko Mauno
Greg Kroah-Hartman
maintainerRe: [PATCH 5.15 136/276] perf test: Dont leak workload gopipe in PERF_RECORD_*
Quoted 198 lines · Niko Mauno
Quoted 188 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit
48918cacefd226af44373e914e63304927c0e7dc]The test starts a workload and then opens events. If the events fail to open, for example because of
perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.Before:
``` $ perf test -vv 7 7: PERF_RECORD_* events & perf_sample fields: --- start --- test child forked, pid 1189568 Using CPUID GenuineIntel-6-B7-1 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 Attempt to add: software/cpu-clock/ ..after resolving event: software/config=0/ cpu-clock -> software/cpu-clock/ ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0x9 (PERF_COUNT_SW_DUMMY) sample_type IP|TID|TIME|CPU read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 enable_on_exec 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 { wakeup_events, wakeup_watermark } 1 ------------------------------------------------------------ sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 perf_evlist__open: Permission denied ---- end(-2) ---- Leak of file descriptor 6 that opened: 'pipe:[14200347]' ---- unexpected signal (6) ---- iFailed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 #3 0x7f29ce849cc2 in raise raise.c:27 #4 0x7f29ce8324ac in abort abort.c:81 #5 0x565358f662d4 in check_leaks builtin-test.c:226 #6 0x565358f6682e in run_test_child builtin-test.c:344 #7 0x565358ef7121 in start_command run-command.c:128 #8 0x565358f67273 in start_test builtin-test.c:545 #9 0x565358f6771d in __cmd_test builtin-test.c:647 #10 0x565358f682bd in cmd_test builtin-test.c:849 #11 0x565358ee5ded in run_builtin perf.c:349 #12 0x565358ee6085 in handle_internal_command perf.c:401 #13 0x565358ee61de in run_argv perf.c:448 #14 0x565358ee6527 in main perf.c:555 #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #17 0x565358e391c1 in _start perf[851c1] 7: PERF_RECORD_* events & perf_sample fields : FAILED! ```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```Fixes 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")Signed-off-by Ian Rogers <[email protected]>Cc Adrian Hunter <[email protected]>Cc Alexander Shishkin <[email protected]>Cc Athira Rajeev <[email protected]>Cc Chun-Tse Shao <[email protected]>Cc Howard Chu <[email protected]>Cc Ingo Molnar <[email protected]>Cc James Clark <[email protected]>Cc Jiri Olsa <[email protected]>Cc Kan Liang <[email protected]>Cc Mark Rutland <[email protected]>Cc Namhyung Kim <[email protected]>Cc Peter Zijlstra <[email protected]>Signed-off-by Arnaldo Carvalho de Melo <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)tools/perf/tests/perf-record.c +3
-0@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }tools/perf/tests/perf-record.c int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus · line 157
Quoted 6 lines
tools/perf/tests/perf-record.c +1
-0@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }it seems that this commit breaks building perf followingly with v5.15.195:
Quoted 7 lines
| /usr/bin/ld: perf-in.o: in function `test__PERF_RECORD': | /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:142: undefined reference to `evlist__cancel_workload' | /usr/bin/ld: /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:130: undefined reference to `evlist__cancel_workload'The '
evlist__cancel_workload' seems to be introduced in commite880a70f8046("perf stat: Closecork_fdwhencreate_perf_stat_counter()failed") which is currently not included in the 5.15.y stable series.BR, Niko Mauno
Can you send a revert for this?
thanks,
greg k-h
Re: [PATCH 5.15 136/276] perf test: Dont leak workload gopipe in PERF_RECORD_*
Quoted 203 lines · Greg Kroah-Hartman
Quoted 202 lines · Niko Mauno
Quoted 188 lines · Greg Kroah-Hartman
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit
48918cacefd226af44373e914e63304927c0e7dc]The test starts a workload and then opens events. If the events fail to open, for example because of
perf_event_paranoid, the gopipe of the workload is leaked and the file descriptor leak check fails when the test exits. To avoid this cancel the workload when opening the events fails.Before:
``` $ perf test -vv 7 7: PERF_RECORD_* events & perf_sample fields: --- start --- test child forked, pid 1189568 Using CPUID GenuineIntel-6-B7-1 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/) disabled 1 exclude_kernel 1 ------------------------------------------------------------ sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3 Attempt to add: software/cpu-clock/ ..after resolving event: software/config=0/ cpu-clock -> software/cpu-clock/ ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0x9 (PERF_COUNT_SW_DUMMY) sample_type IP|TID|TIME|CPU read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 enable_on_exec 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 { wakeup_events, wakeup_watermark } 1 ------------------------------------------------------------ sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8 sys_perf_event_open failed, error -13 perf_evlist__open: Permission denied ---- end(-2) ---- Leak of file descriptor 6 that opened: 'pipe:[14200347]' ---- unexpected signal (6) ---- iFailed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon Failed to read build ID for //anon #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311 #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0 #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44 #3 0x7f29ce849cc2 in raise raise.c:27 #4 0x7f29ce8324ac in abort abort.c:81 #5 0x565358f662d4 in check_leaks builtin-test.c:226 #6 0x565358f6682e in run_test_child builtin-test.c:344 #7 0x565358ef7121 in start_command run-command.c:128 #8 0x565358f67273 in start_test builtin-test.c:545 #9 0x565358f6771d in __cmd_test builtin-test.c:647 #10 0x565358f682bd in cmd_test builtin-test.c:849 #11 0x565358ee5ded in run_builtin perf.c:349 #12 0x565358ee6085 in handle_internal_command perf.c:401 #13 0x565358ee61de in run_argv perf.c:448 #14 0x565358ee6527 in main perf.c:555 #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74 #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #17 0x565358e391c1 in _start perf[851c1] 7: PERF_RECORD_* events & perf_sample fields : FAILED! ```After:
``` $ perf test 7 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ```Fixes 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")Signed-off-by Ian Rogers <[email protected]>Cc Adrian Hunter <[email protected]>Cc Alexander Shishkin <[email protected]>Cc Athira Rajeev <[email protected]>Cc Chun-Tse Shao <[email protected]>Cc Howard Chu <[email protected]>Cc Ingo Molnar <[email protected]>Cc James Clark <[email protected]>Cc Jiri Olsa <[email protected]>Cc Kan Liang <[email protected]>Cc Mark Rutland <[email protected]>Cc Namhyung Kim <[email protected]>Cc Peter Zijlstra <[email protected]>Signed-off-by Arnaldo Carvalho de Melo <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- tools/perf/tests/perf-record.c | 4 ++++ 1 file changed, 4 insertions(+)tools/perf/tests/perf-record.c +3
-0@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("sched__get_first_possible_cpu: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (sched_setaffinity (evlist->workload.pid, cpu_mask_size, &cpu_mask) <0 ) {pr_debug ("sched_setaffinity: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("perf_evlist__open: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }tools/perf/tests/perf-record.c int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus · line 157
Quoted 6 lines
tools/perf/tests/perf-record.c +1
-0@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unusif (err <0 ) {pr_debug ("evlist__mmap: %s\n" ,str_error_r (errno, sbuf,sizeof (sbuf))); +evlist__cancel_workload (evlist); goto out_delete_evlist; }it seems that this commit breaks building perf followingly with v5.15.195:
| /usr/bin/ld: perf-in.o: in function `test__PERF_RECORD': | /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:142: undefined reference to `evlist__cancel_workload' | /usr/bin/ld: /home/username/src/vaisala-linux-stable/tools/perf/tests/perf-record.c:130: undefined reference to `evlist__cancel_workload'
Quoted 5 lines
Quoted 3 lines
The '
evlist__cancel_workload' seems to be introduced in commite880a70f8046("perf stat: Closecork_fdwhencreate_perf_stat_counter()failed") which is currently not included in the 5.15.y stable series.BR, Niko Mauno
Can you send a revert for this?
Submitted https://lore.kernel.org/stable/[email protected]/T/#u
-Niko
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 137/276 clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series.
Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +9 -7
@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,return 0 ; } -static long lpc18xx_pll0_round_rate (struct clk_hw *hw,unsigned long rate, -unsigned long *prate) +static int lpc18xx_pll0_determine_rate (struct clk_hw *hw, +struct clk_rate_request *req) {unsigned long m; -if (*prate < rate) { +if (req->best_parent_rate < req->rate) {pr_warn ("%s: pll dividers not supported\n" , __func__);return -EINVAL ; } - m =DIV_ROUND_UP_ULL (*prate, rate *2 ); + m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 );if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { -pr_warn ("%s: unable to support rate %lu\n" , __func__, rate); +pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; } -return 2 * *prate * m; + req->rate =2 * req->best_parent_rate * m; + +return 0 ; } static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,static const struct clk_ops lpc18xx_pll0_ops = { .recalc_rate = lpc18xx_pll0_recalc_rate, - .round_rate = lpc18xx_pll0_round_rate, + .determine_rate = lpc18xx_pll0_determine_rate, .set_rate = lpc18xx_pll0_set_rate, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 138/276 clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
The conditional check for the PLL0 multiplier 'm' used a logical AND instead of OR, making the range check ineffective. This patch replaces && with || to correctly reject invalid values of 'm' that are either less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
This ensures proper bounds checking during clk rate setting and rounding.
--- drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/nxp/clk-lpc18xx-cgu.c +2 -2
@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw, } m =DIV_ROUND_UP_ULL (req->best_parent_rate, req->rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, req->rate);return -EINVAL ; }
@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate, } m =DIV_ROUND_UP_ULL (parent_rate, rate *2 ); -if (m <=0 && m >LPC18XX_PLL0_MSEL_MAX ) { +if (m ==0 || m >LPC18XX_PLL0_MSEL_MAX ) {pr_warn ("%s: unable to support rate %lu\n" , __func__, rate);return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 139/276 cpufreq: tegra186: Set target frequency for all cpus in policy
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency.
--- drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/cpufreq/tegra186-cpufreq.c +6 -2
@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy, {struct tegra186_cpufreq_data *data =cpufreq_get_driver_data ();struct cpufreq_frequency_table *tbl = policy->freq_table + index; -unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset; +unsigned int edvd_offset;u32 edvd_val = tbl->driver_data; +u32 cpu; -writel (edvd_val, data->regs + edvd_offset); +for_each_cpu (cpu, policy->cpus) { + edvd_offset = data->cpus[cpu].edvd_offset; +writel (edvd_val, data->regs + edvd_offset); + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 140/276 scsi: libsas: Add sas_task_find_rq()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
blk-mq already provides a unique tag per request. Some libsas LLDDs - like hisi_sas - already use this tag as the unique per-I/O HW tag.
Add a common function to provide the request associated with a sas_task for all libsas LLDDs.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- include/scsi/libsas.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
include/scsi/libsas.h +18 -0
@@ -631,6 +631,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);extern struct sas_task *sas_alloc_slow_task (gfp_t flags);extern void sas_free_task (struct sas_task *task); +static inline struct request *sas_task_find_rq (struct sas_task *task) +{ +struct scsi_cmnd *scmd; + +if (task->task_proto &SAS_PROTOCOL_STP_ALL ) { +struct ata_queued_cmd *qc = task->uldd_task; + + scmd = qc ? qc->scsicmd :NULL ; + }else { + scmd = task->uldd_task; + } + +if (!scmd) +return NULL ; + +return scsi_cmd_to_rq (scmd); +} +struct sas_domain_function_template {/* The class calls these to notify the LLDD of an event. */ void (*lldd_port_formed)(struct asd_sas_phy *);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 141/276 scsi: mvsas: Delete mvs_tag_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
All mvs_tag_init() does is zero the tag bitmap, but this is already done with the kzalloc() call to alloc the tags, so delete this unneeded function.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_init.c | 2 -- drivers/scsi/mvsas/mv_sas.c | 7 ------- drivers/scsi/mvsas/mv_sas.h | 1 - 3 files changed, 10 deletions(-)
drivers/scsi/mvsas/mv_init.c +0 -2
@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost) } mvi->tags_num = slot_nr; -/* Initialize tags */ -mvs_tag_init (mvi);return 0 ; err_out:return 1 ;
drivers/scsi/mvsas/mv_sas.c +0 -7
@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)return 0 ; } -void mvs_tag_init (struct mvs_info *mvi) -{ -int i; -for (i =0 ; i < mvi->tags_num; ++i) -mvs_tag_clear (mvi, i); -} -static struct mvs_info *mvs_find_dev_mvi (struct domain_device *dev) {unsigned long i =0 , j =0 , hi =0 ;
drivers/scsi/mvsas/mv_sas.h +0 -1
@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);void mvs_tag_free (struct mvs_info *mvi,u32 tag);void mvs_tag_set (struct mvs_info *mvi,unsigned int tag);int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out); -void mvs_tag_init (struct mvs_info *mvi);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/276 scsi: mvsas: Use sas_task_find_rq() for tagging
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
The request associated with a SCSI command coming from the block layer has a unique tag, so use that when possible for getting a slot.
Unfortunately we don't support reserved commands in the SCSI midlayer yet. As such, SMP tasks - as an example - will not have a request associated, so in the interim continue to manage those tags for that type of sas_task internally.
We reserve an arbitrary 4 tags for these internal tags. Indeed, we already decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
mvsas: add support for 94xx; layout change; bug fixes"), but what those 2 slots are used for is not obvious.
Also make the tag management functions static, where possible.
Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
--- drivers/scsi/mvsas/mv_defs.h | 1 + drivers/scsi/mvsas/mv_init.c | 9 +++++---- drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++------------- drivers/scsi/mvsas/mv_sas.h | 7 +------ 4 files changed, 29 insertions(+), 23 deletions(-)
drivers/scsi/mvsas/mv_defs.h +1 -0
@@ -40,6 +40,7 @@ enum driver_configuration {MVS_ATA_CMD_SZ =96 ,/* SATA command table buffer size */ MVS_OAF_SZ =64 ,/* Open address frame buffer size */ MVS_QUEUE_SIZE =64 ,/* Support Queue depth */ +MVS_RSVD_SLOTS =4 , MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2, };
drivers/scsi/mvsas/mv_init.c +5 -4
@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry)cancel_delayed_work (&mwq->work_q); -kfree (mvi->tags); +kfree (mvi->rsvd_tags);kfree (mvi); }
@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)printk (KERN_DEBUG "failed to create dma pool %s.\n" , pool_name); goto err_out; } - mvi->tags_num = slot_nr;return 0 ; err_out:
@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev, mvi->sas = sha; mvi->shost = shost; - mvi->tags =kzalloc (MVS_CHIP_SLOT_SZ >>3 ,GFP_KERNEL ); -if (!mvi->tags) + mvi->rsvd_tags =bitmap_zalloc (MVS_RSVD_SLOTS ,GFP_KERNEL ); +if (!mvi->rsvd_tags) goto err_out;if (MVS_CHIP_DISP ->chip_ioremap (mvi))
@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,else can_queue =MVS_CHIP_SLOT_SZ ; + can_queue -=MVS_RSVD_SLOTS ; + shost->sg_tablesize =min_t (u16,SG_ALL ,MVS_MAX_SG ); shost->can_queue = can_queue; mvi->shost->cmd_per_lun =MVS_QUEUE_SIZE ;
drivers/scsi/mvsas/mv_sas.c +22 -13
@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)return 0 ; } -void mvs_tag_clear (struct mvs_info *mvi,u32 tag) +static void mvs_tag_clear (struct mvs_info *mvi,u32 tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;clear_bit (tag, bitmap); } -void mvs_tag_free (struct mvs_info *mvi,u32 tag) +static void mvs_tag_free (struct mvs_info *mvi,u32 tag) { +if (tag >=MVS_RSVD_SLOTS ) +return ; +mvs_tag_clear (mvi, tag); } -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) +static void mvs_tag_set (struct mvs_info *mvi,unsigned int tag) { -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags;set_bit (tag, bitmap); } -inline int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) +static int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out) {unsigned int index, tag; -void *bitmap = mvi->tags; +void *bitmap = mvi->rsvd_tags; - index =find_first_zero_bit (bitmap, mvi->tags_num); + index =find_first_zero_bit (bitmap,MVS_RSVD_SLOTS ); tag = index; -if (tag >= mvi->tags_num) +if (tag >=MVS_RSVD_SLOTS )return -SAS_QUEUE_FULL ;mvs_tag_set (mvi, tag); *tag_out = tag;
@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmfstruct mvs_task_exec_info tei;struct mvs_slot_info *slot;u32 tag =0xdeadbeef , n_elem =0 ; +struct request *rq;int rc =0 ;if (!dev->port) {
@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf n_elem = task->num_scatter; } - rc =mvs_tag_alloc (mvi, &tag); -if (rc) - goto err_out; + rq =sas_task_find_rq (task); +if (rq) { + tag = rq->tag +MVS_RSVD_SLOTS ; + }else { + rc =mvs_tag_alloc (mvi, &tag); +if (rc) + goto err_out; + } slot = &mvi->slot_info[tag];
@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)static void mvs_slot_free (struct mvs_info *mvi,u32 rx_desc) {u32 slot_idx = rx_desc &RXQ_SLOT_MASK ; -mvs_tag_clear (mvi, slot_idx); +mvs_tag_free (mvi, slot_idx); } static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
drivers/scsi/mvsas/mv_sas.h +1 -6
@@ -370,8 +370,7 @@ struct mvs_info {u32 chip_id;const struct mvs_chip_info *chip; -int tags_num; -unsigned long *tags; +unsigned long *rsvd_tags;/* further per-slot information */ struct mvs_phy phy[MVS_MAX_PHYS ];struct mvs_port port[MVS_MAX_PHYS ];
@@ -424,10 +423,6 @@ struct mvs_task_exec_info {/******************** function prototype *********************/ void mvs_get_sas_addr (void *buf,u32 buflen); -void mvs_tag_clear (struct mvs_info *mvi,u32 tag); -void mvs_tag_free (struct mvs_info *mvi,u32 tag); -void mvs_tag_set (struct mvs_info *mvi,unsigned int tag); -int mvs_tag_alloc (struct mvs_info *mvi,u32 *tag_out);void mvs_iounmap (void __iomem *regs);int mvs_ioremap (struct mvs_info *mvi,int bar,int bar_ex);void mvs_phys_reset (struct mvs_info *mvi,u32 phy_mask,int hard);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/276 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <[email protected]>
[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback)
mvs_pci_remove() |
mvs_free() | mvs_work_queue()
cancel_delayed_work() |
kfree(mvi) |
| mvi-> // UAFReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.
This bug was found by static analysis.
--- drivers/scsi/mvsas/mv_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mvsas/mv_init.c +1 -1
@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi)if (mvi->shost)scsi_host_put (mvi->shost);list_for_each_entry (mwq, &mvi->wq_list, entry) -cancel_delayed_work (&mwq->work_q); +cancel_delayed_work_sync (&mwq->work_q);kfree (mvi->rsvd_tags);kfree (mvi); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/276 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it.
--- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +1 -1
@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,mlx4_unregister_mac (mdev->dev, priv->port, mac);hlist_del_rcu (&entry->hlist); -kfree_rcu (entry, rcu);en_dbg (DRV , priv,"Removed MAC %pM on port:%d\n" , entry->mac, priv->port); +kfree_rcu (entry, rcu); ++removed; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/276 s390/cio: unregister the subchannel while purging
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit fa172f043f5bc21c357c54a6ca2e9c8acd18c3db ]
The cio_ignore list is used to create and maintain the list of devices which is to be ignored by Linux. During boot-time, this list is adjusted and accommodate all the devices which are configured on the HMC interface. Once these devices are accessible, they are then available to Linux and set online.
cio_ignore purge function should align with this functionality. But currently, the subchannel associated with the offline-devices are not unregistered during purge. Add an explicit subchannel-unregister function in the purge_fn callback.
Stable-dep-of: 9daa5a879586 ("s390/cio: Update purge function to unregister the unused subchannels")
--- drivers/s390/cio/device.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/s390/cio/device.c +2 -0
@@ -1327,6 +1327,7 @@ static int purge_fn(struct device *dev, void *data) {struct ccw_device *cdev =to_ccwdev (dev);struct ccw_dev_id *id = &cdev->private->dev_id; +struct subchannel *sch =to_subchannel (cdev->dev.parent);spin_lock_irq (cdev->ccwlock); if (is_blacklisted(id->ssid, id->devno) &&
@@ -1335,6 +1336,7 @@ static int purge_fn(struct device *dev, void *data)CIO_MSG_EVENT (3 ,"ccw: purging 0.%x.%04x\n" , id->ssid, id->devno);ccw_device_sched_todo (cdev,CDEV_TODO_UNREG ); +css_sched_sch_todo (sch,SCH_TODO_UNREG );atomic_set (&cdev->private->onoff,0 ); }spin_unlock_irq (cdev->ccwlock);
Signature · 1 line
2.51.0