5.10.247-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 1/300 net/sched: sch_qfq: Fix null-deref in agg_dequeue
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <[email protected]>
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
--- include/net/pkt_sched.h | 25 ++++++++++++++++++++++++- net/sched/sch_api.c | 10 ---------- net/sched/sch_hfsc.c | 16 ---------------- net/sched/sch_qfq.c | 2 +- 4 files changed, 25 insertions(+), 28 deletions(-)
include/net/pkt_sched.h +24 -1
@@ -114,7 +114,6 @@ struct qdisc_rate_table *qdisc_get_rtab( struct netlink_ext_ack *extack);void qdisc_put_rtab (struct qdisc_rate_table *tab);void qdisc_put_stab (struct qdisc_size_table *tab); -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc);bool sch_direct_xmit (struct sk_buff *skb,struct Qdisc *q,struct net_device *dev,struct netdev_queue *txq,spinlock_t *root_lock,bool validate);
@@ -190,4 +189,28 @@ static inline void skb_txtime_consumed(s skb->tstamp = ktime_set(0, 0); } +static inline void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) +{ +if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { +pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , + txt, qdisc->ops->id, qdisc->handle >>16 ); + qdisc->flags |=TCQ_F_WARN_NONWC ; + } +} + +static inline unsigned int qdisc_peek_len (struct Qdisc *sch) +{ +struct sk_buff *skb; +unsigned int len; + + skb = sch->ops->peek (sch); +if (unlikely (skb ==NULL )) { +qdisc_warn_nonwc ("qdisc_peek_len" , sch); +return 0 ; + } + len =qdisc_pkt_len (skb); + +return len; +} +#endif
net/sched/sch_api.c +0 -10
@@ -595,16 +595,6 @@ out:qdisc_skb_cb (skb)->pkt_len = pkt_len; } -void qdisc_warn_nonwc (const char *txt,struct Qdisc *qdisc) -{ -if (!(qdisc->flags &TCQ_F_WARN_NONWC )) { -pr_warn ("%s: %s qdisc %X: is non-work-conserving?\n" , - txt, qdisc->ops->id, qdisc->handle >>16 ); - qdisc->flags |=TCQ_F_WARN_NONWC ; - } -} -EXPORT_SYMBOL (qdisc_warn_nonwc); -static enum hrtimer_restart qdisc_watchdog (struct hrtimer *timer) { struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
net/sched/sch_hfsc.c +0 -16
@@ -836,22 +836,6 @@ update_vf(struct hfsc_class *cl, unsigne } } -static unsigned int -qdisc_peek_len (struct Qdisc *sch) -{ -struct sk_buff *skb; -unsigned int len; - - skb = sch->ops->peek (sch); -if (unlikely (skb ==NULL )) { -qdisc_warn_nonwc ("qdisc_peek_len" , sch); -return 0 ; - } - len =qdisc_pkt_len (skb); - -return len; -} -static void hfsc_adjust_levels (struct hfsc_class *cl) {
net/sched/sch_qfq.c +1 -1
@@ -1007,7 +1007,7 @@ static struct sk_buff *agg_dequeue(strucif (cl->qdisc->q.qlen ==0 )/* no more packets, remove from list */ list_del_init (&cl->alist); -else if (cl->deficit <qdisc_pkt_len (cl->qdisc->ops->peek (cl->qdisc))) { +else if (cl->deficit <qdisc_peek_len (cl->qdisc)) { cl->deficit += agg->lmax;list_move_tail (&cl->alist, &agg->active); }
Greg Kroah-Hartman
maintainerPATCH 10/300 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <[email protected]>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++-------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 - 3 files changed, 12 insertions(+), 22 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +1 -2
@@ -5187,8 +5187,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wipbrcmf_dbg (TRACE ,"Action frame, cookie=%lld, len=%d, freq=%d\n" , *cookie,le16_to_cpu (action_frame->len), freq); - ack =brcmf_p2p_send_action_frame (cfg,cfg_to_ndev (cfg), - af_params); + ack =brcmf_p2p_send_action_frame (vif->ifp, af_params);cfg80211_mgmt_tx_status (wdev, *cookie, buf, len, ack,GFP_KERNEL );
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +10 -18
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(/** * brcmf_p2p_tx_action_frame() - send action frame over fil. * +* @ifp: interface to transmit on. * @p2p: p2p info struct for vif. * @af_params: action frame data/info. *
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action * frame is transmitted. */ -static s32 brcmf_p2p_tx_action_frame (struct brcmf_p2p_info *p2p, +static s32 brcmf_p2p_tx_action_frame (struct brcmf_if *ifp, +struct brcmf_p2p_info *p2p,struct brcmf_fil_af_params_le *af_params) {struct brcmf_pub *drvr = p2p->cfg->pub; -struct brcmf_cfg80211_vif *vif; -struct brcmf_p2p_action_frame *p2p_af;s32 err =0 ;brcmf_dbg (TRACE ,"Enter\n" );
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(strclear_bit (BRCMF_P2P_STATUS_ACTION_TX_COMPLETED , &p2p->status);clear_bit (BRCMF_P2P_STATUS_ACTION_TX_NOACK , &p2p->status); -/* check if it is a p2p_presence response */ - p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; -if (p2p_af->subtype ==P2P_AF_PRESENCE_RSP ) - vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION ].vif; -else - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE ].vif; - - err =brcmf_fil_bsscfg_data_set (vif->ifp,"actframe" , af_params, + err =brcmf_fil_bsscfg_data_set (ifp,"actframe" , af_params,sizeof (*af_params));if (err) {bphy_err (drvr," sending action frame has failed\n" );
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl/** * brcmf_p2p_send_action_frame() - send action frame . * -* @cfg: driver private data for cfg80211 interface. -* @ndev: net device to transmit on. +* @ifp: interface to transmit on. * @af_params: configuration data for action frame. */ -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params) { +struct brcmf_cfg80211_info *cfg = ifp->drvr->config;struct brcmf_p2p_info *p2p = &cfg->p2p; -struct brcmf_if *ifp =netdev_priv (ndev);struct brcmf_fil_action_frame_le *action_frame;struct brcmf_config_af_params config_af_params;struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(structif (af_params->channel)msleep (P2P_AF_RETRY_DELAY_TIME ); - ack = !brcmf_p2p_tx_action_frame (p2p, af_params); + ack = !brcmf_p2p_tx_action_frame (ifp, p2p, af_params); tx_retry++; dwell_overflow =brcmf_p2p_check_dwell_overflow (requested_dwell, dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_crWARN_ON (p2p_ifp->bsscfgidx != bsscfgidx); -init_completion (&p2p->send_af_done);INIT_WORK (&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);init_completion (&p2p->afx_hdl.act_frm_scan);init_completion (&p2p->wait_next_af);
@@ -2505,6 +2495,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802 pri_ifp =brcmf_get_ifp (cfg->pub,0 ); p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY ].vif = pri_ifp->vif; +init_completion (&p2p->send_af_done); +if (p2pdev_forced) { err_ptr =brcmf_p2p_create_p2pdev (p2p,NULL ,NULL );if (IS_ERR (err_ptr)) {
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +1 -2
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(strint brcmf_p2p_notify_action_tx_complete (struct brcmf_if *ifp,const struct brcmf_event_msg *e,void *data); -bool brcmf_p2p_send_action_frame (struct brcmf_cfg80211_info *cfg, -struct net_device *ndev, +bool brcmf_p2p_send_action_frame (struct brcmf_if *ifp,struct brcmf_fil_af_params_le *af_params);bool brcmf_p2p_scan_finding_common_channel (struct brcmf_cfg80211_info *cfg,struct brcmf_bss_info_le *bi);
Greg Kroah-Hartman
maintainerPATCH 11/300 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <[email protected]>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled.
--- drivers/video/fbdev/pvr2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/pvr2fb.c +1 -1
@@ -191,7 +191,7 @@ static unsigned long pvr2fb_map;#ifdef CONFIG_PVR2_DMA static unsigned int shdma =PVR2_CASCADE_CHAN ; -static unsigned int pvr2dma =ONCHIP_NR_DMA_CHANNELS ; +static unsigned int pvr2dma =CONFIG_NR_ONCHIP_DMA_CHANNELS ;#endif static struct fb_videomode pvr2_modedb[] = {
Greg Kroah-Hartman
maintainerPATCH 12/300 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done.
Found via static analysis.
--- drivers/video/fbdev/valkyriefb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/valkyriefb.c +2 -0
@@ -336,11 +336,13 @@ int __init valkyriefb_init(void)if (of_address_to_resource (dp,0 , &r)) {printk (KERN_ERR "can't find address for valkyrie\n" ); +of_node_put (dp);return 0 ; } frame_buffer_phys = r.start; cmap_regs_phys = r.start +0x304000 ; + of_node_put(dp); }#endif /* ppc (!CONFIG_MAC) */
Greg Kroah-Hartman
maintainerPATCH 13/300 ASoC: qdsp6: q6asm: do not sleep while atomic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock, which can sleep.
move the kfree out of spinlock section.
--- sound/soc/qcom/qdsp6/q6asm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6asm.c +1 -1
@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(spin_lock_irqsave (&ac->lock, flags); port->num_periods =0 ; +spin_unlock_irqrestore (&ac->lock, flags);kfree (port->buf); port->buf =NULL ; -spin_unlock_irqrestore (&ac->lock, flags); }/**
Greg Kroah-Hartman
maintainerPATCH 14/300 wifi: ath10k: Fix memory leak on unsupported WMI command
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath10k/wmi.c +1 -0
@@ -1936,6 +1936,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)if (cmd_id ==WMI_CMD_UNSUPPORTED ) {ath10k_warn (ar,"wmi command %d is not supported by firmware\n" , cmd_id); +dev_kfree_skb_any (skb);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/300 drm/msm/a6xx: Fix GMU firmware parser
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header.
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -1
@@ -666,6 +666,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)return true; } +#define NEXT_BLK (blk) \ + ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size)) +static int a6xx_gmu_fw_load (struct a6xx_gmu *gmu) { struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -696,7 +699,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)for (blk = (const struct block_header *) fw_image->data; (const u8 *) blk < fw_image->data + fw_image->size; - blk = (const struct block_header *) &blk->data[blk->size >>2 ]) { + blk =NEXT_BLK (blk)) {if (blk->size ==0 )continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/300 ALSA: usb-audio: fix control pipe direction
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <[email protected]>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe().
--- sound/usb/mixer_s1810c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/mixer_s1810c.c +1 -1
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev, pkt_out.fields[SC1810C_STATE_F1_IDX ] =SC1810C_SET_STATE_F1 ; pkt_out.fields[SC1810C_STATE_F2_IDX ] =SC1810C_SET_STATE_F2 ; - ret =snd_usb_ctl_msg (dev,usb_rcvctrlpipe (dev,0 ), + ret =snd_usb_ctl_msg (dev,usb_sndctrlpipe (dev,0 ),SC1810C_SET_STATE_REQ ,SC1810C_SET_STATE_REQTYPE , (*seqnum),0 , &pkt_out,sizeof (pkt_out));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/300 bpf: Sync pending IRQ work before freeing ring buffer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <[email protected]>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory.
Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.
--- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/ringbuf.c +2 -0
@@ -209,6 +209,8 @@ static void bpf_ringbuf_free(struct bpf_struct page **pages = rb->pages;int i, nr_pages = rb->nr_pages; +irq_work_sync (&rb->work); +vunmap (rb);for (i =0 ; i < nr_pages; i++)__free_page (pages[i]);
Greg Kroah-Hartman
maintainerPATCH 18/300 usbnet: Prevents free active kevent
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <[email protected]>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing free_netdev().
--- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/usbnet.c +2 -0
@@ -1597,6 +1597,8 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net;unregister_netdev (net); +cancel_work_sync (&dev->kevent); +while ((urb =usb_get_from_anchor (&dev->deferred))) {dev_kfree_skb (urb->context);kfree (urb->sg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/300 drm/etnaviv: fix flush sequence logic
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <[email protected]>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional.
However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors.
--- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/etnaviv/etnaviv_buffer.c +1 -1
@@ -346,7 +346,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,u32 link_target, link_dwords;bool switch_context = gpu->exec_state != exec_state;bool switch_mmu_context = gpu->mmu_context != mmu_context; -unsigned int new_flush_seq =READ_ONCE (gpu->mmu_context->flush_seq); +unsigned int new_flush_seq =READ_ONCE (mmu_context->flush_seq);bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;bool has_blt = !!(gpu->identity.minor_features5 & chipMinorFeatures5_BLT_ENGINE);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/300 x86/bugs: Fix reporting of LFENCE retpoline
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <[email protected]>
[ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
The LFENCE retpoline mitigation is not secure but the kernel prints inconsistent messages about this fact. The dmesg log says 'Mitigation:
LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable:
LFENCE' implying the system (correctly) is not mitigated.
Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere when this mitigation is selected.
--- arch/x86/kernel/cpu/bugs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/x86/kernel/cpu/bugs.c +1 -4
@@ -1508,7 +1508,7 @@ spectre_v2_user_select_mitigation(void)static const char *const spectre_v2_strings[] = { [SPECTRE_V2_NONE ] ="Vulnerable" , [SPECTRE_V2_RETPOLINE ] ="Mitigation: Retpolines" , - [SPECTRE_V2_LFENCE ] ="Mitigation: LFENCE" , + [SPECTRE_V2_LFENCE ] ="Vulnerable: LFENCE" , [SPECTRE_V2_EIBRS ] ="Mitigation: Enhanced / Automatic IBRS" , [SPECTRE_V2_EIBRS_LFENCE ] ="Mitigation: Enhanced / Automatic IBRS + LFENCE" , [SPECTRE_V2_EIBRS_RETPOLINE ] ="Mitigation: Enhanced / Automatic IBRS + Retpolines" ,
@@ -3011,9 +3011,6 @@ static char *pbrsb_eibrs_state(void)static ssize_t spectre_v2_show_state (char *buf) { -if (spectre_v2_enabled ==SPECTRE_V2_LFENCE ) -return sysfs_emit (buf,"Vulnerable: LFENCE\n" ); -if (spectre_v2_enabled ==SPECTRE_V2_EIBRS &&unprivileged_ebpf_enabled ())return sysfs_emit (buf,"Vulnerable: eIBRS with unprivileged eBPF\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/300 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
--- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 -1
@@ -587,7 +587,7 @@ int smu_cmn_update_table(struct smu_context *smu, table_index);uint32_t table_size;int ret =0 ; -if (!table_data || table_id >=SMU_TABLE_COUNT || table_id <0 ) +if (!table_data || table_index >=SMU_TABLE_COUNT || table_id <0 )return -EINVAL ; table_size = smu_table->tables[table_index].size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/300 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c +1 -1
@@ -2026,7 +2026,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ;/* 0:Gen1 1:Gen2 2:Gen3*/ + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; table->VRConfig =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/300 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <[email protected]>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the
maximum value from the speed table which is the behaviour of all other smumgr implementations.
--- drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c +1 -1
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr) table->VoltageResponseTime =0 ; table->PhaseResponseTime =0 ; table->MemoryThermThrottleEnable =1 ; - table->PCIeBootLinkLevel =0 ; + table->PCIeBootLinkLevel = (uint8_t ) (data->dpm_table.pcie_speed_table.count); table->PCIeGenInterval =1 ; result =iceland_populate_smc_svi2_config (hwmgr, table);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/300 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device.
--- include/linux/blk_types.h | 1 + 1 file changed, 1 insertion(+)
include/linux/blk_types.h +1 -0
@@ -496,6 +496,7 @@ static inline bool op_is_zone_mgmt(enum {switch (op &REQ_OP_MASK ) {case REQ_OP_ZONE_RESET : +case REQ_OP_ZONE_RESET_ALL :case REQ_OP_ZONE_OPEN :case REQ_OP_ZONE_CLOSE :case REQ_OP_ZONE_FINISH :
Greg Kroah-Hartman
maintainerPATCH 24/300 regmap: slimbus: fix bus_context pointer in regmap init calls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
--- drivers/base/regmap/regmap-slimbus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-slimbus.c +2 -4
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(strif (IS_ERR (bus))return ERR_CAST (bus); -return __regmap_init (&slimbus->dev, bus, &slimbus->dev, config, - lock_key, lock_name); +return __regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbuif (IS_ERR (bus))return ERR_CAST (bus); -return __devm_regmap_init (&slimbus->dev, bus, &slimbus, config, - lock_key, lock_name); +return __devm_regmap_init (&slimbus->dev, bus, slimbus, config, lock_key, lock_name); }EXPORT_SYMBOL_GPL (__devm_regmap_init_slimbus);
Greg Kroah-Hartman
maintainerPATCH 3/300 btrfs: always drop log root tree reference in btrfs_replay_log()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
Currently we have this odd behaviour:
1) At btrfs_replay_log() we drop the reference of the log root tree if the call to btrfs_recover_log_trees() failed;
2) But if the call to btrfs_recover_log_trees() did not fail, we don't drop the reference in btrfs_replay_log() - we expect that btrfs_recover_log_trees() does it in case it returns success.
Let's simplify this and make btrfs_replay_log() always drop the reference on the log root tree, not only this simplifies code as it's what makes sense since it's btrfs_replay_log() who grabbed the reference in the first place.
--- fs/btrfs/disk-io.c | 2 +- fs/btrfs/tree-log.c | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/disk-io.c +1 -1
@@ -2309,10 +2309,10 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info, }/* returns with log_tree_root freed on success */ ret =btrfs_recover_log_trees (log_tree_root); +btrfs_put_root (log_tree_root);if (ret) {btrfs_handle_fs_error (fs_info, ret,"Failed to recover log tree" ); -btrfs_put_root (log_tree_root);return ret; }
fs/btrfs/tree-log.c +0 -1
@@ -6432,7 +6432,6 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree) log_root_tree->log_root =NULL ;clear_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags); -btrfs_put_root (log_root_tree);return 0 ; error:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/300 btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a full write barrier, smp_wmb(), but we don't need to, all we need is a smp_mb__after_atomic(). The use of the smp_wmb() is from the old days when we didn't use a bit and used instead an int field in the root to signal if cow is forced. After the int field was changed to a bit in the root's state (flags field), we forgot to update the memory barrier in create_pending_snapshot() to smp_mb__after_atomic(), but we did the change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root"). On the reader side, in should_cow_block(), we also use the counterpart smp_mb__before_atomic() which generates further confusion.
So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't even need any barrier at all since create_pending_snapshot() is called in the critical section of a transaction commit and therefore no one can concurrently join/attach the transaction, or start a new one, until the transaction is unblocked. By the time someone starts a new transaction and enters should_cow_block(), a lot of implicit memory barriers already took place by having acquired several locks such as fs_info->trans_lock and extent buffer locks on the root node at least. Nevertlheless, for consistency use smp_mb__after_atomic() after setting the force cow bit in create_pending_snapshot().
--- fs/btrfs/transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/transaction.c +1 -1
@@ -1660,7 +1660,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, }/* see comments in should_cow_block() */ set_bit (BTRFS_ROOT_FORCE_COW , &root->state); -smp_wmb (); +smp_mb__after_atomic ();btrfs_set_root_node (new_root_item, tmp);/* record when the snapshot was created in key.offset */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/300 NFSD: Fix crash in nfsd4_read_release()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.
--- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs4proc.c +4 -3
@@ -945,10 +945,11 @@ nfsd4_read(struct svc_rqst *rqstp, strucstatic void nfsd4_read_release (union nfsd4_op_u *u) { -if (u->read.rd_nf) +if (u->read.rd_nf) { +trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length);nfsd_file_put (u->read.rd_nf); -trace_nfsd_read_done (u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32
Greg Kroah-Hartman
maintainerPATCH 6/300 net: usb: asix_devices: Check return value of usbnet_get_endpoints
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
--- drivers/net/usb/asix_devices.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/usb/asix_devices.c +9 -3
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *dint i;unsigned long gpio_bits = dev->driver_info->data; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) + goto out;/* Toggle the GPIOs in a manufacturer/model specific way */ for (i =2 ; i >=0 ; i--) {
@@ -681,7 +683,9 @@ static int ax88772_bind(struct usbnet *du32 phyid;struct asix_common_private *priv; -usbnet_get_endpoints (dev, intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Maybe the boot loader passed the MAC address via device tree */ if (!eth_platform_get_mac_address (&dev->udev->dev, buf)) {
@@ -1063,7 +1067,9 @@ static int ax88178_bind(struct usbnet *dint ret;u8 buf[ETH_ALEN ] = {0 }; -usbnet_get_endpoints (dev,intf); + ret =usbnet_get_endpoints (dev, intf); +if (ret) +return ret;/* Get the MAC address */ ret =asix_read_cmd (dev,AX_CMD_READ_NODE_ID ,0 ,0 ,ETH_ALEN , buf,0 );
Greg Kroah-Hartman
maintainerPATCH 7/300 fbdev: atyfb: Check if pll_ops->init_pll failed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll() as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5.
--- drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/aty/atyfb_base.c +6 -2
@@ -2606,8 +2606,12 @@ static int aty_init(struct fb_info *info pr_cont("\n"); }#endif -if (par->pll_ops->init_pll) - par->pll_ops->init_pll (info, &par->pll); +if (par->pll_ops->init_pll) { + ret = par->pll_ops->init_pll (info, &par->pll); +if (ret) +return ret; + } +if (par->pll_ops->resume_pll) par->pll_ops->resume_pll (info, &par->pll);
Greg Kroah-Hartman
maintainerPATCH 8/300 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <[email protected]>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
--- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +3 -1
@@ -2028,8 +2028,10 @@ static void acpi_video_bus_remove_notifystruct acpi_video_device *dev;mutex_lock (&video->device_list_lock); -list_for_each_entry (dev, &video->video_device_list, entry) +list_for_each_entry (dev, &video->video_device_list, entry) {acpi_video_dev_remove_notify_handler (dev); +cancel_delayed_work_sync (&dev->switch_brightness_work); + }mutex_unlock (&video->device_list_lock);acpi_video_bus_stop_devices (video);
Greg Kroah-Hartman
maintainerPATCH 9/300 fbdev: bitblit: bound-check glyph index in bit_putcs*
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
--- drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/bitblit.c +12 -4
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str struct fb_image *image, u8 *buf, u8 *dst) { u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff; +unsigned int charcnt = vc->vc_font.charcount;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s u8 *dst) {u16 charmask = vc->vc_hi_font_mask ?0x1ff :0xff ; +unsigned int charcnt = vc->vc_font.charcount;u32 shift_low =0 , mod = vc->vc_font.width %8 ;u32 shift_high =8 ;u32 idx = vc->vc_font.width >>3 ;u8 *src;while (cnt--) { - src = vc->vc_font.data + (scr_readw (s++)& - charmask)*cellsize; +u16 ch =scr_readw (s++) & charmask; + +if (ch >= charcnt) + ch =0 ; + src = vc->vc_font.data + (unsigned int )ch * cellsize;if (attr) {update_attr (buf, src, attr, vc);
Greg Kroah-Hartman
maintainercover 5.10.247-rc1 review
This is the start of the stable review cycle for the 5.10.247 release. There are 300 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.247-rc1
Florian Westphal <[email protected]>
netfilter: nf_set_pipapo_avx2: fix initial map fill
Vasiliy Kovalev <[email protected]>
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
Owen Gu <[email protected]>
usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
Claudiu Beznea <[email protected]>
usb: renesas_usbhs: Fix synchronous external abort on unbind
Jameson Thies <[email protected]>
usb: typec: ucsi: psy: Set max current to zero when disconnected
Paulo Alcantara <[email protected]>
smb: client: fix memory leak in cifs_construct_tcon()
Jiayuan Chen <[email protected]>
mptcp: Fix proto fallback detection with BPF
Igor Pylypiv <[email protected]>
scsi: pm80xx: Set phy->enable_completion only when we
Florian Westphal <[email protected]>
netfilter: nf_set_pipapo: fix initial map fill
Alex Lu <[email protected]>
Bluetooth: Add more enc key size check
Jiufei Xue <[email protected]>
fs: writeback: fix use-after-free in __mark_inode_dirty()
Ilya Dryomov <[email protected]>
libceph: fix potential use-after-free in have_mon_and_osd_map()
Alex Hung <[email protected]>
drm/amd/display: Check NULL before accessing
Johan Hovold <[email protected]>
drm: sti: fix device leaks at component probe
Vanillan Wang <[email protected]>
USB: serial: option: add support for Rolling RW101R-GL
Oleksandr Suvorov <[email protected]>
USB: serial: ftdi_sio: add support for u-blox EVK-M101
Mathias Nyman <[email protected]>
xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
Manish Nagar <[email protected]>
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Tianchu Chen <[email protected]>
usb: storage: sddr55: Reject out-of-bound new_pba
Alan Stern <[email protected]>
USB: storage: Remove subclass and protocol overrides from Novatek quirk
Desnes Nunes <[email protected]>
usb: storage: Fix memory leak in USB bulk transport
Kuen-Han Tsai <[email protected]>
usb: gadget: f_eem: Fix memory leak in eem_unwrap
Miaoqian Lin <[email protected]>
usb: cdns3: Fix double resource release in cdns3_pci_probe
Johan Hovold <[email protected]>
most: usb: fix double free on late probe failure
Miaoqian Lin <[email protected]>
serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
Khairul Anuar Romli <[email protected]>
firmware: stratix10-svc: fix bug in saving controller data
Miaoqian Lin <[email protected]>
slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
Alan Borzeszkowski <[email protected]>
thunderbolt: Add support for Intel Wildcat Lake
Mikulas Patocka <[email protected]>
dm-verity: fix unreliable memory allocation
Marc Kleine-Budde <[email protected]>
can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
Thomas Mühlbacher <[email protected]>
can: sja1000: fix max irq loop handling
Gui-Dong Han <[email protected]>
atm/fore200e: Fix possible data race in fore200e_open()
Thomas Bogendoerfer <[email protected]>
MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
Maciej W. Rozycki <[email protected]>
MIPS: mm: Prevent a TLB shutdown on initial uniquification
Christophe JAILLET <[email protected]>
iio:common:ssp_sensors: Fix an error handling path ssp_probe()
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
Jiri Olsa <[email protected]>
Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
Hang Zhou <[email protected]>
spi: bcm63xx: fix premature CS deassertion on RX-only transactions
Haotian Zhang <[email protected]>
mailbox: mailbox-test: Fix debugfs_create_dir error checking
Jiefeng Zhang <[email protected]>
net: atlantic: fix fragment overflow handling in RX path
Alexey Kodanev <[email protected]>
net: sxgbe: fix potential NULL dereference in sxgbe_rx()
Danielle Costantino <[email protected]>
net/mlx5e: Fix validation logic in rate limiting
Kai-Heng Feng <[email protected]>
net: aquantia: Add missing descriptor cache invalidation on ATL2
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SMP: Fix not generating mackey and ltk when repairing
Seungjin Bae <[email protected]>
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
Seungjin Bae <[email protected]>
Input: pegasus-notetaker - fix potential out-of-bounds access
Vincent Mailhol <[email protected]>
Input: remove third argument of usb_maxpacket()
Vincent Mailhol <[email protected]>
usb: deprecate the third argument of usb_maxpacket()
Paolo Abeni <[email protected]>
mptcp: do not fallback when OoO is present
Eric Dumazet <[email protected]>
mptcp: fix a race in mptcp_pm_del_add_timer()
Vlastimil Babka <[email protected]>
mm/mempool: fix poisoning order>0 pages with HIGHMEM
Fabio M. De Francesco <[email protected]>
mm/mempool: replace kmap_atomic() with kmap_local_page()
Krzysztof Kozlowski <[email protected]>
dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
Eric Dumazet <[email protected]>
mptcp: fix race condition in mptcp_schedule_work()
Paolo Abeni <[email protected]>
mptcp: introduce mptcp_schedule_work
Niklas Cassel <[email protected]>
ata: libata-scsi: Fix system suspend for a security locked drive
Sudeep Holla <[email protected]>
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
Miaoqian Lin <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_remove
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Trond Myklebust <[email protected]>
Revert "NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity"
Nick Desaulniers <[email protected]>
Makefile.compiler: replace cc-ifversion with compiler-specific macros
Nathan Chancellor <[email protected]>
net: qede: Initialize qede_ll_ops with designated initializer
Long Li <[email protected]>
uio_hv_generic: Set event for all channels on the device
Nishanth Menon <[email protected]>
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
René Rebe <[email protected]>
ALSA: usb-audio: fix uac2 clock source at terminal parser
Isaac J. Manjarres <[email protected]>
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
Jakub Horký <[email protected]>
kconfig/nconf: Initialize the default locale at startup
Jakub Horký <[email protected]>
kconfig/mconf: Initialize the default locale at startup
Shahar Shitrit <[email protected]>
net: tls: Cancel RX async resync request on rcd_delta overflow
Bart Van Assche <[email protected]>
scsi: core: Fix a regression triggered by scsi_host_busy()
Michal Luczaj <[email protected]>
vsock: Ignore signal/timeout on connect() if already established
Aleksei Nikiforov <[email protected]>
s390/ctcm: Fix double-kfree
Ilya Maximets <[email protected]>
net: openvswitch: remove never-working support for setting nsh fields
Zilin Guan <[email protected]>
mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
Ma Ke <[email protected]>
drm/tegra: dc: Fix reference leak in tegra_dc_couple()
Maciej W. Rozycki <[email protected]>
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
Hamza Mahfooz <[email protected]>
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
Bart Van Assche <[email protected]>
scsi: sg: Do not sleep in atomic context
Ewan D. Milne <[email protected]>
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
Dan Carpenter <[email protected]>
Input: imx_sc_key - fix memory corruption on unload
Tzung-Bi Shih <[email protected]>
Input: cros_ec_keyb - fix an invalid memory access
Andrey Vatoropin <[email protected]>
be2net: pass wrb_params in case of OS2BMC
Yongpeng Yang <[email protected]>
exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
Niravkumar L Rabara <[email protected]>
mtd: rawnand: cadence: fix DMA device NULL pointer dereference
Zhang Heng <[email protected]>
HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Olga Kornievskaia <[email protected]>
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Masami Ichikawa <[email protected]>
HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject duplicate device on updates
Dan Carpenter <[email protected]>
mtd: onenand: Pass correct pointer to IRQ handler
Eric Biggers <[email protected]>
lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
Jakub Acs <[email protected]>
mm/ksm: fix flag-dropping behavior in ksm_madvise
Christoph Hellwig <[email protected]>
fsdax: mark the iomap argument to dax_iomap_sector as const
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Chris Morgan <[email protected]>
regulator: fixed: use dev_err_probe for register
Shuai Xue <[email protected]>
acpi,srat: Fix incorrect device handle check for Generic Initiator
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Felix Maurer <[email protected]>
hsr: Fix supervision frame sending on HSRv0
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
D. Wythe <[email protected]>
net/smc: fix mismatch between CLC header and proposal
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Danil Skrebenkov <[email protected]>
RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Cleanup wakeup source only if it was enabled
Nathan Chancellor <[email protected]>
lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
Zilin Guan <[email protected]>
tracing: Fix memory leaks in create_field_var()
Qendrim Maxhuni <[email protected]>
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
Stefan Wiehler <[email protected]>
sctp: Hold sock lock while iterating over address list
Xin Long <[email protected]>
sctp: hold endpoint before calling cb in sctp_transport_lookup_process
Yajun Deng <[email protected]>
net: Use nlmsg_unicast() instead of netlink_unicast()
Lu Wei <[email protected]>
net: sctp: Fix some typos
Stefan Wiehler <[email protected]>
sctp: Prevent TOCTOU out-of-bounds write
Stefan Wiehler <[email protected]>
sctp: Hold RCU read lock while iterating over address list
Jonas Gorski <[email protected]>
net: dsa: b53: stop reading ARL entries if search is done
Jonas Gorski <[email protected]>
net: dsa: b53: fix enabling ip multicast
Jonas Gorski <[email protected]>
net: dsa: b53: fix resetting speed and pause on forced link
Hangbin Liu <[email protected]>
net: vlan: sync VLAN features with lower device
Josephine Pfeiffer <[email protected]>
riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
Kailang Yang <[email protected]>
ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
Viacheslav Dubeyko <[email protected]>
ceph: add checking of wait_for_completion_killable() return value
Valerio Setti <[email protected]>
ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
Albin Babu Varghese <[email protected]>
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Ian Rogers <[email protected]>
tools bitmap: Add missing asm-generic/bitsperlong.h include
Sakari Ailus <[email protected]>
ACPI: property: Return present device nodes only on fwnode interface
Randall P. Embry <[email protected]>
9p: sysfs_init: don't hardcode error to ENOMEM
Randall P. Embry <[email protected]>
9p: fix /sys/fs/9p/caches overwriting itself
Nicolas Ferre <[email protected]>
ARM: at91: pm: save and restore ACR during PLL disable/enable
Tiwei Bie <[email protected]>
um: Fix help message for ssl-non-raw
Yikang Yue <[email protected]>
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
austinchang <[email protected]>
btrfs: mark dirty extent range for out of bound prealloc extents
Saket Dumbre <[email protected]>
ACPICA: Update dsmethod.c to get rid of unused variable warning
Mike Marshall <[email protected]>
orangefs: fix xattr related buffer overflow...
Dragos Tatulea <[email protected]>
page_pool: Clamp pool size to max 16K pages
Chi Zhiling <[email protected]>
exfat: limit log print for IO error
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: add mono main switch to Presonus S1824c
Ivan Pravdin <[email protected]>
Bluetooth: bcsp: receive data only if registered
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix UAF on sco_conn_free
Théo Lebrun <[email protected]>
net: macb: avoid dealing with endianness in macb_set_hwaddr()
chuguangqing <[email protected]>
fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
Al Viro <[email protected]>
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
Anthony Iliopoulos <[email protected]>
NFSv4.1: fix mount hang after CREATE_SESSION failure
Olga Kornievskaia <[email protected]>
NFSv4: handle ERR_GRACE on delegation recalls
Stephan Gerhold <[email protected]>
remoteproc: qcom: q6v5: Avoid handling handover twice
Koakuma <[email protected]>
sparc/module: Add R_SPARC_UA64 relocation handling
Chen Wang <[email protected]>
PCI: cadence: Check for the existence of cdns_pcie::ops before using it
ChunHao Lin <[email protected]>
r8169: set EEE speed down ratio to 1
Brahmajit Das <[email protected]>
net: intel: fm10k: Fix parameter idx set but not used
Loic Poulain <[email protected]>
wifi: ath10k: Fix connection after GTK rekeying
Shaurya Rane <[email protected]>
jfs: fix uninitialized waitqueue in transaction manager
Tetsuo Handa <[email protected]>
jfs: Verify inode mode when loading from disk
Eric Dumazet <[email protected]>
ipv6: np->rxpmtu race annotation
Krishna Kurapati <[email protected]>
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
Forest Crossman <[email protected]>
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
Al Viro <[email protected]>
allow finish_no_open(file, ERR_PTR(-E...))
Justin Tee <[email protected]>
scsi: lpfc: Define size of debugfs entry for xri rebalancing
Nai-Chen Cheng <[email protected]>
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
Yafang Shao <[email protected]>
net/cls_cgroup: Fix task_get_classid() during qdisc run
Alok Tiwari <[email protected]>
udp_tunnel: use netdev_warn() instead of netdev_WARN()
David Ahern <[email protected]>
selftests: Replace sleep with slowwait
Daniel Palmer <[email protected]>
eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
David Ahern <[email protected]>
selftests: Disable dad for ipv6 in fcnal-test.sh
Li RongQing <[email protected]>
x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
Ido Schimmel <[email protected]>
selftests: traceroute: Use require_command()
Qianfeng Rong <[email protected]>
media: redrat3: use int type to store negative error codes
Niklas Söderlund <[email protected]>
net: sh_eth: Disable WoL if system can not suspend
Harikrishna Shenoy <[email protected]>
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
Rohan G Thomas <[email protected]>
net: phy: marvell: Fix 88e1510 downshift counter errata
William Wu <[email protected]>
usb: gadget: f_hid: Fix zero length packet transfer
Ashish Kalra <[email protected]>
iommu/amd: Skip enabling command/event buffers for kdump
Eric Dumazet <[email protected]>
net: call cond_resched() less often in __release_sock()
Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP Quark2
Juraj Šarinay <[email protected]>
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
Yue Haibing <[email protected]>
ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
Devendra K Verma <[email protected]>
dmaengine: dw-edma: Set status for callback_result
Rosen Penev <[email protected]>
dmaengine: mv_xor: match alloc_wc and free_wc
Thomas Andreatta <[email protected]>
dmaengine: sh: setup_xref error handling
Qianfeng Rong <[email protected]>
scsi: pm8001: Use int instead of u32 to store error codes
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename stp clock
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing device_type in pci node
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: danube: add missing properties to cpu node
Chelsy Ratnawat <[email protected]>
media: fix uninitialized symbol warnings
Amber Lin <[email protected]>
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
Krzysztof Kozlowski <[email protected]>
extcon: adc-jack: Fix wakeup source leaks on device unbind
Francisco Gutierrez <[email protected]>
scsi: pm80xx: Fix race condition caused by static variables
Ujwal Kundur <[email protected]>
rds: Fix endianness annotation for RDS_MPATH_HASH
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
Sungho Kim <[email protected]>
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
Kuniyuki Iwashima <[email protected]>
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
Christoph Paasch <[email protected]>
net: When removing nexthops, don't call synchronize_net if it is not necessary
Zijun Hu <[email protected]>
char: misc: Does not request module for miscdevice with dynamic minor
raub camaioni <[email protected]>
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
Rodrigo Gobbi <[email protected]>
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
Dmitry Baryshkov <[email protected]>
drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
Tetsuo Handa <[email protected]>
media: imon: make send_packet() more robust
Charalampos Mitrodimas <[email protected]>
net: ipv6: fix field-spanning memcpy warning in AH output
Ido Schimmel <[email protected]>
bridge: Redirect to backup port when port is administratively down
Niklas Schnelle <[email protected]>
powerpc/eeh: Use result of error_detected() in uevent
Tiezhu Yang <[email protected]>
net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
Kirill A. Shutemov <[email protected]>
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
Tomi Valkeinen <[email protected]>
drm/tidss: Use the crtc_* timings when programming the HW
Laurent Pinchart <[email protected]>
media: pci: ivtv: Don't create fake v4l2_fh
Geoffrey McRae <[email protected]>
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
Wake Liu <[email protected]>
selftests/net: Ensure assert() triggers in psock_tpacket.c
Wake Liu <[email protected]>
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
Marcos Del Sol Vives <[email protected]>
PCI: Disable MSI on RDC PCI to PCIe bridges
Seyediman Seyedarab <[email protected]>
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
Sathishkumar S <[email protected]>
drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
Lijo Lazar <[email protected]>
drm/amd/pm: Use cached metrics data on arcturus
Jens Kehne <[email protected]>
mfd: da9063: Split chip variant reading in two bus transactions
Arnd Bergmann <[email protected]>
mfd: madera: Work around false-positive -Wininitialized warning
Alexander Stein <[email protected]>
mfd: stmpe-i2c: Add missing MODULE_LICENSE
Alexander Stein <[email protected]>
mfd: stmpe: Remove IRQ domain upon removal
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Prefer driver HWP limits
Len Brown <[email protected]>
tools/power x86_energy_perf_policy: Enhance HWP enable
Kaushlendra Kumar <[email protected]>
tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
Kaushlendra Kumar <[email protected]>
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
Armin Wolf <[email protected]>
hwmon: (dell-smm) Add support for Dell OptiPlex 7040
Jiri Olsa <[email protected]>
uprobe: Do not emulate/sstep original instruction when ip is changed
Daniel Lezcano <[email protected]>
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
Rafael J. Wysocki <[email protected]>
cpuidle: Fail cpuidle device registration if there is one already
Svyatoslav Ryhel <[email protected]>
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
Daniel Wagner <[email protected]>
nvme-fc: use lock accessing port_state and rport state
Amirreza Zarrabi <[email protected]>
tee: allow a driver to allocate a tee_device without a pool
Hans de Goede <[email protected]>
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
Sarthak Garg <[email protected]>
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
Svyatoslav Ryhel <[email protected]>
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
Christian Bruel <[email protected]>
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
Kees Cook <[email protected]>
arc: Fix __fls() const-foldability via __builtin_clzl()
Dennis Beier <[email protected]>
cpufreq/longhaul: handle NULL policy in longhaul_exit
Ricardo B. Marlière <[email protected]>
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
Mario Limonciello (AMD) <[email protected]>
ACPI: video: force native for Lenovo 82K8
Jiayi Li <[email protected]>
memstick: Add timeout to prevent indefinite waiting
Biju Das <[email protected]>
mmc: host: renesas_sdhi: Fix the actual clock
Chi Zhang <[email protected]>
pinctrl: single: fix bias pull up/down handling in pin_config_set
Thomas Weißschuh <[email protected]>
bpf: Don't use %pK through printk
Thomas Weißschuh <[email protected]>
soc: ti: pruss: don't use %pK through printk
Thomas Weißschuh <[email protected]>
spi: loopback-test: Don't use %pK through printk
Jens Reidel <[email protected]>
soc: qcom: smem: Fix endian-unaware access of num_entries
Damien Le Moal <[email protected]>
block: make REQ_OP_ZONE_OPEN a write operation
Owen Gu <[email protected]>
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
Matthieu Baerts (NGI0) <[email protected]>
tracing: fix declaration-after-statement warning
Matthieu Baerts (NGI0) <[email protected]>
arch: back to -std=gnu89 in < v5.18
Alexey Dobriyan <[email protected]>
x86/boot: Compile boot code with -std=gnu11 too
Babu Moger <[email protected]>
x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
Artem Shimko <[email protected]>
serial: 8250_dw: handle reset control deassert error
Andy Shevchenko <[email protected]>
serial: 8250_dw: Use devm_add_action_or_reset()
Celeste Liu <[email protected]>
can: gs_usb: increase max interface to U8_MAX
Maarten Lankhorst <[email protected]>
devcoredump: Fix circular locking dependency with devcd->mutex.
Darrick J. Wong <[email protected]>
xfs: always warn about deprecated mount options
Lad Prabhakar <[email protected]>
net: ravb: Enforce descriptor type ordering
Emanuele Ghidoli <[email protected]>
net: phy: dp83867: Disable EEE support as not implemented
Alexey Klimov <[email protected]>
regmap: slimbus: fix bus_context pointer in regmap init calls
Damien Le Moal <[email protected]>
block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
John Smith <[email protected]>
drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
Yang Wang <[email protected]>
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
Tomeu Vizoso <[email protected]>
drm/etnaviv: fix flush sequence logic
Lizhi Xu <[email protected]>
usbnet: Prevents free active kevent
Noorain Eqbal <[email protected]>
bpf: Sync pending IRQ work before freeing ring buffer
Roy Vegard Ovesen <[email protected]>
ALSA: usb-audio: fix control pipe direction
Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix GMU firmware parser
Loic Poulain <[email protected]>
wifi: ath10k: Fix memory leak on unsupported WMI command
Srinivas Kandagatla <[email protected]>
ASoC: qdsp6: q6asm: do not sleep while atomic
Miaoqian Lin <[email protected]>
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
Florian Fuchs <[email protected]>
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
Gokul Sivakumar <[email protected]>
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Junjie Cao <[email protected]>
fbdev: bitblit: bound-check glyph index in bit_putcs*
Yuhao Jiang <[email protected]>
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
Daniel Palmer <[email protected]>
fbdev: atyfb: Check if pll_ops->init_pll failed
Miaoqian Lin <[email protected]>
net: usb: asix_devices: Check return value of usbnet_get_endpoints
Chuck Lever <[email protected]>
NFSD: Fix crash in nfsd4_read_release()
Filipe Manana <[email protected]>
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
Filipe Manana <[email protected]>
btrfs: always drop log root tree reference in btrfs_replay_log()
David Kaplan <[email protected]>
x86/bugs: Fix reporting of LFENCE retpoline
Xiang Mei <[email protected]>
net/sched: sch_qfq: Fix null-deref in agg_dequeue
-------------
Diffstat:
.../bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 ++-- Documentation/kbuild/makefiles.rst | 29 +++-- Makefile | 8 +- arch/arc/include/asm/bitops.h | 2 + arch/arm/crypto/Kconfig | 2 +- arch/arm/mach-at91/pm_suspend.S | 8 +- arch/mips/boot/dts/lantiq/danube.dtsi | 6 + arch/mips/lantiq/xway/sysctrl.c | 2 +- arch/mips/loongson64/Platform | 2 +- arch/mips/mm/tlb-r4k.c | 118 ++++++++++++------ arch/mips/mti-malta/malta-init.c | 20 +-- arch/parisc/boot/compressed/Makefile | 2 +- arch/powerpc/Makefile | 4 +- arch/powerpc/kernel/eeh_driver.c | 2 +- arch/riscv/kernel/cpu-hotplug.c | 1 + arch/riscv/mm/ptdump.c | 2 +- arch/s390/Makefile | 6 +- arch/s390/purgatory/Makefile | 2 +- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/kernel/module.c | 1 + arch/um/drivers/ssl.c | 5 +- arch/x86/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++- arch/x86/events/core.c | 10 +- arch/x86/kernel/cpu/bugs.c | 5 +- arch/x86/kernel/cpu/resctrl/monitor.c | 10 +- arch/x86/kernel/kvm.c | 20 +-- drivers/acpi/acpi_video.c | 4 +- drivers/acpi/acpica/dsmethod.c | 10 +- drivers/acpi/numa/srat.c | 2 +- drivers/acpi/property.c | 24 +++- drivers/acpi/video_detect.c | 8 ++ drivers/ata/libata-scsi.c | 8 ++ drivers/atm/fore200e.c | 2 + drivers/base/devcoredump.c | 138 +++++++++++++-------- drivers/base/regmap/regmap-slimbus.c | 6 +- drivers/bluetooth/btusb.c | 13 +- drivers/bluetooth/hci_bcsp.c | 3 + drivers/char/misc.c | 8 +- drivers/clocksource/timer-vf-pit.c | 22 ++-- drivers/cpufreq/longhaul.c | 3 + drivers/cpuidle/cpuidle.c | 8 +- drivers/dma/dw-edma/dw-edma-core.c | 22 ++++ drivers/dma/mv_xor.c | 4 +- drivers/dma/sh/shdma-base.c | 25 +++- drivers/dma/sh/shdmac.c | 17 ++- drivers/edac/altera_edac.c | 22 +++- drivers/extcon/extcon-adc-jack.c | 2 + drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +- drivers/firmware/efi/libstub/Makefile | 2 +- drivers/firmware/stratix10-svc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +- drivers/gpu/drm/amd/display/dc/calcs/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 +- drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dcn30/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 2 +- drivers/gpu/drm/amd/display/dc/dsc/Makefile | 2 +- .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +- .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +- drivers/gpu/drm/bridge/display-connector.c | 3 +- drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- drivers/gpu/drm/sti/sti_vtg.c | 7 +- drivers/gpu/drm/tegra/dc.c | 1 + drivers/gpu/drm/tidss/tidss_crtc.c | 2 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 +-- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/hid/hid-ids.h | 7 +- drivers/hid/hid-ntrig.c | 7 +- drivers/hid/hid-quirks.c | 14 ++- drivers/hwmon/dell-smm-hwmon.c | 7 ++ drivers/iio/adc/spear_adc.c | 9 +- drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 ++-- drivers/input/keyboard/cros_ec_keyb.c | 6 + drivers/input/keyboard/imx_sc_key.c | 2 +- drivers/input/misc/ati_remote2.c | 2 +- drivers/input/misc/cm109.c | 2 +- drivers/input/misc/powermate.c | 2 +- drivers/input/misc/yealink.c | 2 +- drivers/input/tablet/acecad.c | 2 +- drivers/input/tablet/pegasus_notetaker.c | 11 +- drivers/iommu/amd/init.c | 28 +++-- drivers/irqchip/irq-gic-v2m.c | 13 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 ++- drivers/mailbox/mailbox-test.c | 2 +- drivers/md/dm-verity-fec.c | 6 +- drivers/media/i2c/ir-kbd-i2c.c | 6 +- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 - drivers/media/pci/ivtv/ivtv-driver.h | 3 +- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +-- drivers/media/pci/ivtv/ivtv-irq.c | 4 +- drivers/media/rc/imon.c | 61 +++++---- drivers/media/rc/redrat3.c | 2 +- drivers/media/tuners/xc4000.c | 8 +- drivers/media/tuners/xc5000.c | 12 +- drivers/memstick/core/memstick.c | 8 +- drivers/mfd/da9063-i2c.c | 27 +++- drivers/mfd/madera-core.c | 4 +- drivers/mfd/stmpe-i2c.c | 1 + drivers/mfd/stmpe.c | 3 + drivers/mmc/host/renesas_sdhi_core.c | 6 +- drivers/mmc/host/sdhci-msm.c | 15 +++ drivers/most/most_usb.c | 14 +-- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- drivers/mtd/nand/raw/cadence-nand-controller.c | 3 +- drivers/net/can/sja1000/sja1000.c | 4 +- drivers/net/can/sun4i_can.c | 4 +- drivers/net/can/usb/gs_usb.c | 23 ++-- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +- drivers/net/dsa/b53/b53_common.c | 15 ++- drivers/net/dsa/b53/b53_regs.h | 3 +- .../net/ethernet/aquantia/atlantic/aq_hw_utils.c | 22 ++++ .../net/ethernet/aquantia/atlantic/aq_hw_utils.h | 1 + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 + .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +-- .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 2 + drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 ++- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- drivers/net/ethernet/realtek/Kconfig | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 6 +- drivers/net/ethernet/renesas/ravb_main.c | 16 ++- drivers/net/ethernet/renesas/sh_eth.c | 4 + drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +- drivers/net/ethernet/ti/netcp_core.c | 10 +- drivers/net/phy/dp83867.c | 6 + drivers/net/phy/marvell.c | 39 +++++- drivers/net/phy/mdio_bus.c | 5 +- drivers/net/usb/asix_devices.c | 12 +- drivers/net/usb/qmi_wwan.c | 6 + drivers/net/usb/usbnet.c | 2 + drivers/net/wireless/ath/ath10k/mac.c | 12 +- drivers/net/wireless/ath/ath10k/wmi.c | 1 + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++--- .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +- drivers/nvme/host/fc.c | 12 +- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 +- drivers/pci/controller/cadence/pcie-cadence.h | 6 +- drivers/pci/p2pdma.c | 2 +- drivers/pci/quirks.c | 1 + drivers/phy/cadence/cdns-dphy.c | 4 +- drivers/pinctrl/pinctrl-single.c | 4 +- drivers/regulator/fixed.c | 6 +- drivers/remoteproc/qcom_q6v5.c | 5 + drivers/s390/net/ctcm_mpc.c | 1 - drivers/scsi/hosts.c | 5 +- drivers/scsi/lpfc/lpfc_debugfs.h | 3 + drivers/scsi/pm8001/pm8001_ctl.c | 24 ++-- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.c | 4 +- drivers/scsi/pm8001/pm8001_sas.h | 4 + drivers/scsi/sg.c | 10 +- drivers/slimbus/qcom-ngd-ctrl.c | 1 + drivers/soc/imx/gpc.c | 2 + drivers/soc/qcom/smem.c | 2 +- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++ drivers/soc/ti/knav_dma.c | 14 +-- drivers/soc/ti/pruss.c | 2 +- drivers/spi/spi-bcm63xx.c | 14 +++ drivers/spi/spi-loopback-test.c | 12 +- drivers/spi/spi.c | 10 ++ drivers/target/loopback/tcm_loop.c | 3 + drivers/tee/tee_core.c | 2 +- drivers/thunderbolt/nhi.c | 2 + drivers/thunderbolt/nhi.h | 1 + drivers/tty/serial/8250/8250_dw.c | 67 +++++----- drivers/tty/serial/amba-pl011.c | 2 +- drivers/uio/uio_hv_generic.c | 21 +++- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +- drivers/usb/dwc3/ep0.c | 1 + drivers/usb/dwc3/gadget.c | 7 ++ drivers/usb/gadget/function/f_eem.c | 7 +- drivers/usb/gadget/function/f_fs.c | 8 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/function/f_ncm.c | 3 +- drivers/usb/host/xhci-dbgcap.h | 1 + drivers/usb/host/xhci-dbgtty.c | 17 ++- drivers/usb/host/xhci-plat.c | 1 + drivers/usb/mon/mon_bin.c | 14 ++- drivers/usb/renesas_usbhs/common.c | 14 +-- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 1 + drivers/usb/serial/option.c | 10 +- drivers/usb/storage/sddr55.c | 6 + drivers/usb/storage/transport.c | 16 +++ drivers/usb/storage/uas.c | 7 +- drivers/usb/storage/unusual_devs.h | 2 +- drivers/usb/typec/ucsi/psy.c | 5 + drivers/video/backlight/lp855x_bl.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/core/bitblit.c | 33 ++++- drivers/video/fbdev/pvr2fb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 2 + fs/9p/v9fs.c | 9 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/file.c | 10 ++ fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 1 - fs/ceph/locks.c | 5 +- fs/cifs/connect.c | 1 + fs/dax.c | 2 +- fs/exfat/fatent.c | 11 +- fs/exfat/super.c | 5 +- fs/ext4/xattr.c | 2 +- fs/fs-writeback.c | 7 +- fs/hpfs/namei.c | 18 ++- fs/jfs/inode.c | 8 +- fs/jfs/jfs_txnmgr.c | 9 +- fs/nfs/inode.c | 6 +- fs/nfs/nfs4client.c | 1 + fs/nfs/nfs4proc.c | 7 +- fs/nfs/nfs4state.c | 3 + fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/nfs4state.c | 3 +- fs/open.c | 10 +- fs/orangefs/xattr.c | 12 +- fs/overlayfs/copy_up.c | 2 +- fs/proc/generic.c | 12 +- fs/xfs/xfs_super.c | 33 +++-- include/linux/ata.h | 1 + include/linux/blk_types.h | 11 +- include/linux/compiler_types.h | 5 +- include/linux/filter.h | 2 +- include/linux/mm.h | 2 +- include/linux/shdma-base.h | 2 +- include/linux/usb.h | 16 +-- include/net/cls_cgroup.h | 2 +- include/net/nfc/nci_core.h | 2 +- include/net/pkt_sched.h | 25 +++- include/net/sctp/sctp.h | 3 +- include/net/tls.h | 6 + kernel/bpf/ringbuf.c | 2 + kernel/events/uprobes.c | 7 ++ kernel/gcov/gcc_4_7.c | 4 +- kernel/trace/trace_events_hist.c | 6 +- kernel/trace/trace_events_synth.c | 3 +- lib/crypto/Makefile | 2 +- mm/mempool.c | 32 ++++- mm/page_alloc.c | 2 +- net/8021q/vlan.c | 2 + net/bluetooth/6lowpan.c | 103 ++++++++++----- net/bluetooth/hci_event.c | 21 +++- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/sco.c | 7 ++ net/bluetooth/smp.c | 31 ++--- net/bridge/br_forward.c | 3 +- net/ceph/ceph_common.c | 53 ++++---- net/ceph/debugfs.c | 16 ++- net/core/netpoll.c | 7 +- net/core/page_pool.c | 6 +- net/core/sock.c | 15 ++- net/hsr/hsr_device.c | 3 + net/ipv4/fib_frontend.c | 2 +- net/ipv4/inet_diag.c | 5 +- net/ipv4/nexthop.c | 6 + net/ipv4/raw_diag.c | 7 +- net/ipv4/route.c | 5 + net/ipv4/udp_diag.c | 6 +- net/ipv4/udp_tunnel_nic.c | 2 +- net/ipv6/addrconf.c | 4 +- net/ipv6/ah6.c | 50 +++++--- net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- net/mac80211/rx.c | 10 +- net/mptcp/mptcp_diag.c | 6 +- net/mptcp/pm.c | 3 +- net/mptcp/pm_netlink.c | 20 +-- net/mptcp/protocol.c | 59 ++++++--- net/mptcp/protocol.h | 1 + net/netfilter/nf_tables_api.c | 15 +++ net/netfilter/nft_set_pipapo.c | 4 +- net/netfilter/nft_set_pipapo.h | 21 ++++ net/netfilter/nft_set_pipapo_avx2.c | 31 ++++- net/netlink/af_netlink.c | 2 +- net/openvswitch/actions.c | 68 +--------- net/openvswitch/flow_netlink.c | 64 ++-------- net/openvswitch/flow_netlink.h | 2 - net/rds/rds.h | 2 +- net/sched/act_ife.c | 12 +- net/sched/sch_api.c | 10 -- net/sched/sch_generic.c | 17 +-- net/sched/sch_hfsc.c | 16 --- net/sched/sch_qfq.c | 2 +- net/sctp/diag.c | 73 ++++++----- net/sctp/sm_make_chunk.c | 2 +- net/sctp/socket.c | 24 ++-- net/sctp/transport.c | 13 +- net/smc/smc_clc.c | 1 + net/strparser/strparser.c | 2 +- net/tipc/net.c | 2 + net/tls/tls_device.c | 4 +- net/unix/diag.c | 6 +- net/vmw_vsock/af_vsock.c | 40 ++++-- scripts/Kbuild.include | 10 +- scripts/kconfig/mconf.c | 3 + scripts/kconfig/nconf.c | 3 + sound/pci/hda/patch_realtek.c | 17 +-- sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/meson/aiu-encoder-i2s.c | 9 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/usb/endpoint.c | 5 + sound/usb/mixer.c | 11 +- sound/usb/mixer_s1810c.c | 28 ++++- sound/usb/validate.c | 9 +- tools/include/linux/bitmap.h | 1 + tools/power/cpupower/lib/cpuidle.c | 5 +- .../x86_energy_perf_policy.c | 30 +++-- tools/testing/selftests/Makefile | 2 +- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- tools/testing/selftests/net/fcnal-test.sh | 4 +- tools/testing/selftests/net/psock_tpacket.c | 4 +- tools/testing/selftests/net/traceroute.sh | 13 +- 332 files changed, 2243 insertions(+), 1164 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 26/300 net: ravb: Enforce descriptor type ordering
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 5370c31e84b0e0999c7b5ff949f4e104def35584 ]
Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised.
For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen.
This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets.
--- drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +14 -2
@@ -1596,13 +1596,25 @@ static netdev_tx_t ravb_start_xmit(struc }skb_tx_timestamp (skb); -/* Descriptor type must be set after all the above writes */ -dma_wmb (); +if (num_tx_desc >1 ) { desc->die_dt =DT_FEND ; desc--; +/* When using multi-descriptors, DT_FEND needs to get written +* before DT_FSTART, but the compiler may reorder the memory +* writes in an attempt to optimize the code. +* Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART +* are written exactly in the order shown in the code. +* This is particularly important for cases where the DMA engine +* is already running when we are running this code. If the DMA +* sees DT_FSTART without the corresponding DT_FEND it will enter +* an error condition. +*/ +dma_wmb (); desc->die_dt =DT_FSTART ; }else { +/* Descriptor type must be set after all the above writes */ +dma_wmb (); desc->die_dt =DT_FSINGLE ; }
Greg Kroah-Hartman
maintainerPATCH 35/300 tracing: fix declaration-after-statement warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
When building this kernel version this warning is visible:
kernel/trace/trace_events_synth.c: In function 'synth_event_reg':
kernel/trace/trace_events_synth.c:847:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
847 | int ret = trace_event_reg(call, type, data);
| ^~~This can be easily fixed by declaring 'ret' earlier.
This issue is visible in < v5.18, because -std=gnu89 is used by default, see commit e8c07082a810 ("Kbuild: move to -std=gnu11").
Please note that in v5.15.y, the 'Fixes' commit has been modified during the backport, not to have this warning. See commit 72848b81b3dd ("tracing: Ensure module defining synth event cannot be unloaded while tracing") from v5.15.y.
--- kernel/trace/trace_events_synth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/trace_events_synth.c +2 -1
@@ -831,6 +831,7 @@ static int synth_event_reg(struct trace_ enum trace_reg type, void *data) { struct synth_event *event = container_of(call, struct synth_event, call); +int ret;switch (type) {#ifdef CONFIG_PERF_EVENTS
@@ -844,7 +845,7 @@ static int synth_event_reg(struct trace_break ; } -int ret =trace_event_reg (call, type, data); + ret =trace_event_reg (call, type, data);switch (type) {#ifdef CONFIG_PERF_EVENTS
Greg Kroah-Hartman
maintainerPATCH 36/300 usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <[email protected]>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
--- drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +7 -1
@@ -1993,7 +1993,12 @@ static int ffs_func_eps_enable(struct ff ep = func->eps; epfile = ffs->epfiles; count = ffs->eps_count; -while (count--) { +if (!epfile) { + ret = -ENOMEM ; + goto done; + } + +while (count--) { ep->ep->driver_data = ep; ret =config_ep_by_speed (func->gadget, &func->function, ep->ep);
@@ -2017,6 +2022,7 @@ static int ffs_func_eps_enable(struct ff }wake_up_interruptible (&ffs->wait); +done:spin_unlock_irqrestore (&func->ffs->eps_lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 37/300 block: make REQ_OP_ZONE_OPEN a write operation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 19de03b312d69a7e9bacb51c806c6e3f4207376c ]
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation.
Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device.
--- include/linux/blk_types.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/linux/blk_types.h +5 -5
@@ -349,17 +349,17 @@ enum req_opf {/* write the zero filled sector many times */ REQ_OP_WRITE_ZEROES =9 ,/* Open a zone */ -REQ_OP_ZONE_OPEN =10 , +REQ_OP_ZONE_OPEN =11 ,/* Close a zone */ -REQ_OP_ZONE_CLOSE =11 , +REQ_OP_ZONE_CLOSE =13 ,/* Transition a zone to full */ -REQ_OP_ZONE_FINISH =13 , -/* write data at the current zone write pointer */ -REQ_OP_ZONE_APPEND =15 , +REQ_OP_ZONE_FINISH =15 ,/* reset a zone write pointer */ REQ_OP_ZONE_RESET =17 ,/* reset all the zone present on the device */ REQ_OP_ZONE_RESET_ALL =19 , +/* write data at the current zone write pointer */ +REQ_OP_ZONE_APPEND =21 ,/* SCSI passthrough using struct scsi_request */ REQ_OP_SCSI_IN = 32,
Greg Kroah-Hartman
maintainerPATCH 38/300 soc: qcom: smem: Fix endian-unaware access of num_entries
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <[email protected]>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
--- drivers/soc/qcom/smem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/smem.c +1 -1
@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)if (IS_ERR_OR_NULL (ptable))return SMEM_ITEM_COUNT ; - info = (struct smem_info *)&ptable->entry[ptable->num_entries]; + info = (struct smem_info *)&ptable->entry[le32_to_cpu (ptable->num_entries)];if (memcmp (info->magic,SMEM_INFO_MAGIC ,sizeof (info->magic)))return SMEM_ITEM_COUNT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/300 spi: loopback-test: Dont use %pK through printk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe.
--- drivers/spi/spi-loopback-test.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-loopback-test.c +6 -6
@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,int i;u8 b; -dev_info (&spi->dev," spi_msg@%pK\n" , msg); +dev_info (&spi->dev," spi_msg@%p\n" , msg);if (msg->status)dev_info (&spi->dev," status: %i\n" , msg->status);
@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi, msg->actual_length);list_for_each_entry (xfer, &msg->transfers, transfer_list) { -dev_info (&spi->dev," spi_transfer@%pK\n" , xfer); +dev_info (&spi->dev," spi_transfer@%p\n" , xfer);dev_info (&spi->dev," len: %i\n" , xfer->len); -dev_info (&spi->dev," tx_buf: %pK\n" , xfer->tx_buf); +dev_info (&spi->dev," tx_buf: %p\n" , xfer->tx_buf);if (dump_data && xfer->tx_buf)spi_test_print_hex_dump (" TX: " , xfer->tx_buf, xfer->len); -dev_info (&spi->dev," rx_buf: %pK\n" , xfer->rx_buf); +dev_info (&spi->dev," rx_buf: %p\n" , xfer->rx_buf);if (dump_data && xfer->rx_buf) spi_test_print_hex_dump(" RX: ", xfer->rx_buf,
@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,/* if still not found then something has modified too much */ /* we could list the "closest" transfer here... */ dev_err (&spi->dev, -"loopback strangeness - rx changed outside of allowed range at: %pK\n" , +"loopback strangeness - rx changed outside of allowed range at: %p\n" , addr);/* do not return, only set ret, * so that we list all addresses
@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi, }dev_err (&spi->dev, -"PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n" , +"PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n" , *ptr, *ptr + len,RX (0 ),RX (SPI_TEST_MAX_SIZE ),TX (0 ),TX (SPI_TEST_MAX_SIZE ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/300 soc: ti: pruss: dont use %pK through printk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- drivers/soc/ti/pruss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/ti/pruss.c +1 -1
@@ -229,7 +229,7 @@ static int pruss_probe(struct platform_device *pdev) pruss->mem_regions[i].pa = res.start; pruss->mem_regions[i].size =resource_size (&res); -dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %pK\n" , +dev_dbg (dev,"memory %8s: pa %pa size 0x%zx va %p\n" , mem_names[i], &pruss->mem_regions[i].pa, pruss->mem_regions[i].size, pruss->mem_regions[i].va); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/300 bpf: Dont use %pK through printk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and easier to reason about.
--- include/linux/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/filter.h +1 -1
@@ -1031,7 +1031,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);static inline void bpf_jit_dump (unsigned int flen,unsigned int proglen,u32 pass,void *image) { -pr_err ("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" , flen, +pr_err ("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n" , flen, proglen, pass, image, current->comm,task_pid_nr (current));if (image)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/300 pinctrl: single: fix bias pull up/down handling in pin_config_set
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <[email protected]>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias() which writes the register. However, the subsequent operations continue using the stale 'data' value from before the register write, effectively causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit 9dddb4df90d1 ("pinctrl: single: support generic pinconf").
--- drivers/pinctrl/pinctrl-single.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +3 -1
@@ -586,8 +586,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,break ;case PIN_CONFIG_BIAS_PULL_DOWN :case PIN_CONFIG_BIAS_PULL_UP : -if (arg) +if (arg) {pcs_pinconf_clear_bias (pctldev, pin); + data = pcs->read (pcs->base + offset); + } fallthrough;case PIN_CONFIG_INPUT_SCHMITT_ENABLE : data &= ~func->conf[i].mask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/300 mmc: host: renesas_sdhi: Fix the actual clock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios Without the patch:
clock: 50000000 Hz actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz actual clock: 50000000 Hz
--- drivers/mmc/host/renesas_sdhi_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mmc/host/renesas_sdhi_core.c +5 -1
@@ -183,7 +183,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host, clk &= ~0xff ; } -sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); + clock = clk &CLK_CTL_DIV_MASK ; +if (clock !=0xff ) + host->mmc->actual_clock /= (1 << (ffs (clock) +1 )); + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clock);if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 ))usleep_range (10000 ,11000 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/300 memstick: Add timeout to prevent indefinite waiting
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <[email protected]>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr() and memstick_alloc_card() to prevent indefinite blocking in case of hardware or communication failures.
--- drivers/memstick/core/memstick.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/memstick/core/memstick.c +6 -2
@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card) { card->next_request = h_memstick_set_rw_addr;memstick_new_req (card->host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;return card->current_mrq.error; }
@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host) card->next_request = h_memstick_read_dev_id;memstick_new_req (host); -wait_for_completion (&card->mrq_complete); +if (!wait_for_completion_timeout (&card->mrq_complete, +msecs_to_jiffies (500 ))) + card->current_mrq.error = -ETIMEDOUT ;if (card->current_mrq.error) goto err_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/300 xfs: always warn about deprecated mount options
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <[email protected]>
[ Upstream commit 630785bfbe12c3ee3ebccd8b530a98d632b7e39d ]
The deprecation of the 'attr2' mount option in 6.18 wasn't entirely successful because nobody noticed that the kernel never printed a warning about attr2 being set in fstab if the only xfs filesystem is the root fs; the initramfs mounts the root fs with no mount options; and the init scripts only conveyed the fstab options by remounting the root fs.
Fix this by making it complain all the time.
--- fs/xfs/xfs_super.c | 33 +++++++++++++++++++++------------ 1 file changed, 21 insertions(+), 12 deletions(-)
fs/xfs/xfs_super.c +21 -12
@@ -1162,16 +1162,25 @@ suffix_kstrtoint(static inline void xfs_fs_warn_deprecated (struct fs_context *fc, -struct fs_parameter *param, -uint64_t flag, -bool value) +struct fs_parameter *param) { -/* Don't print the warning if reconfiguring and current mount point -* already had the flag set +/* +* Always warn about someone passing in a deprecated mount option. +* Previously we wouldn't print the warning if we were reconfiguring +* and current mount point already had the flag set, but that was not +* the right thing to do. +* +* Many distributions mount the root filesystem with no options in the +* initramfs and rely on mount -a to remount the root fs with the +* options in fstab. However, the old behavior meant that there would +* never be a warning about deprecated mount options for the root fs in +* /etc/fstab. On a single-fs system, that means no warning at all. +* +* Compounding this problem are distribution scripts that copy +* /proc/mounts to fstab, which means that we can't remove mount +* options unless we're 100% sure they have only ever been advertised +* in /proc/mounts in response to explicitly provided mount options. */ -if ((fc->purpose &FS_CONTEXT_FOR_RECONFIGURE ) && - !!(XFS_M (fc->root->d_sb)->m_flags & flag) == value) -return ;xfs_warn (fc->s_fs_info,"%s mount option is deprecated." , param->key); }
@@ -1314,19 +1323,19 @@ xfs_fc_parse_param(#endif /* Following mount options will be removed in September 2025 */ case Opt_ikeep: -xfs_fs_warn_deprecated (fc, param,XFS_MOUNT_IKEEP , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_flags |=XFS_MOUNT_IKEEP ;return 0 ;case Opt_noikeep: -xfs_fs_warn_deprecated (fc, param,XFS_MOUNT_IKEEP , false); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_flags &= ~XFS_MOUNT_IKEEP ;return 0 ;case Opt_attr2: -xfs_fs_warn_deprecated (fc, param,XFS_MOUNT_ATTR2 , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_flags |=XFS_MOUNT_ATTR2 ;return 0 ;case Opt_noattr2: -xfs_fs_warn_deprecated (fc, param,XFS_MOUNT_NOATTR2 , true); +xfs_fs_warn_deprecated (fc, param); parsing_mp->m_flags &= ~XFS_MOUNT_ATTR2 ; parsing_mp->m_flags |=XFS_MOUNT_NOATTR2 ;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 45/300 ACPI: video: force native for Lenovo 82K8
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec. Add a quirk to prevent using it.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"), }, }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */ + { + .callback = video_detect_force_native, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "82K8"), + }, + }, { }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/300 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt the usage in test_lirc_mode2_user.c.
--- tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lirc_mode2_user.c +1 -1
@@ -73,7 +73,7 @@ int main(int argc, char **argv)/* Let's try detach it before it was ever attached */ ret =bpf_prog_detach2 (progfd, lircfd,BPF_LIRC_MODE2 ); -if (ret !=-1 || errno !=ENOENT ) { +if (ret != -ENOENT ) {printf ("bpf_prog_detach2 not attached should fail: %m\n" );return 1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/300 cpufreq/longhaul: handle NULL policy in longhaul_exit
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <[email protected]>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the policy is NULL.
Bugzilla: #219962
--- drivers/cpufreq/longhaul.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/cpufreq/longhaul.c +3 -0
@@ -955,6 +955,9 @@ static void __exit longhaul_exit(void)struct cpufreq_policy *policy =cpufreq_cpu_get (0 );int i; +if (unlikely (!policy)) +return ; +for (i =0 ; i < numscales; i++) {if (mults[i] == maxmult) {struct cpufreq_freqs freqs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/300 arc: Fix __fls() const-foldability via __builtin_clzl()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by BUILD_BUG_ON() suddenly stopped working[1], we found that an added static initializer was convincing the compiler that it couldn't track the state of the prior statically initialized value. Tracing this down found that ffs() was used in the initializer macro, but since it wasn't marked with __attribute__const__, the compiler had to assume the function might change variable states as a side-effect (which is not true for ffs(), which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function uses __builtin_arc_fls() which lacks GCC's const attribute, preventing compile-time constant folding, and KUnit testing of ffs/fls fails on arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard __builtin_clzl() builtin (which has const attribute) while preserving the optimized arc-specific builtin for runtime cases. This has the added benefit of skipping runtime calculation of compile-time constant values. Even with the GCC bug fixed (which is about "attribute const") this is a good change to avoid needless runtime costs, and should be done regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
--- arch/arc/include/asm/bitops.h | 2 ++ 1 file changed, 2 insertions(+)
arch/arc/include/asm/bitops.h +2 -0
@@ -315,6 +315,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)*/ static inline __attribute__ ((const))int __fls (unsigned long x) { +if (__builtin_constant_p (x)) +return x ?BITS_PER_LONG -1 -__builtin_clzl (x) :0 ;/* FLS insn has exactly same semantics as the API */ return __builtin_arc_fls (x); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/300 irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the low-order bits of the MSI Message DATA register to encode nr_irqs interrupt numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base vector conflict with the nr_irqs masking, causing the wrong MSI interrupt to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of bitmap_find_free_region() to align the initial base vector with nr_irqs.
--- drivers/irqchip/irq-gic-v2m.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v2m.c +9 -4
@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, {msi_alloc_info_t *info = args;struct v2m_data *v2m =NULL , *tmp; -int hwirq, offset, i, err =0 ; +int hwirq, i, err =0 ; +unsigned long offset; +unsigned long align_mask = nr_irqs -1 ;spin_lock (&v2m_lock);list_for_each_entry (tmp, &v2m_nodes, entry) { - offset =bitmap_find_free_region (tmp->bm, tmp->nr_spis, -get_count_order (nr_irqs)); -if (offset >=0 ) { +unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask); + + offset =bitmap_find_next_zero_area_off (tmp->bm, tmp->nr_spis,0 , + nr_irqs, align_mask, align_off); +if (offset < tmp->nr_spis) { v2m = tmp; +bitmap_set (v2m->bm, offset, nr_irqs);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/300 soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for Tegra124+ but omitted for Tegra114.
--- drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++ 1 file changed, 122 insertions(+)
drivers/soc/tegra/fuse/fuse-tegra30.c +122 -0
@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {#endif #ifdef CONFIG_ARCH_TEGRA_114_SOC +static const struct nvmem_cell_info tegra114_fuse_cells[] = { + { + .name ="tsensor-cpu1" , + .offset =0x084 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu2" , + .offset =0x088 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-common" , + .offset =0x08c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu0" , + .offset =0x098 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="xusb-pad-calibration" , + .offset =0x0f0 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-cpu3" , + .offset =0x12c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-gpu" , + .offset =0x154 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem0" , + .offset =0x158 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-mem1" , + .offset =0x15c , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, { + .name ="tsensor-pllx" , + .offset =0x160 , + .bytes =4 , + .bit_offset =0 , + .nbits =32 , + }, +}; + +static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = { + { + .nvmem_name ="fuse" , + .cell_name ="xusb-pad-calibration" , + .dev_id ="7009f000.padctl" , + .con_id ="calibration" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-common" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="common" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu2" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu2" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-cpu3" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="cpu3" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem0" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem0" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-mem1" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="mem1" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-gpu" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="gpu" , + }, { + .nvmem_name ="fuse" , + .cell_name ="tsensor-pllx" , + .dev_id ="700e2000.thermal-sensor" , + .con_id ="pllx" , + }, +}; +static const struct tegra_fuse_info tegra114_fuse_info = { .read = tegra30_fuse_read, .size = 0x2a0,
@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = { .init = tegra30_fuse_init, .speedo_init = tegra114_init_speedo_data, .info = &tegra114_fuse_info, + .lookups = tegra114_fuse_lookups, + .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups), + .cells = tegra114_fuse_cells, + .num_cells = ARRAY_SIZE(tegra114_fuse_cells), .soc_attr_group = &tegra_soc_attr_group, };#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/300 mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <[email protected]>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets with level shifter on Qualcomm SOC's.
--- drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/mmc/host/sdhci-msm.c +15 -0
@@ -78,6 +78,7 @@#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)#define CORE_IO_PAD_PWR_SWITCH BIT(16)#define CORE_HC_SELECT_IN_EN BIT(18) +#define CORE_HC_SELECT_IN_SDR50 (4 << 19)#define CORE_HC_SELECT_IN_HS400 (6 << 19)#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1113,6 +1114,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host) {struct mmc_ios *ios = &host->mmc->ios; +if (ios->timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) +return true; +/* * Tuning is required for SDR104, HS200 and HS400 cards and * if clock frequency is greater than 100MHz in these modes.
@@ -1181,6 +1186,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)struct mmc_ios ios = host->mmc->ios;struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct sdhci_msm_host *msm_host =sdhci_pltfm_priv (pltfm_host); +const struct sdhci_msm_offset *msm_offset = msm_host->offset; +u32 config;if (!sdhci_msm_is_tuning_needed (host)) { msm_host->use_cdr = false;
@@ -1197,6 +1204,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)*/ msm_host->tuning_done =0 ; +if (ios.timing ==MMC_TIMING_UHS_SDR50 && + host->flags &SDHCI_SDR50_NEEDS_TUNING ) { + config =readl_relaxed (host->ioaddr + msm_offset->core_vendor_spec); + config &= ~CORE_HC_SELECT_IN_MASK ; + config |=CORE_HC_SELECT_IN_EN |CORE_HC_SELECT_IN_SDR50 ; +writel_relaxed (config, host->ioaddr + msm_offset->core_vendor_spec); + } +/* * For HS400 tuning in HS200 timing requires: * - select MCLK/2 in VENDOR_SPEC
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/300 ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack acpi_ds_call_control_method() was deleting obj_desc->Method.param_count operands. But Method.param_count does not necessarily match this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check i < this_walk_state->num_operands the code is identical to acpi_ds_clear_operands(), so just outright replace the code with acpi_ds_clear_operands() to fix this.
--- drivers/acpi/acpica/dsmethod.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/acpi/acpica/dsmethod.c +1 -8
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,* Delete the operands on the previous walkstate operand stack * (they were copied to new objects) */ -for (i =0 ; i < obj_desc->method.param_count; i++) { -acpi_ut_remove_reference (this_walk_state->operands[i]); - this_walk_state->operands[i] =NULL ; - } - -/* Clear the operand stack */ - - this_walk_state->num_operands =0 ; +acpi_ds_clear_operands (this_walk_state); ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/300 tee: allow a driver to allocate a tee_device without a pool
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <[email protected]>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't support memory sharing ioctls and can allocate memory for TEE messages in another way. Although this is mentioned in the documentation for tee_device_alloc(), it is not handled correctly.
--- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/tee_core.c +1 -1
@@ -894,7 +894,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,if (!teedesc || !teedesc->name || !teedesc->ops || !teedesc->ops->get_version || !teedesc->ops->open || - !teedesc->ops->release || !pool) + !teedesc->ops->release)return ERR_PTR (-EINVAL ); teedev =kzalloc (sizeof (*teedev),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/300 nvme-fc: use lock accessing port_state and rport state
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <[email protected]>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races with with the reconnect logic, because nvme_fc_create_association is not taking a lock to check the port_state and atomically increase the active count on the rport.
--- drivers/nvme/host/fc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/nvme/host/fc.c +8 -2
@@ -3042,11 +3042,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) ++ctrl->ctrl.nr_reconnects; -if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) +spin_lock_irqsave (&ctrl->rport->lock, flags); +if (ctrl->rport->remoteport.port_state !=FC_OBJSTATE_ONLINE ) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENODEV ; + } -if (nvme_fc_ctlr_active_on_rport (ctrl)) +if (nvme_fc_ctlr_active_on_rport (ctrl)) { +spin_unlock_irqrestore (&ctrl->rport->lock, flags);return -ENOTUNIQ ; + } +spin_unlock_irqrestore (&ctrl->rport->lock, flags);dev_info (ctrl->ctrl.device, "NVME-FC{%d}: create association : host wwpn 0x%016llx "
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/300 devcoredump: Fix circular locking dependency with devcd->mutex.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <[email protected]>
[ Upstream commit a91c8096590bd7801a26454789f2992094fe36da ]
The original code causes a circular locking dependency found by lockdep.
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U
------------------------------------------------------
xe_fault_inject/5091 is trying to acquire lock:ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660
but task is already holding lock:
ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&devcd->mutex){+.+.}-{3:3}:
mutex_lock_nested+0x4e/0xc0
devcd_data_write+0x27/0x90
sysfs_kf_bin_write+0x80/0xf0
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (kn->active#236){++++}-{0:0}:
kernfs_drain+0x1e2/0x200
__kernfs_remove+0xae/0x400
kernfs_remove_by_name_ns+0x5d/0xc0
remove_files+0x54/0x70
sysfs_remove_group+0x3d/0xa0
sysfs_remove_groups+0x2e/0x60
device_remove_attrs+0xc7/0x100
device_del+0x15d/0x3b0
devcd_del+0x19/0x30
process_one_work+0x22b/0x6f0
worker_thread+0x1e8/0x3d0
kthread+0x11c/0x250
ret_from_fork+0x26c/0x2e0
ret_from_fork_asm+0x1a/0x30
-> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}:
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
__flush_work+0x27a/0x660
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&devcd->mutex);
lock(kn->active#236);
lock(&devcd->mutex);
lock((work_completion)(&(&devcd->del_wk)->work));
*** DEADLOCK ***
5 locks held by xe_fault_inject/5091:
#0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0
#1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220
#2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280
#3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
#4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660
stack backtrace:
CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)}
Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
dump_stack+0x10/0x20
print_circular_bug+0x285/0x360
check_noncircular+0x135/0x150
? register_lock_class+0x48/0x4a0
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
? __flush_work+0x25d/0x660
? mark_held_locks+0x46/0x90
? __flush_work+0x25d/0x660
__flush_work+0x27a/0x660
? __flush_work+0x25d/0x660
? trace_hardirqs_on+0x1e/0xd0
? __pfx_wq_barrier_func+0x10/0x10
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
? bus_find_device+0xa8/0xe0
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
? __f_unlock_pos+0x15/0x20
? __x64_sys_getdents64+0x9b/0x130
? __pfx_filldir64+0x10/0x10
? do_syscall_64+0x1a2/0xb60
? clear_bhb_loop+0x30/0x80
? clear_bhb_loop+0x30/0x80
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x76e292edd574
Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574
RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b
RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063
R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000
</TASK>xe 0000:03:00.0: [drm] Xe device coredump has been deleted.
--- drivers/base/devcoredump.c | 138 +++++++++++++++++++++++++++------------------ 1 file changed, 84 insertions(+), 54 deletions(-)
drivers/base/devcoredump.c +84 -54
@@ -30,50 +30,46 @@ struct devcd_entry {void *data;size_t datalen;/* -* Here, mutex is required to serialize the calls to del_wk work between -* user/kernel space which happens when devcd is added with device_add() -* and that sends uevent to user space. User space reads the uevents, -* and calls to devcd_data_write() which try to modify the work which is -* not even initialized/queued from devcoredump. +* There are 2 races for which mutex is required. * +* The first race is between device creation and userspace writing to +* schedule immediately destruction. * +* This race is handled by arming the timer before device creation, but +* when device creation fails the timer still exists. * -* cpu0(X) cpu1(Y) +* To solve this, hold the mutex during device_add(), and set +* init_completed on success before releasing the mutex. * -* dev_coredump() uevent sent to user space -* device_add() ======================> user space process Y reads the -* uevents writes to devcd fd -* which results into writes to +* That way the timer will never fire until device_add() is called, +* it will do nothing if init_completed is not set. The timer is also +* cancelled in that case. * -* devcd_data_write() -* mod_delayed_work() -* try_to_grab_pending() -* del_timer() -* debug_assert_init() -* INIT_DELAYED_WORK() -* schedule_delayed_work() -* -* -* Also, mutex alone would not be enough to avoid scheduling of -* del_wk work after it get flush from a call to devcd_free() -* mentioned as below. -* -* disabled_store() -* devcd_free() -* mutex_lock() devcd_data_write() -* flush_delayed_work() -* mutex_unlock() -* mutex_lock() -* mod_delayed_work() -* mutex_unlock() -* So, delete_work flag is required. +* The second race involves multiple parallel invocations of devcd_free(), +* add a deleted flag so only 1 can call the destructor. */ struct mutex mutex; -bool delete_work; +bool init_completed, deleted;struct module *owner;ssize_t (*read)(char *buffer,loff_t offset,size_t count,void *data,size_t datalen);void (*free)(void *data); +/* +* If nothing interferes and device_add() was returns success, +* del_wk will destroy the device after the timer fires. +* +* Multiple userspace processes can interfere in the working of the timer: +* - Writing to the coredump will reschedule the timer to run immediately, +* if still armed. +* +* This is handled by using "if (cancel_delayed_work()) { +* schedule_delayed_work() }", to prevent re-arming after having +* been previously fired. +* - Writing to /sys/class/devcoredump/disabled will destroy the +* coredump synchronously. +* This is handled by using disable_delayed_work_sync(), and then +* checking if deleted flag is set with &devcd->mutex held. +*/ struct delayed_work del_wk;struct device *failing_dev; };
@@ -102,14 +98,27 @@ static void devcd_dev_release(struct devkfree (devcd); } +static void __devcd_del (struct devcd_entry *devcd) +{ + devcd->deleted = true; +device_del (&devcd->devcd_dev); +put_device (&devcd->devcd_dev); +} +static void devcd_del (struct work_struct *wk) {struct devcd_entry *devcd; +bool init_completed; devcd = container_of(wk, struct devcd_entry, del_wk.work); -device_del (&devcd->devcd_dev); -put_device (&devcd->devcd_dev); +/* devcd->mutex serializes against dev_coredumpm_timeout */ +mutex_lock (&devcd->mutex); + init_completed = devcd->init_completed; +mutex_unlock (&devcd->mutex); + +if (init_completed) +__devcd_del (devcd); } static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj,
@@ -129,12 +138,12 @@ static ssize_t devcd_data_write(struct fstruct device *dev =kobj_to_dev (kobj);struct devcd_entry *devcd =dev_to_devcd (dev); -mutex_lock (&devcd->mutex); -if (!devcd->delete_work) { - devcd->delete_work = true; -mod_delayed_work (system_wq, &devcd->del_wk,0 ); - } -mutex_unlock (&devcd->mutex); +/* +* Although it's tempting to use mod_delayed work here, +* that will cause a reschedule if the timer already fired. +*/ +if (cancel_delayed_work (&devcd->del_wk)) +schedule_delayed_work (&devcd->del_wk,0 );return count; }
@@ -162,11 +171,21 @@ static int devcd_free(struct device *dev {struct devcd_entry *devcd =dev_to_devcd (dev); +/* +* To prevent a race with devcd_data_write(), cancel work and +* complete manually instead. +* +* We cannot rely on the return value of +* cancel_delayed_work_sync() here, because it might be in the +* middle of a cancel_delayed_work + schedule_delayed_work pair. +* +* devcd->mutex here guards against multiple parallel invocations +* of devcd_free(). +*/ +cancel_delayed_work_sync (&devcd->del_wk);mutex_lock (&devcd->mutex); -if (!devcd->delete_work) - devcd->delete_work = true; - -flush_delayed_work (&devcd->del_wk); +if (!devcd->deleted) +__devcd_del (devcd);mutex_unlock (&devcd->mutex);return 0 ; }
@@ -190,12 +209,10 @@ static ssize_t disabled_show(struct clas* put_device() <- last reference * error = fn(dev, data) devcd_dev_release() * devcd_free(dev, data) kfree(devcd) -* mutex_lock(&devcd->mutex); * * -* In the above diagram, It looks like disabled_store() would be racing with parallely -* running devcd_del() and result in memory abort while acquiring devcd->mutex which -* is called after kfree of devcd memory after dropping its last reference with +* In the above diagram, it looks like disabled_store() would be racing with parallelly +* running devcd_del() and result in memory abort after dropping its last reference with * put_device(). However, this will not happens as fn(dev, data) runs * with its own reference to device via klist_node so it is not its last reference. * so, above situation would not occur.
@@ -357,7 +374,7 @@ void dev_coredumpm(struct device *dev, s devcd->read = read; devcd->free = free; devcd->failing_dev =get_device (dev); - devcd->delete_work = false; + devcd->deleted = false;mutex_init (&devcd->mutex);device_initialize (&devcd->devcd_dev);
@@ -366,8 +383,14 @@ void dev_coredumpm(struct device *dev, s atomic_inc_return(&devcd_count)); devcd->devcd_dev.class = &devcd_class; -mutex_lock (&devcd->mutex);dev_set_uevent_suppress (&devcd->devcd_dev, true); + +/* devcd->mutex prevents devcd_del() completing until init finishes */ +mutex_lock (&devcd->mutex); + devcd->init_completed = false; +INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); +schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); +if (device_add (&devcd->devcd_dev)) goto put_device;
@@ -381,13 +404,20 @@ void dev_coredumpm(struct device *dev, sdev_set_uevent_suppress (&devcd->devcd_dev, false);kobject_uevent (&devcd->devcd_dev.kobj,KOBJ_ADD ); -INIT_DELAYED_WORK (&devcd->del_wk, devcd_del); -schedule_delayed_work (&devcd->del_wk,DEVCD_TIMEOUT ); + +/* +* Safe to run devcd_del() now that we are done with devcd_dev. +* Alternatively we could have taken a ref on devcd_dev before +* dropping the lock. +*/ + devcd->init_completed = true;mutex_unlock (&devcd->mutex);return ; put_device: -put_device (&devcd->devcd_dev);mutex_unlock (&devcd->mutex); +cancel_delayed_work_sync (&devcd->del_wk); +put_device (&devcd->devcd_dev); + put_module:module_put (owner); free:
Greg Kroah-Hartman
maintainerPATCH 55/300 video: backlight: lp855x_bl: Set correct EPROM start for LP8556
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <[email protected]>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value in the driver accordingly.
--- drivers/video/backlight/lp855x_bl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/backlight/lp855x_bl.c +1 -1
@@ -21,7 +21,7 @@#define LP855X_DEVICE_CTRL 0x01#define LP855X_EEPROM_START 0xA0#define LP855X_EEPROM_END 0xA7 -#define LP8556_EPROM_START 0xA0 +#define LP8556_EPROM_START 0x98#define LP8556_EPROM_END 0xAF/* LP8555/7 Registers */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/300 cpuidle: Fail cpuidle device registration if there is one already
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
Refuse to register a cpuidle device if the given CPU has a cpuidle device already and print a message regarding it.
Without this, an attempt to register a new cpuidle device without unregistering the existing one leads to the removal of the existing cpuidle device without removing its sysfs interface.
--- drivers/cpuidle/cpuidle.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/cpuidle/cpuidle.c +7 -1
@@ -576,8 +576,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)static int __cpuidle_register_device (struct cpuidle_device *dev) {struct cpuidle_driver *drv =cpuidle_get_cpu_driver (dev); +unsigned int cpu = dev->cpu;int i, ret; +if (per_cpu (cpuidle_devices, cpu)) { +pr_info ("CPU%d: cpuidle device already registered\n" , cpu); +return -EEXIST ; + } +if (!try_module_get (drv->owner))return -EINVAL ;
@@ -589,7 +595,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev) dev->states_usage[i].disable |=CPUIDLE_STATE_DISABLED_BY_USER ; } -per_cpu (cpuidle_devices, dev->cpu) = dev; +per_cpu (cpuidle_devices, cpu) = dev;list_add (&dev->device_list, &cpuidle_detected_devices); ret =cpuidle_coupled_register_device (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/300 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <[email protected]>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
--- drivers/clocksource/timer-vf-pit.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/clocksource/timer-vf-pit.c +11 -11
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;static inline void pit_timer_enable (void ) { -__raw_writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); +writel (PITTCTRL_TEN |PITTCTRL_TIE , clkevt_base +PITTCTRL ); }static inline void pit_timer_disable (void ) { -__raw_writel (0 , clkevt_base +PITTCTRL ); +writel (0 , clkevt_base +PITTCTRL ); }static inline void pit_irq_acknowledge (void ) { -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG ); } static u64 notrace pit_read_sched_clock(void) { -return ~__raw_readl (clksrc_base +PITCVAL ); +return ~readl (clksrc_base +PITCVAL ); }static int __init pit_clocksource_init (unsigned long rate) {/* set the max load value and start the clock source counter */ -__raw_writel (0 , clksrc_base +PITTCTRL ); -__raw_writel (~0UL , clksrc_base +PITLDVAL ); -__raw_writel (PITTCTRL_TEN , clksrc_base +PITTCTRL ); +writel (0 , clksrc_base +PITTCTRL ); +writel (~0UL , clksrc_base +PITLDVAL ); +writel (PITTCTRL_TEN , clksrc_base +PITTCTRL );sched_clock_register (pit_read_sched_clock,32 , rate); return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,* hardware requirement. */ pit_timer_disable (); -__raw_writel (delta -1 , clkevt_base +PITLDVAL ); +writel (delta -1 , clkevt_base +PITLDVAL );pit_timer_enable ();return 0 ;
@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {static int __init pit_clockevent_init (unsigned long rate,int irq) { -__raw_writel (0 , clkevt_base +PITTCTRL ); -__raw_writel (PITTFLG_TIF , clkevt_base +PITTFLG ); +writel (0 , clkevt_base +PITTCTRL ); +writel (PITTFLG_TIF , clkevt_base +PITTFLG );BUG_ON (request_irq (irq, pit_timer_interrupt,IRQF_TIMER |IRQF_IRQPOLL ,"VF pit timer" , &clockevent_pit));
@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np) cycle_per_jiffy = clk_rate / (HZ );/* enable the pit module */ -__raw_writel (~PITMCR_MDIS , timer_base +PITMCR ); +writel (~PITMCR_MDIS , timer_base +PITMCR ); ret =pit_clocksource_init (clk_rate);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/300 uprobe: Do not emulate/sstep original instruction when ip is changed
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length.
This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it.
--- kernel/events/uprobes.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/events/uprobes.c +7 -0
@@ -2242,6 +2242,13 @@ static void handle_swbp(struct pt_regs *regs)handler_chain (uprobe, regs); +/* +* If user decided to take execution elsewhere, it makes little sense +* to execute the original instruction, so let's skip it. +*/ +if (instruction_pointer (regs) != bp_vaddr) + goto out; +if (arch_uprobe_skip_sstep (&uprobe->arch, regs)) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/300 hwmon: (dell-smm) Add support for Dell OptiPlex 7040
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically.
--- drivers/hwmon/dell-smm-hwmon.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/hwmon/dell-smm-hwmon.c +7 -0
@@ -1065,6 +1065,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = { }, .driver_data = (void *)&i8k_config_data[DELL_PRECISION_490], }, + { + .ident = "Dell OptiPlex 7040", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"), + }, + }, { .ident ="Dell Precision" , .matches = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/300 tools/cpupower: Fix incorrect size in cpuidle_state_disable()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs.
--- tools/power/cpupower/lib/cpuidle.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/power/cpupower/lib/cpuidle.c +3 -2
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu, {char value[SYSFS_PATH_MAX ];int bytes_written; +int len;if (cpuidle_state_count (cpu) <= idlestate)return -1 ;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu, idlestate_value_files[IDLESTATE_DISABLE]))return -2 ; -snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); + len =snprintf (value,SYSFS_PATH_MAX ,"%u" , disable); bytes_written =cpuidle_state_write_file (cpu, idlestate,"disable" , - value,sizeof (disable)); + value, len);if (bytes_written)return 0 ;return -3 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/300 can: gs_usb: increase max interface to U8_MAX
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <[email protected]>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
--- drivers/net/can/usb/gs_usb.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
drivers/net/can/usb/gs_usb.c +11 -12
@@ -156,10 +156,6 @@ struct gs_host_frame {#define GS_MAX_TX_URBS 10/* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */ #define GS_MAX_RX_URBS 30 -/* Maximum number of interfaces the driver supports per device. -* Current hardware only supports 2 interfaces. The future may vary. -*/ -#define GS_MAX_INTF 2struct gs_tx_context {struct gs_can *dev;
@@ -190,10 +186,11 @@ struct gs_can {/* usb interface struct */ struct gs_usb { -struct gs_can *canch[GS_MAX_INTF ];struct usb_anchor rx_submitted;struct usb_device *udev;u8 active_channels; +u8 channel_cnt; +struct gs_can *canch[]; };/* 'allocate' a tx context.
@@ -321,7 +318,7 @@ static void gs_usb_receive_bulk_callback }/* device reports out of range channel id */ -if (hf->channel >=GS_MAX_INTF ) +if (hf->channel >= usbcan->channel_cnt) goto device_detach; dev = usbcan->canch[hf->channel];
@@ -409,7 +406,7 @@ static void gs_usb_receive_bulk_callback/* USB failure take down all interfaces */ if (rc == -ENODEV ) { device_detach: -for (rc =0 ; rc <GS_MAX_INTF ; rc++) { +for (rc =0 ; rc < usbcan->channel_cnt; rc++) {if (usbcan->canch[rc])netif_device_detach (usbcan->canch[rc]->netdev); }
@@ -991,20 +988,22 @@ static int gs_usb_probe(struct usb_inter icount = dconf->icount +1 ;dev_info (&intf->dev,"Configuring for %d interfaces\n" , icount); -if (icount >GS_MAX_INTF ) { +if (icount >type_max (typeof (dev->channel_cnt))) {dev_err (&intf->dev, -"Driver cannot handle more that %d CAN interfaces\n" , -GS_MAX_INTF ); +"Driver cannot handle more that %u CAN interfaces\n" , +type_max (typeof (dev->channel_cnt)));kfree (dconf);return -EINVAL ; } - dev =kzalloc (sizeof (*dev),GFP_KERNEL ); + dev =kzalloc (struct_size (dev, canch, icount),GFP_KERNEL );if (!dev) {kfree (dconf);return -ENOMEM ; } + dev->channel_cnt = icount; +init_usb_anchor (&dev->rx_submitted);usb_set_intfdata (intf, dev);
@@ -1045,7 +1044,7 @@ static void gs_usb_disconnect(struct usbreturn ; } -for (i =0 ; i <GS_MAX_INTF ; i++) +for (i =0 ; i < dev->channel_cnt; i++)if (dev->canch[i])gs_destroy_candev (dev->canch[i]);
Greg Kroah-Hartman
maintainerPATCH 30/300 serial: 8250_dw: Use devm_add_action_or_reset()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 295b09128d12fb1a7a67f771cc0ae0df869eafaf ]
Slightly simplify ->probe() and drop a few goto labels by using devm_add_action_or_reset() for clock and reset cleanup.
Stable-dep-of: daeb4037adf7 ("serial: 8250_dw: handle reset control deassert error")
--- drivers/tty/serial/8250/8250_dw.c | 63 ++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 32 deletions(-)
drivers/tty/serial/8250/8250_dw.c +31 -32
@@ -438,6 +438,16 @@ static void dw8250_quirks(struct uart_po } } +static void dw8250_clk_disable_unprepare (void *data) +{ +clk_disable_unprepare (data); +} + +static void dw8250_reset_control_assert (void *data) +{ +reset_control_assert (data); +} +static int dw8250_probe (struct platform_device *pdev) {struct uart_8250_port uart = {}, *up = &uart;
@@ -539,35 +549,43 @@ static int dw8250_probe(struct platform_if (err)dev_warn (dev,"could not enable optional baudclk: %d\n" , err); + err =devm_add_action_or_reset (dev, dw8250_clk_disable_unprepare, data->clk); +if (err) +return err; +if (data->clk) p->uartclk =clk_get_rate (data->clk);/* If no clock rate is defined, fail. */ if (!p->uartclk) {dev_err (dev,"clock rate not defined\n" ); - err = -EINVAL ; - goto err_clk; +return -EINVAL ; } data->pclk =devm_clk_get_optional (dev,"apb_pclk" ); -if (IS_ERR (data->pclk)) { - err =PTR_ERR (data->pclk); - goto err_clk; - } +if (IS_ERR (data->pclk)) +return PTR_ERR (data->pclk); err =clk_prepare_enable (data->pclk);if (err) {dev_err (dev,"could not enable apb_pclk\n" ); - goto err_clk; +return err; } + err =devm_add_action_or_reset (dev, dw8250_clk_disable_unprepare, data->pclk); +if (err) +return err; + data->rst =devm_reset_control_get_optional_exclusive (dev,NULL ); -if (IS_ERR (data->rst)) { - err =PTR_ERR (data->rst); - goto err_pclk; - } +if (IS_ERR (data->rst)) +return PTR_ERR (data->rst); +reset_control_deassert (data->rst); + err =devm_add_action_or_reset (dev, dw8250_reset_control_assert, data->rst); +if (err) +return err; +dw8250_quirks (p, data);/* If the Busy Functionality is not implemented, don't handle it */
@@ -585,10 +603,8 @@ static int dw8250_probe(struct platform_ } data->data.line =serial8250_register_8250_port (up); -if (data->data.line <0 ) { - err = data->data.line; - goto err_reset; - } +if (data->data.line <0 ) +return data->data.line;/* * Some platforms may provide a reference clock shared between several
@@ -609,17 +625,6 @@ static int dw8250_probe(struct platform_pm_runtime_enable (dev);return 0 ; - -err_reset: -reset_control_assert (data->rst); - -err_pclk: -clk_disable_unprepare (data->pclk); - -err_clk: -clk_disable_unprepare (data->clk); - -return err; }static int dw8250_remove (struct platform_device *pdev)
@@ -637,12 +642,6 @@ static int dw8250_remove(struct platformserial8250_unregister_port (data->data.line); -reset_control_assert (data->rst); - -clk_disable_unprepare (data->pclk); - -clk_disable_unprepare (data->clk); -pm_runtime_disable (dev);pm_runtime_put_noidle (dev);
Greg Kroah-Hartman
maintainerPATCH 31/300 serial: 8250_dw: handle reset control deassert error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Shimko <[email protected]>
[ Upstream commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b ]
Check the return value of reset_control_deassert() in the probe function to prevent continuing probe when reset deassertion fails.
Previously, reset_control_deassert() was called without checking its return value, which could lead to probe continuing even when the device reset wasn't properly deasserted.
The fix checks the return value and returns an error with dev_err_probe() if reset deassertion fails, providing better error handling and diagnostics.
--- drivers/tty/serial/8250/8250_dw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dw.c +3 -1
@@ -580,7 +580,9 @@ static int dw8250_probe(struct platform_if (IS_ERR (data->rst))return PTR_ERR (data->rst); -reset_control_deassert (data->rst); + err =reset_control_deassert (data->rst); +if (err) +return dev_err_probe (dev, err,"failed to deassert resets\n" ); err =devm_add_action_or_reset (dev, dw8250_reset_control_assert, data->rst);if (err)
Greg Kroah-Hartman
maintainerPATCH 32/300 x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babu Moger <[email protected]>
[ Upstream commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 ]
Users can create as many monitoring groups as the number of RMIDs supported by the hardware. However, on AMD systems, only a limited number of RMIDs are guaranteed to be actively tracked by the hardware. RMIDs that exceed this limit are placed in an "Unavailable" state.
When a bandwidth counter is read for such an RMID, the hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable remains set on first read after tracking re-starts and is clear on all subsequent reads as long as the RMID is tracked.
resctrl miscounts the bandwidth events after an RMID transitions from the "Unavailable" state back to being tracked. This happens because when the hardware starts counting again after resetting the counter to zero, resctrl in turn compares the new count against the counter value stored from the previous time the RMID was tracked.
This results in resctrl computing an event value that is either undercounting (when new counter is more than stored counter) or a mistaken overflow (when new counter is less than stored counter).
Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to zero whenever the RMID is in the "Unavailable" state to ensure accurate counting after the RMID resets to zero when it starts to be tracked again.
Example scenario that results in mistaken overflow
==================================================
1. The resctrl filesystem is mounted, and a task is assigned to a monitoring group.
$mount -t resctrl resctrl /sys/fs/resctrl $mkdir /sys/fs/resctrl/mon_groups/test1/ $echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
21323 <- Total bytes on domain 0
"Unavailable" <- Total bytes on domain 1
Task is running on domain 0. Counter on domain 1 is "Unavailable".
2. The task runs on domain 0 for a while and then moves to domain 1. The counter starts incrementing on domain 1.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
7345357 <- Total bytes on domain 0
4545 <- Total bytes on domain 1
3. At some point, the RMID in domain 0 transitions to the "Unavailable" state because the task is no longer executing in that domain.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
"Unavailable" <- Total bytes on domain 0
434341 <- Total bytes on domain 1
4. Since the task continues to migrate between domains, it may eventually return to domain 0.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 17592178699059 <- Overflow on domain 0
3232332 <- Total bytes on domain 1
In this case, the RMID on domain 0 transitions from "Unavailable" state to active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when the counter is read and begins tracking the RMID counting from 0.
Subsequent reads succeed but return a value smaller than the previously saved MSR value (7345357). Consequently, the resctrl's overflow logic is triggered, it compares the previous value (7345357) with the new, smaller value and incorrectly interprets this as a counter overflow, adding a large delta.
In reality, this is a false positive: the counter did not overflow but was simply reset when the RMID transitioned from "Unavailable" back to active state.
Here is the text from APM [1] available from [2].
"In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the first QM_CTR read when it begins tracking an RMID that it was not previously tracking. The U bit will be zero for all subsequent reads from that RMID while it is still tracked by the hardware. Therefore, a QM_CTR read with the U bit set when that RMID is in use by a processor can be considered 0 when calculating the difference with a subsequent read."
[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory Bandwidth (MBM).
[ bp: Split commit message into smaller paragraph chunks for better
consumption. ]
--- arch/x86/kernel/cpu/resctrl/monitor.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/resctrl/monitor.c +9 -1
@@ -224,11 +224,19 @@ static u64 mbm_overflow_count(u64 prev_mstatic u64 __mon_event_count (u32 rmid,struct rmid_read *rr) { -struct mbm_state *m; +struct mbm_state *m =NULL ;u64 chunks, tval; tval =__rmid_read (rmid, rr->evtid);if (tval & (RMID_VAL_ERROR |RMID_VAL_UNAVAIL )) { +if (tval &RMID_VAL_UNAVAIL ) { +if (rr->evtid ==QOS_L3_MBM_TOTAL_EVENT_ID ) + m = &rr->d->mbm_total[rmid]; +else if (rr->evtid ==QOS_L3_MBM_LOCAL_EVENT_ID ) + m = &rr->d->mbm_local[rmid]; +if (m) + m->prev_msr =0 ; + }return tval; }switch (rr->evtid) {
Greg Kroah-Hartman
maintainerPATCH 33/300 x86/boot: Compile boot code with -std=gnu11 too
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
commit b3bee1e7c3f2b1b77182302c7b2131c804175870 upstream.
Use -std=gnu11 for consistency with main kernel code.
It doesn't seem to change anything in vmlinux.
[ This kernel version doesn't build with GCC 15:
In file included from include/uapi/linux/posix_types.h:5,
from include/uapi/linux/types.h:14,
from include/linux/types.h:6,
from arch/x86/realmode/rm/wakeup.h:11,
from arch/x86/realmode/rm/wakemain.c:2:
include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
11 | false = 0,
| ^~~~~
include/linux/stddef.h:11:9: note: 'false' is a keyword with '-std=c23' onwards include/linux/types.h:30:33: error: 'bool' cannot be defined via 'typedef'
30 | typedef _Bool bool;
| ^~~~
include/linux/types.h:30:33: note: 'bool' is a keyword with '-std=c23' onwards include/linux/types.h:30:1: warning: useless type name in empty declaration
30 | typedef _Bool bool;
| ^~~~~~~
The fix is similar to commit ee2ab467bddf ("x86/boot: Use '-std=gnu11' to fix build with GCC 15") which has been backported to this kernel.
Note: In < 5.18 version, -std=gnu89 is used instead of -std=gnu11, see commit e8c07082a810 ("Kbuild: move to -std=gnu11"). I suggest not to modify that in this commit here as all the other similar fixes to support GCC 15 set -std=gnu11. This can be done in a dedicated commit if needed.
There was a conflict, because commit 2838307b019d ("x86/build: Remove -m16 workaround for unsupported versions of GCC") is not in this version and change code in the context. -std=gnu11 can still be added at the same place. ]
--- arch/x86/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Makefile +1 -1
@@ -31,7 +31,7 @@ endif CODE16GCC_CFLAGS := -m32 -Wa,$(srctree)/arch/x86/boot/code16gcc.h M16_CFLAGS := $(call cc-option, -m16, $(CODE16GCC_CFLAGS)) -REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ +REALMODE_CFLAGS := -std=gnu11 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
Greg Kroah-Hartman
maintainerPATCH 34/300 arch: back to -std=gnu89 in < v5.18
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
Recent fixes have been backported to < v5.18 to fix build issues with GCC 5.15. They all force -std=gnu11 in the CFLAGS, "because [the kernel] requests the gnu11 standard via '-std=' in the main Makefile".
This is true for >= 5.18 versions, but not before. This switch to -std=gnu11 has been done in commit e8c07082a810 ("Kbuild: move to -std=gnu11").
For a question of uniformity, force -std=gnu89, similar to what is done in the main Makefile.
Note: the fixes tags below refers to upstream commits, but this fix is only for kernels not having commit e8c07082a810 ("Kbuild: move to -std=gnu11").
--- arch/parisc/boot/compressed/Makefile | 2 +- arch/s390/Makefile | 2 +- arch/s390/purgatory/Makefile | 2 +- arch/x86/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 2 +- drivers/firmware/efi/libstub/Makefile | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-)
arch/parisc/boot/compressed/Makefile +1 -1
@@ -22,7 +22,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-reg ifndef CONFIG_64BIT KBUILD_CFLAGS += -mfast-indirect-calls endif -KBUILD_CFLAGS += -std=gnu11 +KBUILD_CFLAGS += -std=gnu89 OBJECTS += $(obj)/head.o $(obj)/real2.o $(obj)/firmware.o $(obj)/misc.o $(obj)/piggy.o
arch/s390/Makefile +1 -1
@@ -23,7 +23,7 @@ endif aflags_dwarf := -Wa,-gdwarf-2 KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__ KBUILD_AFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),$(aflags_dwarf)) -KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu11 +KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu89 KBUILD_CFLAGS_DECOMPRESSOR += -DDISABLE_BRANCH_PROFILING -D__NO_FORTIFY KBUILD_CFLAGS_DECOMPRESSOR += -fno-delete-null-pointer-checks -msoft-float KBUILD_CFLAGS_DECOMPRESSOR += -fno-asynchronous-unwind-tables
arch/s390/purgatory/Makefile +1 -1
@@ -20,7 +20,7 @@ GCOV_PROFILE := n UBSAN_SANITIZE := n KASAN_SANITIZE := n -KBUILD_CFLAGS := -std=gnu11 -fno-strict-aliasing -Wall -Wstrict-prototypes +KBUILD_CFLAGS := -std=gnu89 -fno-strict-aliasing -Wall -Wstrict-prototypes KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding KBUILD_CFLAGS += -c -MD -Os -m64 -msoft-float -fno-common
arch/x86/Makefile +1 -1
@@ -31,7 +31,7 @@ endif CODE16GCC_CFLAGS := -m32 -Wa,$(srctree)/arch/x86/boot/code16gcc.h M16_CFLAGS := $(call cc-option, -m16, $(CODE16GCC_CFLAGS)) -REALMODE_CFLAGS := -std=gnu11 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ +REALMODE_CFLAGS := -std=gnu89 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
arch/x86/boot/compressed/Makefile +1 -1
@@ -33,7 +33,7 @@ targets := vmlinux vmlinux.bin vmlinux.b # avoid errors with '-march=i386', and future flags may depend on the target to # be valid. KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS) -KBUILD_CFLAGS += -std=gnu11 +KBUILD_CFLAGS += -std=gnu89 KBUILD_CFLAGS += -fno-strict-aliasing -fPIE KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING cflags-$(CONFIG_X86_32) := -march=i386
drivers/firmware/efi/libstub/Makefile +1 -1
@@ -7,7 +7,7 @@ # cflags-$(CONFIG_X86_32) := -march=i386 cflags-$(CONFIG_X86_64) := -mcmodel=small -cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \ +cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu89 \ -fPIC -fno-strict-aliasing -mno-red-zone \ -mno-mmx -mno-sse -fshort-wchar \ -Wno-pointer-sign \
Greg Kroah-Hartman
maintainerPATCH 25/300 net: phy: dp83867: Disable EEE support as not implemented
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <[email protected]>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs.
--- drivers/net/phy/dp83867.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/phy/dp83867.c +6 -0
@@ -664,6 +664,12 @@ static int dp83867_config_init(struct phreturn ret; } +/* Although the DP83867 reports EEE capability through the +* MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature +* is not actually implemented in hardware. +*/ + phydev->eee_broken_modes =MDIO_EEE_100TX |MDIO_EEE_1000T ; +if (phy_interface_is_rgmii (phydev) || phydev->interface ==PHY_INTERFACE_MODE_SGMII ) { val =phy_read (phydev,MII_DP83867_PHYCTRL );
Greg Kroah-Hartman
maintainerPATCH 62/300 tools/power x86_energy_perf_policy: Enhance HWP enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -1077,13 +1077,18 @@ int update_hwp_request_pkg(int pkg)int enable_hwp_on_cpu (int cpu) { -unsigned long long msr; +unsigned long long old_msr, new_msr; + +get_msr (cpu,MSR_PM_ENABLE , &old_msr); + +if (old_msr &1 ) +return 0 ;/* already enabled */ -get_msr (cpu,MSR_PM_ENABLE , &msr); -put_msr (cpu,MSR_PM_ENABLE ,1 ); + new_msr = old_msr |1 ; +put_msr (cpu,MSR_PM_ENABLE , new_msr);if (verbose) -printf ("cpu%d: MSR_PM_ENABLE old: %d new: %d\n" , cpu, (unsigned int ) msr,1 ); +printf ("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n" , cpu, old_msr, new_msr);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/300 PCI: Disable MSI on RDC PCI to PCIe bridges
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Del Sol Vives <[email protected]>
[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do not support MSIs. If enabled, interrupts generated by PCIe devices never reach the processor.
I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs need to be disabled for them.
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -2554,6 +2554,7 @@ static void quirk_disable_msi(struct pci_dev *dev)DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_AMD ,PCI_DEVICE_ID_AMD_8131_BRIDGE , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_VIA ,0xa238 , quirk_disable_msi);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x5a3f , quirk_disable_msi); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_RDC ,0x1031 , quirk_disable_msi);/* * The APC bridge device in AMD 780 family northbridges has some random
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/300 selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
The __WORDSIZE macro, defined in the non-standard <bits/wordsize.h> header, is a GNU extension and not universally available with all toolchains, such as Clang when used with musl libc.
This can lead to build failures in environments where this header is missing.
The intention of the code is to determine the bit width of a C long. Replace the non-portable __WORDSIZE with the standard and portable sizeof(long) * 8 expression to achieve the same result.
This change also removes the inclusion of the now-unused <bits/wordsize.h> header.
--- tools/testing/selftests/net/psock_tpacket.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/net/psock_tpacket.c +1 -2
@@ -33,7 +33,6 @@#include <ctype.h> #include <fcntl.h> #include <unistd.h> -#include <bits/wordsize.h> #include <net/ethernet.h> #include <netinet/ip.h> #include <arpa/inet.h>
@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)static int test_user_bit_width (void ) { -return __WORDSIZE; +return sizeof (long ) *8 ; }static const char *tpacket_str[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/300 selftests/net: Ensure assert() triggers in psock_tpacket.c
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <[email protected]>
[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
The get_next_frame() function in psock_tpacket.c was missing a return statement in its default switch case, leading to a compiler warning.
This was caused by a bug_on(1) call, which is defined as an assert(), being compiled out because NDEBUG is defined during the build.
Instead of adding a return NULL; which would silently hide the error and could lead to crashes later, this change restores the original author's intent. By adding #undef NDEBUG before including <assert.h>, we ensure the assertion is active and will cause the test to abort if this unreachable code is ever executed.
--- tools/testing/selftests/net/psock_tpacket.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/psock_tpacket.c +1 -0
@@ -22,6 +22,7 @@* - TPACKET_V3: RX_RING */ +#undef NDEBUG#include <stdio.h> #include <stdlib.h> #include <sys/types.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/300 drm/amdkfd: return -ENOTTY for unsupported IOCTLs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey McRae <[email protected]>
[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
Some kfd ioctls may not be available depending on the kernel version the user is running, as such we need to report -ENOTTY so userland can determine the cause of the ioctl failure.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +6 -2
@@ -1887,8 +1887,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)unsigned int usize, asize;int retcode = -EINVAL ; -if (nr >=AMDKFD_CORE_IOCTL_COUNT ) +if (nr >=AMDKFD_CORE_IOCTL_COUNT ) { + retcode = -ENOTTY ; goto err_i1; + }if ((nr >=AMDKFD_COMMAND_START ) && (nr <AMDKFD_COMMAND_END )) {u32 amdkfd_size;
@@ -1901,8 +1903,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) asize = amdkfd_size; cmd = ioctl->cmd; - }else + }else { + retcode = -ENOTTY ; goto err_i1; + }dev_dbg (kfd_device,"ioctl cmd 0x%x (#0x%x), arg 0x%lx\n" , cmd, nr, arg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/300 media: pci: ivtv: Dont create fake v4l2_fh
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
The ivtv driver has a structure named ivtv_open_id that models an open file handle for the device. It embeds a v4l2_fh instance for file handles that correspond to a V4L2 video device, and stores a pointer to that v4l2_fh in struct ivtv_stream to identify which open file handle owns a particular stream.
In addition to video devices, streams can be owned by ALSA PCM devices. Those devices do not make use of the v4l2_fh instance for obvious reasons, but the snd_ivtv_pcm_capture_open() function still initializes a "fake" v4l2_fh for the sole purpose of using it as an open file handle identifier. The v4l2_fh is not properly destroyed when the ALSA PCM device is closed, leading to possible resource leaks.
Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not accessed, only the pointer value is used for comparison. Replace it with a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and don't initialize the v4l2_fh for ALSA PCM devices.
--- drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 -- drivers/media/pci/ivtv/ivtv-driver.h | 3 ++- drivers/media/pci/ivtv/ivtv-fileops.c | 18 +++++++++--------- drivers/media/pci/ivtv/ivtv-irq.c | 4 ++-- 4 files changed, 13 insertions(+), 14 deletions(-)
drivers/media/pci/ivtv/ivtv-alsa-pcm.c +0 -2
@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream) s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM ]; -v4l2_fh_init (&item.fh, &s->vdev); item.itv = itv; item.type = s->type;/* See if the stream is available */ if (ivtv_claim_stream (&item, item.type)) {/* No, it's already in use */ -v4l2_fh_exit (&item.fh);snd_ivtv_unlock (itvsc);return -EBUSY ; }
drivers/media/pci/ivtv/ivtv-driver.h +2 -1
@@ -324,6 +324,7 @@ struct ivtv_queue { };struct ivtv ;/* forward reference */ +struct ivtv_open_id ;struct ivtv_stream {/* These first four fields are always set, even if the stream
@@ -333,7 +334,7 @@ struct ivtv_stream {const char *name;/* name of the stream */ int type;/* stream type */ -struct v4l2_fh *fh;/* pointer to the streaming filehandle */ +struct ivtv_open_id *id;/* pointer to the streaming ivtv_open_id */ spinlock_t qlock;/* locks access to the queues */ unsigned long s_flags;/* status flags, see above */ int dma;/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
drivers/media/pci/ivtv/ivtv-fileops.c +9 -9
@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)if (test_and_set_bit (IVTV_F_S_CLAIMED , &s->s_flags)) {/* someone already claimed this stream */ -if (s->fh == &id->fh) { +if (s->id == id) {/* yes, this file descriptor did. So that's OK. */ return 0 ; } -if (s->fh ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || +if (s->id ==NULL && (type ==IVTV_DEC_STREAM_TYPE_VBI || type ==IVTV_ENC_STREAM_TYPE_VBI )) {/* VBI is handled already internally, now also assign the file descriptor to this stream for external reading of the stream. */ - s->fh = &id->fh; + s->id = id;IVTV_DEBUG_INFO ("Start Read VBI\n" );return 0 ; }
@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)IVTV_DEBUG_INFO ("Stream %d is busy\n" , type);return -EBUSY ; } - s->fh = &id->fh; + s->id = id;if (type ==IVTV_DEC_STREAM_TYPE_VBI ) {/* Enable reinsertion interrupt */ ivtv_clear_irq_mask (itv,IVTV_IRQ_DEC_VBI_RE_INSERT );
@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)struct ivtv *itv = s->itv;struct ivtv_stream *s_vbi; - s->fh =NULL ; + s->id =NULL ;if ((s->type ==IVTV_DEC_STREAM_TYPE_VBI || s->type ==IVTV_ENC_STREAM_TYPE_VBI ) &&test_bit (IVTV_F_S_INTERNAL_USE , &s->s_flags)) {/* this stream is still in use internally */
@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)/* was already cleared */ return ; } -if (s_vbi->fh) { +if (s_vbi->id) {/* VBI stream still claimed by a file descriptor */ return ; }
@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_cosize_t tot_written =0 ;int single_frame =0 ; -if (atomic_read (&itv->capturing) ==0 && s->fh ==NULL ) { +if (atomic_read (&itv->capturing) ==0 && s->id ==NULL ) {/* shouldn't happen */ IVTV_DEBUG_WARN ("Stream %s not initialized before read\n" , s->name);return -EIO ;
@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end) id->type == IVTV_ENC_STREAM_TYPE_VBI) && test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) { /* Also used internally, don't stop capturing */ - s->fh = NULL; + s->id = NULL; } else {ivtv_stop_v4l2_encode_stream (s, gop_end);
@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)v4l2_fh_exit (fh);/* Easy case first: this stream was never claimed by us */ -if (s->fh != &id->fh) +if (s->id != id) goto close_done;/* 'Unclaim' this stream */
drivers/media/pci/ivtv/ivtv-irq.c +2 -2
@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)ivtv_process_vbi_data (itv, buf,0 , s->type); s->q_dma.bytesused += buf->bytesused; } -if (s->fh ==NULL ) { +if (s->id ==NULL ) {ivtv_queue_move (s, &s->q_dma,NULL , &s->q_free,0 );return ; }
@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)set_bit (IVTV_F_I_HAVE_WORK , &itv->i_flags); } -if (s->fh) +if (s->id)wake_up (&s->waitq); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/300 drm/tidss: Use the crtc_* timings when programming the HW
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
Use the crtc_* fields from drm_display_mode, instead of the "logical" fields. This shouldn't change anything in practice, but afaiu the crtc_* fields are the correct ones to use here.
--- drivers/gpu/drm/tidss/tidss_crtc.c | 2 +- drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-)
drivers/gpu/drm/tidss/tidss_crtc.c +1 -1
@@ -226,7 +226,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,tidss_runtime_get (tidss); r =dispc_vp_set_clk_rate (tidss->dispc, tcrtc->hw_videoport, - mode->clock *1000 ); + mode->crtc_clock *1000 );if (r !=0 )return ;
drivers/gpu/drm/tidss/tidss_dispc.c +8 -8
@@ -978,13 +978,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,dispc_set_num_datalines (dispc, hw_videoport, fmt->data_width); - hfp = mode->hsync_start - mode->hdisplay; - hsw = mode->hsync_end - mode->hsync_start; - hbp = mode->htotal - mode->hsync_end; + hfp = mode->crtc_hsync_start - mode->crtc_hdisplay; + hsw = mode->crtc_hsync_end - mode->crtc_hsync_start; + hbp = mode->crtc_htotal - mode->crtc_hsync_end; - vfp = mode->vsync_start - mode->vdisplay; - vsw = mode->vsync_end - mode->vsync_start; - vbp = mode->vtotal - mode->vsync_end; + vfp = mode->crtc_vsync_start - mode->crtc_vdisplay; + vsw = mode->crtc_vsync_end - mode->crtc_vsync_start; + vbp = mode->crtc_vtotal - mode->crtc_vsync_end; dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H, FLD_VAL(hsw - 1, 7, 0) |
@@ -1026,8 +1026,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport, FLD_VAL(ivs, 12, 12));dispc_vp_write (dispc, hw_videoport,DISPC_VP_SIZE_SCREEN , -FLD_VAL (mode->hdisplay -1 ,11 ,0 ) | -FLD_VAL (mode->vdisplay -1 ,27 ,16 )); +FLD_VAL (mode->crtc_hdisplay -1 ,11 ,0 ) | +FLD_VAL (mode->crtc_vdisplay -1 ,27 ,16 ));VP_REG_FLD_MOD (dispc, hw_videoport,DISPC_VP_CONTROL ,1 ,0 ,0 ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/300 x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <[email protected]>
[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall page fault, but the CPU does not report X86_PF_INSTR if neither X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for early P4 processors that did not support this feature.
Instead of explicitly checking for X86_PF_INSTR, compare the fault address to RIP.
On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal to fault address but X86_PF_INSTR is absent.
[ dhansen: flesh out code comments ]
--- arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/x86/entry/vsyscall/vsyscall_64.c +14 -3
@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,if ((error_code & (X86_PF_WRITE |X86_PF_USER )) !=X86_PF_USER )return false; -if (!(error_code &X86_PF_INSTR )) { +/* +* Assume that faults at regs->ip are because of an +* instruction fetch. Return early and avoid +* emulation for faults during data accesses: +*/ +if (address != regs->ip) {/* Failed vsyscall read */ if (vsyscall_mode ==EMULATE )return false;
@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,return false; } +/* +* X86_PF_INSTR is only set when NX is supported. When +* available, use it to double-check that the emulation code +* is only being used for instruction fetches: +*/ +if (cpu_feature_enabled (X86_FEATURE_NX )) +WARN_ON_ONCE (!(error_code &X86_PF_INSTR )); +/* * No point in checking CS -- the only way to get here is a user mode * trap to a high address, which means that we're in 64-bit user code. */ -WARN_ON_ONCE (address != regs->ip); -if (vsyscall_mode ==NONE ) {warn_bad_vsyscall (KERN_INFO , regs,"vsyscall attempted with vsyscall=none" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/300 net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
stmmac_hw_setup() may return 0 on success and an appropriate negative integer as defined in errno.h file on failure, just check it and then return early if failed in stmmac_resume().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +8 -1
@@ -5415,7 +5415,14 @@ int stmmac_resume(struct device *dev)stmmac_free_tx_skbufs (priv);stmmac_clear_descriptors (priv); -stmmac_hw_setup (ndev, false); + ret =stmmac_hw_setup (ndev, false); +if (ret <0 ) { +netdev_err (priv->dev,"%s: Hw setup failed\n" , __func__); +mutex_unlock (&priv->lock); +rtnl_unlock (); +return ret; + } +stmmac_init_coalesce (priv);stmmac_set_rx_mode (ndev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/300 powerpc/eeh: Use result of error_detected() in uevent
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <[email protected]>
[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
Ever since uevent support was added for AER and EEH with commit 856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for udev") subsequently amended AER to report the actual return value of error_detected().
Make the same change to EEH to align it with AER and s390.
--- arch/powerpc/kernel/eeh_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/eeh_driver.c +1 -1
@@ -335,7 +335,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev, rc = driver->err_handler->error_detected (pdev, pci_channel_io_frozen); edev->in_error = true; -pci_uevent_ers (pdev,PCI_ERS_RESULT_NONE ); +pci_uevent_ers (pdev, rc);return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/300 bridge: Redirect to backup port when port is administratively down
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
If a backup port is configured for a bridge port, the bridge will redirect known unicast traffic towards the backup port when the primary port is administratively up but without a carrier. This is useful, for example, in MLAG configurations where a system is connected to two switches and there is a peer link between both switches. The peer link serves as the backup port in case one of the switches loses its connection to the multi-homed system.
In order to avoid flooding when the primary port loses its carrier, the bridge does not flush dynamic FDB entries pointing to the port upon STP disablement, if the port has a backup port.
The above means that known unicast traffic destined to the primary port will be blackholed when the port is put administratively down, until the FDB entries pointing to it are aged-out.
Given that the current behavior is quite weird and unlikely to be depended on by anyone, amend the bridge to redirect to the backup port also when the primary port is administratively down and not only when it does not have a carrier.
The change is motivated by a report from a user who expected traffic to be redirected to the backup port when the primary port was put administratively down while debugging a network issue.
--- net/bridge/br_forward.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/bridge/br_forward.c +2 -1
@@ -142,7 +142,8 @@ void br_forward(const struct net_bridge_port *to, goto out;/* redirect to backup link if the destination port is down */ -if (rcu_access_pointer (to->backup_port) && !netif_carrier_ok (to->dev)) { +if (rcu_access_pointer (to->backup_port) && + (!netif_carrier_ok (to->dev) || !netif_running (to->dev))) {struct net_bridge_port *backup_port; backup_port =rcu_dereference (to->backup_port);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/300 tools/power x86_energy_perf_policy: Prefer driver HWP limits
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO.
--- .../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +9 -4
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;unsigned char update_hwp_epp;unsigned char update_hwp_min;unsigned char update_hwp_max; +unsigned char hwp_limits_done_via_sysfs;unsigned char update_hwp_desired;unsigned char update_hwp_window;unsigned char update_hwp_use_pkg;
@@ -862,8 +863,10 @@ int ratio_2_sysfs_khz(int ratio) }/* * If HWP is enabled and cpufreq sysfs attribtes are present, -* then update sysfs, so that it will not become -* stale when we write to MSRs. +* then update via sysfs. The intel_pstate driver may modify (clip) +* this request, say, when HWP_CAP is outside of PLATFORM_INFO limits, +* and the driver-chosen value takes precidence. +* * (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq, * so we don't have to touch that.) */
@@ -918,6 +921,8 @@ int update_sysfs(int cpu)if (update_hwp_max)update_cpufreq_scaling_freq (1 , cpu, req_update.hwp_max); + hwp_limits_done_via_sysfs =1 ; +return 0 ; }
@@ -996,10 +1001,10 @@ int update_hwp_request(int cpu)if (debug)print_hwp_request (cpu, &req,"old: " ); -if (update_hwp_min) +if (update_hwp_min && !hwp_limits_done_via_sysfs) req.hwp_min = req_update.hwp_min; -if (update_hwp_max) +if (update_hwp_max && !hwp_limits_done_via_sysfs) req.hwp_max = req_update.hwp_max;if (update_hwp_desired)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/300 net: ipv6: fix field-spanning memcpy warning in AH output
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <[email protected]>
[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
Fix field-spanning memcpy warnings in ah6_output() and ah6_output_done() where extension headers are copied to/from IPv6 address fields, triggering fortify-string warnings about writes beyond the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are intentionally placed after the IPv6 header in memory. Fix by properly copying addresses and extension headers separately, and introduce helper functions to avoid code duplication.
--- net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-)
net/ipv6/ah6.c +31 -19
@@ -46,6 +46,34 @@ struct ah_skb_cb {#define AH_SKB_CB (__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) +/* Helper to save IPv6 addresses and extension headers to temporary storage */ +static inline void ah6_save_hdrs (struct tmp_ext *iph_ext, +struct ipv6hdr *top_iph,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + iph_ext->saddr = top_iph->saddr; +#endif + iph_ext->daddr = top_iph->daddr; +memcpy (&iph_ext->hdrs, top_iph +1 , extlen -sizeof (*iph_ext)); +} + +/* Helper to restore IPv6 addresses and extension headers from temporary storage */ +static inline void ah6_restore_hdrs (struct ipv6hdr *top_iph, +struct tmp_ext *iph_ext,int extlen) +{ +if (!extlen) +return ; + +#if IS_ENABLED (CONFIG_IPV6_MIP6 ) + top_iph->saddr = iph_ext->saddr; +#endif + top_iph->daddr = iph_ext->daddr; +memcpy (top_iph +1 , &iph_ext->hdrs, extlen -sizeof (*iph_ext)); +} +static void *ah_alloc_tmp (struct crypto_ahash *ahash,int nfrags,unsigned int size) {
@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen);kfree (AH_SKB_CB (skb)->tmp);xfrm_output_resume (skb->sk, skb, err);
@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)*/ memcpy (iph_base, top_iph,IPV6HDR_BASELEN ); +ah6_save_hdrs (iph_ext, top_iph, extlen);if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (iph_ext, &top_iph->saddr, extlen); -#else -memcpy (iph_ext, &top_iph->daddr, extlen); -#endif err = ipv6_clear_mutable_options(top_iph, extlen - sizeof(*iph_ext) + sizeof(*top_iph),
@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)memcpy (ah->auth_data, icv, ahp->icv_trunc_len);memcpy (top_iph, iph_base,IPV6HDR_BASELEN ); -if (extlen) { -#if IS_ENABLED (CONFIG_IPV6_MIP6 ) -memcpy (&top_iph->saddr, iph_ext, extlen); -#else -memcpy (&top_iph->daddr, iph_ext, extlen); -#endif - } +ah6_restore_hdrs (top_iph, iph_ext, extlen); out_free:kfree (iph_base);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/300 media: imon: make send_packet() more robust
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1].
First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls).
Alan Stern commented [2] that
In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away.
but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed.
Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb).
Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task).
Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds.
--- drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 24 deletions(-)
drivers/media/rc/imon.c +37 -24
@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)smp_rmb ();/* ensure later readers know we're not busy */ pr_err_ratelimited ("error submitting urb(%d)\n" , retval); }else { -/* Wait for transmission to complete (or abort) */ - retval =wait_for_completion_interruptible ( - &ictx->tx.finished); -if (retval) { +/* Wait for transmission to complete (or abort or timeout) */ + retval =wait_for_completion_interruptible_timeout (&ictx->tx.finished,10 *HZ ); +if (retval <=0 ) {usb_kill_urb (ictx->tx_urb);pr_err_ratelimited ("task interrupted\n" ); +if (retval <0 ) + ictx->tx.status = retval; +else + ictx->tx.status = -ETIMEDOUT ; } ictx->tx.busy = false;
@@ -1759,14 +1762,6 @@ static void usb_rx_callback_intf0(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf0) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1775,16 +1770,29 @@ static void usb_rx_callback_intf0(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf0) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf0,GFP_ATOMIC ); }
@@ -1800,14 +1808,6 @@ static void usb_rx_callback_intf1(struct urb *urb)if (!ictx)return ; -/* -* if we get a callback before we're done configuring the hardware, we -* can't yet process the data, as there's nowhere to send it, but we -* still need to submit a new rx URB to avoid wedging the hardware -*/ -if (!ictx->dev_present_intf1) - goto out; -switch (urb->status) {case -ENOENT :/* usbcore unlink successful! */ return ;
@@ -1816,16 +1816,29 @@ static void usb_rx_callback_intf1(struct urb *urb)break ;case 0 : -imon_incoming_packet (ictx, urb, intfnum); +/* +* if we get a callback before we're done configuring the hardware, we +* can't yet process the data, as there's nowhere to send it, but we +* still need to submit a new rx URB to avoid wedging the hardware +*/ +if (ictx->dev_present_intf1) +imon_incoming_packet (ictx, urb, intfnum);break ; +case -ECONNRESET : +case -EILSEQ : +case -EPROTO : +case -EPIPE : +dev_warn (ictx->dev,"imon %s: status(%d)\n" , + __func__, urb->status); +return ; +default :dev_warn (ictx->dev,"imon %s: status(%d): ignored\n" , __func__, urb->status);break ; } -out:usb_submit_urb (ictx->rx_urb_intf1,GFP_ATOMIC ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/300 drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
Detecting the monitor for DisplayPort targets is more complicated than just reading the HPD pin level: it requires reading the DPCD in order to check what kind of device is attached to the port and whether there is an actual display attached.
In order to let DRM framework handle such configurations, disable DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so it is valid for the bridge to report HPD events.
Currently inside the kernel there are only two targets which list hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and arm64/qcom/sa8295p-adp. Both should be fine with this change.
--- drivers/gpu/drm/bridge/display-connector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/display-connector.c +2 -1
@@ -229,7 +229,8 @@ static int display_connector_probe(struct platform_device *pdev)if (conn->bridge.ddc) conn->bridge.ops |=DRM_BRIDGE_OP_EDID |DRM_BRIDGE_OP_DETECT ; -if (conn->hpd_gpio) +/* Detecting the monitor requires reading DPCD */ +if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort) conn->bridge.ops |=DRM_BRIDGE_OP_DETECT ;if (conn->hpd_irq >=0 ) conn->bridge.ops |=DRM_BRIDGE_OP_HPD ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/300 iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <[email protected]>
[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
avg sample info is a bit field coded inside the following
bits: 5,6,7 and 8 of a device status register.
Channel num info the same, but over bits: 1, 2 and 3.
Mask both values in order to avoid touching other register bits, since the first info (avg sample), came from DT.
--- drivers/iio/adc/spear_adc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/iio/adc/spear_adc.c +5 -4
@@ -12,6 +12,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/io.h> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/err.h> #include <linux/completion.h>
@@ -29,9 +30,9 @@/* Bit definitions for SPEAR_ADC_STATUS */ #define SPEAR_ADC_STATUS_START_CONVERSION BIT(0) -#define SPEAR_ADC_STATUS_CHANNEL_NUM (x) ((x) << 1) +#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1)#define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4) -#define SPEAR_ADC_STATUS_AVG_SAMPLE (x) ((x) << 5) +#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5)#define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9)#define SPEAR_ADC_DATA_MASK 0x03ff
@@ -148,8 +149,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,case IIO_CHAN_INFO_RAW :mutex_lock (&indio_dev->mlock); - status =SPEAR_ADC_STATUS_CHANNEL_NUM (chan->channel) | -SPEAR_ADC_STATUS_AVG_SAMPLE (st->avg_samples) | + status =FIELD_PREP (SPEAR_ADC_STATUS_CHANNEL_NUM_MASK , chan->channel) | +FIELD_PREP (SPEAR_ADC_STATUS_AVG_SAMPLE_MASK , st->avg_samples) |SPEAR_ADC_STATUS_START_CONVERSION |SPEAR_ADC_STATUS_ADC_ENABLE ;if (st->vref_external ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/300 usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: raub camaioni <[email protected]>
[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
This fix is already present in f_ecm.c and was never propagated to f_ncm.c
When creating multiple NCM ethernet devices
on a composite usb gadget device
each MAC address on the HOST side will be identical. Having the same MAC on different network interfaces is bad.
This fix updates the MAC address inside the ncm_strings_defs global during the ncm_bind call. This ensures each device has a unique MAC.
In f_ecm.c ecm_string_defs is updated in the same way.
The defunct MAC assignment in ncm_alloc has been removed.
--- drivers/usb/gadget/function/f_ncm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +2 -1
@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) ncm_opts->bound = true; + ncm_string_defs[1 ].s = ncm->ethaddr; + us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs));if (IS_ERR (us)) {
@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)mutex_unlock (&opts->lock);return ERR_PTR (-EINVAL ); } - ncm_string_defs[STRING_MAC_IDX ].s = ncm->ethaddr;spin_lock_init (&ncm->lock);ncm_reset_values (ncm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/300 char: misc: Does not request module for miscdevice with dynamic minor
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
misc_open() may request module for miscdevice with dynamic minor, which is meaningless since:
- The dynamic minor allocated is unknown in advance without registering miscdevice firstly.
- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
Fix by only requesting module for miscdevice with fixed minor.
--- drivers/char/misc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/char/misc.c +5 -3
@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file) } } -if (!new_fops) { +/* Only request module for fixed minor code */ +if (!new_fops && minor <MISC_DYNAMIC_MINOR ) {mutex_unlock (&misc_mtx);request_module ("char-major-%d-%d" ,MISC_MAJOR , minor);mutex_lock (&misc_mtx);
@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)break ; } } -if (!new_fops) - goto fail; } +if (!new_fops) + goto fail; +/* * Place the miscdevice in the file's * private_data so it can be used by the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/300 net: When removing nexthops, dont call synchronize_net if it is not necessary
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <[email protected]>
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit90f33bffa382 ("nexthops: don't modify published nexthop groups") added a call to synchronize_rcu() (later changed to _net()) to make sure everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is fastest to first flush the groups (ip nexthop flush groups) and then flush the nexthops themselves (ip -6 nexthop flush). As that way the groups don't need to be rebalanced.
However, ip -6 nexthop flush will still take a long time if there is a very large number of nexthops because of the call to synchronize_net(). Now, if there are no more groups, there is no point in calling synchronize_net(). So, let's skip that entirely by checking if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
--- net/ipv4/nexthop.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv4/nexthop.c +6 -0
@@ -843,6 +843,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh, {struct nh_grp_entry *nhge, *tmp; +/* If there is nothing to do, let's avoid the costly call to +* synchronize_net() +*/ +if (list_empty (&nh->grp_list)) +return ; +list_for_each_entry_safe (nhge, tmp, &nh->grp_list, nh_list)remove_nh_grp_entry (net, nhge, nlinfo);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/300 net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
Initially, trace_sock_exceed_buf_limit() was invoked when __sk_mem_raise_allocated() failed due to the memcg limit or the global limit.
However, commit d6f19938eb031 ("net: expose sk wmem in sock_exceed_buf_limit tracepoint") somehow suppressed the event only when memcg failed to charge for SK_MEM_RECV, although the memcg failure for SK_MEM_SEND still triggers the event.
Let's restore the event for SK_MEM_RECV.
--- net/core/sock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/core/sock.c +1 -2
@@ -2695,8 +2695,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)return 1 ; } -if (kind ==SK_MEM_SEND || (kind ==SK_MEM_RECV && charged)) -trace_sock_exceed_buf_limit (sk, prot, allocated, kind); +trace_sock_exceed_buf_limit (sk, prot, allocated, kind);sk_memory_allocated_sub (sk, amt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/300 PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungho Kim <[email protected]>
[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
The error handling path in pci_p2pdma_add_resource() contains a bug in its pgmap_free label.
Memory is allocated for the p2p_pgmap struct, and the pointer is stored in p2p_pgmap. However, the error path calls devm_kfree() with pgmap, which is a pointer to a member field within the p2p_pgmap struct, not the base pointer of the allocation.
Correct the bug by passing the correct base pointer, p2p_pgmap, to devm_kfree().
--- drivers/pci/p2pdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/p2pdma.c +1 -1
@@ -215,7 +215,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, pages_free:devm_memunmap_pages (&pdev->dev, pgmap); pgmap_free: -devm_kfree (&pdev->dev, pgmap); +devm_kfree (&pdev->dev, p2p_pgmap);return error; }EXPORT_SYMBOL_GPL (pci_p2pdma_add_resource);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/300 ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
Just add fixed struct size validations for UAC2 and UAC3 effect units. The descriptor has a variable-length array, so it should be validated with a proper function later once when the unit is really parsed and used by the driver (currently only referred partially for the input terminal parsing).
--- sound/usb/validate.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/usb/validate.c +7 -2
@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {FUNC (UAC_VERSION_2 ,UAC_MIXER_UNIT , validate_mixer_unit),FUNC (UAC_VERSION_2 ,UAC_SELECTOR_UNIT , validate_selector_unit),FUNC (UAC_VERSION_2 ,UAC_FEATURE_UNIT , validate_uac2_feature_unit), -/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */ +/* just a stop-gap, it should be a proper function for the array +* once if the unit is really parsed/used +*/ +FIXED (UAC_VERSION_2 ,UAC2_EFFECT_UNIT , + struct uac2_effect_unit_descriptor),FUNC (UAC_VERSION_2 ,UAC2_PROCESSING_UNIT_V2 , validate_processing_unit),FUNC (UAC_VERSION_2 ,UAC2_EXTENSION_UNIT_V2 , validate_processing_unit), FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {FUNC (UAC_VERSION_3 ,UAC3_MIXER_UNIT , validate_mixer_unit),FUNC (UAC_VERSION_3 ,UAC3_SELECTOR_UNIT , validate_selector_unit),FUNC (UAC_VERSION_3 ,UAC3_FEATURE_UNIT , validate_uac3_feature_unit), -/* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ +FIXED (UAC_VERSION_3 ,UAC3_EFFECT_UNIT , + struct uac2_effect_unit_descriptor), /* sharing the same struct */FUNC (UAC_VERSION_3 ,UAC3_PROCESSING_UNIT , validate_processing_unit),FUNC (UAC_VERSION_3 ,UAC3_EXTENSION_UNIT , validate_processing_unit), FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/300 mfd: stmpe: Remove IRQ domain upon removal
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove.
--- drivers/mfd/stmpe.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/stmpe.c +3 -0
@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)int stmpe_remove (struct stmpe *stmpe) { +if (stmpe->domain) +irq_domain_remove (stmpe->domain); +if (!IS_ERR (stmpe->vio) &®ulator_is_enabled (stmpe->vio))regulator_disable (stmpe->vio);if (!IS_ERR (stmpe->vcc) &®ulator_is_enabled (stmpe->vcc))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/300 rds: Fix endianness annotation for RDS_MPATH_HASH
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ujwal Kundur <[email protected]>
[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
jhash_1word accepts host endian inputs while rs_bound_port is a be16 value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
Flagged by Sparse.
--- net/rds/rds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/rds.h +1 -1
@@ -93,7 +93,7 @@ enum {/* Max number of multipaths per RDS connection. Must be a power of 2 */ #define RDS_MPATH_WORKERS 8 -#define RDS_MPATH_HASH (rs, n) (jhash_1word((rs)->rs_bound_port, \ +#define RDS_MPATH_HASH (rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \ (rs)->rs_hash_initval) & ((n) - 1))#define IS_CANONICAL (laddr, faddr) (htonl(laddr) < htonl(faddr))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/300 scsi: pm80xx: Fix race condition caused by static variables
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francisco Gutierrez <[email protected]>
[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
Eliminate the use of static variables within the log pull implementation to resolve a race condition and prevent data gaps when pulling logs from multiple controllers in parallel, ensuring each operation is properly isolated.
--- drivers/scsi/pm8001/pm8001_ctl.c | 22 ++++++++++++---------- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.h | 4 ++++ 3 files changed, 17 insertions(+), 10 deletions(-)
drivers/scsi/pm8001/pm8001_ctl.c +12 -10
@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,char *str = buf;u32 read_size = pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size /1024 ; -static u32 start, end, count;u32 max_read_times =32 ;u32 max_count = (read_size *1024 ) / (max_read_times *4 );u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP ].virt_ptr; -if ((count % max_count) ==0 ) { - start =0 ; - end = max_read_times; - count =0 ; +mutex_lock (&pm8001_ha->iop_log_lock); + +if ((pm8001_ha->iop_log_count % max_count) ==0 ) { + pm8001_ha->iop_log_start =0 ; + pm8001_ha->iop_log_end = max_read_times; + pm8001_ha->iop_log_count =0 ; }else { - start = end; - end = end + max_read_times; + pm8001_ha->iop_log_start = pm8001_ha->iop_log_end; + pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times; } -for (; start < end; start++) - str +=sprintf (str,"%08x " , *(temp+start)); - count++; +for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++) + str +=sprintf (str,"%08x " , *(temp+pm8001_ha->iop_log_start)); + pm8001_ha->iop_log_count++; +mutex_unlock (&pm8001_ha->iop_log_lock);return str - buf; } static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
drivers/scsi/pm8001/pm8001_init.c +1 -0
@@ -505,6 +505,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev, pm8001_ha->id = pm8001_id++; pm8001_ha->logging_level = logging_level; pm8001_ha->non_fatal_count =0 ; +mutex_init (&pm8001_ha->iop_log_lock);if (link_rate >=1 && link_rate <=15 ) pm8001_ha->link_rate = (link_rate <<8 );else {
drivers/scsi/pm8001/pm8001_sas.h +4 -0
@@ -540,6 +540,10 @@ struct pm8001_hba_info {u32 ci_offset;u32 pi_offset;u32 max_memcnt; +u32 iop_log_start; +u32 iop_log_end; +u32 iop_log_count; +struct mutex iop_log_lock; };struct pm8001_work {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/300 extcon: adc-jack: Fix wakeup source leaks on device unbind
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
Device can be unbound, so driver must also release memory for the wakeup source. Do not use devm interface, because it would change the order of cleanup.
--- drivers/extcon/extcon-adc-jack.c | 1 + 1 file changed, 1 insertion(+)
drivers/extcon/extcon-adc-jack.c +1 -0
@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev) {struct adc_jack_data *data =platform_get_drvdata (pdev); +device_init_wakeup (&pdev->dev, false);free_irq (data->irq, data);cancel_work_sync (&data->handler.work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/300 drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <[email protected]>
[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
When KFD asks CP to preempt queues, other than preempt CP queues, CP also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout. Currently queue_preemption_timeout_ms is 9000 ms by default but can be configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as 4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to queue_preemption_timeout_ms so in a slow system such as emulator, both CP and SDMA slowness are taken into account.
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +8 -1
@@ -108,7 +108,14 @@#define KFD_KERNEL_QUEUE_SIZE 2048 -#define KFD_UNMAP_LATENCY_MS (4000) +/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC +* can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time +* driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is +* queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload +* The format here makes CP workload 10% of total timeout +*/ +#define KFD_UNMAP_LATENCY_MS \ + ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)/* * 512 = 0x200
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/300 media: fix uninitialized symbol warnings
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <[email protected]>
[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
Initialize variables to fix these smatch warnings drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'protocol'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'scancode'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'toggle'.drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized symbol 'snr'.drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized symbol 'totalgain'.
--- drivers/media/i2c/ir-kbd-i2c.c | 6 +++--- drivers/media/tuners/xc4000.c | 8 ++++---- drivers/media/tuners/xc5000.c | 12 ++++++------ 3 files changed, 13 insertions(+), 13 deletions(-)
drivers/media/i2c/ir-kbd-i2c.c +3 -3
@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,static int ir_key_poll (struct IR_i2c *ir) { -enum rc_proto protocol; -u32 scancode; -u8 toggle; +enum rc_proto protocol =0 ; +u32 scancode =0 ; +u8 toggle =0 ;int rc;dev_dbg (&ir->rc->dev,"%s\n" , __func__);
drivers/media/tuners/xc4000.c +4 -4
@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,static void xc_debug_dump (struct xc4000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; +u16 frame_lines =0 ; +u16 quality =0 ;u16 signal =0 ;u16 noise =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;
drivers/media/tuners/xc5000.c +6 -6
@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,static void xc_debug_dump (struct xc5000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; -u16 snr; -u16 totalgain; +u16 frame_lines =0 ; +u16 quality =0 ; +u16 snr =0 ; +u16 totalgain =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;u8 fw_majorversion =0 , fw_minorversion =0 ;u16 fw_buildversion =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/300 mfd: stmpe-i2c: Add missing MODULE_LICENSE
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
--- drivers/mfd/stmpe-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/stmpe-i2c.c +1 -0
@@ -139,3 +139,4 @@ module_exit(stmpe_exit);MODULE_LICENSE ("GPL v2" );MODULE_DESCRIPTION ("STMPE MFD I2C Interface Driver" );MODULE_AUTHOR ("Rabin Vincent <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/300 mfd: madera: Work around false-positive -Wininitialized warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
clang-21 warns about one uninitialized variable getting dereferenced in madera_dev_init:
drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
739 | mfd_devs, n_devs,
| ^~~~~~~~
drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
459 | const struct mfd_cell *mfd_devs;
| ^
| = NULLThe code is actually correct here because n_devs is only nonzero when mfd_devs is a valid pointer, but this is impossible for the compiler to see reliably.
Change the logic to check for the pointer as well, to make this easier for the compiler to follow.
--- drivers/mfd/madera-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/madera-core.c +2 -2
@@ -436,7 +436,7 @@ int madera_dev_init(struct madera *madera)struct device *dev = madera->dev;unsigned int hwid;int (*patch_fn)(struct madera *) =NULL ; -const struct mfd_cell *mfd_devs; +const struct mfd_cell *mfd_devs =NULL ;int n_devs =0 ;int i, ret;
@@ -642,7 +642,7 @@ int madera_dev_init(struct madera *madera) goto err_reset; } -if (!n_devs) { +if (!n_devs || !mfd_devs) {dev_err (madera->dev,"Device ID 0x%x not a %s\n" , hwid, madera->type_name); ret = -ENODEV ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/300 mfd: da9063: Split chip variant reading in two bus transactions
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Kehne <[email protected]>
[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
We observed the initial probe of the da9063 failing in da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based board. The problem originates in da9063_i2c_blockreg_read, which uses a single bus transaction to turn the register page and then read a register. On the bus, this should translate to a write to register 0, followed by a read to the target register, separated by a repeated start. However, we found that after the write to register 0, the controller sometimes continues directly with the register address of the read request, without sending the chip address or a repeated start in between, which makes the read request invalid.
To fix this, separate turning the page and reading the register into two separate transactions. This brings the initialization code in line with the rest of the driver, which uses register maps (which to my knowledge do not use repeated starts after turning the page). This has been included in our kernel for several months and was recently included in a shipped product. For us, it reliably fixes the issue, and we have not observed any new issues.
While the underlying problem is probably with the i2c controller or its driver, I still propose a change here in the interest of
robustness: First, I'm not sure this issue can be fixed on the controller side, since there are other issues related to repeated start which can't (AR# 60695, AR# 61664). Second, similar problems might exist with other controllers.
--- drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/mfd/da9063-i2c.c +21 -6
@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt { DA9063_PAGE_SEL_BUF_SIZE, }; +enum da9063_page_sel_msgs { +DA9063_PAGE_SEL_MSG =0 , +DA9063_PAGE_SEL_CNT , +}; +enum da9063_paged_read_msgs { -DA9063_PAGED_READ_MSG_PAGE_SEL =0 , -DA9063_PAGED_READ_MSG_REG_SEL , +DA9063_PAGED_READ_MSG_REG_SEL =0 ,DA9063_PAGED_READ_MSG_DATA ,DA9063_PAGED_READ_MSG_CNT , };
@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr, (page_num <<DA9063_I2C_PAGE_SEL_SHIFT ) &DA9063_REG_PAGE_MASK ;/* Write reg address, page selection */ - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].addr = client->addr; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].flags =0 ; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].len =DA9063_PAGE_SEL_BUF_SIZE ; - xfer[DA9063_PAGED_READ_MSG_PAGE_SEL ].buf = page_sel_buf; + xfer[DA9063_PAGE_SEL_MSG ].addr = client->addr; + xfer[DA9063_PAGE_SEL_MSG ].flags =0 ; + xfer[DA9063_PAGE_SEL_MSG ].len =DA9063_PAGE_SEL_BUF_SIZE ; + xfer[DA9063_PAGE_SEL_MSG ].buf = page_sel_buf; + + ret =i2c_transfer (client->adapter, xfer,DA9063_PAGE_SEL_CNT ); +if (ret <0 ) { +dev_err (&client->dev,"Page switch failed: %d\n" , ret); +return ret; + } + +if (ret !=DA9063_PAGE_SEL_CNT ) { +dev_err (&client->dev,"Page switch failed to complete\n" ); +return -EIO ; + }/* Select register address */ xfer[DA9063_PAGED_READ_MSG_REG_SEL ].addr = client->addr;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/300 drm/amd/pm: Use cached metrics data on arcturus
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
Cached metrics data validity is 1ms on arcturus. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +1 -1
@@ -2276,7 +2276,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu, ret =smu_cmn_get_metrics_table (smu, &metrics, - true); + false);if (ret)return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/300 drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <[email protected]>
[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
Acquire jpeg_pg_lock before changes to jpeg power state and release it after power off from idle work handler.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c +4 -2
@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work) fences +=amdgpu_fence_count_emitted (&adev->jpeg.inst[i].ring_dec); } -if (!fences && !atomic_read (&adev->jpeg.total_submission_cnt)) +if (!fences && !atomic_read (&adev->jpeg.total_submission_cnt)) { +mutex_lock (&adev->jpeg.jpeg_pg_lock);amdgpu_device_ip_set_powergating_state (adev,AMD_IP_BLOCK_TYPE_JPEG ,AMD_PG_STATE_GATE ); -else +mutex_unlock (&adev->jpeg.jpeg_pg_lock); + }else schedule_delayed_work (&adev->jpeg.idle_work,JPEG_IDLE_TIMEOUT ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/300 drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <[email protected]>
[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
snprintf() returns the number of characters that *would* have been written, which can overestimate how much you actually wrote to the buffer in case of truncation. That leads to 'data += this' advancing the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures consistent behavior when building the output string.
--- drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/core/enum.c +1 -1
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)bool space = false;while (size >=1 && bf->name) {if (value & bf->mask) { -int this =snprintf (data, size,"%s%s" , +int this =scnprintf (data, size,"%s%s" , space ?" " :"" , bf->name); size -= this; data += this;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/300 tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
The fopen_or_die() function was previously hardcoded to open files in read-only mode ("r"), ignoring the mode parameter passed to it. This patch corrects fopen_or_die() to use the provided mode argument, allowing for flexible file access as intended.
Additionally, the call to fopen_or_die() inerr_on_hypervisor() incorrectly used the mode
"ro", which is not a valid fopen mode. This is
fixed to use the correct "r" mode.
--- .../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c +2 -2
@@ -627,7 +627,7 @@ void cmdline(int argc, char **argv)*/ FILE *fopen_or_die (const char *path,const char *mode) { -FILE *filep =fopen (path,"r" ); +FILE *filep =fopen (path, mode);if (!filep)err (1 ,"%s: open failed" , path);
@@ -641,7 +641,7 @@ void err_on_hypervisor(void)char *buffer;/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */ - cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"ro" ); + cpuinfo =fopen_or_die ("/proc/cpuinfo" ,"r" ); buffer =malloc (4096 );if (!buffer) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/300 mips: lantiq: danube: add missing device_type in pci node
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +2 -0
@@ -105,6 +105,8 @@ 0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */ reg = <0x7000000 0x8000 /* config space */ 0xe105400 0x400>; /* pci bridge */ + + device_type = "pci"; }; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/300 net: call cond_resched() less often in __release_sock()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
While stress testing TCP I had unexpected retransmits and sack packets when a single cpu receives data from multiple high-throughput flows.
super_netperf 4 -H srv -T,10 -l 3000 &
Tcpdump extract:
00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
After analysis, it appears this is because of the cond_resched() call from __release_sock().
When current thread is yielding, while still holding the TCP socket lock, it might regain the cpu after a very long time.
Other peer TLP/RTO is firing (multiple times) and packets are retransmit, while the initial copy is waiting in the socket backlog or receive queue.
In this patch, I call cond_resched() only once every 16 packets.
Modern TCP stack now spends less time per packet in the backlog, especially because ACK are no longer sent (commit 133c4c0d3717 "tcp: defer regular ACK while processing socket backlog")
Before:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19046186 0.0 TcpRetransSegs 1471 0.0 TcpExtTCPTimeouts 1397 0.0 TcpExtTCPLossProbes 1356 0.0 TcpExtTCPDSACKRecv 1352 0.0 TcpExtTCPSpuriousRTOs 114 0.0 TcpExtTCPDSACKRecvSegs 1352 0.0
After:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19218936 0.0
--- net/core/sock.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/core/sock.c +8 -4
@@ -2561,23 +2561,27 @@ void __release_sock(struct sock *sk) __acquires(&sk->sk_lock.slock) {struct sk_buff *skb, *next; +int nb =0 ;while ((skb = sk->sk_backlog.head) !=NULL ) { sk->sk_backlog.head = sk->sk_backlog.tail =NULL ;spin_unlock_bh (&sk->sk_lock.slock); -do { +while (1 ) { next = skb->next;prefetch (next);WARN_ON_ONCE (skb_dst_is_noref (skb));skb_mark_not_on_list (skb);sk_backlog_rcv (sk, skb); -cond_resched (); - skb = next; - }while (skb !=NULL ); +if (!skb) +break ; + +if (!(++nb &15 )) +cond_resched (); + }spin_lock_bh (&sk->sk_lock.slock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/300 iommu/amd: Skip enabling command/event buffers for kdump
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled.
IOMMU command buffers and event buffer registers remain locked and exclusive to the previous kernel. Attempts to enable command and event buffers in the kdump kernel will fail, as hardware ignores writes to the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
Skip enabling command buffers and event buffers for kdump boot as they are already enabled in the previous kernel.
--- drivers/iommu/amd/init.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/iommu/amd/init.c +19 -9
@@ -697,11 +697,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)BUG_ON (iommu->cmd_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->cmd_buf); - entry |=MMIO_CMD_SIZE_512 ; - -memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Command buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->cmd_buf); + entry |=MMIO_CMD_SIZE_512 ; +memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , + &entry,sizeof (entry)); + }amd_iommu_reset_cmd_buffer (iommu); }
@@ -750,10 +755,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)BUG_ON (iommu->evt_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; - -memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Event buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; +memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , + &entry,sizeof (entry)); + }/* set head and tail to zero manually */ writel (0x00 , iommu->mmio_base +MMIO_EVT_HEAD_OFFSET );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/300 usb: gadget: f_hid: Fix zero length packet transfer
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
Set the hid req->zero flag of ep0/in_ep to true by default, then the UDC drivers can transfer a zero length packet at the end if the hid transfer with size divisible to EPs max packet size according to the USB 2.0 spec.
--- drivers/usb/gadget/function/f_hid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_hid.c +2 -2
@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, } req->status =0 ; - req->zero =0 ; + req->zero =1 ; req->length = count; req->complete = f_hidg_req_complete; req->context = hidg;
@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,return -EOPNOTSUPP ; respond: - req->zero =0 ; + req->zero =1 ; req->length = length; status =usb_ep_queue (cdev->gadget->ep0, req,GFP_ATOMIC );if (status <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/300 net: phy: marvell: Fix 88e1510 downshift counter errata
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
The 88e1510 PHY has an erratum where the phy downshift counter is not cleared after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN cleared). This can cause the gigabit link to intermittently downshift to a lower speed.
Disabling and re-enabling the downshift feature clears the counter, allowing the PHY to retry gigabit link negotiation up to the programmed retry count times before downshifting. This behavior has been observed on copper links.
--- drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-)
drivers/net/phy/marvell.c +38 -1
@@ -1596,6 +1596,43 @@ static int marvell_resume(struct phy_device *phydev)return err; } +/* m88e1510_resume +* +* The 88e1510 PHY has an erratum where the phy downshift counter is not cleared +* after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN +* cleared). This can cause the link to intermittently downshift to a lower speed. +* +* Disabling and re-enabling the downshift feature clears the counter, allowing +* the PHY to retry gigabit link negotiation up to the programmed retry count +* before downshifting. This behavior has been observed on copper links. +*/ +static int m88e1510_resume (struct phy_device *phydev) +{ +int err; +u8 cnt =0 ; + + err =marvell_resume (phydev); +if (err <0 ) +return err; + +/* read downshift counter value */ + err =m88e1011_get_downshift (phydev, &cnt); +if (err <0 ) +return err; + +if (cnt) { +/* downshift disabled */ + err =m88e1011_set_downshift (phydev,0 ); +if (err <0 ) +return err; + +/* downshift enabled, with previous counter value */ + err =m88e1011_set_downshift (phydev, cnt); + } + +return err; +} +static int marvell_aneg_done (struct phy_device *phydev) {int retval =phy_read (phydev,MII_M1011_PHY_STATUS );
@@ -2845,7 +2882,7 @@ static struct phy_driver marvell_drivers[] = { .did_interrupt = m88e1121_did_interrupt, .get_wol = m88e1318_get_wol, .set_wol = m88e1318_set_wol, - .resume = marvell_resume, + .resume = m88e1510_resume, .suspend = marvell_suspend, .read_page = marvell_read_page, .write_page = marvell_write_page,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/300 phy: cadence: cdns-dphy: Enable lower resolutions in dphy
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harikrishna Shenoy <[email protected]>
[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
Enable support for data lane rates between 80-160 Mbps cdns dphy as mentioned in TRM [0] by setting the pll_opdiv field to 16. This change enables lower resolutions like 640x480 at 60Hz.
[0]: https://www.ti.com/lit/zip/spruil1
(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
--- drivers/phy/cadence/cdns-dphy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/phy/cadence/cdns-dphy.c +3 -1
@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, dlane_bps = opts->hs_clk_rate; -if (dlane_bps >2500000000UL || dlane_bps <160000000UL ) +if (dlane_bps >2500000000UL || dlane_bps <80000000UL )return -EINVAL ;else if (dlane_bps >=1250000000 ) cfg->pll_opdiv =1 ;
@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, cfg->pll_opdiv =4 ; else if (dlane_bps >= 160000000) cfg->pll_opdiv = 8; + else if (dlane_bps >= 80000000) + cfg->pll_opdiv = 16; cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv * cfg->pll_ipdiv,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/300 net: sh_eth: Disable WoL if system can not suspend
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
The MAC can't facilitate WoL if the system can't go to sleep. Gate the WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
--- drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/renesas/sh_eth.c +4 -0
@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,return 0 ; } +#ifdef CONFIG_PM_SLEEP static void sh_eth_get_wol (struct net_device *ndev,struct ethtool_wolinfo *wol) {struct sh_eth_private *mdp =netdev_priv (ndev);
@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)return 0 ; } +#endif static const struct ethtool_ops sh_eth_ethtool_ops = { .get_regs_len = sh_eth_get_regs_len,
@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = { .set_ringparam = sh_eth_set_ringparam, .get_link_ksettings = phy_ethtool_get_link_ksettings, .set_link_ksettings = phy_ethtool_set_link_ksettings, +#ifdef CONFIG_PM_SLEEP .get_wol = sh_eth_get_wol, .set_wol = sh_eth_set_wol, +#endif };/* network device open function */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/300 media: redrat3: use int type to store negative error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
Change "ret" from u8 to int type in redrat3_enable_detector() to store negative error codes or zero returned by redrat3_send_cmd() and usb_submit_urb() - this better aligns with the coding standards and maintains code consistency.
No effect on runtime.
--- drivers/media/rc/redrat3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/redrat3.c +1 -1
@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)static int redrat3_enable_detector (struct redrat3_dev *rr3) {struct device *dev = rr3->dev; -u8 ret; +int ret; ret =redrat3_send_cmd (RR3_RC_DET_ENABLE , rr3);if (ret !=0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/300 selftests: traceroute: Use require_command()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
Use require_command() so that the test will return SKIP (4) when a required command is not present.
Before:
# ./traceroute.sh SKIP: Could not run IPV6 test without traceroute6 SKIP: Could not run IPV4 test without traceroute $ echo $? 0
After:
# ./traceroute.sh TEST: traceroute6 not installed [SKIP] $ echo $? 4
--- tools/testing/selftests/net/traceroute.sh | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
tools/testing/selftests/net/traceroute.sh +3 -10
@@ -209,11 +209,6 @@ setup_traceroute6() run_traceroute6() { - if [ ! -x "$(command -v traceroute6)" ]; then - echo "SKIP: Could not run IPV6 test without traceroute6" - return - fi - setup_traceroute6 # traceroute6 host-2 from host-1 (expects 2000:102::2)
@@ -278,11 +273,6 @@ setup_traceroute() run_traceroute() { - if [ ! -x "$(command -v traceroute)" ]; then - echo "SKIP: Could not run IPV4 test without traceroute" - return - fi - setup_traceroute # traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
@@ -316,6 +306,9 @@ do esac done +require_command traceroute6 +require_command traceroute + run_tests printf "\nTests passed: %3d\n" ${nsuccess}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/300 x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated physical CPUs are available") states that when PV_DEDICATED=1 (vCPU has dedicated pCPU), qspinlock should be preferred regardless of PV_UNHALT. However, the current implementation doesn't reflect this: when PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
This is suboptimal because:
1. Native qspinlocks should outperform virt_spin_lock() for dedicated vCPUs irrespective of HALT exiting
2. virt_spin_lock() should only be preferred when vCPUs may be preempted (non-dedicated case)
So reorder the PV spinlock checks to:
1. First handle dedicated pCPU case (disable virt_spin_lock_key)
2. Second check single CPU, and nopvspin configuration
3. Only then check PV_UNHALT support
This ensures we always use native qspinlock for dedicated vCPUs, delivering pretty performance gains at high contention levels.
--- arch/x86/kernel/kvm.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/x86/kernel/kvm.c +10 -10
@@ -964,16 +964,6 @@ ASM_RET*/ void __init kvm_spinlock_init (void ) { -/* -* In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an -* advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is -* preferred over native qspinlock when vCPU is preempted. -*/ -if (!kvm_para_has_feature (KVM_FEATURE_PV_UNHALT )) { -pr_info ("PV spinlocks disabled, no host support\n" ); -return ; - } -/* * Disable PV spinlocks and use native qspinlock when dedicated pCPUs * are available.
@@ -993,6 +983,16 @@ void __init kvm_spinlock_init(void) goto out; } +/* +* In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an +* advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is +* preferred over native qspinlock when vCPU is preempted. +*/ +if (!kvm_para_has_feature (KVM_FEATURE_PV_UNHALT )) { +pr_info ("PV spinlocks disabled, no host support\n" ); +return ; + } +pr_info ("PV spinlocks enabled\n" );__pv_init_lock_hash ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/300 selftests: Disable dad for ipv6 in fcnal-test.sh
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
Constrained test environment; duplicate address detection is not needed and causes races so disable it.
--- tools/testing/selftests/net/fcnal-test.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fcnal-test.sh +2 -0
@@ -400,6 +400,8 @@ create_ns() ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0 } # create veth pair to connect namespaces and apply addresses.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/300 mips: lantiq: xway: sysctrl: rename stp clock
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch changes the clock name from “stp” to “gpio”.
--- arch/mips/lantiq/xway/sysctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/lantiq/xway/sysctrl.c +1 -1
@@ -463,7 +463,7 @@ void __init ltq_soc_init(void)/* add our generic xway clocks */ clkdev_add_pmu ("10000000.fpi" ,NULL ,0 ,0 ,PMU_FPI );clkdev_add_pmu ("1e100a00.gptu" ,NULL ,1 ,0 ,PMU_GPT ); -clkdev_add_pmu ("1e100bb0.stp" ,NULL ,1 ,0 ,PMU_STP ); +clkdev_add_pmu ("1e100bb0.gpio" ,NULL ,1 ,0 ,PMU_STP );clkdev_add_pmu ("1e100c00.serial" ,NULL ,0 ,0 ,PMU_ASC1 );clkdev_add_pmu ("1e104100.dma" ,NULL ,1 ,0 ,PMU_DMA );clkdev_add_pmu ("1e100800.spi" ,NULL ,1 ,0 ,PMU_SPI );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/300 eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range() and from there __pci_ioport_map() for the PCI IO space.
If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will always fail and the driver will complain it couldn't map the PIO space and return an error.
NO_IOPORT_MAP seems to cover the case where what 8139too is trying to do cannot ever work so make 8139TOO_PIO depend on being it false and avoid creating an unusable driver.
--- drivers/net/ethernet/realtek/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/realtek/Kconfig +1 -1
@@ -58,7 +58,7 @@ config 8139TOO config 8139TOO_PIO bool "Use PIO instead of MMIO" default y - depends on 8139TOO + depends on 8139TOO && !NO_IOPORT_MAP help This instructs the driver to use programmed I/O ports (PIO) instead of PCI shared memory (MMIO). This can possibly solve some problems
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/300 selftests: Replace sleep with slowwait
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
Replace the sleep in kill_procs with slowwait.
--- tools/testing/selftests/net/fcnal-test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/fcnal-test.sh +1 -1
@@ -183,7 +183,7 @@ show_hint() kill_procs() { killall nettest ping ping6 >/dev/null 2>&1 - sleep 1 + slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"' } do_run_cmd()
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/300 udp_tunnel: use netdev_warn() instead of netdev_WARN()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
netdev_WARN() uses WARN/WARN_ON to print a backtrace along with file and line information. In this case, udp_tunnel_nic_register() returning an error is just a failed operation, not a kernel bug.
udp_tunnel_nic_register() can fail due to a memory allocation failure (kzalloc() or udp_tunnel_nic_alloc()).
This is a normal runtime error and not a kernel bug.
Replace netdev_WARN() with netdev_warn() accordingly.
--- net/ipv4/udp_tunnel_nic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_tunnel_nic.c +1 -1
@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused, err =udp_tunnel_nic_register (dev);if (err) -netdev_WARN (dev,"failed to register for UDP tunnel offloads: %d" , err); +netdev_warn (dev,"failed to register for UDP tunnel offloads: %d" , err);return notifier_from_errno (err); }/* All other events will need the udp_tunnel_nic state */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/300 net/cls_cgroup: Fix task_get_classid() during qdisc run
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
During recent testing with the netem qdisc to inject delays into TCP traffic, we observed that our CLS BPF program failed to function correctly due to incorrect classid retrieval from task_get_classid(). The issue manifests in the following call stack:
bpf_get_cgroup_classid+5
cls_bpf_classify+507
__tcf_classify+90
tcf_classify+217
__dev_queue_xmit+798
bond_dev_queue_xmit+43
__bond_start_xmit+211
bond_start_xmit+70
dev_hard_start_xmit+142
sch_direct_xmit+161
__qdisc_run+102 <<<<< Issue location
__dev_xmit_skb+1015
__dev_queue_xmit+637
neigh_hh_output+159
ip_finish_output2+461
__ip_finish_output+183
ip_finish_output+41
ip_output+120
ip_local_out+94
__ip_queue_xmit+394
ip_queue_xmit+21
__tcp_transmit_skb+2169
tcp_write_xmit+959
__tcp_push_pending_frames+55
tcp_push+264
tcp_sendmsg_locked+661
tcp_sendmsg+45
inet_sendmsg+67
sock_sendmsg+98
sock_write_iter+147
vfs_write+786
ksys_write+181
__x64_sys_write+25
do_syscall_64+56
entry_SYSCALL_64_after_hwframe+100The problem occurs when multiple tasks share a single qdisc. In such cases, __qdisc_run() may transmit skbs created by different tasks. Consequently, task_get_classid() retrieves an incorrect classid since it references the current task's context rather than the skb's originating task.
Given that dev_queue_xmit() always executes with bh disabled, we can use softirq_count() instead to obtain the correct classid.
The simple steps to reproduce this issue:
1. Add network delay to the network interface:
such as: tc qdisc add dev bond0 root netem delay 1.5ms
2. Build two distinct net_cls cgroups, each with a network-intensive task
3. Initiate parallel TCP streams from both tasks to external servers.
Under this specific condition, the issue reliably occurs. The kernel eventually dequeues an SKB that originated from Task-A while executing in the context of Task-B.
It is worth noting that it will change the established behavior for a slightly different scenario:
<sock S is created by task A>
<class ID for task A is changed>
<skb is created by sock S xmit and classified>
prior to this patch the skb will be classified with the 'new' task A classid, now with the old/original one. The bpf_get_cgroup_classid_curr() function is a more appropriate choice for this case.
--- include/net/cls_cgroup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cls_cgroup.h +1 -1
@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)* calls by looking at the number of nested bh disable calls because * softirqs always disables bh. */ -if (in_serving_softirq ()) { +if (softirq_count ()) {struct sock *sk =skb_to_full_sk (skb);/* If there is an sock_cgroup_classid we'll use that. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/300 selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nai-Chen Cheng <[email protected]>
[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
The selftests 'make clean' does not clean the net/lib because it only processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves compiled objects in net/lib after cleaning, requiring manual cleanup.
Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib dependency is properly cleaned.
--- tools/testing/selftests/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/Makefile +1 -1
@@ -257,7 +257,7 @@ gen_tar: install @echo "Created ${TAR_PATH}" clean: - @for TARGET in $(TARGETS); do \ + @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\ done;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/300 scsi: lpfc: Define size of debugfs entry for xri rebalancing
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs entry is used. The debugfs file operations for xri rebalancing have been previously implemented, but lack definition for its information buffer size. Similar to other pre-existing debugfs entry buffers, define LPFC_HDWQINFO_SIZE as 8192 bytes.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/lpfc/lpfc_debugfs.h +3 -0
@@ -44,6 +44,9 @@/* hbqinfo output buffer size */ #define LPFC_HBQINFO_SIZE 8192 +/* hdwqinfo output buffer size */ +#define LPFC_HDWQINFO_SIZE 8192 +/* nvmestat output buffer size */ #define LPFC_NVMESTAT_SIZE 8192#define LPFC_IOKTIME_SIZE 8192
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/300 allow finish_no_open(file, ERR_PTR(-E...))
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
... allowing any ->lookup() return value to be passed to it.
--- fs/open.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/open.c +6 -4
@@ -896,18 +896,20 @@ EXPORT_SYMBOL(finish_open);* finish_no_open - finish ->atomic_open() without opening the file * * @file: file pointer -* @dentry: dentry or NULL (as returned from ->lookup()) +* @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) * -* This can be used to set the result of a successful lookup in ->atomic_open(). +* This can be used to set the result of a lookup in ->atomic_open(). * * NB: unlike finish_open() this function does consume the dentry reference and * the caller need not dput() it. * -* Returns "0" which must be the return value of ->atomic_open() after having -* called this function. +* Returns 0 or -E..., which must be the return value of ->atomic_open() after +* having called this function. */ int finish_no_open (struct file *file,struct dentry *dentry) { +if (IS_ERR (dentry)) +return PTR_ERR (dentry); file->f_path.dentry = dentry;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/300 usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Crossman <[email protected]>
[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
The usbmon binary interface currently truncates captures of large transfers from higher-speed USB devices. Because a single event capture is limited to one-fifth of the total buffer size, the current maximum size of a captured URB is around 240 KiB. This is insufficient when capturing traffic from modern devices that use transfers of several hundred kilobytes or more, as truncated URBs can make it impossible for user-space USB analysis tools like Wireshark to properly defragment and reassemble higher-level protocol packets in the captured data.
The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has not been changed since the binary interface was introduced in 2006.
To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The original comment for BUFF_MAX based the limit's calculation on a saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2 Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the buffer should be at least 50 MB. The new limit of 64 MiB covers that, plus a little extra for any overhead.
With this change, both users and developers should now be able to debug and reverse engineer modern USB devices even when running unmodified distro kernels.
Please note that this change does not affect the default buffer size. A larger buffer is only allocated when a user explicitly requests it via the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size should not unduly increase memory usage for users that don't deliberately request a larger buffer.
--- drivers/usb/mon/mon_bin.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/mon/mon_bin.c +8 -6
@@ -68,18 +68,20 @@* The magic limit was calculated so that it allows the monitoring * application to pick data once in two ticks. This way, another application, * which presumably drives the bus, gets to hog CPU, yet we collect our data. -* If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an -* enormous overhead built into the bus protocol, so we need about 1000 KB. +* +* Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For +* modern 20 Gbps buses, this value increases to over 50 MB. The maximum +* buffer size is set to 64 MiB to accommodate this. * * This is still too much for most cases, where we just snoop a few * descriptor fetches for enumeration. So, the default is a "reasonable" -* amount for systems with HZ=250 and incomplete bus saturation. +* amount for typical, low-throughput use cases. * * XXX What about multi-megabyte URBs which take minutes to transfer? */ -#define BUFF_MAX CHUNK_ALIGN(1200*1024) -#define BUFF_DFL CHUNK_ALIGN(300*1024) -#define BUFF_MIN CHUNK_ALIGN(8*1024) +#define BUFF_MAX CHUNK_ALIGN(64*1024*1024) +#define BUFF_DFL CHUNK_ALIGN(300*1024) +#define BUFF_MIN CHUNK_ALIGN(8*1024)/* * The per-event API header (2 per URB).
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/300 usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs, when in host mode, it is intended that the controller goes to suspend state to save power and wait for interrupts from connected peripheral to wake it up. This is particularly used in cases where a HID or Audio device is connected. In such scenarios, the usb controller can enter auto suspend and resume action after getting interrupts from the connected device.
--- drivers/usb/host/xhci-plat.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-plat.c +1 -0
@@ -242,6 +242,7 @@ static int xhci_plat_probe(struct platform_device *pdev) }pm_runtime_set_active (&pdev->dev); +pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_enable (&pdev->dev);pm_runtime_get_noresume (&pdev->dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/300 ipv6: np->rxpmtu race annotation
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
Add READ_ONCE() annotations because np->rxpmtu can be changed while udpv6_recvmsg() and rawv6_recvmsg() read it.
Since this is a very rarely used feature, and that udpv6_recvmsg() and rawv6_recvmsg() read np->rxopt anyway, change the test order so that np->rxpmtu does not need to be in a hot cache line.
--- net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/raw.c +1 -1
@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); skb =skb_recv_datagram (sk, flags, noblock, &err);
net/ipv6/udp.c +1 -1
@@ -361,7 +361,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); try_again:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/300 scsi: pm8001: Use int instead of u32 to store error codes
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req().
--- drivers/scsi/pm8001/pm8001_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_ctl.c +1 -1
@@ -683,7 +683,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)struct pm8001_ioctl_payload *payload;DECLARE_COMPLETION_ONSTACK (completion);u8 *ioctlbuffer; -u32 ret; +int ret;u32 length =1024 *5 +sizeof (*payload) -1 ;if (pm8001_ha->fw_image->size >4096 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/300 jfs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does.
--- fs/jfs/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/jfs/inode.c +7 -1
@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)*/ inode->i_link[inode->i_size] ='\0' ; } - }else { + }else if (S_ISCHR (inode->i_mode) ||S_ISBLK (inode->i_mode) || +S_ISFIFO (inode->i_mode) ||S_ISSOCK (inode->i_mode)) { inode->i_op = &jfs_file_inode_operations;init_special_inode (inode, inode->i_mode, inode->i_rdev); + }else { +printk (KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); +iget_failed (inode); +return ERR_PTR (-EIO ); }unlock_new_inode (inode);return inode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/300 jfs: fix uninitialized waitqueue in transaction manager
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
The transaction manager initialization in txInit() was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.
When a filesystem is mounted read-only, txBegin() returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor via tid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.
This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEnd
Fix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during txInit().
--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/jfs/jfs_txnmgr.c +5 -4
@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);
Signature · 1 line
2.51.0
syzbot
syzbotRe: [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the…
Quoted 62 lines
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit
300b072df72694ea330c4c673c035253e07827b8]The transaction manager initialization in
txInit()was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.When a filesystem is mounted read-only,
txBegin()returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor viatid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEndFix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during
txInit().Reported-by [email protected]Signed-off-by Shaurya Rane <[email protected]>Signed-off-by Dave Kleikamp <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)fs/jfs/jfs_txnmgr.c +5
-4@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);Signature · 1 line
2.51.0
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the address.
Greg Kroah-Hartman
maintainerPATCH 128/300 wifi: ath10k: Fix connection after GTK rekeying
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
It appears that not all hardware/firmware implementations support group key deletion correctly, which can lead to connection hangs and deauthentication following GTK rekeying (delete and install).
To avoid this issue, instead of attempting to delete the key using the special WMI_CIPHER_NONE value, we now replace the key with an invalid (random) value.
This behavior has been observed with WCN39xx chipsets.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +10 -2
@@ -13,6 +13,7 @@#include <linux/acpi.h> #include <linux/of.h> #include <linux/bitfield.h> +#include <linux/random.h> #include "hif.h" #include "core.h"
@@ -275,8 +276,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif, key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV ;if (cmd ==DISABLE_KEY ) { - arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE ]; - arg.key_data =NULL ; +if (flags &WMI_KEY_GROUP ) { +/* Not all hardware handles group-key deletion operation +* correctly. Replace the key with a junk value to invalidate it. +*/ +get_random_bytes (key->key, key->keylen); + }else { + arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE ]; + arg.key_data =NULL ; + } }return ath10k_wmi_vdev_install_key (arvif->ar, &arg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/300 net: intel: fm10k: Fix parameter idx set but not used
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
Variable idx is set in the loop, but is never used resulting in dead code. Building with GCC 16, which enables -Werror=unused-but-set-parameter= by default results in build error. This patch removes the idx parameter, since all the callers of the fm10k_unbind_hw_stats_q as 0 as idx anyways.
--- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++--- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/fm10k/fm10k_common.c +2 -3
@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,/** * fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues * @q: pointer to the ring of hardware statistics queue -* @idx: index pointing to the start of the ring iteration * @count: number of queues to iterate over * * Function invalidates the index values for the queues so any updates that * may have happened are ignored and the base for the queue stats is reset. **/ -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count) +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count) {u32 i; -for (i =0 ; i < count; i++, idx++, q++) { +for (i =0 ; i < count; i++, q++) { q->rx_stats_idx =0 ; q->tx_stats_idx =0 ; }
drivers/net/ethernet/intel/fm10k/fm10k_common.h +1 -1
@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,void fm10k_update_hw_stats_q (struct fm10k_hw *hw,struct fm10k_hw_stats_q *q,u32 idx,u32 count);#define fm10k_unbind_hw_stats_32b (s) ((s)->base_h = 0) -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count); +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count);s32 fm10k_get_host_state_generic (struct fm10k_hw *hw,bool *host_ready);#endif /* _FM10K_COMMON_H_ */
drivers/net/ethernet/intel/fm10k/fm10k_pf.c +1 -1
@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,fm10k_unbind_hw_stats_32b (&stats->nodesc_drop);/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_pf (hw, stats);
drivers/net/ethernet/intel/fm10k/fm10k_vf.c +1 -1
@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw, struct fm10k_hw_stats *stats) {/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_vf (hw, stats);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/300 r8169: set EEE speed down ratio to 1
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChunHao Lin <[email protected]>
[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
EEE speed down means speed down MAC MCU clock. It is not from spec. It is kind of Realtek specific power saving feature. But enable it may cause some issues, like packet drop or interrupt loss. Different hardware may have different issues.
EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed down rate. The larger this value is, the more power can save. But it actually save less power then we expected. And, as mentioned above, will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0) , which means not to speed down, to improve compatibility.
--- drivers/net/ethernet/realtek/r8169_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -3
@@ -3278,7 +3278,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xd412 ,0x0fff , sw_cnt_1ms_ini); } -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0070 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_modify (tp,0xe052 ,0x6000 ,0x8008 );r8168_mac_ocp_modify (tp,0xe0d6 ,0x01ff ,0x017f );r8168_mac_ocp_modify (tp,0xd420 ,0x0fff ,0x047f );
@@ -3433,7 +3433,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xd412 ,0x0fff , sw_cnt_1ms_ini); } -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0070 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_write (tp,0xea80 ,0x0003 );r8168_mac_ocp_modify (tp,0xe052 ,0x0000 ,0x0009 );r8168_mac_ocp_modify (tp,0xd420 ,0x0fff ,0x047f );
@@ -3628,7 +3628,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xc0b4 ,0x0000 ,0x000c );r8168_mac_ocp_modify (tp,0xeb6a ,0x00ff ,0x0033 );r8168_mac_ocp_modify (tp,0xeb50 ,0x03e0 ,0x0040 ); -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0030 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_modify (tp,0xe040 ,0x1000 ,0x0000 );r8168_mac_ocp_modify (tp,0xea1c ,0x0003 ,0x0001 );r8168_mac_ocp_modify (tp,0xe0c0 ,0x4f0f ,0x4403 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/300 PCI: cadence: Check for the existence of cdns_pcie::ops before using it
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Wang <[email protected]>
[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This is going to be true for the upcoming Sophgo platform which doesn't set the ops.
Hence, add a check to prevent NULL pointer dereference.
--- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 ++-- drivers/pci/controller/cadence/pcie-cadence.h | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-host.c +1 -1
@@ -444,7 +444,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_PCI_ADDR1 (0 ), addr1);cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_DESC1 (0 ), desc1); -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
drivers/pci/controller/cadence/pcie-cadence.c +2 -2
@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_DESC1 (r), desc1);/* Set the CPU address */ -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie, }/* Set the CPU address */ -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
drivers/pci/controller/cadence/pcie-cadence.h +3 -3
@@ -471,7 +471,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)static inline int cdns_pcie_start_link (struct cdns_pcie *pcie) { -if (pcie->ops->start_link) +if (pcie->ops && pcie->ops->start_link)return pcie->ops->start_link (pcie);return 0 ;
@@ -479,13 +479,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)static inline void cdns_pcie_stop_link (struct cdns_pcie *pcie) { -if (pcie->ops->stop_link) +if (pcie->ops && pcie->ops->stop_link) pcie->ops->stop_link (pcie); }static inline bool cdns_pcie_link_up (struct cdns_pcie *pcie) { -if (pcie->ops->link_up) +if (pcie->ops && pcie->ops->link_up)return pcie->ops->link_up (pcie);return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/300 dmaengine: sh: setup_xref error handling
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Andreatta <[email protected]>
[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
This patch modifies the type of setup_xref from void to int and handles errors since the function can fail.
setup_xref now returns the (eventual) error from dmae_set_dmars|dmae_set_chcr, while shdma_tx_submit handles the result, removing the chunks from the queue and marking PM as idle in case of an error.
--- drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------ drivers/dma/sh/shdmac.c | 17 +++++++++++++---- include/linux/shdma-base.h | 2 +- 3 files changed, 33 insertions(+), 11 deletions(-)
drivers/dma/sh/shdma-base.c +19 -6
@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)const struct shdma_ops *ops = sdev->ops;dev_dbg (schan->dev,"Bring up channel %d\n" , schan->id); -/* -* TODO: .xfer_setup() might fail on some platforms. -* Make it int then, on error remove chunks from the -* queue again -*/ - ops->setup_xfer (schan, schan->slave_id); + + ret = ops->setup_xfer (schan, schan->slave_id); +if (ret <0 ) { +dev_err (schan->dev,"setup_xfer failed: %d\n" , ret); + +/* Remove chunks from the queue and mark them as idle */ +list_for_each_entry_safe (chunk, c, &schan->ld_queue, node) { +if (chunk->cookie == cookie) { + chunk->mark =DESC_IDLE ; +list_move (&chunk->node, &schan->ld_free); + } + } + + schan->pm_state =SHDMA_PM_ESTABLISHED ; + ret =pm_runtime_put (schan->dev); + +spin_unlock_irq (&schan->chan_lock); +return ret; + }if (schan->pm_state ==SHDMA_PM_PENDING )shdma_chan_xfer_ld_queue (schan);
drivers/dma/sh/shdmac.c +13 -4
@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)return dmae_is_busy (sh_chan); } -static void sh_dmae_setup_xfer (struct shdma_chan *schan, -int slave_id) +static int sh_dmae_setup_xfer (struct shdma_chan *schan,int slave_id) { struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan, shdma_chan); +int ret =0 ;if (slave_id >=0 ) {const struct sh_dmae_slave_config *cfg = sh_chan->config; -dmae_set_dmars (sh_chan, cfg->mid_rid); -dmae_set_chcr (sh_chan, cfg->chcr); + ret =dmae_set_dmars (sh_chan, cfg->mid_rid); +if (ret <0 ) + goto END; + + ret =dmae_set_chcr (sh_chan, cfg->chcr); +if (ret <0 ) + goto END; + }else {dmae_init (sh_chan); } + +END: +return ret; }/*
include/linux/shdma-base.h +1 -1
@@ -96,7 +96,7 @@ struct shdma_ops {int (*desc_setup)(struct shdma_chan *,struct shdma_desc *,dma_addr_t ,dma_addr_t ,size_t *);int (*set_slave)(struct shdma_chan *,int ,dma_addr_t ,bool ); -void (*setup_xfer)(struct shdma_chan *,int ); +int (*setup_xfer)(struct shdma_chan *,int );void (*start_xfer)(struct shdma_chan *,struct shdma_desc *);struct shdma_desc *(*embedded_desc)(void *,int );bool (*chan_irq)(struct shdma_chan *,int );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/300 dmaengine: mv_xor: match alloc_wc and free_wc
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
dma_alloc_wc is used but not dma_free_wc.
--- drivers/dma/mv_xor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/mv_xor.c +2 -2
@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)dma_async_device_unregister (&mv_chan->dmadev); -dma_free_coherent (dev,MV_XOR_POOL_SIZE , +dma_free_wc (dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);dma_unmap_single (dev, mv_chan->dummy_src_addr,MV_XOR_MIN_BYTE_COUNT ,DMA_FROM_DEVICE );
@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, err_free_irq:free_irq (mv_chan->irq, mv_chan); err_free_dma: -dma_free_coherent (&pdev->dev,MV_XOR_POOL_SIZE , +dma_free_wc (&pdev->dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); err_unmap_dst: dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/300 dmaengine: dw-edma: Set status for callback_result
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra K Verma <[email protected]>
[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
DMA Engine has support for the callback_result which provides the status of the request and the residue. This helps in determining the correct status of the request and in efficient resource management of the request.
The 'callback_result' method is preferred over the deprecated 'callback' method.
--- drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/dma/dw-edma/dw-edma-core.c +22 -0
@@ -488,6 +488,25 @@ dw_edma_device_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t paddr,return dw_edma_device_transfer (&xfer); } +static void dw_hdma_set_callback_result (struct virt_dma_desc *vd, +enum dmaengine_tx_result result) +{ +u32 residue =0 ; +struct dw_edma_desc *desc; +struct dmaengine_result *res; + +if (!vd->tx.callback_result) +return ; + + desc =vd2dw_edma_desc (vd); +if (desc) + residue = desc->alloc_sz - desc->xfer_sz; + + res = &vd->tx_result; + res->result = result; + res->residue = residue; +} +static void dw_edma_done_interrupt (struct dw_edma_chan *chan) {struct dw_edma_desc *desc;
@@ -503,6 +522,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)case EDMA_REQ_NONE : desc =vd2dw_edma_desc (vd);if (!desc->chunks_alloc) { +dw_hdma_set_callback_result (vd, +DMA_TRANS_NOERROR );list_del (&vd->node);vchan_cookie_complete (vd); }
@@ -541,6 +562,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)spin_lock_irqsave (&chan->vc.lock, flags); vd =vchan_next_desc (&chan->vc);if (vd) { +dw_hdma_set_callback_result (vd,DMA_TRANS_ABORTED );list_del (&vd->node);vchan_cookie_complete (vd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/300 ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled, idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is zero, but if one of the values is negative it will in fact return non-zero.
--- net/ipv6/addrconf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +3 -1
@@ -6978,7 +6978,9 @@ static const struct ctl_table addrconf_sysctl[] = { .data = &ipv6_devconf.rpl_seg_enabled, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, {/* sentinel */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/300 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juraj Šarinay <[email protected]>
[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
An exchange with a NFC target must complete within NCI_DATA_TIMEOUT. A delay of 700 ms is not sufficient for cryptographic operations on smart cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH or 3072-bit RSA. To prevent brute-force attacks, passports and similar documents introduce even longer delays into access control protocols (BAC/PACE).
The timeout should be higher, but not too much. The expiration allows us to detect that a NFC target has disappeared.
--- include/net/nfc/nci_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/nfc/nci_core.h +1 -1
@@ -52,7 +52,7 @@ enum nci_state {#define NCI_RF_DISC_SELECT_TIMEOUT 5000#define NCI_RF_DEACTIVATE_TIMEOUT 30000#define NCI_CMD_TIMEOUT 5000 -#define NCI_DATA_TIMEOUT 700 +#define NCI_DATA_TIMEOUT 3000struct nci_dev ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/300 ALSA: usb-audio: apply quirk for MOONDROP Quark2
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <[email protected]>
[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
It reports a MIN value -15360 for volume control, but will mute when setting it less than -14208
--- sound/usb/mixer.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/usb/mixer.c +7 -0
@@ -1192,6 +1192,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, cval->res =1 ; }break ; +case USB_ID (0x3302 ,0x12db ):/* MOONDROP Quark2 */ +if (!strcmp (kctl->id.name,"PCM Playback Volume" )) { +usb_audio_info (chip, +"set volume quirk for MOONDROP Quark2\n" ); + cval->min =-14208 ;/* Mute under it */ + } +break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/300 mips: lantiq: danube: add missing properties to cpu node
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
This fixes the following warnings:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +4 -0
@@ -5,8 +5,12 @@ compatible = "lantiq,xway", "lantiq,danube"; cpus { + #address-cells = <1>; + #size-cells = <0>; + cpu@0 { compatible = "mips,mips24Kc"; + reg = <0>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 133/300 remoteproc: qcom: q6v5: Avoid handling handover twice
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
A remoteproc could theoretically signal handover twice. This is unexpected and would break the reference counting for the handover resources (power domains, clocks, regulators, etc), so add a check to prevent that from happening.
--- drivers/remoteproc/qcom_q6v5.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/remoteproc/qcom_q6v5.c +5 -0
@@ -123,6 +123,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data) {struct qcom_q6v5 *q6v5 = data; +if (q6v5->handover_issued) { +dev_err (q6v5->dev,"Handover signaled, but it already happened\n" ); +return IRQ_HANDLED ; + } +if (q6v5->handover) q6v5->handover (q6v5);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 142/300 exfat: limit log print for IO error
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <[email protected]>
[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
For exFAT filesystems with 4MB read_ahead_size, removing the storage device when the read operation is in progress, which cause the last read syscall spent 150s [1]. The main reason is that exFAT generates excessive log messages [2].
After applying this patch, approximately 300,000 lines of log messages were suppressed, and the delay of the last read() syscall was reduced to about 4 seconds.
[1]:write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120> read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032> write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215>
[2]:
[ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
--- fs/exfat/fatent.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/exfat/fatent.c +6 -5
@@ -88,35 +88,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,int err;if (!is_valid_cluster (sbi, loc)) { -exfat_fs_error (sb,"invalid access to FAT (entry 0x%08x)" , +exfat_fs_error_ratelimit (sb, +"invalid access to FAT (entry 0x%08x)" , loc);return -EIO ; } err =__exfat_ent_get (sb, loc, content);if (err) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"failed to access to FAT (entry 0x%08x, err:%d)" , loc, err);return err; }if (*content ==EXFAT_FREE_CLUSTER ) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT free cluster (entry 0x%08x)" , loc);return -EIO ; }if (*content ==EXFAT_BAD_CLUSTER ) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT bad cluster (entry 0x%08x)" , loc);return -EIO ; }if (*content !=EXFAT_EOF_CLUSTER && !is_valid_cluster (sbi, *content)) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)" , loc, *content);return -EIO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 143/300 page_pool: Clamp pool size to max 16K pages
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
page_pool_init() returns E2BIG when the page_pool size goes above 32K pages. As some drivers are configuring the page_pool size according to the MTU and ring size, there are cases where this limit is exceeded and the queue creation fails.
The page_pool size doesn't have to cover a full queue, especially for larger ring size. So clamp the size instead of returning an error. Do this in the core to avoid having each driver do the clamping.
The current limit was deemed to high [1] so it was reduced to 16K to avoid page waste.
[1] https://lore.kernel.org/all/[email protected]/
--- net/core/page_pool.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/core/page_pool.c +1 -5
@@ -33,11 +33,7 @@ static int page_pool_init(struct page_pool *pool,return -EINVAL ;if (pool->p.pool_size) - ring_qsize = pool->p.pool_size; - -/* Sanity limit mem that can be pinned down */ -if (ring_qsize >32768 ) -return -E2BIG ; + ring_qsize =min (pool->p.pool_size,16384 );/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL. * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 144/300 orangefs: fix xattr related buffer overflow...
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
Willy Tarreau <[email protected]> forwarded me a message from Disclosure <[email protected]> with the following warning:
Quoted 5 lines
The helper
xattr_key()uses the pointer variable in the loop condition rather than dereferencing it. Askeyis incremented, it remains non-NULL (until it runs into unmapped memory), so the loop does not terminate on valid C strings and will walk memory indefinitely, consuming CPU or hanging the thread.
I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on.
After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed.
I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture.
--- fs/orangefs/xattr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/orangefs/xattr.c +7 -5
@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)static unsigned int xattr_key (const char *key) {unsigned int i =0 ; -while (key) +if (!key) +return 0 ; +while (*key) i += *key++;return i %16 ; }
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, cx->length =-1 ; cx->timeout = jiffies + orangefs_getattr_timeout_msecs*HZ /1000 ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head ( &cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } } goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,memcpy (cx->val, buffer, length); cx->length = length; cx->timeout = jiffies +HZ ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head (&cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 145/300 ACPICA: Update dsmethod.c to get rid of unused variable warning
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Dumbre <[email protected]>
[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about the unused variable i after the removal of its usage by PR #1031 addressing Issue #1027
--- drivers/acpi/acpica/dsmethod.c | 1 - 1 file changed, 1 deletion(-)
drivers/acpi/acpica/dsmethod.c +0 -1
@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,struct acpi_walk_state *next_walk_state =NULL ;union acpi_operand_object *obj_desc;struct acpi_evaluate_info *info; -u32 i;ACPI_FUNCTION_TRACE_PTR (ds_call_control_method, this_walk_state);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 146/300 btrfs: mark dirty extent range for out of bound prealloc extents
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: austinchang <[email protected]>
[ Upstream commit 3b1a4a59a2086badab391687a6a0b86e03048393 ]
In btrfs_fallocate(), when the allocated range overlaps with a prealloc extent and the extent starts after i_size, the range doesn't get marked dirty in file_extent_tree. This results in persisting an incorrect disk_i_size for the inode when not using the no-holes feature.
This is reproducible since commit 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree"), then became hidden since commit 3d7db6e8bd22 ("btrfs: don't allocate file extent tree for non regular files") and then visible again after commit 8679d2687c35 ("btrfs: initialize inode::file_extent_tree after i_mode has been set"), which fixes the previous commit.
The following reproducer triggers the problem:
$ cat test.sh
MNT=/mnt/test
DEV=/dev/vdb
mkdir -p $MNT
mkfs.btrfs -f -O ^no-holes $DEV
mount $DEV $MNT
touch $MNT/file1
fallocate -n -o 1M -l 2M $MNT/file1
umount $MNT
mount $DEV $MNT
len=$((1 * 1024 * 1024))
fallocate -o 1M -l $len $MNT/file1
du --bytes $MNT/file1
umount $MNT
mount $DEV $MNT
du --bytes $MNT/file1
umount $MNT
Running the reproducer gives the following result:
$ ./test.sh (...) 2097152 /mnt/test/file1 1048576 /mnt/test/file1
The difference is exactly 1048576 as we assigned.
Fix by adding a call to btrfs_inode_set_file_extent_range() in btrfs_fallocate_update_isize().
--- fs/btrfs/file.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/btrfs/file.c +10 -0
@@ -3049,12 +3049,22 @@ static int btrfs_fallocate_update_isize(struct inode *inode, {struct btrfs_trans_handle *trans;struct btrfs_root *root =BTRFS_I (inode)->root; +u64 range_start; +u64 range_end;int ret;int ret2;if (mode &FALLOC_FL_KEEP_SIZE || end <=i_size_read (inode))return 0 ; + range_start =round_down (i_size_read (inode), root->fs_info->sectorsize); + range_end =round_up (end, root->fs_info->sectorsize); + + ret =btrfs_inode_set_file_extent_range (BTRFS_I (inode), range_start, + range_end - range_start); +if (ret) +return ret; + trans =btrfs_start_transaction (root,1 );if (IS_ERR (trans))return PTR_ERR (trans);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 147/300 fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yikang Yue <[email protected]>
[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
The function call new_inode() is a primitive for allocating an inode in memory, rather than planning disk space for it. Therefore, -ENOMEM should be returned as the error code rather than -ENOSPC.
To be specific, new_inode()'s call path looks like this:new_inode
new_inode_pseudo
alloc_inode
ops->alloc_inode (hpfs_alloc_inode)
alloc_inode_sb
kmem_cache_alloc_lruTherefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM), not a lack of disk space. However, the current implementation of hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails. This patch fix this by set err to -ENOMEM before the goto statement.
BTW, we also noticed that other nested calls within these four functions, like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure. But similarly, only -ENOSPC is returned. Addressing these will involve code modifications in other functions, and we plan to submit dedicated patches for these issues in the future. For this patch, we focus on new_inode().
--- fs/hpfs/namei.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/hpfs/namei.c +12 -6
@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) dee.fnode =cpu_to_le32 (fno); dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail2; + }hpfs_init_inode (result); result->i_ino = fno;hpfs_i (result)->i_parent_dir = dir->i_ino;
@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; - + }hpfs_init_inode (result); result->i_ino = fno; result->i_mode |=S_IFREG ;
@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; - + }hpfs_init_inode (result); result->i_ino = fno;hpfs_i (result)->i_parent_dir = dir->i_ino;
@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy dee.creation_date = dee.write_date = dee.read_date =cpu_to_le32 (local_get_seconds (dir->i_sb)); result =new_inode (dir->i_sb); -if (!result) +if (!result) { + err = -ENOMEM ; goto bail1; + } result->i_ino = fno;hpfs_init_inode (result);hpfs_i (result)->i_parent_dir = dir->i_ino;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 148/300 um: Fix help message for ssl-non-raw
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <[email protected]>
[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
Add the missing option name in the help message. Additionally, switch to __uml_help(), because this is a global option rather than a per-channel option.
--- arch/um/drivers/ssl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/um/drivers/ssl.c +4 -1
@@ -202,4 +202,7 @@ static int ssl_non_raw_setup(char *str)return 1 ; }__setup ("ssl-non-raw" , ssl_non_raw_setup); -__channel_help (ssl_non_raw_setup,"set serial lines to non-raw mode" ); +__uml_help (ssl_non_raw_setup, +"ssl-non-raw\n" +" Set serial lines to non-raw mode.\n\n" +);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 149/300 ARM: at91: pm: save and restore ACR during PLL disable/enable
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
Add a new word in assembly to store ACR value during the calls to at91_plla_disable/at91_plla_enable macros and use it.
--- arch/arm/mach-at91/pm_suspend.S | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/arm/mach-at91/pm_suspend.S +7 -1
@@ -373,6 +373,10 @@ ENDPROC(at91_backup_mode) bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID str tmp2, [pmc, #AT91_PMC_PLL_UPDT] + /* save acr */ + ldr tmp2, [pmc, #AT91_PMC_PLL_ACR] + str tmp2, .saved_acr + /* save div. */ mov tmp1, #0 ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
@@ -442,7 +446,7 @@ ENDPROC(at91_backup_mode) str tmp1, [pmc, #AT91_PMC_PLL_UPDT] /* step 2. */ - ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA + ldr tmp1, .saved_acr str tmp1, [pmc, #AT91_PMC_PLL_ACR] /* step 3. */
@@ -694,6 +698,8 @@ ENDPROC(at91_sramc_self_refresh) .word 0 .saved_mckr: .word 0 +.saved_acr: + .word 0 .saved_pllar: .word 0 .saved_sam9_lpr:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 150/300 9p: fix /sys/fs/9p/caches overwriting itself
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <[email protected]>
[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
caches_show() overwrote its buffer on each iteration, so only the last cache tag was visible in sysfs output.
Properly append with snprintf(buf + count, …).
Message-ID: <[email protected]>
--- fs/9p/v9fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/9p/v9fs.c +1 -1
@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,spin_lock (&v9fs_sessionlist_lock);list_for_each_entry (v9ses, &v9fs_sessionlist, slist) {if (v9ses->cachetag) { - n =snprintf (buf, limit,"%s\n" , v9ses->cachetag); + n =snprintf (buf + count, limit,"%s\n" , v9ses->cachetag);if (n <0 ) { count = n;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 151/300 9p: sysfs_init: dont hardcode error to ENOMEM
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <[email protected]>
[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
v9fs_sysfs_init() always returned -ENOMEM on failure; return the actual sysfs_create_group() error instead.
Message-ID: <[email protected]>
--- fs/9p/v9fs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/9p/v9fs.c +5 -2
@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = {static int __init v9fs_sysfs_init (void ) { +int ret; + v9fs_kobj =kobject_create_and_add ("9p" , fs_kobj);if (!v9fs_kobj)return -ENOMEM ; -if (sysfs_create_group (v9fs_kobj, &v9fs_attr_group)) { + ret =sysfs_create_group (v9fs_kobj, &v9fs_attr_group); +if (ret) {kobject_put (v9fs_kobj); -return -ENOMEM ; +return ret; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 134/300 NFSv4: handle ERR_GRACE on delegation recalls
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
RFC7530 states that clients should be prepared for the return of NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
--- fs/nfs/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +2 -2
@@ -7473,10 +7473,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,return err;do { err =_nfs4_do_setlk (state,F_SETLK , fl,NFS_LOCK_NEW ); -if (err != -NFS4ERR_DELAY ) +if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE )break ;ssleep (1 ); - }while (err == -NFS4ERR_DELAY ); + }while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE );return nfs4_handle_delegation_recall_error (server, state, stateid, fl, err); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 152/300 ACPI: property: Return present device nodes only on fwnode interface
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
fwnode_graph_get_next_subnode() may return fwnode backed by ACPI device nodes and there has been no check these devices are present in the system, unlike there has been on fwnode OF backend.
In order to provide consistent behaviour towards callers, add a check for device presence by introducing
a new function acpi_get_next_present_subnode(), used as the get_next_child_node() fwnode operation that also checks device node presence.
--- drivers/acpi/property.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/acpi/property.c +23 -1
@@ -1107,6 +1107,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,return NULL ; } +/* +* acpi_get_next_present_subnode - Return the next present child node handle +* @fwnode: Firmware node to find the next child node for. +* @child: Handle to one of the device's child nodes or a null handle. +* +* Like acpi_get_next_subnode(), but the device nodes returned by +* acpi_get_next_present_subnode() are guaranteed to be present. +* +* Returns: The fwnode handle of the next present sub-node. +*/ +static struct fwnode_handle * +acpi_get_next_present_subnode (const struct fwnode_handle *fwnode, +struct fwnode_handle *child) +{ +do { + child =acpi_get_next_subnode (fwnode, child); + }while (is_acpi_device_node (child) && + !acpi_device_is_present (to_acpi_device_node (child))); + +return child; +} +/** * acpi_node_get_parent - Return parent fwnode of this fwnode * @fwnode: Firmware node whose parent to get
@@ -1421,7 +1443,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode, .property_read_string_array = \ acpi_fwnode_property_read_string_array, \ .get_parent = acpi_node_get_parent, \ - .get_next_child_node = acpi_get_next_subnode, \ + .get_next_child_node = acpi_get_next_present_subnode, \ .get_named_child_node = acpi_fwnode_get_named_child_node, \ .get_name = acpi_fwnode_get_name, \ .get_name_prefix = acpi_fwnode_get_name_prefix, \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 153/300 tools bitmap: Add missing asm-generic/bitsperlong.h include
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
small_const_nbits is defined in asm-generic/bitsperlong.h which bitmap.h uses but doesn't include causing build failures in some build systems. Add the missing #include.
Note the bitmap.h in tools has diverged from that of the kernel, so no changes are made there.
--- tools/include/linux/bitmap.h | 1 + 1 file changed, 1 insertion(+)
tools/include/linux/bitmap.h +1 -0
@@ -3,6 +3,7 @@#define _PERF_BITOPS_H#include <string.h> +#include <asm-generic/bitsperlong.h> #include <linux/align.h> #include <linux/bitops.h> #include <stdlib.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 154/300 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Babu Varghese <[email protected]>
[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches.
Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.
--- drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/video/fbdev/core/bitblit.c +17 -0
@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth =1 ; +if (image.dy >= info->var.yres) +return ; + + image.height =min (image.height, info->var.yres - image.dy); +if (attribute) { buf =kmalloc (cellsize,GFP_ATOMIC );if (!buf)
@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + +if (image.dx >= info->var.xres) +break ; + +if (image.dx + image.width > info->var.xres) { + image.width = info->var.xres - image.dx; + cnt = image.width / vc->vc_font.width; +if (cnt ==0 ) +break ; + image.width = cnt * vc->vc_font.width; + } + pitch =DIV_ROUND_UP (image.width,8 ) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 155/300 ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valerio Setti <[email protected]>
[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
According to I2S specs audio data is sampled on the rising edge of the clock and it can change on the falling one. When operating in normal mode this SoC behaves the opposite so a clock polarity inversion is required in this case.
This was tested on an OdroidC2 (Amlogic S905 SoC) board.
--- sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/meson/aiu-encoder-i2s.c +6 -3
@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) inv == SND_SOC_DAIFMT_IB_IF) val |=AIU_CLK_CTRL_LRCLK_INVERT ; -if (inv ==SND_SOC_DAIFMT_IB_NF || - inv ==SND_SOC_DAIFMT_IB_IF ) +/* +* The SoC changes data on the rising edge of the bitclock +* so an inversion of the bitclock is required in normal mode +*/ +if (inv ==SND_SOC_DAIFMT_NB_NF || + inv ==SND_SOC_DAIFMT_NB_IF ) val |=AIU_CLK_CTRL_AOCLK_INVERT ;/* Signal skew */
@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = { .startup = aiu_encoder_i2s_startup, .shutdown = aiu_encoder_i2s_shutdown, }; -
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 156/300 ceph: add checking of wait_for_completion_killable() return value
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <[email protected]>
[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
The Coverity Scan service has detected the calling of wait_for_completion_killable() without checking the return value in ceph_lock_wait_for_completion() [1]. The CID 1636232 defect contains explanation: "If the function returns an error value, the error value may be mistaken for a normal value. In ceph_lock_wait_for_completion(): Value returned from a function is not checked for errors before being used. (CWE-252)".
The patch adds the checking of wait_for_completion_killable() return value and return the error code from ceph_lock_wait_for_completion().
[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
--- fs/ceph/locks.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ceph/locks.c +4 -1
@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,if (err && err != -ERESTARTSYS )return err; -wait_for_completion_killable (&req->r_safe_completion); + err =wait_for_completion_killable (&req->r_safe_completion); +if (err) +return err; +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 157/300 ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <[email protected]>
[ Upstream commit f4b3cef55f5f96fdb4e7f9ca90b7d6213689faeb ]
There was a similar bug in the past (Bug 217440), which was fixed for this laptop.
The same issue is occurring again as of kernel v.6.12.2. The symptoms are very similar - initially audio works but after a warm reboot, the audio completely disappears until the computer is powered off (there is no audio output at all).
The issue is also related by caused by a different change now. By bisecting different kernel versions, I found that reverting cc3d0b5dd989 in patch_realtek.c[*] restores the sound and it works fine after the reboot.
[ patch description reformatted by tiwai ]
--- sound/pci/hda/patch_realtek.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
sound/pci/hda/patch_realtek.c +9 -8
@@ -3637,6 +3637,15 @@ static void alc256_shutup(struct hda_codec *codec) hp_pin =0x21 ;alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ + +/* 3k pull low control for Headset jack. */ +/* NOTE: call this before clearing the pin, otherwise codec stalls */ +/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly +* when booting with headset plugged. So skip setting it for the codec alc257 +*/ +if (spec->en_3kpull_low) +alc_update_coef_idx (codec,0x46 ,0 ,3 <<12 ); + hp_pin_sense =snd_hda_jack_detect (codec, hp_pin);if (hp_pin_sense) {
@@ -3647,14 +3656,6 @@ static void alc256_shutup(struct hda_codec *codec)msleep (75 ); -/* 3k pull low control for Headset jack. */ -/* NOTE: call this before clearing the pin, otherwise codec stalls */ -/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly -* when booting with headset plugged. So skip setting it for the codec alc257 -*/ -if (spec->en_3kpull_low) -alc_update_coef_idx (codec,0x46 ,0 ,3 <<12 ); -if (!spec->no_shutup_pins)snd_hda_codec_write (codec, hp_pin,0 ,AC_VERB_SET_PIN_WIDGET_CONTROL ,0x0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 158/300 riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josephine Pfeiffer <[email protected]>
[ Upstream commit a74f038fa50e0d33b740f44f862fe856f16de6a8 ]
The pt_dump_seq_puts() macro incorrectly uses seq_printf() instead of seq_puts(). This is both a performance issue and conceptually wrong, as the macro name suggests plain string output (puts) but the implementation uses formatted output (printf).
The macro is used in ptdump.c:301 to output a newline character. Using seq_printf() adds unnecessary overhead for format string parsing when outputting this constant string.
This bug was introduced in commit 59c4da8640cc ("riscv: Add support to dump the kernel page tables") in 2020, which copied the implementation pattern from other architectures that had the same bug.
--- arch/riscv/mm/ptdump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/mm/ptdump.c +1 -1
@@ -22,7 +22,7 @@#define pt_dump_seq_puts (m, fmt) \ ({ \ if (m) \ - seq_printf(m, fmt); \ + seq_puts(m, fmt); \ })/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 159/300 net: vlan: sync VLAN features with lower device
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee ]
After registering a VLAN device and setting its feature flags, we need to synchronize the VLAN features with the lower device. For example, the VLAN device does not have the NETIF_F_LRO flag, it should be synchronized with the lower device based on the NETIF_F_UPPER_DISABLES definition.
As the dev->vlan_features has changed, we need to call netdev_update_features(). The caller must run after netdev_upper_dev_link() links the lower devices, so this patch adds the netdev_update_features() call in register_vlan_dev().
--- net/8021q/vlan.c | 2 ++ 1 file changed, 2 insertions(+)
net/8021q/vlan.c +2 -0
@@ -191,6 +191,8 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)vlan_group_set_device (grp, vlan->vlan_proto, vlan_id, dev); grp->nr_vlan_devs++; +netdev_update_features (dev); +return 0 ; out_unregister_netdev:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 160/300 net: dsa: b53: fix resetting speed and pause on forced link
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 ]
There is no guarantee that the port state override registers have their default values, as not all switches support being reset via register or have a reset GPIO.
So when forcing port config, we need to make sure to clear all fields, which we currently do not do for the speed and flow control configuration. This can cause flow control stay enabled, or in the case of speed becoming an illegal value, e.g. configured for 1G (0x2), then setting 100M (0x1), results in 0x3 which is invalid.
For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on supported chips, as the bit can have different meanings on other chips, e.g. for BCM5389 this controls scanning PHYs for link/speed configuration.
--- drivers/net/dsa/b53/b53_common.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/dsa/b53/b53_common.c +9 -0
@@ -1151,6 +1151,10 @@ static void b53_force_port_config(struct b53_device *dev, int port,else reg &= ~PORT_OVERRIDE_FULL_DUPLEX ; + reg &= ~(0x3 <<GMII_PO_SPEED_S ); +if (is5301x (dev) ||is58xx (dev)) + reg &= ~PORT_OVERRIDE_SPEED_2000M ; +switch (speed) {case 2000 : reg |=PORT_OVERRIDE_SPEED_2000M ;
@@ -1169,6 +1173,11 @@ static void b53_force_port_config(struct b53_device *dev, int port,return ; } +if (is5325 (dev)) + reg &= ~PORT_OVERRIDE_LP_FLOW_25 ; +else + reg &= ~(PORT_OVERRIDE_RX_FLOW |PORT_OVERRIDE_TX_FLOW ); +if (rx_pause) {if (is5325 (dev)) reg |=PORT_OVERRIDE_LP_FLOW_25 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 161/300 net: dsa: b53: fix enabling ip multicast
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit c264294624e956a967a9e2e5fa41e3273340b089 ]
In the New Control register bit 1 is either reserved, or has a different function:
Out of Range Error Discard
When enabled, the ingress port discards any frames if the Length field is between 1500 and 1536 (excluding 1500 and 1536) and with good CRC.
The actual bit for enabling IP multicast is bit 0, which was only explicitly enabled for BCM5325 so far.
For older switch chips, this bit defaults to 0, so we want to enable it as well, while newer switch chips default to 1, and their documentation says "It is illegal to set this bit to zero."
So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit also for other switch chips. While at it, rename it to (B53_)IP_MC as that is how it is called in Broadcom code.
--- drivers/net/dsa/b53/b53_common.c | 4 ++-- drivers/net/dsa/b53/b53_regs.h | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/net/dsa/b53/b53_common.c +2 -2
@@ -349,11 +349,11 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)* frames should be flooded or not. */ b53_read8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , &mgmt); - mgmt |=B53_UC_FWD_EN |B53_MC_FWD_EN |B53_IPMC_FWD_EN ; + mgmt |=B53_UC_FWD_EN |B53_MC_FWD_EN |B53_IP_MC ;b53_write8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , mgmt); }else {b53_read8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , &mgmt); - mgmt |=B53_IP_MCAST_25 ; + mgmt |=B53_IP_MC ;b53_write8 (dev,B53_CTRL_PAGE ,B53_IP_MULTICAST_CTRL , mgmt); } }
drivers/net/dsa/b53/b53_regs.h +1 -2
@@ -104,8 +104,7 @@/* IP Multicast control (8 bit) */ #define B53_IP_MULTICAST_CTRL 0x21 -#define B53_IP_MCAST_25 BIT(0) -#define B53_IPMC_FWD_EN BIT(1) +#define B53_IP_MC BIT(0)#define B53_UC_FWD_EN BIT(6)#define B53_MC_FWD_EN BIT(7)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 135/300 NFSv4.1: fix mount hang after CREATE_SESSION failure
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
When client initialization goes through server trunking discovery, it schedules the state manager and then sleeps waiting for nfs_client initialization completion.
The state manager can fail during state recovery, and specifically in lease establishment as nfs41_init_clientid() will bail out in case of errors returned from nfs4_proc_create_session(), without ever marking the client ready. The session creation can fail for a variety of reasons e.g. during backchannel parameter negotiation, with status -EINVAL.
The error status will propagate all the way to the nfs4_state_manager but the client status will not be marked, and thus the mount process will remain blocked waiting.
Fix it by adding -EINVAL error handling to nfs4_state_manager().
--- fs/nfs/nfs4state.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4state.c +3 -0
@@ -2724,6 +2724,9 @@ static void nfs4_state_manager(struct nfs_client *clp)case -ENETUNREACH :nfs_mark_client_ready (clp, -EIO );break ; +case -EINVAL : +nfs_mark_client_ready (clp, status); +break ;default :ssleep (1 );break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 162/300 net: dsa: b53: stop reading ARL entries if search is done
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da ]
The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it finished traversing the ARL table.
This means that there will be no valid result, so we should not attempt to read and process any further entries.
We only ever check the validity of the entries for 4 ARL bin chips, and only after having passed the first entry to the b53_fdb_copy().
This means that we always pass an invalid entry at the end to the b53_fdb_copy(). b53_fdb_copy() does check the validity though before passing on the entry, so it never gets passed on.
On < 4 ARL bin chips, we will even continue reading invalid entries until we reach the result limit.
--- drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/b53/b53_common.c +1 -1
@@ -1731,7 +1731,7 @@ static int b53_arl_search_wait(struct b53_device *dev) do { b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_CTL, ®); if (!(reg & ARL_SRCH_STDN)) - return 0; + return -ENOENT; if (reg & ARL_SRCH_VLID) return 0;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 163/300 sctp: Hold RCU read lock while iterating over address list
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <[email protected]>
[ Upstream commit 38f50242bf0f237cdc262308d624d333286ec3c5 ]
With CONFIG_PROVE_RCU_LIST=y and by executing
$ netcat -l --sctp & $ netcat --sctp localhost & $ ss --sctp
one can trigger the following Lockdep-RCU splat(s):
WARNING: suspicious RCU usage 6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted
-----------------------------
net/sctp/diag.c:76 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by ss/215:
#0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0 #1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200
stack backtrace: CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5d/0x90 lockdep_rcu_suspicious.cold+0x4e/0xa3 inet_sctp_diag_fill.isra.0+0x4b1/0x5d0 sctp_sock_dump+0x131/0x200 sctp_transport_traverse_process+0x170/0x1b0 ? __pfx_sctp_sock_filter+0x10/0x10 ? __pfx_sctp_sock_dump+0x10/0x10 sctp_diag_dump+0x103/0x140 __inet_diag_dump+0x70/0xb0 netlink_dump+0x148/0x490 __netlink_dump_start+0x1f3/0x2b0 inet_diag_handler_cmd+0xcd/0x100 ? __pfx_inet_diag_dump_start+0x10/0x10 ? __pfx_inet_diag_dump+0x10/0x10 ? __pfx_inet_diag_dump_done+0x10/0x10 sock_diag_rcv_msg+0x18e/0x320 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x4d/0x100 netlink_unicast+0x1d7/0x2b0 netlink_sendmsg+0x203/0x450 ____sys_sendmsg+0x30c/0x340 ___sys_sendmsg+0x94/0xf0 __sys_sendmsg+0x83/0xf0 do_syscall_64+0xbb/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK>
--- net/sctp/diag.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sctp/diag.c +4 -0
@@ -73,19 +73,23 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,struct nlattr *attr;void *info =NULL ; +rcu_read_lock ();list_for_each_entry_rcu (laddr, address_list, list) addrcnt++; +rcu_read_unlock (); attr =nla_reserve (skb,INET_DIAG_LOCALS , addrlen * addrcnt);if (!attr)return -EMSGSIZE ; info =nla_data (attr); +rcu_read_lock ();list_for_each_entry_rcu (laddr, address_list, list) {memcpy (info, &laddr->a,sizeof (laddr->a));memset (info +sizeof (laddr->a),0 , addrlen -sizeof (laddr->a)); info += addrlen; } +rcu_read_unlock ();return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 164/300 sctp: Prevent TOCTOU out-of-bounds write
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <[email protected]>
[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use).
--- net/sctp/diag.c | 3 +++ 1 file changed, 3 insertions(+)
net/sctp/diag.c +3 -0
@@ -88,6 +88,9 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,memcpy (info, &laddr->a,sizeof (laddr->a));memset (info +sizeof (laddr->a),0 , addrlen -sizeof (laddr->a)); info += addrlen; + +if (!--addrcnt) +break ; }rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 165/300 net: sctp: Fix some typos
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Wei <[email protected]>
[ Upstream commit 21c00a186fac6e035eef5e6751f1e2d2609f969c ]
Modify "unkown" to "unknown" in net/sctp/sm_make_chunk.c and Modify "orginal" to "original" in net/sctp/socket.c.
Stable-dep-of: f1fc201148c7 ("sctp: Hold sock lock while iterating over address list")
--- net/sctp/sm_make_chunk.c | 2 +- net/sctp/socket.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/sctp/sm_make_chunk.c +1 -1
@@ -3206,7 +3206,7 @@ bool sctp_verify_asconf(const struct sctp_association *asoc,return false;break ;default : -/* This is unkown to us, reject! */ +/* This is unknown to us, reject! */ return false; } }
net/sctp/socket.c +1 -1
@@ -9266,7 +9266,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,if (newsk->sk_flags &SK_FLAGS_TIMESTAMP )net_enable_timestamp (); -/* Set newsk security attributes from orginal sk and connection +/* Set newsk security attributes from original sk and connection * security attribute from ep. */ security_sctp_sk_clone (ep, sk, newsk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 166/300 net: Use nlmsg_unicast() instead of netlink_unicast()
In reply to Greg Kroah-Hartman5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yajun Deng <[email protected]>
[ Upstream commit 01757f536ac825e3614d583fee9acb48c64ed084 ]
It has 'if (err >0 )' statement in nlmsg_unicast(), so use nlmsg_unicast() instead of netlink_unicast(), this looks more concise.
v2: remove the change in netfilter.
Stable-dep-of: f1fc201148c7 ("sctp: Hold sock lock while iterating over address list")
--- net/ipv4/fib_frontend.c | 2 +- net/ipv4/inet_diag.c | 5 +---- net/ipv4/raw_diag.c | 7 ++----- net/ipv4/udp_diag.c | 6 ++---- net/mptcp/mptcp_diag.c | 6 ++---- net/netlink/af_netlink.c | 2 +- net/sctp/diag.c | 6 ++---- net/unix/diag.c | 6 ++---- 8 files changed, 13 insertions(+), 27 deletions(-)
net/ipv4/fib_frontend.c +1 -1
@@ -1400,7 +1400,7 @@ static void nl_fib_input(struct sk_buff *skb) portid =NETLINK_CB (skb).portid;/* netlink portid */ NETLINK_CB (skb).portid =0 ;/* from kernel */ NETLINK_CB (skb).dst_group =0 ;/* unicast */ -netlink_unicast (net->ipv4.fibnl, skb, portid,MSG_DONTWAIT ); +nlmsg_unicast (net->ipv4.fibnl, skb, portid); }static int __net_init nl_fib_lookup_init (struct net *net)
net/ipv4/inet_diag.c +1 -4
@@ -572,10 +572,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo,nlmsg_free (rep); goto out; } - err =netlink_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); out:if (sk)
net/ipv4/raw_diag.c +2 -5
@@ -119,11 +119,8 @@ static int raw_diag_dump_one(struct netlink_callback *cb,return err; } - err =netlink_unicast (net->diag_nlsk, rep, -NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); +return err; }
net/ipv4/udp_diag.c +2 -4
@@ -77,10 +77,8 @@ static int udp_dump_one(struct udp_table *tbl,kfree_skb (rep); goto out; } - err =netlink_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); + out:if (sk)sock_put (sk);
net/mptcp/mptcp_diag.c +2 -4
@@ -57,10 +57,8 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb,kfree_skb (rep); goto out; } - err =netlink_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); + out:sock_put (sk);
net/netlink/af_netlink.c +1 -1
@@ -2470,7 +2470,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,nlmsg_end (skb, rep); -netlink_unicast (in_skb->sk, skb,NETLINK_CB (in_skb).portid,MSG_DONTWAIT ); +nlmsg_unicast (in_skb->sk, skb,NETLINK_CB (in_skb).portid); }EXPORT_SYMBOL (netlink_ack);
net/sctp/diag.c +2 -4
@@ -288,10 +288,8 @@ static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p) goto out; } - err =netlink_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); + out:return err; }
net/unix/diag.c +2 -4
@@ -299,10 +299,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb, goto again; } - err =netlink_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid, -MSG_DONTWAIT ); -if (err >0 ) - err =0 ; + err =nlmsg_unicast (net->diag_nlsk, rep,NETLINK_CB (in_skb).portid); + out:if (sk)sock_put (sk);
Signature · 1 line
2.51.0