6.12.68-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 1/169 posix-clock: Store file pointer in struct posix_clock_context
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit e859d375d1694488015e6804bfeea527a0b25b9f ]
File descriptor based pc_clock_*() operations of dynamic posix clocks have access to the file pointer and implement permission checks in the generic code before invoking the relevant dynamic clock callback.
Character device operations (open, read, poll, ioctl) do not implement a generic permission control and the dynamic clock callbacks have no access to the file pointer to implement them.
Extend struct posix_clock_context with a struct file pointer and initialize it in posix_clock_open(), so that all dynamic clock callbacks can access it.
--- include/linux/posix-clock.h | 6 +++++- kernel/time/posix-clock.c | 1 + 2 files changed, 6 insertions(+), 1 deletion(-)
include/linux/posix-clock.h +5 -1
@@ -95,10 +95,13 @@ struct posix_clock {* struct posix_clock_context - represents clock file operations context * * @clk: Pointer to the clock +* @fp: Pointer to the file used to open the clock * @private_clkdata: Pointer to user data * * Drivers should use struct posix_clock_context during specific character -* device file operation methods to access the posix clock. +* device file operation methods to access the posix clock. In particular, +* the file pointer can be used to verify correct access mode for ioctl() +* calls. * * Drivers can store a private data structure during the open operation * if they have specific information that is required in other file
@@ -106,6 +109,7 @@ struct posix_clock {*/ struct posix_clock_context {struct posix_clock *clk; +struct file *fp;void *private_clkdata; };
kernel/time/posix-clock.c +1 -0
@@ -129,6 +129,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) goto out; } pccontext->clk = clk; + pccontext->fp = fp;if (clk->ops.open) { err = clk->ops.open (pccontext, fp->f_mode);if (err) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/169 ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit b4e53b15c04e3852949003752f48f7a14ae39e86 ]
Many devices implement highly accurate clocks, which the kernel manages as PTP Hardware Clocks (PHCs). Userspace applications rely on these clocks to timestamp events, trace workload execution, correlate timescales across devices, and keep various clocks in sync.
The kernel’s current implementation of PTP clocks does not enforce file permissions checks for most device operations except for POSIX clock operations, where file mode is verified in the POSIX layer before forwarding the call to the PTP subsystem. Consequently, it is common practice to not give unprivileged userspace applications any access to PTP clocks whatsoever by giving the PTP chardevs 600 permissions. An example of users running into this limitation is documented in [1]. Additionally, POSIX layer requires WRITE permission even for readonly adjtime() calls which are used in PTP layer to return current frequency offset applied to the PHC.
Add permission checks for functions that modify the state of a PTP device. Continue enforcing permission checks for POSIX clock operations (settime, adjtime) in the POSIX layer. Only require WRITE access for dynamic clocks adjtime() if any flags are set in the modes field.
[1] https://lists.nwtime.org/sympa/arc/linuxptp-users/2024-01/msg00036.html
Changes in v4:
- Require FMODE_WRITE in ajtime() only for calls modifying the clock in any way.
--- drivers/ptp/ptp_chardev.c | 16 ++++++++++++++++ kernel/time/posix-clock.c | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-)
drivers/ptp/ptp_chardev.c +16 -0
@@ -205,6 +205,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_EXTTS_REQUEST :case PTP_EXTTS_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.extts, (void __user *)arg,
@@ -246,6 +250,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PEROUT_REQUEST :case PTP_PEROUT_REQUEST2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req)); if (copy_from_user(&req.perout, (void __user *)arg,
@@ -314,6 +322,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_ENABLE_PPS :case PTP_ENABLE_PPS2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }memset (&req,0 ,sizeof (req));if (!capable (CAP_SYS_TIME ))
@@ -456,6 +468,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,case PTP_PIN_SETFUNC :case PTP_PIN_SETFUNC2 : +if ((pccontext->fp->f_mode &FMODE_WRITE ) ==0 ) { + err = -EACCES ; +break ; + }if (copy_from_user (&pd, (void __user *)arg,sizeof (pd))) { err = -EFAULT ;break ;
kernel/time/posix-clock.c +1 -1
@@ -252,7 +252,7 @@ static int pc_clock_adjtime(clockid_t id, struct __kernel_timex *tx)if (err)return err; -if ((cd.fp->f_mode &FMODE_WRITE ) ==0 ) { +if (tx->modes && (cd.fp->f_mode &FMODE_WRITE ) ==0 ) { err = -EACCES ; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/169 selftest/ptp: update ptp selftest to exercise the gettimex options
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <[email protected]>
[ Upstream commit 3d07b691ee707c00afaf365440975e81bb96cd9b ]
With the inclusion of commit c259acab839e ("ptp/ioctl: support MONOTONIC{,_RAW} timestamps for PTP_SYS_OFFSET_EXTENDED") clock_gettime() now allows retrieval of pre/post timestamps for CLOCK_MONOTONIC and CLOCK_MONOTONIC_RAW timebases along with the previously supported CLOCK_REALTIME.
This patch adds a command line option 'y' to the testptp program to choose one of the allowed timebases [realtime aka system, monotonic, and monotonic-raw).
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
--- tools/testing/selftests/ptp/testptp.c | 62 ++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 5 deletions(-)
tools/testing/selftests/ptp/testptp.c +57 -5
@@ -146,6 +146,7 @@ static void usage(char *progname)" -T val set the ptp clock time to 'val' seconds\n" " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n" " -X get a ptp clock cross timestamp\n" +" -y val pre/post tstamp timebase to use {realtime|monotonic|monotonic-raw}\n" " -z test combinations of rising/falling external time stamp flags\n" , progname, PTP_MAX_SAMPLES); }
@@ -189,6 +190,7 @@ int main(int argc, char *argv[])int seconds =0 ;int settime =0 ;int channel =-1 ; +clockid_t ext_clockid =CLOCK_REALTIME ;int64_t t1, t2, tp;int64_t interval, offset;
@@ -198,7 +200,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -278,6 +280,21 @@ int main(int argc, char *argv[])case 'X' : getcross =1 ;break ; +case 'y' : +if (!strcasecmp (optarg,"realtime" )) + ext_clockid =CLOCK_REALTIME ; +else if (!strcasecmp (optarg,"monotonic" )) + ext_clockid =CLOCK_MONOTONIC ; +else if (!strcasecmp (optarg,"monotonic-raw" )) + ext_clockid =CLOCK_MONOTONIC_RAW ; +else { +fprintf (stderr, +"type needs to be realtime, monotonic or monotonic-raw; was given %s\n" , + optarg); +return -1 ; + } +break ; +case 'z' : flagtest =1 ;break ;
@@ -566,6 +583,7 @@ int main(int argc, char *argv[]) } soe->n_samples = getextended; + soe->clockid = ext_clockid;if (ioctl (fd,PTP_SYS_OFFSET_EXTENDED , soe)) {perror ("PTP_SYS_OFFSET_EXTENDED" );
@@ -574,12 +592,46 @@ int main(int argc, char *argv[]) getextended);for (i =0 ; i < getextended; i++) { -printf ("sample #%2d: system time before: %lld.%09u\n" , - i, soe->ts[i][0 ].sec, soe->ts[i][0 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf ("sample #%2d: real time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf ("sample #%2d: monotonic time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf ("sample #%2d: monotonic-raw time before: %lld.%09u\n" , + i, soe->ts[i][0 ].sec, + soe->ts[i][0 ].nsec); +break ; +default : +break ; + }printf (" phc time: %lld.%09u\n" , soe->ts[i][1 ].sec, soe->ts[i][1 ].nsec); -printf (" system time after: %lld.%09u\n" , - soe->ts[i][2 ].sec, soe->ts[i][2 ].nsec); +switch (ext_clockid) { +case CLOCK_REALTIME : +printf (" real time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC : +printf (" monotonic time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +case CLOCK_MONOTONIC_RAW : +printf (" monotonic-raw time after: %lld.%09u\n" , + soe->ts[i][2 ].sec, + soe->ts[i][2 ].nsec); +break ; +default : +break ; + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/169 testptp: Add option to open PHC in readonly mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <[email protected]>
[ Upstream commit 76868642e42795353106197abf9c607ad80f4c9e ]
PTP Hardware Clocks no longer require WRITE permission to perform readonly operations, such as listing device capabilities or listening to EXTTS events once they have been enabled by a process with WRITE permissions.
Add '-r' option to testptp to open the PHC in readonly mode instead of the default read-write mode. Skip enabling EXTTS if readonly mode is requested.
--- tools/testing/selftests/ptp/testptp.c | 37 +++++++++++++++++---------- 1 file changed, 23 insertions(+), 14 deletions(-)
tools/testing/selftests/ptp/testptp.c +23 -14
@@ -140,6 +140,7 @@ static void usage(char *progname)" -H val set output phase to 'val' nanoseconds (requires -p)\n" " -w val set output pulse width to 'val' nanoseconds (requires -p)\n" " -P val enable or disable (val=1|0) the system clock PPS\n" +" -r open the ptp clock in readonly mode\n" " -s set the ptp clock time from the system time\n" " -S set the system time from the ptp clock time\n" " -t val shift the ptp clock time by 'val' seconds\n"
@@ -188,6 +189,7 @@ int main(int argc, char *argv[])int pin_index =-1 , pin_func;int pps =-1 ;int seconds =0 ; +int readonly =0 ;int settime =0 ;int channel =-1 ;clockid_t ext_clockid =CLOCK_REALTIME ;
@@ -200,7 +202,7 @@ int main(int argc, char *argv[]) progname =strrchr (argv[0 ],'/' ); progname = progname ?1 +progname : argv[0 ]; -while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z" ))) { +while (EOF != (c =getopt (argc, argv,"cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xy:z" ))) {switch (c) {case 'c' : capabilities =1 ;
@@ -252,6 +254,9 @@ int main(int argc, char *argv[])case 'P' : pps =atoi (optarg);break ; +case 'r' : + readonly =1 ; +break ;case 's' : settime =1 ;break ;
@@ -308,7 +313,7 @@ int main(int argc, char *argv[]) } } - fd =open (device,O_RDWR ); + fd =open (device, readonly ?O_RDONLY :O_RDWR );if (fd <0 ) {fprintf (stderr,"opening %s: %s\n" , device,strerror (errno));return -1 ;
@@ -436,14 +441,16 @@ int main(int argc, char *argv[]) }if (extts) { -memset (&extts_request,0 ,sizeof (extts_request)); - extts_request.index = index; - extts_request.flags =PTP_ENABLE_FEATURE ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); - extts =0 ; - }else { -puts ("external time stamp request okay" ); +if (!readonly) { +memset (&extts_request,0 ,sizeof (extts_request)); + extts_request.index = index; + extts_request.flags =PTP_ENABLE_FEATURE ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + extts =0 ; + }else { +puts ("external time stamp request okay" ); + } }for (; extts; extts--) { cnt =read (fd, &event,sizeof (event));
@@ -455,10 +462,12 @@ int main(int argc, char *argv[]) event.t.sec, event.t.nsec);fflush (stdout); } -/* Disable the feature again. */ - extts_request.flags =0 ; -if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { -perror ("PTP_EXTTS_REQUEST" ); +if (!readonly) { +/* Disable the feature again. */ + extts_request.flags =0 ; +if (ioctl (fd,PTP_EXTTS_REQUEST , &extts_request)) { +perror ("PTP_EXTTS_REQUEST" ); + } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/169 dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <[email protected]>
[ Upstream commit 134e9d035d830aabd1121bcda89f7ee9a476d3a3 ]
Document the RPMh Power Domains on the SM8750 Platform.
Message-ID: <[email protected]>
Stable-dep-of: 5bc3e720e725 ("pmdomain: qcom: rpmhpd: Add MXC to SC8280XP")
--- Documentation/devicetree/bindings/power/qcom,rpmpd.yaml | 1 + include/dt-bindings/power/qcom-rpmpd.h | 2 ++ 2 files changed, 3 insertions(+)
Documentation/devicetree/bindings/power/qcom,rpmpd.yaml +1 -0
@@ -58,6 +58,7 @@ properties: - qcom,sm8450-rpmhpd - qcom,sm8550-rpmhpd - qcom,sm8650-rpmhpd + - qcom,sm8750-rpmhpd - qcom,x1e80100-rpmhpd - items: - enum:
include/dt-bindings/power/qcom-rpmpd.h +2 -0
@@ -218,6 +218,7 @@/* SDM845 Power Domain performance levels */ #define RPMH_REGULATOR_LEVEL_RETENTION 16#define RPMH_REGULATOR_LEVEL_MIN_SVS 48 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D3 50#define RPMH_REGULATOR_LEVEL_LOW_SVS_D2 52#define RPMH_REGULATOR_LEVEL_LOW_SVS_D1 56#define RPMH_REGULATOR_LEVEL_LOW_SVS_D0 60
@@ -238,6 +239,7 @@#define RPMH_REGULATOR_LEVEL_TURBO_L1 416#define RPMH_REGULATOR_LEVEL_TURBO_L2 432#define RPMH_REGULATOR_LEVEL_TURBO_L3 448 +#define RPMH_REGULATOR_LEVEL_TURBO_L4 452#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/169 dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit 1c402295c10891988fb2a6fc658e6e95d4852a20 ]
Update the RPMH level definitions to include TURBO_L5 corner.
Patchwork: https://patchwork.freedesktop.org/patch/661840/
Stable-dep-of: 5bc3e720e725 ("pmdomain: qcom: rpmhpd: Add MXC to SC8280XP")
--- include/dt-bindings/power/qcom-rpmpd.h | 1 + 1 file changed, 1 insertion(+)
include/dt-bindings/power/qcom-rpmpd.h +1 -0
@@ -240,6 +240,7 @@#define RPMH_REGULATOR_LEVEL_TURBO_L2 432#define RPMH_REGULATOR_LEVEL_TURBO_L3 448#define RPMH_REGULATOR_LEVEL_TURBO_L4 452 +#define RPMH_REGULATOR_LEVEL_TURBO_L5 456#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/169 dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit dcb8d01b65fb5a891ddbbedcbe6eff0b8ec37867 ]
Historically both RPM and RPMh domain definitions were a part of the same, qcom-rpmpd.h header. Now as we have a separate header for RPMh definitions, qcom,rpmhpd.h, move all RPMh power domain definitions to that header.
Stable-dep-of: 5bc3e720e725 ("pmdomain: qcom: rpmhpd: Add MXC to SC8280XP")
--- include/dt-bindings/power/qcom,rpmhpd.h | 233 ++++++++++++++++++++++++ include/dt-bindings/power/qcom-rpmpd.h | 228 +---------------------- 2 files changed, 234 insertions(+), 227 deletions(-)
include/dt-bindings/power/qcom,rpmhpd.h +233 -0
@@ -29,4 +29,237 @@#define RPMHPD_NSP2 19#define RPMHPD_GMXC 20 +/* RPMh Power Domain performance levels */ +#define RPMH_REGULATOR_LEVEL_RETENTION 16 +#define RPMH_REGULATOR_LEVEL_MIN_SVS 48 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D3 50 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D2 52 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D1 56 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_D0 60 +#define RPMH_REGULATOR_LEVEL_LOW_SVS 64 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_P1 72 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_L1 80 +#define RPMH_REGULATOR_LEVEL_LOW_SVS_L2 96 +#define RPMH_REGULATOR_LEVEL_SVS 128 +#define RPMH_REGULATOR_LEVEL_SVS_L0 144 +#define RPMH_REGULATOR_LEVEL_SVS_L1 192 +#define RPMH_REGULATOR_LEVEL_SVS_L2 224 +#define RPMH_REGULATOR_LEVEL_NOM 256 +#define RPMH_REGULATOR_LEVEL_NOM_L0 288 +#define RPMH_REGULATOR_LEVEL_NOM_L1 320 +#define RPMH_REGULATOR_LEVEL_NOM_L2 336 +#define RPMH_REGULATOR_LEVEL_TURBO 384 +#define RPMH_REGULATOR_LEVEL_TURBO_L0 400 +#define RPMH_REGULATOR_LEVEL_TURBO_L1 416 +#define RPMH_REGULATOR_LEVEL_TURBO_L2 432 +#define RPMH_REGULATOR_LEVEL_TURBO_L3 448 +#define RPMH_REGULATOR_LEVEL_TURBO_L4 452 +#define RPMH_REGULATOR_LEVEL_TURBO_L5 456 +#define RPMH_REGULATOR_LEVEL_SUPER_TURBO 464 +#define RPMH_REGULATOR_LEVEL_SUPER_TURBO_NO_CPR 480 + +/* +* Platform-specific power domain bindings. Don't add new entries here, use +* RPMHPD_* above. +*/ + +/* SA8775P Power Domain Indexes */ +#define SA8775P_CX 0 +#define SA8775P_CX_AO 1 +#define SA8775P_DDR 2 +#define SA8775P_EBI 3 +#define SA8775P_GFX 4 +#define SA8775P_LCX 5 +#define SA8775P_LMX 6 +#define SA8775P_MMCX 7 +#define SA8775P_MMCX_AO 8 +#define SA8775P_MSS 9 +#define SA8775P_MX 10 +#define SA8775P_MX_AO 11 +#define SA8775P_MXC 12 +#define SA8775P_MXC_AO 13 +#define SA8775P_NSP0 14 +#define SA8775P_NSP1 15 +#define SA8775P_XO 16 + +/* SDM670 Power Domain Indexes */ +#define SDM670_MX 0 +#define SDM670_MX_AO 1 +#define SDM670_CX 2 +#define SDM670_CX_AO 3 +#define SDM670_LMX 4 +#define SDM670_LCX 5 +#define SDM670_GFX 6 +#define SDM670_MSS 7 + +/* SDM845 Power Domain Indexes */ +#define SDM845_EBI 0 +#define SDM845_MX 1 +#define SDM845_MX_AO 2 +#define SDM845_CX 3 +#define SDM845_CX_AO 4 +#define SDM845_LMX 5 +#define SDM845_LCX 6 +#define SDM845_GFX 7 +#define SDM845_MSS 8 + +/* SDX55 Power Domain Indexes */ +#define SDX55_MSS 0 +#define SDX55_MX 1 +#define SDX55_CX 2 + +/* SDX65 Power Domain Indexes */ +#define SDX65_MSS 0 +#define SDX65_MX 1 +#define SDX65_MX_AO 2 +#define SDX65_CX 3 +#define SDX65_CX_AO 4 +#define SDX65_MXC 5 + +/* SM6350 Power Domain Indexes */ +#define SM6350_CX 0 +#define SM6350_GFX 1 +#define SM6350_LCX 2 +#define SM6350_LMX 3 +#define SM6350_MSS 4 +#define SM6350_MX 5 + +/* SM8150 Power Domain Indexes */ +#define SM8150_MSS 0 +#define SM8150_EBI 1 +#define SM8150_LMX 2 +#define SM8150_LCX 3 +#define SM8150_GFX 4 +#define SM8150_MX 5 +#define SM8150_MX_AO 6 +#define SM8150_CX 7 +#define SM8150_CX_AO 8 +#define SM8150_MMCX 9 +#define SM8150_MMCX_AO 10 + +/* SA8155P is a special case, kept for backwards compatibility */ +#define SA8155P_CX SM8150_CX +#define SA8155P_CX_AO SM8150_CX_AO +#define SA8155P_EBI SM8150_EBI +#define SA8155P_GFX SM8150_GFX +#define SA8155P_MSS SM8150_MSS +#define SA8155P_MX SM8150_MX +#define SA8155P_MX_AO SM8150_MX_AO + +/* SM8250 Power Domain Indexes */ +#define SM8250_CX 0 +#define SM8250_CX_AO 1 +#define SM8250_EBI 2 +#define SM8250_GFX 3 +#define SM8250_LCX 4 +#define SM8250_LMX 5 +#define SM8250_MMCX 6 +#define SM8250_MMCX_AO 7 +#define SM8250_MX 8 +#define SM8250_MX_AO 9 + +/* SM8350 Power Domain Indexes */ +#define SM8350_CX 0 +#define SM8350_CX_AO 1 +#define SM8350_EBI 2 +#define SM8350_GFX 3 +#define SM8350_LCX 4 +#define SM8350_LMX 5 +#define SM8350_MMCX 6 +#define SM8350_MMCX_AO 7 +#define SM8350_MX 8 +#define SM8350_MX_AO 9 +#define SM8350_MXC 10 +#define SM8350_MXC_AO 11 +#define SM8350_MSS 12 + +/* SM8450 Power Domain Indexes */ +#define SM8450_CX 0 +#define SM8450_CX_AO 1 +#define SM8450_EBI 2 +#define SM8450_GFX 3 +#define SM8450_LCX 4 +#define SM8450_LMX 5 +#define SM8450_MMCX 6 +#define SM8450_MMCX_AO 7 +#define SM8450_MX 8 +#define SM8450_MX_AO 9 +#define SM8450_MXC 10 +#define SM8450_MXC_AO 11 +#define SM8450_MSS 12 + +/* SM8550 Power Domain Indexes */ +#define SM8550_CX 0 +#define SM8550_CX_AO 1 +#define SM8550_EBI 2 +#define SM8550_GFX 3 +#define SM8550_LCX 4 +#define SM8550_LMX 5 +#define SM8550_MMCX 6 +#define SM8550_MMCX_AO 7 +#define SM8550_MX 8 +#define SM8550_MX_AO 9 +#define SM8550_MXC 10 +#define SM8550_MXC_AO 11 +#define SM8550_MSS 12 +#define SM8550_NSP 13 + +/* QDU1000/QRU1000 Power Domain Indexes */ +#define QDU1000_EBI 0 +#define QDU1000_MSS 1 +#define QDU1000_CX 2 +#define QDU1000_MX 3 + +/* SC7180 Power Domain Indexes */ +#define SC7180_CX 0 +#define SC7180_CX_AO 1 +#define SC7180_GFX 2 +#define SC7180_MX 3 +#define SC7180_MX_AO 4 +#define SC7180_LMX 5 +#define SC7180_LCX 6 +#define SC7180_MSS 7 + +/* SC7280 Power Domain Indexes */ +#define SC7280_CX 0 +#define SC7280_CX_AO 1 +#define SC7280_EBI 2 +#define SC7280_GFX 3 +#define SC7280_MX 4 +#define SC7280_MX_AO 5 +#define SC7280_LMX 6 +#define SC7280_LCX 7 +#define SC7280_MSS 8 + +/* SC8180X Power Domain Indexes */ +#define SC8180X_CX 0 +#define SC8180X_CX_AO 1 +#define SC8180X_EBI 2 +#define SC8180X_GFX 3 +#define SC8180X_LCX 4 +#define SC8180X_LMX 5 +#define SC8180X_MMCX 6 +#define SC8180X_MMCX_AO 7 +#define SC8180X_MSS 8 +#define SC8180X_MX 9 +#define SC8180X_MX_AO 10 + +/* SC8280XP Power Domain Indexes */ +#define SC8280XP_CX 0 +#define SC8280XP_CX_AO 1 +#define SC8280XP_DDR 2 +#define SC8280XP_EBI 3 +#define SC8280XP_GFX 4 +#define SC8280XP_LCX 5 +#define SC8280XP_LMX 6 +#define SC8280XP_MMCX 7 +#define SC8280XP_MMCX_AO 8 +#define SC8280XP_MSS 9 +#define SC8280XP_MX 10 +#define SC8280XP_MXC 12 +#define SC8280XP_MX_AO 11 +#define SC8280XP_NSP 13 +#define SC8280XP_QPHY 14 +#define SC8280XP_XO 15 +#endif
include/dt-bindings/power/qcom-rpmpd.h +1 -227
240 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/169 dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 45e1be5ddec98db71e7481fa7a3005673200d85c ]
Not sure how useful it's gonna be in practice, but the definition is missing (unlike the previously-unused SC8280XP_MXC-non-_AO), so add it to allow the driver to create the corresponding pmdomain.
Stable-dep-of: 5bc3e720e725 ("pmdomain: qcom: rpmhpd: Add MXC to SC8280XP")
--- include/dt-bindings/power/qcom,rpmhpd.h | 1 + 1 file changed, 1 insertion(+)
include/dt-bindings/power/qcom,rpmhpd.h +1 -0
@@ -261,5 +261,6 @@#define SC8280XP_NSP 13#define SC8280XP_QPHY 14#define SC8280XP_XO 15 +#define SC8280XP_MXC_AO 16#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainercover 6.12.68-rc1 review
This is the start of the stable review cycle for the 6.12.68 release. There are 169 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 30 Jan 2026 14:53:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.68-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.68-rc1
Will Deacon <[email protected]>
vsock/virtio: Fix message iterator handling on transmit path
Will Deacon <[email protected]>
net: Introduce skb_copy_datagram_from_iter_full()
Will Deacon <[email protected]>
vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
Will Deacon <[email protected]>
vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
Will Deacon <[email protected]>
vsock/virtio: Rename virtio_vsock_skb_rx_put()
Will Deacon <[email protected]>
vsock/virtio: Move SKB allocation lower-bound check to callers
Will Deacon <[email protected]>
vsock/virtio: Rename virtio_vsock_alloc_skb()
Will Deacon <[email protected]>
vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
P Praneesh <[email protected]>
wifi: ath11k: fix RCU stall while reaping monitor destination ring
Boris Burkov <[email protected]>
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Tomasz Rusinowicz <[email protected]>
accel/ivpu: Fix race condition when unbinding BOs
Bartlomiej Kubik <[email protected]>
fs/ntfs3: Initialize allocated memory before use
Zqiang <[email protected]>
sched_ext: Fix possible deadlock in the deferred_irq_workfn()
Shuhao Fu <[email protected]>
exfat: fix refcount leak in exfat_find
Johan Hovold <[email protected]>
iio: adc: exynos_adc: fix OF populate on driver rebind
Rasmus Villemoes <[email protected]>
iio: core: add separate lockdep class for info_exist_lock
Andy Shevchenko <[email protected]>
iio: core: Replace lockdep_set_class() + mutex_init() by combined call
Andy Shevchenko <[email protected]>
iio: core: add missing mutex_destroy in iio_dev_release()
Geraldo Nascimento <[email protected]>
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
Daniel Borkmann <[email protected]>
bpf: Do not let BPF test infra emit invalid GSO types to stack
Ihor Solodrai <[email protected]>
selftests/bpf: Check for timeout in perf_link test
Marc Kleine-Budde <[email protected]>
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
Siddharth Vadapalli <[email protected]>
dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA
Matthew Wilcox (Oracle) <[email protected]>
migrate: correct lock ordering for hugetlb file folios
Tzung-Bi Shih <[email protected]>
gpio: cdev: Correct return code on memory allocation failure
Likun Gao <[email protected]>
drm/amdgpu: remove frame cntl for gfx v12
Marc Kleine-Budde <[email protected]>
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <[email protected]>
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
Hamza Mahfooz <[email protected]>
net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
Arnd Bergmann <[email protected]>
irqchip/gic-v3-its: Avoid truncating memory addresses
Fernand Sieber <[email protected]>
perf/x86/intel: Do not enable BTS for guests
Ming Qian <[email protected]>
pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix automatic module loading
Jeongjun Park <[email protected]>
netrom: fix double-free in nr_route_frame()
Chenghai Huang <[email protected]>
uacce: ensure safe queue release with state management
Yang Shen <[email protected]>
uacce: implement mremap in uacce_vm_ops to return -EPERM
Chenghai Huang <[email protected]>
uacce: fix isolate sysfs check condition
Wenkai Lin <[email protected]>
uacce: fix cdev handling in the cleanup path
Harald Freudenberger <[email protected]>
s390/ap: Fix wrong APQN fill calculation
Alexander Usyskin <[email protected]>
mei: trace: treat reg parameter as string
Johan Hovold <[email protected]>
intel_th: fix device leak on output open()
Steven Rostedt <[email protected]>
tracing: Fix crash on synthetic stacktrace field usage
Johan Hovold <[email protected]>
slimbus: core: fix device reference leak on report present
Johan Hovold <[email protected]>
slimbus: core: fix runtime PM imbalance on report present
Thomas Fourier <[email protected]>
octeontx2: Fix otx2_dma_map_page() error return code
Zhaoyang Huang <[email protected]>
arm64: Set __nocfi on swsusp_arch_resume()
Mark Rutland <[email protected]>
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
Marek Vasut <[email protected]>
wifi: rsi: Fix memory corruption due to not set vif driver data size
Dan Carpenter <[email protected]>
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
Thomas Fourier <[email protected]>
wifi: ath12k: fix dma_free_coherent() pointer
Thomas Fourier <[email protected]>
wifi: ath10k: fix dma_free_coherent() pointer
Lyude Paul <[email protected]>
drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
Matthew Schwartz <[email protected]>
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
Berk Cem Goksel <[email protected]>
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
Samasth Norway Ananda <[email protected]>
ALSA: scarlett2: Fix buffer overflow in config retrieval
Takashi Iwai <[email protected]>
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
Kübrich, Andreas <[email protected]>
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
Fiona Klute <[email protected]>
iio: chemical: scd4x: fix reported channel endianness
Thorsten Blum <[email protected]>
iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
Pei Xiao <[email protected]>
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
Tomas Melin <[email protected]>
iio: adc: ad9467: fix ad9434 vref mask
Markus Koeniger <[email protected]>
iio: accel: iis328dq: fix gain values
Francesco Lavra <[email protected]>
iio: accel: adxl380: fix handling of unavailable "INT1" interrupt
Rob Herring (Arm) <[email protected]>
of: platform: Use default match table for /firmware
Weigang He <[email protected]>
of: fix reference count leak in of_alias_scan()
Hans de Goede <[email protected]>
leds: led-class: Only Add LED to leds_list when it is fully ready
Srish Srinivasan <[email protected]>
keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
Eric Biggers <[email protected]>
tpm: Compare HMAC values in constant time
Cedric Xing <[email protected]>
x86: make page fault handling disable interrupts properly
Ivan Vecera <[email protected]>
dpll: Prevent duplicate registrations
Eric Dumazet <[email protected]>
net/sched: act_ife: avoid possible NULL deref
Melbin K Mathew <[email protected]>
vsock/virtio: cap TX credit to local buffer size
Stefano Garzarella <[email protected]>
vsock/test: fix seqpacket message bounds test
Melbin K Mathew <[email protected]>
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
David Yang <[email protected]>
net: openvswitch: fix data race in ovs_vport_get_upcall_stats
Ratheesh Kannoth <[email protected]>
octeontx2-af: Fix error handling
Vladimir Oltean <[email protected]>
net: dsa: fix off-by-one in maximum bridge ID determination
Eric Dumazet <[email protected]>
bonding: provide a net pointer to __skb_flow_dissect()
Taehee Yoo <[email protected]>
selftests: net: amt: wait longer for connection before sending packets
Andrey Vatoropin <[email protected]>
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
Alex Ramírez <[email protected]>
drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors
Alex Ramírez <[email protected]>
drm/nouveau: add missing DCB connector types
Timur Kristóf <[email protected]>
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
Timur Kristóf <[email protected]>
drm/amd/pm: Don't clear SI SMC table when setting power limit
Vincent Guittot <[email protected]>
sched/fair: Fix pelt clock sync when entering idle
Thomas Gleixner <[email protected]>
clocksource: Reduce watchdog readout delay limit to prevent false positives
Laurent Vivier <[email protected]>
usbnet: limit max_mtu based on device's hard_mtu
Eric Dumazet <[email protected]>
ipv6: annotate data-race in ndisc_router_discovery()
Eric Dumazet <[email protected]>
mISDN: annotate data-race around dev->work
Jijie Shao <[email protected]>
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
Jijie Shao <[email protected]>
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
David Yang <[email protected]>
be2net: fix data race in be_get_new_eqd
David Yang <[email protected]>
net: hns3: fix data race in hns3_fetch_stats
Cody Haas <[email protected]>
ice: Fix persistent failure in ice_get_rxfh
Yun Lu <[email protected]>
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
Brajesh Gupta <[email protected]>
drm/imagination: Wait for FW trace update command completion
Arun Raghavan <[email protected]>
ALSA: usb: Increase volume range that triggers a warning
Jiasheng Jiang <[email protected]>
scsi: qla2xxx: Sanitize payload size to prevent member overflow
David Jeffery <[email protected]>
scsi: core: Wake up the error handler when final completions race against each other
Zilin Guan <[email protected]>
platform/x86/amd: Fix memory leak in wbrf_record()
Naohiko Shimizu <[email protected]>
riscv: clocksource: Fix stimecmp update hazard on RV32
Arkadiusz Kozdra <[email protected]>
kconfig: fix static linking of nconf
Cheng-Yu Lee <[email protected]>
regmap: Fix race condition in hwspinlock irqsave routine
Felix Gu <[email protected]>
spi: spi-sprd-adi: Fix double free in probe error path
Georgi Djakov <[email protected]>
interconnect: debugfs: initialize src_node and dst_node to empty strings
Pavel Zhigulin <[email protected]>
iio: adc: ad7280a: handle spi_setup() errors in probe()
Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
Jens Axboe <[email protected]>
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
David Hildenbrand (Red Hat) <[email protected]>
mm/rmap: fix two comments related to huge_pmd_unshare()
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
Mario Limonciello <[email protected]>
platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
Ian Abbott <[email protected]>
comedi: Fix getting range information for subdevices 16 to 255
Andrew Cooper <[email protected]>
x86/kfence: avoid writing L1TF-vulnerable PTEs
Ondrej Jirman <[email protected]>
arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
Geraldo Nascimento <[email protected]>
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
Abdun Nihaal <[email protected]>
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
Long Li <[email protected]>
scsi: storvsc: Process unsupported MODE_SENSE_10
feng <[email protected]>
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
gongqi <[email protected]>
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Thadeu Lima de Souza Cascardo <[email protected]>
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
Haoxiang Li <[email protected]>
w1: fix redundant counter decrement in w1_attach_slave_device()
Thorsten Blum <[email protected]>
w1: therm: Fix off-by-one buffer overflow in alarms_store
Ian Abbott <[email protected]>
comedi: dmm32at: serialize use of paged registers
Marnix Rijnart <[email protected]>
serial: 8250_pci: Fix broken RS485 for F81504/508/512
Lachlan Hodges <[email protected]>
wifi: mac80211: don't perform DA check on S1G beacon
Taeyang Lee <[email protected]>
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
Jamal Hadi Salim <[email protected]>
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
Jamal Hadi Salim <[email protected]>
net/sched: Enforce that teql can only be used as root qdisc
Alok Tiwari <[email protected]>
octeontx2: cn10k: fix RX flowid TCAM mask handling
Dmitry Skorodumov <[email protected]>
ipvlan: Make the addrs_lock be per port
Eric Dumazet <[email protected]>
l2tp: avoid one data-race in l2tp_tunnel_del_work()
David Yang <[email protected]>
veth: fix data race in veth_get_ethtool_stats
Kuniyuki Iwashima <[email protected]>
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
Kuniyuki Iwashima <[email protected]>
tools: ynl: Specify --no-line-number in ynl-regen.sh.
Kuniyuki Iwashima <[email protected]>
gue: Fix skb memleak with inner IP protocol 0.
Raju Rangoju <[email protected]>
amd-xgbe: avoid misleading per-packet error log
Xin Long <[email protected]>
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
Ricardo B. Marlière <[email protected]>
selftests: net: fib-onlink-tests: Convert to use namespaces by default
Kuniyuki Iwashima <[email protected]>
l2tp: Fix memleak in l2tp_udp_encap_recv().
Eric Dumazet <[email protected]>
bonding: limit BOND_MODE_8023AD to Ethernet devices
Ethan Nelson-Moore <[email protected]>
net: usb: dm9601: remove broken SR9700 support
Michal Luczaj <[email protected]>
vsock/virtio: Coalesce only linear skb
Chwee-Lin Choong <[email protected]>
igc: fix race condition in TX timestamp read for register 0
Kurt Kanzenbach <[email protected]>
igc: Restore default Qbv schedule when changing channels
Ding Hui <[email protected]>
ice: Fix incorrect timeout ice_release_res()
Dave Ertman <[email protected]>
ice: Avoid detrimental cleanup for bond during interface stop
Jacob Keller <[email protected]>
ice: initialize ring_stats->syncp
Niklas Cassel <[email protected]>
ata: libata: Print features also for ATAPI devices
Niklas Cassel <[email protected]>
ata: libata: Call ata_dev_config_lpm() for ATAPI devices
Damien Le Moal <[email protected]>
ata: libata-core: Introduce ata_dev_config_lpm()
Niklas Cassel <[email protected]>
ata: libata: Add cpr_log to ata_dev_print_features() early return
Niklas Cassel <[email protected]>
ata: libata-sata: Improve link_power_management_supported sysfs attribute
Niklas Cassel <[email protected]>
ata: ahci: Do not read the per port area for unimplemented ports
Mark Harmstone <[email protected]>
btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
Michael Kelley <[email protected]>
Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
Konrad Dybcio <[email protected]>
pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
Konrad Dybcio <[email protected]>
dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
Dmitry Baryshkov <[email protected]>
dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
Akhil P Oommen <[email protected]>
dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
Taniya Das <[email protected]>
dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
Wojtek Wasko <[email protected]>
testptp: Add option to open PHC in readonly mode
Mahesh Bandewar <[email protected]>
selftest/ptp: update ptp selftest to exercise the gettimex options
Wojtek Wasko <[email protected]>
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
Wojtek Wasko <[email protected]>
posix-clock: Store file pointer in struct posix_clock_context
-------------
Diffstat:
.../devicetree/bindings/power/qcom,rpmpd.yaml | 1 + Documentation/netlink/specs/fou.yaml | 2 + Makefile | 4 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 +- .../boot/dts/rockchip/rk3399-kobol-helios64.dts | 1 - arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 1 - .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 4 +- arch/arm64/kernel/hibernate.c | 2 +- arch/arm64/kernel/signal.c | 4 + arch/x86/events/perf_event.h | 13 +- arch/x86/include/asm/kfence.h | 29 ++- arch/x86/mm/fault.c | 15 +- crypto/authencesn.c | 6 + drivers/accel/ivpu/ivpu_gem.c | 3 +- drivers/ata/ahci.c | 10 +- drivers/ata/libata-core.c | 32 ++- drivers/ata/libata-sata.c | 2 +- drivers/base/regmap/regmap.c | 4 +- drivers/char/tpm/Kconfig | 1 + drivers/char/tpm/tpm2-sessions.c | 6 +- drivers/clocksource/timer-riscv.c | 3 +- drivers/comedi/comedi_fops.c | 2 +- drivers/comedi/drivers/dmm32at.c | 32 ++- drivers/comedi/range.c | 2 +- drivers/dma/ti/k3-udma.c | 36 ++++ drivers/dpll/dpll_core.c | 12 +- drivers/gpio/gpiolib-cdev.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 12 -- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 23 +- drivers/gpu/drm/imagination/pvr_fw_trace.c | 8 +- .../drm/nouveau/include/nvkm/subdev/bios/conn.h | 95 +++++++-- drivers/gpu/drm/nouveau/nouveau_display.c | 2 + drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 73 +++++-- drivers/hv/hv_common.c | 12 +- drivers/hwtracing/intel_th/core.c | 19 +- drivers/iio/accel/adxl380.c | 6 +- drivers/iio/accel/st_accel_core.c | 72 ++++++- drivers/iio/adc/ad7280a.c | 4 +- drivers/iio/adc/ad9467.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 1 + drivers/iio/adc/exynos_adc.c | 13 +- drivers/iio/adc/pac1934.c | 6 +- drivers/iio/chemical/scd4x.c | 6 +- drivers/iio/dac/ad5686.c | 6 + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +- drivers/iio/industrialio-core.c | 12 +- drivers/input/serio/i8042-acpipnpio.h | 18 ++ drivers/interconnect/debugfs-client.c | 5 + drivers/irqchip/irq-gic-v3-its.c | 8 +- drivers/isdn/mISDN/timerdev.c | 13 +- drivers/leds/led-class.c | 10 +- drivers/misc/mei/mei-trace.h | 18 +- drivers/misc/uacce/uacce.c | 48 ++++- drivers/mmc/host/rtsx_pci_sdmmc.c | 41 ++++ drivers/mmc/host/sdhci-of-dwcmshc.c | 7 + drivers/net/bonding/bond_main.c | 11 +- drivers/net/can/usb/ems_usb.c | 8 +- drivers/net/can/usb/esd_usb.c | 9 +- drivers/net/can/usb/gs_usb.c | 7 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 +- drivers/net/can/usb/mcba_usb.c | 8 +- drivers/net/can/usb/usb_8dev.c | 8 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 3 +- drivers/net/ethernet/emulex/benet/be_main.c | 8 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 69 +++--- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_common.c | 2 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 6 +- drivers/net/ethernet/intel/ice/ice_lib.c | 29 ++- drivers/net/ethernet/intel/ice/ice_main.c | 28 +++ drivers/net/ethernet/intel/igc/igc_ethtool.c | 4 +- drivers/net/ethernet/intel/igc/igc_main.c | 5 + drivers/net/ethernet/intel/igc/igc_ptp.c | 43 ++-- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 86 ++++++-- .../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +- drivers/net/ipvlan/ipvlan_main.c | 49 +++-- drivers/net/netdevsim/bpf.c | 6 + drivers/net/netdevsim/dev.c | 2 + drivers/net/netdevsim/netdevsim.h | 1 + drivers/net/phy/sfp.c | 2 + drivers/net/usb/dm9601.c | 4 - drivers/net/usb/usbnet.c | 9 +- drivers/net/veth.c | 8 +- drivers/net/wireless/ath/ath10k/ce.c | 16 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 4 +- drivers/net/wireless/ath/ath12k/ce.c | 12 +- .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 + drivers/nfc/virtual_ncidev.c | 4 - drivers/of/base.c | 8 +- drivers/of/platform.c | 2 +- drivers/platform/x86/amd/wbrf.c | 4 +- drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 8 + drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 12 +- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 11 +- drivers/pmdomain/qcom/rpmhpd.c | 4 + drivers/ptp/ptp_chardev.c | 16 ++ drivers/s390/crypto/ap_card.c | 2 +- drivers/s390/crypto/ap_queue.c | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 7 + drivers/scsi/scsi_error.c | 11 +- drivers/scsi/scsi_lib.c | 8 + drivers/scsi/storvsc_drv.c | 3 +- drivers/slimbus/core.c | 19 +- drivers/spi/spi-sprd-adi.c | 33 +-- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/vhost/vsock.c | 11 +- drivers/w1/slaves/w1_therm.c | 60 ++---- drivers/w1/w1.c | 2 - drivers/xen/xen-scsiback.c | 1 + fs/btrfs/block-group.c | 6 +- fs/btrfs/disk-io.c | 2 +- fs/btrfs/space-info.c | 22 +- fs/btrfs/space-info.h | 6 +- fs/exfat/namei.c | 20 +- fs/ntfs3/inode.c | 7 +- include/dt-bindings/power/qcom,rpmhpd.h | 234 +++++++++++++++++++++ include/dt-bindings/power/qcom-rpmpd.h | 225 +------------------- include/linux/iio/iio-opaque.h | 2 + include/linux/posix-clock.h | 6 +- include/linux/skbuff.h | 2 + include/linux/virtio_vsock.h | 39 +++- include/uapi/linux/comedi.h | 2 +- io_uring/io-wq.c | 2 +- kernel/sched/ext.c | 2 +- kernel/sched/fair.c | 6 - kernel/sched/idle.c | 6 + kernel/time/clocksource.c | 2 +- kernel/time/posix-clock.c | 3 +- kernel/trace/trace_events_hist.c | 9 + kernel/trace/trace_events_synth.c | 8 +- mm/migrate.c | 12 +- mm/rmap.c | 20 +- net/bpf/test_run.c | 5 + net/core/datagram.c | 14 ++ net/core/filter.c | 7 + net/dsa/dsa.c | 2 +- net/ipv4/fou_core.c | 3 + net/ipv4/fou_nl.c | 2 +- net/ipv6/ndisc.c | 4 +- net/l2tp/l2tp_core.c | 8 +- net/mac80211/scan.c | 9 +- net/netrom/nr_route.c | 13 +- net/openvswitch/vport.c | 11 +- net/sched/act_ife.c | 6 +- net/sched/sch_qfq.c | 2 +- net/sched/sch_teql.c | 5 + net/sctp/sm_statefuns.c | 10 +- net/vmw_vsock/virtio_transport.c | 6 +- net/vmw_vsock/virtio_transport_common.c | 45 ++-- scripts/kconfig/nconf-cfg.sh | 11 +- security/keys/trusted-keys/trusted_tpm2.c | 4 +- sound/pci/ctxfi/ctamixer.c | 2 + sound/usb/mixer.c | 22 +- sound/usb/mixer_scarlett2.c | 6 +- tools/net/ynl/ynl-regen.sh | 2 +- tools/testing/selftests/bpf/prog_tests/perf_link.c | 15 +- tools/testing/selftests/net/amt.sh | 7 +- tools/testing/selftests/net/fib-onlink-tests.sh | 71 +++---- tools/testing/selftests/ptp/testptp.c | 97 +++++++-- tools/testing/vsock/vsock_test.c | 11 + 167 files changed, 1691 insertions(+), 882 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 10/169 arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 868b979c5328b867c95a6d5a93ba13ad0d3cd2f1 ]
To make sure that power rail is voted for, wire it up to its consumers.
--- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sc8280xp.dtsi +12 -4
@@ -5218,8 +5218,12 @@ remoteproc_nsp0: remoteproc@1b300000 { clocks = <&rpmhcc RPMH_CXO_CLK>; clock-names = "xo"; - power-domains = <&rpmhpd SC8280XP_NSP>; - power-domain-names = "nsp"; + power-domains = <&rpmhpd SC8280XP_NSP>, + <&rpmhpd SC8280XP_CX>, + <&rpmhpd SC8280XP_MXC>; + power-domain-names = "nsp", + "cx", + "mxc"; memory-region = <&pil_nsp0_mem>;
@@ -5349,8 +5353,12 @@ remoteproc_nsp1: remoteproc@21300000 { clocks = <&rpmhcc RPMH_CXO_CLK>; clock-names = "xo"; - power-domains = <&rpmhpd SC8280XP_NSP>; - power-domain-names = "nsp"; + power-domains = <&rpmhpd SC8280XP_NSP>, + <&rpmhpd SC8280XP_CX>, + <&rpmhpd SC8280XP_MXC>; + power-domain-names = "nsp", + "cx", + "mxc"; memory-region = <&pil_nsp1_mem>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/169 ice: initialize ring_stats->syncp
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 8439016c3b8b5ab687c2420317b1691585106611 ]
The u64_stats_sync structure is empty on 64-bit systems. However, on 32-bit systems it contains a seqcount_t which needs to be initialized. While the memory is zero-initialized, a lack of u64_stats_init means that lockdep won't get initialized properly. Fix this by adding u64_stats_init() calls to the rings just after allocation.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/ice/ice_lib.c +4 -0
@@ -394,6 +394,8 @@ static int ice_vsi_alloc_ring_stats(struct ice_vsi *vsi)if (!ring_stats) goto err_out; +u64_stats_init (&ring_stats->syncp); +WRITE_ONCE (tx_ring_stats[i], ring_stats); }
@@ -413,6 +415,8 @@ static int ice_vsi_alloc_ring_stats(struct ice_vsi *vsi)if (!ring_stats) goto err_out; +u64_stats_init (&ring_stats->syncp); +WRITE_ONCE (rx_ring_stats[i], ring_stats); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/169 ice: Avoid detrimental cleanup for bond during interface stop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <[email protected]>
[ Upstream commit a9d45c22ed120cdd15ff56d0a6e4700c46451901 ]
When the user issues an administrative down to an interface that is the primary for an aggregate bond, the prune lists are being purged. This breaks communication to the secondary interface, which shares a prune list on the main switch block while bonded together.
For the primary interface of an aggregate, avoid deleting these prune lists during stop, and since they are hardcoded to specific values for the default vlan and QinQ vlans, the attempt to re-add them during the up phase will quietly fail without any additional problem.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 25 ++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +17 -8
@@ -3746,22 +3746,31 @@ int ice_vsi_add_vlan_zero(struct ice_vsi *vsi)int ice_vsi_del_vlan_zero (struct ice_vsi *vsi) {struct ice_vsi_vlan_ops *vlan_ops =ice_get_compat_vsi_vlan_ops (vsi); +struct ice_pf *pf = vsi->back;struct ice_vlan vlan;int err; - vlan =ICE_VLAN (0 ,0 ,0 ); - err = vlan_ops->del_vlan (vsi, &vlan); -if (err && err != -EEXIST ) -return err; +if (pf->lag && pf->lag->primary) { +dev_dbg (ice_pf_to_dev (pf),"Interface is primary in aggregate - not deleting prune list\n" ); + }else { + vlan =ICE_VLAN (0 ,0 ,0 ); + err = vlan_ops->del_vlan (vsi, &vlan); +if (err && err != -EEXIST ) +return err; + }/* in SVM both VLAN 0 filters are identical */ if (!ice_is_dvm_ena (&vsi->back->hw))return 0 ; - vlan =ICE_VLAN (ETH_P_8021Q ,0 ,0 ); - err = vlan_ops->del_vlan (vsi, &vlan); -if (err && err != -EEXIST ) -return err; +if (pf->lag && pf->lag->primary) { +dev_dbg (ice_pf_to_dev (pf),"Interface is primary in aggregate - not deleting QinQ prune list\n" ); + }else { + vlan =ICE_VLAN (ETH_P_8021Q ,0 ,0 ); + err = vlan_ops->del_vlan (vsi, &vlan); +if (err && err != -EEXIST ) +return err; + }/* when deleting the last VLAN filter, make sure to disable the VLAN * promisc mode so the filter isn't left by accident
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/169 ice: Fix incorrect timeout ice_release_res()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ding Hui <[email protected]>
[ Upstream commit 01139a2ce532d77379e1593230127caa261a8036 ]
The commit 5f6df173f92e ("ice: implement and use rd32_poll_timeout for ice_sq_done timeout") converted ICE_CTL_Q_SQ_CMD_TIMEOUT from jiffies to microseconds.
But the ice_release_res() function was missed, and its logic still treats ICE_CTL_Q_SQ_CMD_TIMEOUT as a jiffies value.
So correct the issue by usecs_to_jiffies().
Found by inspection of the DDP downloading process. Compile and modprobe tested only.
--- drivers/net/ethernet/intel/ice/ice_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_common.c +1 -1
@@ -1951,7 +1951,7 @@ void ice_release_res(struct ice_hw *hw, enum ice_aq_res_ids res)/* there are some rare cases when trying to release the resource * results in an admin queue timeout, so handle them correctly */ - timeout = jiffies +10 *ICE_CTL_Q_SQ_CMD_TIMEOUT ; + timeout = jiffies +10 *usecs_to_jiffies (ICE_CTL_Q_SQ_CMD_TIMEOUT ); do { status = ice_aq_release_res(hw, res, 0, NULL); if (status != -EIO)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/169 igc: Restore default Qbv schedule when changing channels
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Kanzenbach <[email protected]>
[ Upstream commit 41a9a6826f20a524242a6c984845c4855f629841 ]
The Multi-queue Priority (MQPRIO) and Earliest TxTime First (ETF) offloads utilize the Time Sensitive Networking (TSN) Tx mode. This mode is always coupled to IEEE 802.1Qbv time aware shaper (Qbv). Therefore, the driver sets a default Qbv schedule of all gates opened and a cycle time of 1s. This schedule is set during probe.
However, the following sequence of events lead to Tx issues:
- Boot a dual core system
igc_probe():
igc_tsn_clear_schedule():
-> Default Schedule is set
Note: At this point the driver has allocated two Tx/Rx queues, because there are only two CPUs.
- ethtool -L enp3s0 combined 4
igc_ethtool_set_channels():
igc_reinit_queues()
-> Default schedule is gone, per Tx ring start and end time are zero- tc qdisc replace dev enp3s0 handle 100 parent root mqprio \
num_tc 4 map 3 3 2 2 0 1 1 1 3 3 3 3 3 3 3 3 \
queues 1@0 1@1 1@2 1@3 hw 1
igc_tsn_offload_apply():
igc_tsn_enable_offload():
-> Writes zeros to IGC_STQT(i) and IGC_ENDQT(i), causing Tx to stall/failTherefore, restore the default Qbv schedule after changing the number of channels.
Furthermore, add a restriction to not allow queue reconfiguration when TSN/Qbv is enabled, because it may lead to inconsistent states.
--- drivers/net/ethernet/intel/igc/igc_ethtool.c | 4 ++-- drivers/net/ethernet/intel/igc/igc_main.c | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igc/igc_ethtool.c +2 -2
@@ -1540,8 +1540,8 @@ static int igc_ethtool_set_channels(struct net_device *netdev,if (ch->other_count !=NON_Q_VECTORS )return -EINVAL ; -/* Do not allow channel reconfiguration when mqprio is enabled */ -if (adapter->strict_priority_enable) +/* Do not allow channel reconfiguration when any TSN qdisc is enabled */ +if (adapter->flags &IGC_FLAG_TSN_ANY_ENABLED )return -EINVAL ;/* Verify the number of channels doesn't exceed hw limits */
drivers/net/ethernet/intel/igc/igc_main.c +5 -0
@@ -7582,6 +7582,11 @@ int igc_reinit_queues(struct igc_adapter *adapter)if (netif_running (netdev)) err =igc_open (netdev); +if (!err) { +/* Restore default IEEE 802.1Qbv schedule after queue reinit */ +igc_tsn_clear_schedule (adapter); + } +return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/169 igc: fix race condition in TX timestamp read for register 0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chwee-Lin Choong <[email protected]>
[ Upstream commit 6990dc392a9ab10e52af37e0bee8c7b753756dc4 ]
The current HW bug workaround checks the TXTT_0 ready bit first, then reads TXSTMPL_0 twice (before and after reading TXSTMPH_0) to detect whether a new timestamp was captured by timestamp register 0 during the workaround.
This sequence has a race: if a new timestamp is captured after checking the TXTT_0 bit but before the first TXSTMPL_0 read, the detection fails because both the "old" and "new" values come from the same timestamp.
Fix by reading TXSTMPL_0 first to establish a baseline, then checking the TXTT_0 bit. This ensures any timestamp captured during the race window will be detected.
Old sequence:
1. Check TXTT_0 ready bit
2. Read TXSTMPL_0 (baseline)
3. Read TXSTMPH_0 (interrupt workaround)
4. Read TXSTMPL_0 (detect changes vs baseline)
New sequence:
1. Read TXSTMPL_0 (baseline)
2. Check TXTT_0 ready bit
3. Read TXSTMPH_0 (interrupt workaround)
4. Read TXSTMPL_0 (detect changes vs baseline)
--- drivers/net/ethernet/intel/igc/igc_ptp.c | 43 ++++++++++++++---------- 1 file changed, 25 insertions(+), 18 deletions(-)
drivers/net/ethernet/intel/igc/igc_ptp.c +25 -18
@@ -785,36 +785,43 @@ static void igc_ptp_tx_reg_to_stamp(struct igc_adapter *adapter,static void igc_ptp_tx_hwtstamp (struct igc_adapter *adapter) {struct igc_hw *hw = &adapter->hw; +u32 txstmpl_old;u64 regval;u32 mask;int i; +/* Establish baseline of TXSTMPL_0 before checking TXTT_0. +* This baseline is used to detect if a new timestamp arrives in +* register 0 during the hardware bug workaround below. +*/ + txstmpl_old =rd32 (IGC_TXSTMPL ); + mask =rd32 (IGC_TSYNCTXCTL ) &IGC_TSYNCTXCTL_TXTT_ANY ;if (mask &IGC_TSYNCTXCTL_TXTT_0 ) { regval =rd32 (IGC_TXSTMPL ); regval |= (u64 )rd32 (IGC_TXSTMPH ) <<32 ; }else { -/* There's a bug in the hardware that could cause -* missing interrupts for TX timestamping. The issue -* is that for new interrupts to be triggered, the -* IGC_TXSTMPH_0 register must be read. +/* TXTT_0 not set - register 0 has no new timestamp initially. +* +* Hardware bug: Future timestamp interrupts won't fire unless +* TXSTMPH_0 is read, even if the timestamp was captured in +* registers 1-3. * -* To avoid discarding a valid timestamp that just -* happened at the "wrong" time, we need to confirm -* that there was no timestamp captured, we do that by -* assuming that no two timestamps in sequence have -* the same nanosecond value. +* Workaround: Read TXSTMPH_0 here to enable future interrupts. +* However, this read clears TXTT_0. If a timestamp arrives in +* register 0 after checking TXTT_0 but before this read, it +* would be lost. * -* So, we read the "low" register, read the "high" -* register (to latch a new timestamp) and read the -* "low" register again, if "old" and "new" versions -* of the "low" register are different, a valid -* timestamp was captured, we can read the "high" -* register again. +* To detect this race: We saved a baseline read of TXSTMPL_0 +* before TXTT_0 check. After performing the workaround read of +* TXSTMPH_0, we read TXSTMPL_0 again. Since consecutive +* timestamps never share the same nanosecond value, a change +* between the baseline and new TXSTMPL_0 indicates a timestamp +* arrived during the race window. If so, read the complete +* timestamp. */ -u32 txstmpl_old, txstmpl_new; +u32 txstmpl_new; - txstmpl_old =rd32 (IGC_TXSTMPL );rd32 (IGC_TXSTMPH ); txstmpl_new =rd32 (IGC_TXSTMPL );
@@ -829,7 +836,7 @@ static void igc_ptp_tx_hwtstamp(struct igc_adapter *adapter) done:/* Now that the problematic first register was handled, we can -* use retrieve the timestamps from the other registers +* retrieve the timestamps from the other registers * (starting from '1') with less complications. */ for (i =1 ; i <IGC_MAX_TX_TSTAMP_REGS ; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/169 vsock/virtio: Coalesce only linear skb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <[email protected]>
[ Upstream commit 0386bd321d0f95d041a7b3d7b07643411b044a96 ]
vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them.
Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory.
Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb().
Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.
--- net/vmw_vsock/virtio_transport_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/vmw_vsock/virtio_transport_common.c +4 -2
@@ -1374,9 +1374,11 @@ virtio_transport_recv_enqueue(struct vsock_sock *vsk,/* Try to copy small packets into the buffer of last packet queued, * to avoid wasting memory queueing the entire buffer with a small -* payload. +* payload. Skip non-linear (e.g. zerocopy) skbs; these carry payload +* in skb_shinfo. */ -if (len <=GOOD_COPY_LEN && !skb_queue_empty (&vvs->rx_queue)) { +if (len <=GOOD_COPY_LEN && !skb_queue_empty (&vvs->rx_queue) && + !skb_is_nonlinear (skb)) {struct virtio_vsock_hdr *last_hdr;struct sk_buff *last_skb;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/169 net: usb: dm9601: remove broken SR9700 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <[email protected]>
[ Upstream commit 7d7dbafefbe74f5a25efc4807af093b857a7612e ]
The SR9700 chip sends more than one packet in a USB transaction, like the DM962x chips can optionally do, but the dm9601 driver does not support this mode, and the hardware does not have the DM962x MODE_CTL register to disable it, so this driver drops packets on SR9700 devices. The sr9700 driver correctly handles receiving more than one packet per transaction.
While the dm9601 driver could be improved to handle this, the easiest way to fix this issue in the short term is to remove the SR9700 device ID from the dm9601 driver so the sr9700 driver is always used. This device ID should not have been in more than one driver to begin with.
The "Fixes" commit was chosen so that the patch is automatically included in all kernels that have the sr9700 driver, even though the issue affects dm9601.
--- drivers/net/usb/dm9601.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/usb/dm9601.c +0 -4
@@ -603,10 +603,6 @@ static const struct usb_device_id products[] = { USB_DEVICE(0x0fe6, 0x8101), /* DM9601 USB to Fast Ethernet Adapter */ .driver_info = (unsigned long )&dm9601_info, }, - { -USB_DEVICE (0x0fe6 ,0x9700 ),/* DM9601 USB to Fast Ethernet Adapter */ - .driver_info = (unsigned long)&dm9601_info, - }, {USB_DEVICE (0x0a46 ,0x9000 ),/* DM9000E */ .driver_info = (unsigned long)&dm9601_info,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/169 bonding: limit BOND_MODE_8023AD to Ethernet devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6 ]
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.
syzbot reported:
BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline] BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497 CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 __hw_addr_create net/core/dev_addr_lists.c:63 [inline] __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:868 [inline] dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886 bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e </TASK> The buggy address belongs to the variable: lacpdu_mcast_addr+0x0/0x40
--- drivers/net/bonding/bond_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bonding/bond_main.c +6 -0
@@ -2017,6 +2017,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,*/ if (!bond_has_slaves (bond)) {if (bond_dev->type != slave_dev->type) { +if (slave_dev->type !=ARPHRD_ETHER && +BOND_MODE (bond) ==BOND_MODE_8023AD ) { +SLAVE_NL_ERR (bond_dev, slave_dev, extack, +"8023AD mode requires Ethernet devices" ); +return -EINVAL ; + }slave_dbg (bond_dev, slave_dev,"change device type from %d to %d\n" , bond_dev->type, slave_dev->type);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/169 l2tp: Fix memleak in l2tp_udp_encap_recv().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 4d10edfd1475b69dbd4c47f34b61a3772ece83ca ]
syzbot reported memleak of struct l2tp_session, l2tp_tunnel, sock, etc. [0]
The cited commit moved down the validation of the protocol version in l2tp_udp_encap_recv().
The new place requires an extra error handling to avoid the memleak.
Let's call l2tp_session_put() there.
[0]:
BUG: memory leak
unreferenced object 0xffff88810a290200 (size 512):
comm "syz.0.17", pid 6086, jiffies 4294944299
hex dump (first 32 bytes):
7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }...............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc babb6a4f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
l2tp_session_create+0x3a/0x3b0 net/l2tp/l2tp_core.c:1778
pppol2tp_connect+0x48b/0x920 net/l2tp/l2tp_ppp.c:755
__sys_connect_file+0x7a/0xb0 net/socket.c:2089
__sys_connect+0xde/0x110 net/socket.c:2108
__do_sys_connect net/socket.c:2114 [inline]
__se_sys_connect net/socket.c:2111 [inline]
__x64_sys_connect+0x1c/0x30 net/socket.c:2111
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/l2tp/l2tp_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/l2tp/l2tp_core.c +3 -1
@@ -1086,8 +1086,10 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) tunnel = session->tunnel;/* Check protocol version */ -if (version != tunnel->version) +if (version != tunnel->version) { +l2tp_session_put (session); goto invalid; + }if (version ==L2TP_HDR_VER_3 &&l2tp_v3_ensure_opt_in_linear (session, skb, &ptr, &optr)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/169 selftests: net: fib-onlink-tests: Convert to use namespaces by default
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2 ]
Currently, the test breaks if the SUT already has a default route configured for IPv6. Fix by avoiding the use of the default namespace.
--- .../testing/selftests/net/fib-onlink-tests.sh | 71 ++++++++----------- 1 file changed, 30 insertions(+), 41 deletions(-)
tools/testing/selftests/net/fib-onlink-tests.sh +30 -41
@@ -120,7 +120,7 @@ log_subsection() run_cmd() { - local cmd="$*" + local cmd="$1" local out local rc
@@ -145,7 +145,7 @@ get_linklocal() local pfx local addr - addr=$(${pfx} ip -6 -br addr show dev ${dev} | \ + addr=$(${pfx} ${IP} -6 -br addr show dev ${dev} | \ awk '{ for (i = 3; i <= NF; ++i) { if ($i ~ /^fe80/)
@@ -173,58 +173,48 @@ setup() set -e - # create namespace - setup_ns PEER_NS + # create namespaces + setup_ns ns1 + IP="ip -netns $ns1" + setup_ns ns2 # add vrf table - ip li add ${VRF} type vrf table ${VRF_TABLE} - ip li set ${VRF} up - ip ro add table ${VRF_TABLE} unreachable default metric 8192 - ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} li add ${VRF} type vrf table ${VRF_TABLE} + ${IP} li set ${VRF} up + ${IP} ro add table ${VRF_TABLE} unreachable default metric 8192 + ${IP} -6 ro add table ${VRF_TABLE} unreachable default metric 8192 # create test interfaces - ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} - ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} - ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} - ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} + ${IP} li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]} + ${IP} li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]} + ${IP} li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]} + ${IP} li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]} # enslave vrf interfaces for n in 5 7; do - ip li set ${NETIFS[p${n}]} vrf ${VRF} + ${IP} li set ${NETIFS[p${n}]} vrf ${VRF} done # add addresses for n in 1 3 5 7; do - ip li set ${NETIFS[p${n}]} up - ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} up + ${IP} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ${IP} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done # move peer interfaces to namespace and add addresses for n in 2 4 6 8; do - ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up - ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} - ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad + ${IP} li set ${NETIFS[p${n}]} netns ${ns2} up + ip -netns $ns2 addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]} + ip -netns $ns2 addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad done - ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} - ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} + ${IP} -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64} + ${IP} -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64} set +e } -cleanup() -{ - # make sure we start from a clean slate - cleanup_ns ${PEER_NS} 2>/dev/null - for n in 1 3 5 7; do - ip link del ${NETIFS[p${n}]} 2>/dev/null - done - ip link del ${VRF} 2>/dev/null - ip ro flush table ${VRF_TABLE} - ip -6 ro flush table ${VRF_TABLE} -} - ################################################################################ # IPv4 tests #
@@ -241,7 +231,7 @@ run_ip() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink + run_cmd "${IP} ro add table ${table} ${prefix}/32 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -257,8 +247,8 @@ run_ip_mpath() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip ro add table "${table}" "${prefix}"/32 \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} ro add table ${table} ${prefix}/32 \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -339,7 +329,7 @@ run_ip6() # dev arg may be empty [ -n "${dev}" ] && dev="dev ${dev}" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 via ${gw} ${dev} onlink" log_test $? ${exp_rc} "${desc}" }
@@ -353,8 +343,8 @@ run_ip6_mpath() local exp_rc="$6" local desc="$7" - run_cmd ip -6 ro add table "${table}" "${prefix}"/128 "${opts}" \ - nexthop via ${nh1} nexthop via ${nh2} + run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 ${opts} \ + nexthop via ${nh1} nexthop via ${nh2}" log_test $? ${exp_rc} "${desc}" }
@@ -491,10 +481,9 @@ do esac done -cleanup setup run_onlink_tests -cleanup +cleanup_ns ${ns1} ${ns2} if [ "$TESTS" != "none" ]; then printf "\nTests passed: %3d\n" ${nsuccess}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/169 Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 49f49d47af67f8a7b221db1d758fc634242dc91a ]
hv_kmsg_dump() currently skips the panic notification entirely if it doesn't get any message bytes to pass to Hyper-V due to an error from kmsg_dump_get_buffer(). Skipping the notification is undesirable because it leaves the Hyper-V host uncertain about the state of a panic'ed guest.
Fix this by always doing the panic notification, even if bytes_written is zero. Also ensure that bytes_written is initialized, which fixes a kernel test robot warning. The warning is actually bogus because kmsg_dump_get_buffer() happens to set bytes_written even if it fails, and in the kernel test robot's CONFIG_PRINTK not set case, hv_kmsg_dump() is never called. But do the initialization for robustness and to quiet the static checker.
--- drivers/hv/hv_common.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/hv/hv_common.c +7 -5
@@ -218,13 +218,15 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,/* * Write dump contents to the page. No need to synchronize; panic should -* be single-threaded. +* be single-threaded. Ignore failures from kmsg_dump_get_buffer() since +* panic notification should be done even if there is no message data. +* Don't assume bytes_written is set in case of failure, so initialize it. */ kmsg_dump_rewind (&iter); -kmsg_dump_get_buffer (&iter, false, hv_panic_page,HV_HYP_PAGE_SIZE , + bytes_written =0 ; + (void )kmsg_dump_get_buffer (&iter, false, hv_panic_page,HV_HYP_PAGE_SIZE , &bytes_written); -if (!bytes_written) -return ; +/* * P3 to contain the physical address of the panic page & P4 to * contain the size of the panic data in that page. Rest of the
@@ -233,7 +235,7 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,hv_set_msr (HV_MSR_CRASH_P0 ,0 );hv_set_msr (HV_MSR_CRASH_P1 ,0 );hv_set_msr (HV_MSR_CRASH_P2 ,0 ); -hv_set_msr (HV_MSR_CRASH_P3 ,virt_to_phys (hv_panic_page)); +hv_set_msr (HV_MSR_CRASH_P3 , bytes_written ?virt_to_phys (hv_panic_page) :0 );hv_set_msr (HV_MSR_CRASH_P4 , bytes_written);/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/169 can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7 ]
In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup.
However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty.
To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message.
--- drivers/net/can/usb/gs_usb.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/can/usb/gs_usb.c +7 -0
@@ -751,6 +751,10 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)usb_anchor_urb (urb, &parent->rx_submitted); rc =usb_submit_urb (urb,GFP_ATOMIC ); +if (!rc) +return ; + +usb_unanchor_urb (urb);/* USB failure take down all interfaces */ if (rc == -ENODEV ) {
@@ -759,6 +763,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)if (parent->canch[rc])netif_device_detach (parent->canch[rc]->netdev); } + }else if (rc != -ESHUTDOWN &&net_ratelimit ()) { +netdev_info (netdev,"failed to re-submit IN URB: %pe\n" , +ERR_PTR (urb->status)); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/169 sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit a80c9d945aef55b23b54838334345f20251dad83 ]
A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127
The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently:
- SCTP_CMD_PEER_INIT
- SCTP_CMD_TIMER_STOP (T1_INIT)
- SCTP_CMD_TIMER_START (T1_COOKIE)
- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)
- SCTP_CMD_ASSOC_SHKEY
- SCTP_CMD_GEN_COOKIE_ECHO
If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user().
Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue.
Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.
--- net/sctp/sm_statefuns.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sctp/sm_statefuns.c +5 -5
@@ -603,6 +603,11 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_PEER_INIT ,SCTP_PEER_INIT (initchunk)); +/* SCTP-AUTH: generate the association shared keys so that +* we can potentially sign the COOKIE-ECHO. +*/ +sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); +/* Reset init error count upon receipt of INIT-ACK. */ sctp_add_cmd_sf (commands,SCTP_CMD_INIT_COUNTER_RESET ,SCTP_NULL ());
@@ -617,11 +622,6 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,sctp_add_cmd_sf (commands,SCTP_CMD_NEW_STATE ,SCTP_STATE (SCTP_STATE_COOKIE_ECHOED )); -/* SCTP-AUTH: generate the association shared keys so that -* we can potentially sign the COOKIE-ECHO. -*/ -sctp_add_cmd_sf (commands,SCTP_CMD_ASSOC_SHKEY ,SCTP_NULL ()); -/* 5.1 C) "A" shall then send the State Cookie received in the * INIT ACK chunk in a COOKIE ECHO chunk, ... */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/169 amd-xgbe: avoid misleading per-packet error log
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f ]
On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +1 -4
@@ -2105,7 +2105,7 @@ static void xgbe_get_stats64(struct net_device *netdev, s->multicast = pstats->rxmulticastframes_g; s->rx_length_errors = pstats->rxlengtherror; s->rx_crc_errors = pstats->rxcrcerror; - s->rx_fifo_errors = pstats->rxfifooverflow; + s->rx_over_errors = pstats->rxfifooverflow; s->tx_packets = pstats->txframecount_gb; s->tx_bytes = pstats->txoctetcount_gb;
@@ -2559,9 +2559,6 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) goto read_again;if (error || packet->errors) { -if (packet->errors) -netif_err (pdata, rx_err, netdev, -"error in received packet\n" );dev_kfree_skb (skb); goto next_packet; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/169 gue: Fix skb memleak with inner IP protocol 0.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9a56796ad258786d3624eef5aefba394fc9bdded ]
syzbot reported skb memleak below. [0]
The repro generated a GUE packet with its inner protocol 0.
gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number.
Let's drop such packets.
Note that 0 is a valid number (IPv6 Hop-by-Hop Option).
I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer:
* no error
* resubmit HOPOPT
[0]
BUG: memory leak
unreferenced object 0xffff888109695a00 (size 240):
comm "syz.0.17", pid 6088, jiffies 4294943096
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@..............
backtrace (crc a84b336f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
__build_skb+0x23/0x60 net/core/skbuff.c:474
build_skb+0x20/0x190 net/core/skbuff.c:490
__tun_build_skb drivers/net/tun.c:1541 [inline]
tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636
tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x45d/0x710 fs/read_write.c:686
ksys_write+0xa7/0x170 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/ipv4/fou_core.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/fou_core.c +3 -0
@@ -215,6 +215,9 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)return gue_control_message (skb, guehdr); proto_ctype = guehdr->proto_ctype; +if (unlikely (!proto_ctype)) + goto drop; +__skb_pull (skb,sizeof (struct udphdr ) + hdrlen);skb_reset_transport_header (skb);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/169 tools: ynl: Specify --no-line-number in ynl-regen.sh.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 68578370f9b3a2aba5964b273312d51c581b6aad ]
If grep.lineNumber is enabled in .gitconfig,
[grep]
lineNumber = true
ynl-regen.sh fails with the following error:
$ ./tools/net/ynl/ynl-regen.sh -f ... ynl_gen_c.py: error: argument --mode: invalid choice: '4:' (choose from user, kernel, uapi) GEN 4: net/ipv4/fou_nl.c
Let's specify --no-line-number explicitly.
--- tools/net/ynl/ynl-regen.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/net/ynl/ynl-regen.sh +1 -1
@@ -21,7 +21,7 @@ files=$(git grep --files-with-matches '^/\* YNL-GEN \(kernel\|uapi\|user\)') for f in $files; do # params: 0 1 2 3 # $YAML YNL-GEN kernel $mode - params=( $(git grep -B1 -h '/\* YNL-GEN' $f | sed 's@/\*\(.*\)\*/@\1@') ) + params=( $(git grep --no-line-number -B1 -h '/\* YNL-GEN' $f | sed 's@/\*\(.*\)\*/@\1@') ) args=$(sed -n 's@/\* YNL-ARG \(.*\) \*/@\1@p' $f) if [ $f -nt ${params[0]} -a -z "$force" ]; then
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/169 fou: Dont allow 0 for FOU_ATTR_IPPROTO.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 ]
fou_udp_recv() has the same problem mentioned in the previous patch.
If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().
Let's forbid 0 for FOU_ATTR_IPPROTO.
--- Documentation/netlink/specs/fou.yaml | 2 ++ net/ipv4/fou_nl.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
Documentation/netlink/specs/fou.yaml +2 -0
@@ -39,6 +39,8 @@ attribute-sets: - name: ipproto type: u8 + checks: + min: 1 - name: type type: u8
net/ipv4/fou_nl.c +1 -1
@@ -14,7 +14,7 @@const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX +1 ] = { [FOU_ATTR_PORT ] = { .type =NLA_U16 , }, [FOU_ATTR_AF ] = { .type =NLA_U8 , }, - [FOU_ATTR_IPPROTO ] = { .type =NLA_U8 , }, + [FOU_ATTR_IPPROTO ] =NLA_POLICY_MIN (NLA_U8 ,1 ), [FOU_ATTR_TYPE ] = { .type =NLA_U8 , }, [FOU_ATTR_REMCSUM_NOPARTIAL ] = { .type =NLA_FLAG , }, [FOU_ATTR_LOCAL_V4 ] = { .type =NLA_U32 , },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/169 veth: fix data race in veth_get_ethtool_stats
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit b47adaab8b3d443868096bac08fdbb3d403194ba ]
In veth_get_ethtool_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics, peer_tq_xdp_xmit and peer_tq_xdp_xmit_err, are already accumulated by veth_xdp_xmit(). Fix this by reading them into a temporary buffer first.
--- drivers/net/veth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/veth.c +6 -2
@@ -227,16 +227,20 @@ static void veth_get_ethtool_stats(struct net_device *dev,const struct veth_rq_stats *rq_stats = &rcv_priv->rq[i].stats;const void *base = (void *)&rq_stats->vs;unsigned int start, tx_idx = idx; +u64 buf[VETH_TQ_STATS_LEN ];size_t offset; - tx_idx += (i % dev->real_num_tx_queues) *VETH_TQ_STATS_LEN ;do { start =u64_stats_fetch_begin (&rq_stats->syncp);for (j =0 ; j <VETH_TQ_STATS_LEN ; j++) { offset = veth_tq_stats_desc[j].offset; - data[tx_idx + j] += *(u64 *)(base + offset); + buf[j] = *(u64 *)(base + offset); } }while (u64_stats_fetch_retry (&rq_stats->syncp, start)); + + tx_idx += (i % dev->real_num_tx_queues) *VETH_TQ_STATS_LEN ; +for (j =0 ; j <VETH_TQ_STATS_LEN ; j++) + data[tx_idx + j] += buf[j]; } pp_idx = idx + dev->real_num_tx_queues *VETH_TQ_STATS_LEN ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/169 l2tp: avoid one data-race in l2tp_tunnel_del_work()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf ]
We should read sk->sk_socket only when dealing with kernel sockets.
syzbot reported the following data-race:
BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:
sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:
l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
value changed: 0xffff88811b818000 -> 0x0000000000000000
--- net/l2tp/l2tp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/l2tp/l2tp_core.c +2 -2
@@ -1416,8 +1416,6 @@ static void l2tp_tunnel_del_work(struct work_struct *work) { struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel, del_work); -struct sock *sk = tunnel->sock; -struct socket *sock = sk->sk_socket;l2tp_tunnel_closeall (tunnel);
@@ -1425,6 +1423,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)* the sk API to release it here. */ if (tunnel->fd <0 ) { +struct socket *sock = tunnel->sock->sk_socket; +if (sock) {kernel_sock_shutdown (sock,SHUT_RDWR );sock_release (sock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/169 ipvlan: Make the addrs_lock be per port
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Skorodumov <[email protected]>
[ Upstream commit d3ba32162488283c0a4c5bedd8817aec91748802 ]
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause:
1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths.
--- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +++++------ drivers/net/ipvlan/ipvlan_main.c | 49 +++++++++++++++++++------------- 3 files changed, 37 insertions(+), 30 deletions(-)
drivers/net/ipvlan/ipvlan.h +1 -1
@@ -69,7 +69,6 @@ struct ipvl_dev {DECLARE_BITMAP (mac_filters,IPVLAN_MAC_FILTER_SIZE );netdev_features_t sfeatures;u32 msg_enable; -spinlock_t addrs_lock; };struct ipvl_addr {
@@ -90,6 +89,7 @@ struct ipvl_port {struct net_device *dev;possible_net_t pnet;struct hlist_head hlhead[IPVLAN_HASH_SIZE ]; +spinlock_t addrs_lock;/* guards hash-table and addrs */ struct list_head ipvlans;u16 mode;u16 flags;
drivers/net/ipvlan/ipvlan_core.c +7 -9
@@ -107,17 +107,15 @@ void ipvlan_ht_addr_del(struct ipvl_addr *addr)struct ipvl_addr *ipvlan_find_addr (const struct ipvl_dev *ipvlan,const void *iaddr,bool is_v6) { -struct ipvl_addr *addr, *ret =NULL ; +struct ipvl_addr *addr; -rcu_read_lock (); -list_for_each_entry_rcu (addr, &ipvlan->addrs, anode) { -if (addr_equal (is_v6, addr, iaddr)) { - ret = addr; -break ; - } +assert_spin_locked (&ipvlan->port->addrs_lock); + +list_for_each_entry (addr, &ipvlan->addrs, anode) { +if (addr_equal (is_v6, addr, iaddr)) +return addr; } -rcu_read_unlock (); -return ret; +return NULL ; }bool ipvlan_addr_busy (struct ipvl_port *port,void *iaddr,bool is_v6)
drivers/net/ipvlan/ipvlan_main.c +29 -20
173 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/169 octeontx2: cn10k: fix RX flowid TCAM mask handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit ab9b218a1521133a4410722907fa7189566be9bc ]
The RX flowid programming initializes the TCAM mask to all ones, but then overwrites it when clearing the MAC DA mask bits. This results in losing the intended initialization and may affect other match fields.
Update the code to clear the MAC DA bits using an AND operation, making the handling of mask[0] consistent with mask[1], where the field-specific bits are cleared after initializing the mask to ~0ULL.
--- drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c +1 -1
@@ -330,7 +330,7 @@ static int cn10k_mcs_write_rx_flowid(struct otx2_nic *pfvf, req->data[0 ] =FIELD_PREP (MCS_TCAM0_MAC_DA_MASK , mac_da); req->mask[0 ] = ~0ULL ; - req->mask[0 ] = ~MCS_TCAM0_MAC_DA_MASK ; + req->mask[0 ] &= ~MCS_TCAM0_MAC_DA_MASK ; req->data[1 ] =FIELD_PREP (MCS_TCAM1_ETYPE_MASK ,ETH_P_MACSEC ); req->mask[1 ] = ~0ULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/169 btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <[email protected]>
[ Upstream commit 1d8f69f453c2e8a2d99b158e58e02ed65031fa6d ]
When the BLOCK_GROUP_TREE compat_ro flag is set, the extent root and csum root fields are getting missed.
This is because EXTENT_TREE_V2 treated these differently, and when they were split off this special-casing was mistakenly assigned to BGT rather than the rump EXTENT_TREE_V2. There's no reason why the existence of the block group tree should mean that we don't record the details of the last commit's extent root and csum root.
Fix the code in backup_super_roots() so that the correct check gets made.
--- fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/disk-io.c +1 -1
@@ -1676,7 +1676,7 @@ static void backup_super_roots(struct btrfs_fs_info *info)btrfs_set_backup_chunk_root_level (root_backup,btrfs_header_level (info->chunk_root->node)); -if (!btrfs_fs_compat_ro (info,BLOCK_GROUP_TREE )) { +if (!btrfs_fs_incompat (info,EXTENT_TREE_V2 )) {struct btrfs_root *extent_root =btrfs_extent_root (info,0 );struct btrfs_root *csum_root =btrfs_csum_root (info,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/169 net/sched: Enforce that teql can only be used as root qdisc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b ]
Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint.
Although not important, I will describe the scenario that unearthed this issue for the curious.
GangMin Kim <[email protected]> managed to concot a scenario as follows:
ROOT qdisc 1:0 (QFQ)
├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql
GangMin sends a packet which is enqueued to 1:1 (netem).
Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF.
--- net/sched/sch_teql.c | 5 +++++ 1 file changed, 5 insertions(+)
net/sched/sch_teql.c +5 -0
@@ -178,6 +178,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,if (m->dev == dev)return -ELOOP ; +if (sch->parent !=TC_H_ROOT ) { +NL_SET_ERR_MSG_MOD (extack,"teql can only be used as root" ); +return -EOPNOTSUPP ; + } + q->m = m;skb_queue_head_init (&q->q);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/169 net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit d837fbee92453fbb829f950c8e7cf76207d73f33 ]
This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.
--- net/sched/sch_qfq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_qfq.c +1 -1
@@ -373,7 +373,7 @@ static void qfq_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)/* Deschedule class and remove it from its parent aggregate. */ static void qfq_deact_rm_from_agg (struct qfq_sched *q,struct qfq_class *cl) { -if (cl->qdisc->q.qlen >0 )/* class is active */ +if (cl_is_active (cl))/* class is active */ qfq_deactivate_class (q, cl);qfq_rm_from_agg (q, cl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/169 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <[email protected]>
[ Upstream commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 ]
authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).
Add a minimum AAD length check to fail fast on invalid inputs.
--- crypto/authencesn.c | 6 ++++++ 1 file changed, 6 insertions(+)
crypto/authencesn.c +6 -0
@@ -185,6 +185,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req)struct scatterlist *src, *dst;int err; +if (assoclen <8 ) +return -EINVAL ; +sg_init_table (areq_ctx->src,2 ); src =scatterwalk_ffwd (areq_ctx->src, req->src, assoclen); dst = src;
@@ -275,6 +278,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)u32 tmp[2 ];int err; +if (assoclen <8 ) +return -EINVAL ; + cryptlen -= authsize;if (req->src != dst) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/169 wifi: mac80211: dont perform DA check on S1G beacon
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lachlan Hodges <[email protected]>
[ Upstream commit 5dc6975566f5d142ec53eb7e97af688c45dd314d ]
S1G beacons don't contain the DA field as per IEEE80211-2024 9.3.4.3, so the DA broadcast check reads the SA address of the S1G beacon which will subsequently lead to the beacon being dropped. As a result, passive scanning is not possible. Fix this by only performing the check on non-S1G beacons to allow S1G long beacons to be processed during a passive scan.
--- net/mac80211/scan.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
net/mac80211/scan.c +7 -2
@@ -327,8 +327,13 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb) mgmt->da))return ; }else { -/* Beacons are expected only with broadcast address */ -if (!is_broadcast_ether_addr (mgmt->da)) +/* +* Non-S1G beacons are expected only with broadcast address. +* S1G beacons only carry the SA so no DA check is required +* nor possible. +*/ +if (!ieee80211_is_s1g_beacon (mgmt->frame_control) && + !is_broadcast_ether_addr (mgmt->da))return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/169 serial: 8250_pci: Fix broken RS485 for F81504/508/512
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marnix Rijnart <[email protected]>
commit 27aff0a56b3c77ea1a73641c9b3c4172a8f7238f upstream.
Fintek F81504/508/512 can support both RTS_ON_SEND and RTS_AFTER_SEND, but pci_fintek_rs485_supported only announces the former.
This makes it impossible to unset SER_RS485_RTS_ON_SEND from userspace because of uart_sanitize_serial_rs485(). Some devices with these chips need RTS low on TX, so they are effectively broken.
Fix this by announcing the support for SER_RS485_RTS_AFTER_SEND, similar to commit 068d35a7be65 ("serial: sc16is7xx: announce support for SER_RS485_RTS_ON_SEND").
--- drivers/tty/serial/8250/8250_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_pci.c +1 -1
@@ -1641,7 +1641,7 @@ static int pci_fintek_rs485_config(struc }static const struct serial_rs485 pci_fintek_rs485_supported = { - .flags =SER_RS485_ENABLED |SER_RS485_RTS_ON_SEND , + .flags =SER_RS485_ENABLED |SER_RS485_RTS_ON_SEND |SER_RS485_RTS_AFTER_SEND ,/* F81504/508/512 does not support RTS delay before or after send */ };
Greg Kroah-Hartman
maintainerPATCH 13/169 ata: ahci: Do not read the per port area for unimplemented ports
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit ea4d4ea6d10a561043922d285f1765c7e4bfd32a ]
An AHCI HBA specifies the number of ports it supports using CAP.NP. The HBA is free to only make a subset of the number of ports available using the PI (Ports Implemented) register.
libata currently creates dummy ports for HBA ports that are provided by the HBA, but which are marked as "unavailable" using the PI register.
Each port will have a per port area of registers in the HBA, regardless if the port is marked as "unavailable" or not.
ahci_mark_external_port() currently reads this per port area of registers using readl() to see if the port is marked as external/hotplug-capable.
However, AHCI 1.3.1, section "3.1.4 Offset 0Ch: PI – Ports Implemented"
states: "Software must not read or write to registers within unavailable ports."
Thus, make sure that we only call ahci_mark_external_port() and ahci_update_initial_lpm_policy() for ports that are implemented.
Quoted 1 line
From a libata perspective, this should not change anything related to LPM,
as dummy ports do not provide any ap->ops (they do not have a .set_lpm() callback), so even if EH were to call .set_lpm() on a dummy port, it was already a no-op.
--- drivers/ata/ahci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/ata/ahci.c +5 -5
@@ -2071,13 +2071,13 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)if (ap->flags &ATA_FLAG_EM ) ap->em_message_type = hpriv->em_msg_type; -ahci_mark_external_port (ap); - -ahci_update_initial_lpm_policy (ap); -/* disabled/not-implemented port */ -if (!(hpriv->port_map & (1 << i))) +if (!(hpriv->port_map & (1 << i))) { ap->ops = &ata_dummy_port_ops; + }else { +ahci_mark_external_port (ap); +ahci_update_initial_lpm_policy (ap); + } }/* apply workaround for ASUS P5W DH Deluxe mainboard */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/169 ata: libata-sata: Improve link_power_management_supported sysfs attribute
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit ce83767ea323baf8509a75eb0c783cd203e14789 ]
The link_power_management_supported sysfs attribute is currently set as true even for ata ports that lack a .set_lpm() callback, e.g. dummy ports.
This is a bit silly, because while writing to the link_power_management_policy sysfs attribute will make ata_scsi_lpm_store() update ap->target_lpm_policy (thus sysfs will reflect the new value) and call ata_port_schedule_eh() for the port, it is essentially a no-op.
This is because for a port without a .set_lpm() callback, once EH gets to run, the ata_eh_link_set_lpm() will simply return, since the port does not provide a .set_lpm() callback.
Thus, make sure that the link_power_management_supported sysfs attribute is set to false for ports that lack a .set_lpm() callback. This way the link_power_management_policy sysfs attribute will no longer be writable, so we will no longer be misleading users to think that their sysfs write actually does something.
--- drivers/ata/libata-sata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-sata.c +1 -1
@@ -909,7 +909,7 @@ static bool ata_scsi_lpm_supported(struct ata_port *ap)struct ata_link *link;struct ata_device *dev; -if (ap->flags &ATA_FLAG_NO_LPM ) +if ((ap->flags &ATA_FLAG_NO_LPM ) || !ap->ops->set_lpm)return false;ata_for_each_link (link, ap,EDGE ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/169 ata: libata: Add cpr_log to ata_dev_print_features() early return
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit a6bee5e5243ad02cae575becc4c83df66fc29573 ]
ata_dev_print_features() is supposed to return early and not print anything if there are no features supported.
However, commit fe22e1c2f705 ("libata: support concurrent positioning ranges log") added another feature to ata_dev_print_features() without updating the early return conditional.
Add the missing feature to the early return conditional.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -2803,7 +2803,7 @@ static void ata_dev_config_cpr(struct ata_device *dev)static void ata_dev_print_features (struct ata_device *dev) { -if (!(dev->flags &ATA_DFLAG_FEATURES_MASK )) +if (!(dev->flags &ATA_DFLAG_FEATURES_MASK ) && !dev->cpr_log)return ; ata_dev_info(dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/169 ata: libata-core: Introduce ata_dev_config_lpm()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit d360121832d8a36871249271df5b9ff05f835f62 ]
If the port of a device does not support Device Initiated Power Management (DIPM), that is, the port is flagged with ATA_FLAG_NO_DIPM, the DIPM feature of a device should not be used. Though DIPM is disabled by default on a device, the "Software Settings Preservation feature" may keep DIPM enabled or DIPM may have been enabled by the system firmware.
Introduce the function ata_dev_config_lpm() to always disable DIPM on a device that supports this feature if the port of the device is flagged with ATA_FLAG_NO_DIPM. ata_dev_config_lpm() is called from ata_dev_configure(), ensuring that a device DIPM feature is disabled when it cannot be used.
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
--- drivers/ata/libata-core.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
drivers/ata/libata-core.c +25 -0
@@ -2801,6 +2801,30 @@ static void ata_dev_config_cpr(struct ata_device *dev)kfree (buf); } +/* +* Configure features related to link power management. +*/ +static void ata_dev_config_lpm (struct ata_device *dev) +{ +struct ata_port *ap = dev->link->ap; +unsigned int err_mask; + +/* +* Device Initiated Power Management (DIPM) is normally disabled by +* default on a device. However, DIPM may have been enabled and that +* setting kept even after COMRESET because of the Software Settings +* Preservation feature. So if the port does not support DIPM and the +* device does, disable DIPM on the device. +*/ +if (ap->flags &ATA_FLAG_NO_DIPM &&ata_id_has_dipm (dev->id)) { + err_mask =ata_dev_set_feature (dev, +SETFEATURES_SATA_DISABLE ,SATA_DIPM ); +if (err_mask && err_mask !=AC_ERR_DEV ) +ata_dev_err (dev,"Disable DIPM failed, Emask 0x%x\n" , + err_mask); + } +} +static void ata_dev_print_features (struct ata_device *dev) {if (!(dev->flags &ATA_DFLAG_FEATURES_MASK ) && !dev->cpr_log)
@@ -2974,6 +2998,7 @@ int ata_dev_configure(struct ata_device *dev)ata_dev_config_chs (dev); } +ata_dev_config_lpm (dev);ata_dev_config_fua (dev);ata_dev_config_devslp (dev);ata_dev_config_sense_reporting (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/169 ata: libata: Call ata_dev_config_lpm() for ATAPI devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 8f3fb33f8f3f825c708ece800c921977c157f9b6 ]
Commit d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()") introduced ata_dev_config_lpm(). However, it only called this function for ATA_DEV_ATA and ATA_DEV_ZAC devices, not for ATA_DEV_ATAPI devices.
Additionally, commit d99a9142e782 ("ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm()") moved the LPM quirk application from ata_dev_configure() to ata_dev_config_lpm(), causing LPM quirks for ATAPI devices to no longer be applied.
Call ata_dev_config_lpm() also for ATAPI devices, such that LPM quirks are applied for ATAPI devices with an entry in __ata_dev_quirks once again.
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
--- drivers/ata/libata-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/ata/libata-core.c +2 -0
@@ -3073,6 +3073,8 @@ int ata_dev_configure(struct ata_device *dev)ata_mode_string (xfer_mask), cdb_intr_string, atapi_an_string, dma_dir_string); + +ata_dev_config_lpm (dev); }/* determine max_sectors */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/169 ata: libata: Print features also for ATAPI devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit c8c6fb886f57d5bf71fb6de6334a143608d35707 ]
Commit d633b8a702ab ("libata: print feature list on device scan") added a print of the features supported by the device for ATA_DEV_ATA and ATA_DEV_ZAC devices, but not for ATA_DEV_ATAPI devices.
Fix this by printing the features also for ATAPI devices.
Before changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133
After changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133 ata1.00: Features: Dev-Attention HIPM DIPM
--- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/libata-core.c +3 -0
@@ -3075,6 +3075,9 @@ int ata_dev_configure(struct ata_device *dev) dma_dir_string);ata_dev_config_lpm (dev); + +if (print_info) +ata_dev_print_features (dev); }/* determine max_sectors */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/169 pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 5bc3e720e725cd5fa34875fa1e5434d565858067 ]
This was apparently accounted for in dt-bindings, but never made its way into the driver.
Fix it for SC8280XP and its VDD_GFX-less cousin, SA8540P.
--- drivers/pmdomain/qcom/rpmhpd.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pmdomain/qcom/rpmhpd.c +4 -0
@@ -228,6 +228,8 @@ static struct rpmhpd *sa8540p_rpmhpds[] = { [SC8280XP_MMCX_AO] = &mmcx_ao, [SC8280XP_MX] = &mx, [SC8280XP_MX_AO] = &mx_ao, + [SC8280XP_MXC] = &mxc, + [SC8280XP_MXC_AO] = &mxc_ao, [SC8280XP_NSP] = &nsp, };
@@ -593,6 +595,8 @@ static struct rpmhpd *sc8280xp_rpmhpds[] = { [SC8280XP_MMCX_AO] = &mmcx_ao, [SC8280XP_MX] = &mx, [SC8280XP_MX_AO] = &mx_ao, + [SC8280XP_MXC] = &mxc, + [SC8280XP_MXC_AO] = &mxc_ao, [SC8280XP_NSP] = &nsp, [SC8280XP_QPHY] = &qphy, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/169 w1: therm: Fix off-by-one buffer overflow in alarms_store
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit 761fcf46a1bd797bd32d23f3ea0141ffd437668a upstream.
The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'.
Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.
--- drivers/w1/slaves/w1_therm.c | 60 +++++++++++++------------------------------ 1 file changed, 19 insertions(+), 41 deletions(-)
drivers/w1/slaves/w1_therm.c +19 -41
@@ -1846,53 +1846,35 @@ static ssize_t alarms_store(struct devicstruct w1_slave *sl =dev_to_w1_slave (device);struct therm_info info;u8 new_config_register[3 ];/* array of data to be written */ -int temp, ret; -char *token =NULL ; +long long temp; +int ret =0 ;s8 tl, th;/* 1 byte per value + temp ring order */ -char *p_args, *orig; +const char *p = buf; +char *endp; - p_args = orig =kmalloc (size,GFP_KERNEL ); -/* Safe string copys as buf is const */ -if (!p_args) { -dev_warn (device, -"%s: error unable to allocate memory %d\n" , - __func__, -ENOMEM ); -return size; - } -strcpy (p_args, buf); - -/* Split string using space char */ - token =strsep (&p_args," " ); - -if (!token) { -dev_info (device, -"%s: error parsing args %d\n" , __func__, -EINVAL ); - goto free_m; - } - -/* Convert 1st entry to int */ - ret =kstrtoint (token,10 , &temp); + temp =simple_strtoll (p, &endp,10 ); +if (p == endp || *endp !=' ' ) + ret = -EINVAL ; +else if (temp <INT_MIN || temp >INT_MAX ) + ret = -ERANGE ;if (ret) {dev_info (device,"%s: error parsing args %d\n" , __func__, ret); - goto free_m; +return size; } tl =int_to_short (temp); -/* Split string using space char */ - token =strsep (&p_args," " ); -if (!token) { -dev_info (device, -"%s: error parsing args %d\n" , __func__, -EINVAL ); - goto free_m; - } -/* Convert 2nd entry to int */ - ret =kstrtoint (token,10 , &temp); + p = endp +1 ; + temp =simple_strtoll (p, &endp,10 ); +if (p == endp) + ret = -EINVAL ; +else if (temp <INT_MIN || temp >INT_MAX ) + ret = -ERANGE ;if (ret) {dev_info (device,"%s: error parsing args %d\n" , __func__, ret); - goto free_m; +return size; }/* Prepare to cast to short by eliminating out of range values */
@@ -1915,7 +1897,7 @@ static ssize_t alarms_store(struct devicdev_info (device,"%s: error reading from the slave device %d\n" , __func__, ret); - goto free_m; +return size; }/* Write data in the device RAM */
@@ -1923,7 +1905,7 @@ static ssize_t alarms_store(struct devicdev_info (device,"%s: Device not supported by the driver %d\n" , __func__, -ENODEV ); - goto free_m; +return size; } ret =SLAVE_SPECIFIC_FUNC (sl)->write_data (sl, new_config_register);
@@ -1932,10 +1914,6 @@ static ssize_t alarms_store(struct devic"%s: error writing to the slave device %d\n" , __func__, ret); -free_m: -/* free allocated memory */ -kfree (orig); -return size; }
Greg Kroah-Hartman
maintainerPATCH 54/169 x86/kfence: avoid writing L1TF-vulnerable PTEs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <[email protected]>
commit b505f1944535f83d369ae68813e7634d11b990d3 upstream.
For native, the choice of PTE is fine. There's real memory backing the non-present PTE. However, for XenPV, Xen complains:
(XEN) d1 L1TF-vulnerable L1e 8010000018200066 - Shadowing
To explain, some background on XenPV pagetables:
Xen PV guests are control their own pagetables; they choose the new PTE value, and use hypercalls to make changes so Xen can audit for safety.
In addition to a regular reference count, Xen also maintains a type reference count. e.g. SegDesc (referenced by vGDT/vLDT), Writable (referenced with _PAGE_RW) or L{1..4} (referenced by vCR3 or a lower pagetable level). This is in order to prevent e.g. a page being inserted into the pagetables for which the guest has a writable mapping.
For non-present mappings, all other bits become software accessible, and typically contain metadata rather a real frame address. There is nothing that a reference count could sensibly be tied to. As such, even if Xen could recognise the address as currently safe, nothing would prevent that frame from changing owner to another VM in the future.
When Xen detects a PV guest writing a L1TF-PTE, it responds by activating shadow paging. This is normally only used for the live phase of migration, and comes with a reasonable overhead.
KFENCE only cares about getting #PF to catch wild accesses; it doesn't care about the value for non-present mappings. Use a fully inverted PTE, to avoid hitting the slow path when running under Xen.
While adjusting the logic, take the opportunity to skip all actions if the PTE is already in the right state, half the number PVOps callouts, and skip TLB maintenance on a !P -> P transition which benefits non-Xen cases too.
--- arch/x86/include/asm/kfence.h | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)
arch/x86/include/asm/kfence.h +24 -5
@@ -42,10 +42,34 @@ static inline bool kfence_protect_page(u {unsigned int level;pte_t *pte =lookup_address (addr, &level); +pteval_t val;if (WARN_ON (!pte || level !=PG_LEVEL_4K ))return false; + val =pte_val (*pte); + +/* +* protect requires making the page not-present. If the PTE is +* already in the right state, there's nothing to do. +*/ +if (protect != !!(val & _PAGE_PRESENT)) +return true; + +/* +* Otherwise, invert the entire PTE. This avoids writing out an +* L1TF-vulnerable PTE (not present, without the high address bits +* set). +*/ +set_pte (pte,__pte (~val)); + +/* +* If the page was protected (non-present) and we're making it +* present, there is no need to flush the TLB at all. +*/ +if (!protect) +return true; +/* * We need to avoid IPIs, as we may get KFENCE allocations or faults * with interrupts disabled. Therefore, the below is best-effort, and
@@ -53,11 +77,6 @@ static inline bool kfence_protect_page(u* lazy fault handling takes care of faults after the page is PRESENT. */ -if (protect) -set_pte (pte,__pte (pte_val (*pte) & ~_PAGE_PRESENT)); -else -set_pte (pte,__pte (pte_val (*pte) | _PAGE_PRESENT)); -/* * Flush this CPU's TLB, assuming whoever did the allocation/free is * likely to continue running on this CPU.
Greg Kroah-Hartman
maintainerPATCH 55/169 comedi: Fix getting range information for subdevices 16 to 255
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 10d28cffb3f6ec7ad67f0a4cd32c2afa92909452 upstream.
The COMEDI_RANGEINFO ioctl does not work properly for subdevice indices above 15. Currently, the only in-tree COMEDI drivers that support more than 16 subdevices are the "8255" driver and the "comedi_bond" driver. Making the ioctl work for subdevice indices up to 255 is achievable. It needs minor changes to the handling of the COMEDI_RANGEINFO and COMEDI_CHANINFO ioctls that should be mostly harmless to user-space, apart from making them less broken. Details follow...
The COMEDI_RANGEINFO ioctl command gets the list of supported ranges (usually with units of volts or milliamps) for a COMEDI subdevice or channel. (Only some subdevices have per-channel range tables, indicated by the SDF_RANGETYPE flag in the subdevice information.) It uses a range_type value and a user-space pointer, both supplied by user-space, but the range_type value should match what was obtained using the COMEDI_CHANINFO ioctl (if the subdevice has per-channel range tables) or COMEDI_SUBDINFO ioctl (if the subdevice uses a single range table for all channels). Bits 15 to 0 of the range_type value contain the length of the range table, which is the only part that user-space should care about (so it can use a suitably sized buffer to fetch the range table). Bits 23 to 16 store the channel index, which is assumed to be no more than 255 if the subdevice has per-channel range tables, and is set to 0 if the subdevice has a single range table. For range_type values produced by the COMEDI_SUBDINFO ioctl, bits 31 to 24 contain the subdevice index, which is assumed to be no more than 255. But for range_type values produced by the COMEDI_CHANINFO ioctl, bits 27 to 24 contain the subdevice index, which is assumed to be no more than 15, and bits 31 to 28 contain the COMEDI device's minor device number for some unknown reason lost in the mists of time. The COMEDI_RANGEINFO ioctl extract the length from bits 15 to 0 of the user-supplied range_type value, extracts the channel index from bits 23 to 16 (only used if the subdevice has per-channel range tables), extracts the subdevice index from bits 27 to 24, and ignores bits 31 to
28. So for subdevice indices 16 to 255, the COMEDI_SUBDINFO or COMEDI_CHANINFO ioctl will report a range_type value that doesn't work with the COMEDI_RANGEINFO ioctl. It will either get the range table for the subdevice index modulo 16, or will fail with -EINVAL.
To fix this, always use bits 31 to 24 of the range_type value to hold the subdevice index (assumed to be no more than 255). This affects the COMEDI_CHANINFO and COMEDI_RANGEINFO ioctls. There should not be anything in user-space that depends on the old, broken usage, although it may now see different values in bits 31 to 28 of the range_type values reported by the COMEDI_CHANINFO ioctl for subdevices that have per-channel subdevices. User-space should not be trying to decode bits 31 to 16 of the range_type values anyway.
--- drivers/comedi/comedi_fops.c | 2 +- drivers/comedi/range.c | 2 +- include/uapi/linux/comedi.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/comedi/comedi_fops.c +1 -1
@@ -1099,7 +1099,7 @@ static int do_chaninfo_ioctl(struct comefor (i =0 ; i < s->n_chan; i++) {int x; - x = (dev->minor <<28 ) | (it->subdev <<24 ) | (i <<16 ) | + x = (it->subdev <<24 ) | (i <<16 ) | (s->range_table_list[i]->length);if (put_user (x, it->rangelist + i))return -EFAULT ;
drivers/comedi/range.c +1 -1
@@ -52,7 +52,7 @@ int do_rangeinfo_ioctl(struct comedi_devconst struct comedi_lrange *lr;struct comedi_subdevice *s; - subd = (it->range_type >>24 ) &0xf ; + subd = (it->range_type >>24 ) &0xff ; chan = (it->range_type >>16 ) &0xff ;if (!dev->attached)
include/uapi/linux/comedi.h +1 -1
@@ -640,7 +640,7 @@ struct comedi_chaninfo {/** * struct comedi_rangeinfo - used to retrieve the range table for a channel -* @range_type: Encodes subdevice index (bits 27:24), channel index +* @range_type: Encodes subdevice index (bits 31:24), channel index * (bits 23:16) and range table length (bits 15:0). * @range_ptr: Pointer to array of @struct comedi_krange to be filled * in with the range table for the channel or subdevice.
Greg Kroah-Hartman
maintainerPATCH 56/169 platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit fdee1b09721605f532352628d0a24623e7062efb upstream.
The hp-bioscfg driver attempts to register kobjects with empty names when the HP BIOS returns attributes with empty name strings. This causes multiple kernel warnings:
kobject: (00000000135fb5e6): attempted to be registered with empty name!
WARNING: CPU: 14 PID: 3336 at lib/kobject.c:219 kobject_add_internal+0x2eb/0x310
Add validation in hp_init_bios_buffer_attribute() to check if the attribute name is empty after parsing it from the WMI buffer. If empty, log a debug message and skip registration of that attribute, allowing the module to continue processing other valid attributes.
--- drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +8 -0
@@ -10,6 +10,8 @@#include <linux/fs.h> #include <linux/module.h> #include <linux/kernel.h> +#include <linux/printk.h> +#include <linux/string.h> #include <linux/wmi.h> #include "bioscfg.h" #include "../../firmware_attributes_class.h"
@@ -784,6 +786,12 @@ static int hp_init_bios_buffer_attributeif (ret <0 ) goto buff_attr_exit; +if (strlen (str) ==0 ) { +pr_debug ("Ignoring attribute with empty name\n" ); + ret =0 ; + goto buff_attr_exit; + } +if (attr_type ==HPWMI_PASSWORD_TYPE || attr_type ==HPWMI_SECURE_PLATFORM_TYPE ) temp_kset = bioscfg_drv.authentication_dir_kset;
Greg Kroah-Hartman
maintainerPATCH 57/169 platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 25150715e0b049b99df664daf05dab12f41c3e13 upstream.
The GET_INSTANCE_ID macro that caused a kernel panic when accessing sysfs attributes:
1. Off-by-one error: The loop condition used '<=' instead of '<', causing access beyond array bounds. Since array indices are 0-based and go from 0 to instances_count-1, the loop should use '<'.
2. Missing NULL check: The code dereferenced attr_name_kobj->name without checking if attr_name_kobj was NULL, causing a null pointer dereference in min_length_show() and other attribute show functions.
The panic occurred when fwupd tried to read BIOS configuration attributes:
Oops: general protection fault [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg]
Add a NULL check for attr_name_kobj before dereferencing and corrects the loop boundary to match the pattern used elsewhere in the driver.
--- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h +4 -2
@@ -10,6 +10,7 @@#include <linux/wmi.h> #include <linux/types.h> +#include <linux/string.h> #include <linux/device.h> #include <linux/module.h> #include <linux/kernel.h>
@@ -285,8 +286,9 @@ enum hp_wmi_data_elements { { \int i; \ \ - for (i = 0; i <= bioscfg_drv.type##_instances_count; i++) { \ - if (!strcmp(kobj->name, bioscfg_drv.type##_data[i].attr_name_kobj->name)) \ + for (i = 0; i < bioscfg_drv.type##_instances_count; i++) { \ + if (bioscfg_drv.type##_data[i].attr_name_kobj && \ + !strcmp(kobj->name, bioscfg_drv.type##_data[i].attr_name_kobj->name)) \return i; \ } \return -EIO ; \
Greg Kroah-Hartman
maintainerPATCH 58/169 mm/rmap: fix two comments related to huge_pmd_unshare()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand (Red Hat) <[email protected]>
commit a8682d500f691b6dfaa16ae1502d990aeb86e8be upstream.
PMD page table unsharing no longer touches the refcount of a PMD page table. Also, it is not about dropping the refcount of a "PMD page" but the "PMD page table".
Let's just simplify by saying that the PMD page table was unmapped, consequently also unmapping the folio that was mapped into this page.
This code should be deduplicated in the future.
--- mm/rmap.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-)
mm/rmap.c +4 -16
@@ -1753,14 +1753,8 @@ static bool try_to_unmap_one(struct foliflush_tlb_range (vma, range.start, range.end);/* -* The ref count of the PMD page was -* dropped which is part of the way map -* counting is done for shared PMDs. -* Return 'true' here. When there is -* no other sharing, huge_pmd_unshare -* returns false and we will unmap the -* actual page and drop map count -* to zero. +* The PMD table was unmapped, +* consequently unmapping the folio. */ goto walk_done; }
@@ -2128,14 +2122,8 @@ static bool try_to_migrate_one(struct fo range.start, range.end);/* -* The ref count of the PMD page was -* dropped which is part of the way map -* counting is done for shared PMDs. -* Return 'true' here. When there is -* no other sharing, huge_pmd_unshare -* returns false and we will unmap the -* actual page and drop map count -* to zero. +* The PMD table was unmapped, +* consequently unmapping the folio. */ page_vma_mapped_walk_done (&pvmw);break ;
Greg Kroah-Hartman
maintainerPATCH 59/169 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 10dc959398175736e495f71c771f8641e1ca1907 upstream.
Currently this is checked before running the pending work. Normally this is quite fine, as work items either end up blocking (which will create a new worker for other items), or they complete fairly quickly. But syzbot reports an issue where io-wq takes seemingly forever to exit, and with a bit of debugging, this turns out to be because it queues a bunch of big (2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't support ->read_iter(), loop_rw_iter() ends up handling them. Each read returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of these pending, processing the whole chain can take a long time. Easily longer than the syzbot uninterruptible sleep timeout of 140 seconds. This then triggers a complaint off the io-wq exit path:
INFO: task syz.4.135:6326 blocked for more than 143 seconds.
Not tainted syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.135 state:D stack:26824 pid:6326 tgid:6324 ppid:5957 task_flags:0x400548 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
io_wq_exit_workers io_uring/io-wq.c:1328 [inline]
io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356
io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203
io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651
io_uring_files_cancel include/linux/io_uring.h:19 [inline]
do_exit+0x2ce/0x2bd0 kernel/exit.c:911
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa02738f749
RSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098
RBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98There's really nothing wrong here, outside of processing these reads will take a LONG time. However, we can speed up the exit by checking the IO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will exit the ring after queueing up all of these reads. Then once the first item is processed, io-wq will simply cancel the rest. That should avoid syzbot running into this complaint again.
--- io_uring/io-wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/io-wq.c +1 -1
@@ -552,9 +552,9 @@ static void io_worker_handle_work(struct __releases(&acct->lock) {struct io_wq *wq = worker->wq; -bool do_kill =test_bit (IO_WQ_BIT_EXIT , &wq->state); do { + bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state); struct io_wq_work *work; /*
Greg Kroah-Hartman
maintainerPATCH 60/169 iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3 upstream.
The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register.
Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +11 -4
@@ -101,6 +101,13 @@ static const struct iio_chan_spec st_lsm IIO_CHAN_SOFT_TIMESTAMP(3), }; +static const struct iio_chan_spec st_lsm6ds0_acc_channels[] = { +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x28 ,IIO_MOD_X ,0 ), +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x2a ,IIO_MOD_Y ,1 ), +ST_LSM6DSX_CHANNEL (IIO_ACCEL ,0x2c ,IIO_MOD_Z ,2 ), +IIO_CHAN_SOFT_TIMESTAMP (3 ), +}; +static const struct iio_chan_spec st_lsm6dsx_gyro_channels[] = {ST_LSM6DSX_CHANNEL (IIO_ANGL_VEL ,0x22 ,IIO_MOD_X ,0 ),ST_LSM6DSX_CHANNEL (IIO_ANGL_VEL ,0x24 ,IIO_MOD_Y ,1 ),
@@ -142,8 +149,8 @@ static const struct st_lsm6dsx_settings }, .channels = { [ST_LSM6DSX_ID_ACC] = { - .chan = st_lsm6dsx_acc_channels, - .len = ARRAY_SIZE(st_lsm6dsx_acc_channels), + .chan = st_lsm6ds0_acc_channels, + .len = ARRAY_SIZE(st_lsm6ds0_acc_channels), }, [ST_LSM6DSX_ID_GYRO] = { .chan = st_lsm6ds0_gyro_channels,
@@ -1449,8 +1456,8 @@ static const struct st_lsm6dsx_settings }, .channels = { [ST_LSM6DSX_ID_ACC] = { - .chan = st_lsm6dsx_acc_channels, - .len = ARRAY_SIZE(st_lsm6dsx_acc_channels), + .chan = st_lsm6ds0_acc_channels, + .len = ARRAY_SIZE(st_lsm6ds0_acc_channels), }, [ST_LSM6DSX_ID_GYRO] = { .chan = st_lsm6dsx_gyro_channels,
Greg Kroah-Hartman
maintainerPATCH 61/169 iio: adc: ad7280a: handle spi_setup() errors in probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <[email protected]>
[ Upstream commit 6b39824ac4c15783787e6434449772bfb2e31214 ]
The probe() function ignored the return value of spi_setup(), leaving SPI configuration failures undetected. If spi_setup() fails, the driver should stop initialization and propagate the error to the caller.
Add proper error handling: check the return value of spi_setup() and return it on failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/iio/adc/ad7280a.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/adc/ad7280a.c +3 -1
@@ -1026,7 +1026,9 @@ static int ad7280_probe(struct spi_device *spi) st->spi->max_speed_hz =AD7280A_MAX_SPI_CLK_HZ ; st->spi->mode =SPI_MODE_1 ; -spi_setup (st->spi); + ret =spi_setup (st->spi); +if (ret <0 ) +return ret; st->ctrl_lb =FIELD_PREP (AD7280A_CTRL_LB_ACQ_TIME_MSK , st->acquisition_time) |FIELD_PREP (AD7280A_CTRL_LB_THERMISTOR_MSK , st->thermistor_term_en);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/169 interconnect: debugfs: initialize src_node and dst_node to empty strings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgi Djakov <[email protected]>
[ Upstream commit 8cc27f5c6dd17dd090f3a696683f04336c162ff5 ]
The debugfs_create_str() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer uninitialized can cause problems.
Initialize src_node and dst_node to empty strings before creating the debugfs entries to guarantee that reads and writes are safe.
--- drivers/interconnect/debugfs-client.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/interconnect/debugfs-client.c +5 -0
@@ -150,6 +150,11 @@ int icc_debugfs_client_init(struct dentry *icc_dir)return ret; } + src_node =devm_kstrdup (&pdev->dev,"" ,GFP_KERNEL ); + dst_node =devm_kstrdup (&pdev->dev,"" ,GFP_KERNEL ); +if (!src_node || !dst_node) +return -ENOMEM ; + client_dir =debugfs_create_dir ("test_client" , icc_dir);debugfs_create_str ("src_node" ,0600 , client_dir, &src_node);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/169 spi: spi-sprd-adi: Fix double free in probe error path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 383d4f5cffcc8df930d95b06518a9d25a6d74aac ]
The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_controller().
If devm_register_restart_handler() fails, the code jumps to the put_ctlr label and calls spi_controller_put(). However, since the controller was registered via a devm function, the device core will automatically call spi_controller_put() again when the probe fails. This results in a double-free of the spi_controller structure.
Fix this by switching to devm_spi_alloc_host() and removing the manual spi_controller_put() call.
--- drivers/spi/spi-sprd-adi.c | 33 ++++++++++----------------------- 1 file changed, 10 insertions(+), 23 deletions(-)
drivers/spi/spi-sprd-adi.c +10 -23
@@ -528,7 +528,7 @@ static int sprd_adi_probe(struct platform_device *pdev) pdev->id =of_alias_get_id (np,"spi" ); num_chipselect =of_get_child_count (np); - ctlr =spi_alloc_host (&pdev->dev,sizeof (struct sprd_adi )); + ctlr =devm_spi_alloc_host (&pdev->dev,sizeof (struct sprd_adi ));if (!ctlr)return -ENOMEM ;
@@ -536,10 +536,8 @@ static int sprd_adi_probe(struct platform_device *pdev) sadi =spi_controller_get_devdata (ctlr); sadi->base =devm_platform_get_and_ioremap_resource (pdev,0 , &res); -if (IS_ERR (sadi->base)) { - ret =PTR_ERR (sadi->base); - goto put_ctlr; - } +if (IS_ERR (sadi->base)) +return PTR_ERR (sadi->base); sadi->slave_vbase = (unsigned long )sadi->base + data->slave_offset;
@@ -551,18 +549,15 @@ static int sprd_adi_probe(struct platform_device *pdev)if (ret >0 || (IS_ENABLED (CONFIG_HWSPINLOCK ) && ret ==0 )) { sadi->hwlock =devm_hwspin_lock_request_specific (&pdev->dev, ret); -if (!sadi->hwlock) { - ret = -ENXIO ; - goto put_ctlr; - } +if (!sadi->hwlock) +return -ENXIO ; }else {switch (ret) {case -ENOENT :dev_info (&pdev->dev,"no hardware spinlock supplied\n" );break ;default : -dev_err_probe (&pdev->dev, ret,"failed to find hwlock id\n" ); - goto put_ctlr; +return dev_err_probe (&pdev->dev, ret,"failed to find hwlock id\n" ); } }
@@ -579,26 +574,18 @@ static int sprd_adi_probe(struct platform_device *pdev) ctlr->transfer_one = sprd_adi_transfer_one; ret =devm_spi_register_controller (&pdev->dev, ctlr); -if (ret) { -dev_err (&pdev->dev,"failed to register SPI controller\n" ); - goto put_ctlr; - } +if (ret) +return dev_err_probe (&pdev->dev, ret,"failed to register SPI controller\n" );if (sadi->data->restart) { ret =devm_register_restart_handler (&pdev->dev, sadi->data->restart, sadi); -if (ret) { -dev_err (&pdev->dev,"can not register restart handler\n" ); - goto put_ctlr; - } +if (ret) +return dev_err_probe (&pdev->dev, ret,"can not register restart handler\n" ); }return 0 ; - -put_ctlr: -spi_controller_put (ctlr); -return ret; }static struct sprd_adi_data sc9860_data = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/169 w1: fix redundant counter decrement in w1_attach_slave_device()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream.
In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device().
--- drivers/w1/w1.c | 2 -- 1 file changed, 2 deletions(-)
drivers/w1/w1.c +0 -2
@@ -758,8 +758,6 @@ int w1_attach_slave_device(struct w1_masif (err <0 ) {dev_err (&dev->dev,"%s: Attaching %s failed.\n" , __func__, sl->name); - dev->slave_count--; -w1_family_put (sl->family);atomic_dec (&sl->master->refcnt);kfree (sl);return err;
Greg Kroah-Hartman
maintainerPATCH 64/169 regmap: Fix race condition in hwspinlock irqsave routine
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng-Yu Lee <[email protected]>
[ Upstream commit 4b58aac989c1e3fafb1c68a733811859df388250 ]
Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner.
Fix this by using a local stack variable 'flags' to store the IRQ state temporarily.
--- drivers/base/regmap/regmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/regmap/regmap.c +3 -1
@@ -408,9 +408,11 @@ static void regmap_lock_hwlock_irq(void *__map)static void regmap_lock_hwlock_irqsave (void *__map) {struct regmap *map = __map; +unsigned long flags =0 ;hwspin_lock_timeout_irqsave (map->hwlock,UINT_MAX , - &map->spinlock_flags); + &flags); + map->spinlock_flags = flags; }static void regmap_unlock_hwlock (void *__map)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/169 kconfig: fix static linking of nconf
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Kozdra <[email protected]>
[ Upstream commit baaecfcac559bcac73206df447eb5c385fa22f2a ]
When running make nconfig with a static linking host toolchain, the libraries are linked in an incorrect order, resulting in errors similar to the following:
$ MAKEFLAGS='HOSTCC=cc\ -static' make nconfig /usr/bin/ld: /usr/lib64/gcc/x86_64-unknown-linux-gnu/14.2.1/../../../../lib64/libpanel.a(p_new.o): in function `new_panel': (.text+0x13): undefined reference to `_nc_panelhook_sp' /usr/bin/ld: (.text+0x6c): undefined reference to `_nc_panelhook_sp'
--- scripts/kconfig/nconf-cfg.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
scripts/kconfig/nconf-cfg.sh +6 -5
@@ -6,8 +6,9 @@ set -eu cflags=$1 libs=$2 -PKG="ncursesw menuw panelw" -PKG2="ncurses menu panel" +# Keep library order for static linking (HOSTCC='cc -static') +PKG="menuw panelw ncursesw" +PKG2="menu panel ncurses" if [ -n "$(command -v ${HOSTPKG_CONFIG})" ]; then if ${HOSTPKG_CONFIG} --exists $PKG; then
@@ -28,19 +29,19 @@ fi # find ncurses by pkg-config.) if [ -f /usr/include/ncursesw/ncurses.h ]; then echo -D_GNU_SOURCE -I/usr/include/ncursesw > ${cflags} - echo -lncursesw -lmenuw -lpanelw > ${libs} + echo -lmenuw -lpanelw -lncursesw > ${libs} exit 0 fi if [ -f /usr/include/ncurses/ncurses.h ]; then echo -D_GNU_SOURCE -I/usr/include/ncurses > ${cflags} - echo -lncurses -lmenu -lpanel > ${libs} + echo -lmenu -lpanel -lncurses > ${libs} exit 0 fi if [ -f /usr/include/ncurses.h ]; then echo -D_GNU_SOURCE > ${cflags} - echo -lncurses -lmenu -lpanel > ${libs} + echo -lmenu -lpanel -lncurses > ${libs} exit 0 fi
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/169 riscv: clocksource: Fix stimecmp update hazard on RV32
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiko Shimizu <[email protected]>
[ Upstream commit eaa9bb1d39d59e7c17b06cec12622b7c586ab629 ]
On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two separate 32-bit writes. A race condition exists if the timer triggers during these two writes.
The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp) recommends a specific 3-step sequence to avoid spurious interrupts when updating 64-bit comparison registers on 32-bit systems:
1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
2. Set the high-order bits (stimecmph) to the desired value.
3. Set the low-order bits (stimecmp) to the desired value.
Current implementation writes the LSB first without ensuring a future value, which may lead to a transient state where the 64-bit comparison is incorrectly evaluated as "expired" by the hardware. This results in spurious timer interrupts.
This patch adopts the spec-recommended 3-step sequence to ensure the intermediate 64-bit state is never smaller than the current time.
--- drivers/clocksource/timer-riscv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clocksource/timer-riscv.c +2 -1
@@ -50,8 +50,9 @@ static int riscv_clock_next_event(unsigned long delta,if (static_branch_likely (&riscv_sstc_available)) {#if defined(CONFIG_32BIT ) -csr_write (CSR_STIMECMP , next_tval &0xFFFFFFFF ); +csr_write (CSR_STIMECMP ,ULONG_MAX );csr_write (CSR_STIMECMPH , next_tval >>32 ); +csr_write (CSR_STIMECMP , next_tval &0xFFFFFFFF );#else csr_write (CSR_STIMECMP , next_tval);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/169 platform/x86/amd: Fix memory leak in wbrf_record()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 2bf1877b7094c684e1d652cac6912cfbc507ad3e ]
The tmp buffer is allocated using kcalloc() but is not freed if acpi_evaluate_dsm() fails. This causes a memory leak in the error path.
Fix this by explicitly freeing the tmp buffer in the error handling path of acpi_evaluate_dsm().
--- drivers/platform/x86/amd/wbrf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/amd/wbrf.c +3 -1
@@ -104,8 +104,10 @@ static int wbrf_record(struct acpi_device *adev, uint8_t action, struct wbrf_ran obj =acpi_evaluate_dsm (adev->handle, &wifi_acpi_dsm_guid,WBRF_REVISION ,WBRF_RECORD , &argv4); -if (!obj) +if (!obj) { +kfree (tmp);return -EINVAL ; + }if (obj->type !=ACPI_TYPE_INTEGER ) { ret = -EINVAL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/169 scsi: core: Wake up the error handler when final completions race against each other
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Jeffery <[email protected]>
[ Upstream commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 ]
The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance.
First, there is an memory ordering issue within scsi_dec_host_busy(). The write which clears SCMD_STATE_INFLIGHT may be reordered with reads counting in scsi_host_busy(). While the local CPU will see its own write, reordering can allow other CPUs in scsi_dec_host_busy() or scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to see a host busy equal to the host_failed count.
This race condition can be prevented with a memory barrier on the error path to force the write to be visible before counting host busy commands.
Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By counting busy commands before incrementing host_failed, it can race with a final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does not see host_failed incremented but scsi_eh_inc_host_failed() counts busy commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(), resulting in neither waking the error handler task.
This needs the call to scsi_host_busy() to be moved after host_failed is incremented to close the race condition.
--- drivers/scsi/scsi_error.c | 11 ++++++++++- drivers/scsi/scsi_lib.c | 8 ++++++++ 2 files changed, 18 insertions(+), 1 deletion(-)
drivers/scsi/scsi_error.c +10 -1
@@ -282,11 +282,20 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head) {struct scsi_cmnd *scmd =container_of (head,typeof (*scmd), rcu);struct Scsi_Host *shost = scmd->device->host; -unsigned int busy =scsi_host_busy (shost); +unsigned int busy;unsigned long flags;spin_lock_irqsave (shost->host_lock, flags); shost->host_failed++; +spin_unlock_irqrestore (shost->host_lock, flags); +/* +* The counting of busy requests needs to occur after adding to +* host_failed or after the lock acquire for adding to host_failed +* to prevent a race with host unbusy and missing an eh wakeup. +*/ + busy =scsi_host_busy (shost); + +spin_lock_irqsave (shost->host_lock, flags);scsi_eh_wakeup (shost, busy);spin_unlock_irqrestore (shost->host_lock, flags); }
drivers/scsi/scsi_lib.c +8 -0
@@ -373,6 +373,14 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)rcu_read_lock ();__clear_bit (SCMD_STATE_INFLIGHT , &cmd->state);if (unlikely (scsi_host_in_recovery (shost))) { +/* +* Ensure the clear of SCMD_STATE_INFLIGHT is visible to +* other CPUs before counting busy requests. Otherwise, +* reordering can cause CPUs to race and miss an eh wakeup +* when no CPU sees all busy requests as done or timed out. +*/ +smp_mb (); +unsigned int busy =scsi_host_busy (shost);spin_lock_irqsave (shost->host_lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/169 scsi: qla2xxx: Sanitize payload size to prevent member overflow
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <[email protected]>
[ Upstream commit 19bc5f2a6962dfaa0e32d0e0bc2271993d85d414 ]
In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item.
If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE.
Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member.
--- drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/qla2xxx/qla_isr.c +7 -0
@@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt, payload_size =sizeof (purex->els_frame_payload); } +if (total_bytes >sizeof (item->iocb.iocb)) + total_bytes =sizeof (item->iocb.iocb); + pending_bytes = total_bytes; no_bytes = (pending_bytes > payload_size) ? payload_size : pending_bytes;
@@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt, total_bytes = (le16_to_cpu (purex->frame_size) &0x0FFF ) -PURX_ELS_HEADER_SIZE ; + +if (total_bytes >sizeof (item->iocb.iocb)) + total_bytes =sizeof (item->iocb.iocb); + pending_bytes = total_bytes; entry_count = entry_count_remaining = purex->entry_count; no_bytes = (pending_bytes > sizeof(purex->els_frame_payload)) ?
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/169 ALSA: usb: Increase volume range that triggers a warning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Raghavan <[email protected]>
[ Upstream commit 6b971191fcfc9e3c2c0143eea22534f1f48dbb62 ]
On at least the HyperX Cloud III, the range is 18944 (-18944 -> 0 in steps of 1), so the original check for 255 steps is definitely obsolete. Let's give ourselves a little more headroom before we emit a warning.
--- sound/usb/mixer.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
sound/usb/mixer.c +3 -4
@@ -1807,11 +1807,10 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer, range = (cval->max - cval->min) / cval->res;/* -* Are there devices with volume range more than 255? I use a bit more -* to be sure. 384 is a resolution magic number found on Logitech -* devices. It will definitively catch all buggy Logitech devices. +* There are definitely devices with a range of ~20,000, so let's be +* conservative and allow for a bit more. */ -if (range >384 ) { +if (range >65535 ) {usb_audio_warn (mixer->chip,"Warning! Unlikely big volume range (=%u), cval->res is probably wrong." , range);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/169 drm/imagination: Wait for FW trace update command completion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brajesh Gupta <[email protected]>
[ Upstream commit 812062e74a3945b575dce89d330b67cb50054a77 ]
Possibility of no FW trace available after update in the fw_trace_mask due to asynchronous mode of command consumption in the FW.
To ensure FW trace is available after update, wait for FW trace log update command completion from the FW.
--- drivers/gpu/drm/imagination/pvr_fw_trace.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/imagination/pvr_fw_trace.c +7 -1
@@ -141,6 +141,7 @@ update_logtype(struct pvr_device *pvr_dev, u32 group_mask)struct rogue_fwif_kccb_cmd cmd;int idx;int err; +int slot;if (group_mask) fw_trace->tracebuf_ctrl->log_type =ROGUE_FWIF_LOG_TYPE_TRACE | group_mask;
@@ -158,8 +159,13 @@ update_logtype(struct pvr_device *pvr_dev, u32 group_mask) cmd.cmd_type =ROGUE_FWIF_KCCB_CMD_LOGTYPE_UPDATE ; cmd.kccb_flags =0 ; - err =pvr_kccb_send_cmd (pvr_dev, &cmd,NULL ); + err =pvr_kccb_send_cmd (pvr_dev, &cmd, &slot); +if (err) + goto err_drm_dev_exit; + + err =pvr_kccb_wait_for_completion (pvr_dev, slot,HZ ,NULL ); +err_drm_dev_exit:drm_dev_exit (idx); err_up_read:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/169 netdevsim: fix a race issue related to the operation on bpf_bound_progs list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
[ Upstream commit b97d5eedf4976cc94321243be83b39efe81a0e15 ]
The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs list_del. Concurrent operations on the list may lead to list corruption and trigger a kernel crash as follows:
[ 417.290971] kernel BUG at lib/list_debug.c:62! [ 417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 417.291007] Workqueue: events bpf_prog_free_deferred [ 417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0 [ 417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8 [ 417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246 [ 417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000 [ 417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180 [ 417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003 [ 417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20 [ 417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000 [ 417.291074] FS: 0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000 [ 417.291079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0 [ 417.291088] PKRU: 55555554 [ 417.291091] Call Trace: [ 417.291096] <TASK> [ 417.291103] nsim_bpf_destroy_prog+0x31/0x80 [netdevsim] [ 417.291154] __bpf_prog_offload_destroy+0x2a/0x80 [ 417.291163] bpf_prog_dev_bound_destroy+0x6f/0xb0 [ 417.291171] bpf_prog_free_deferred+0x18e/0x1a0 [ 417.291178] process_one_work+0x18a/0x3a0 [ 417.291188] worker_thread+0x27b/0x3a0 [ 417.291197] ? __pfx_worker_thread+0x10/0x10 [ 417.291207] kthread+0xe5/0x120 [ 417.291214] ? __pfx_kthread+0x10/0x10 [ 417.291221] ret_from_fork+0x31/0x50 [ 417.291230] ? __pfx_kthread+0x10/0x10 [ 417.291236] ret_from_fork_asm+0x1a/0x30 [ 417.291246] </TASK>
Add a mutex lock, to prevent simultaneous addition and deletion operations on the list.
--- drivers/net/netdevsim/bpf.c | 6 ++++++ drivers/net/netdevsim/dev.c | 2 ++ drivers/net/netdevsim/netdevsim.h | 1 + 3 files changed, 9 insertions(+)
drivers/net/netdevsim/bpf.c +6 -0
@@ -244,7 +244,9 @@ static int nsim_bpf_create_prog(struct nsim_dev *nsim_dev, &state->state, &nsim_bpf_string_fops);debugfs_create_bool ("loaded" ,0400 , state->ddir, &state->is_loaded); +mutex_lock (&nsim_dev->progs_list_lock);list_add_tail (&state->l, &nsim_dev->bpf_bound_progs); +mutex_unlock (&nsim_dev->progs_list_lock); prog->aux->offload->dev_priv = state;
@@ -273,12 +275,16 @@ static int nsim_bpf_translate(struct bpf_prog *prog)static void nsim_bpf_destroy_prog (struct bpf_prog *prog) {struct nsim_bpf_bound_prog *state; +struct nsim_dev *nsim_dev; state = prog->aux->offload->dev_priv; + nsim_dev = state->nsim_dev;WARN (state->is_loaded,"offload state destroyed while program still bound" );debugfs_remove_recursive (state->ddir); +mutex_lock (&nsim_dev->progs_list_lock);list_del (&state->l); +mutex_unlock (&nsim_dev->progs_list_lock);kfree (state); }
drivers/net/netdevsim/dev.c +2 -0
@@ -1545,6 +1545,7 @@ int nsim_drv_probe(struct nsim_bus_dev *nsim_bus_dev) nsim_dev->max_macs =NSIM_DEV_MAX_MACS_DEFAULT ; nsim_dev->test1 =NSIM_DEV_TEST1_DEFAULT ;spin_lock_init (&nsim_dev->fa_cookie_lock); +mutex_init (&nsim_dev->progs_list_lock);dev_set_drvdata (&nsim_bus_dev->dev, nsim_dev);
@@ -1683,6 +1684,7 @@ void nsim_drv_remove(struct nsim_bus_dev *nsim_bus_dev)devl_unregister (devlink);kfree (nsim_dev->vfconfigs);kfree (nsim_dev->fa_cookie); +mutex_destroy (&nsim_dev->progs_list_lock);devl_unlock (devlink);devlink_free (devlink);dev_set_drvdata (&nsim_bus_dev->dev,NULL );
drivers/net/netdevsim/netdevsim.h +1 -0
@@ -308,6 +308,7 @@ struct nsim_dev {u32 prog_id_gen;struct list_head bpf_bound_progs;struct list_head bpf_bound_maps; +struct mutex progs_list_lock;struct netdev_phys_item_id switch_id;struct list_head port_list;bool fw_update_status;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/169 ice: Fix persistent failure in ice_get_rxfh
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cody Haas <[email protected]>
[ Upstream commit f406220eb8e227ca344eef1a6d30aff53706b196 ]
Several ioctl functions have the ability to call ice_get_rxfh, however all of these ioctl functions do not provide all of the expected information in ethtool_rxfh_param. For example, ethtool_get_rxfh_indir does not provide an rss_key. This previously caused ethtool_get_rxfh_indir to always fail with -EINVAL.
This change draws inspiration from i40e_get_rss to handle this situation, by only calling the appropriate rss helpers when the necessary information has been provided via ethtool_rxfh_param.
--- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 6 +---- drivers/net/ethernet/intel/ice/ice_main.c | 28 ++++++++++++++++++++ 3 files changed, 30 insertions(+), 5 deletions(-)
drivers/net/ethernet/intel/ice/ice.h +1 -0
@@ -952,6 +952,7 @@ void ice_map_xdp_rings(struct ice_vsi *vsi);int ice_xdp_xmit (struct net_device *dev,int n,struct xdp_frame **frames,u32 flags); +int ice_get_rss (struct ice_vsi *vsi,u8 *seed,u8 *lut,u16 lut_size);int ice_set_rss_lut (struct ice_vsi *vsi,u8 *lut,u16 lut_size);int ice_get_rss_lut (struct ice_vsi *vsi,u8 *lut,u16 lut_size);int ice_set_rss_key (struct ice_vsi *vsi,u8 *seed);
drivers/net/ethernet/intel/ice/ice_ethtool.c +1 -5
@@ -3649,11 +3649,7 @@ ice_get_rxfh(struct net_device *netdev, struct ethtool_rxfh_param *rxfh)if (!lut)return -ENOMEM ; - err =ice_get_rss_key (vsi, rxfh->key); -if (err) - goto out; - - err =ice_get_rss_lut (vsi, lut, vsi->rss_table_size); + err =ice_get_rss (vsi, rxfh->key, lut, vsi->rss_table_size);if (err) goto out;
drivers/net/ethernet/intel/ice/ice_main.c +28 -0
@@ -8042,6 +8042,34 @@ int ice_get_rss_key(struct ice_vsi *vsi, u8 *seed)return status; } +/** +* ice_get_rss - Get RSS LUT and/or key +* @vsi: Pointer to VSI structure +* @seed: Buffer to store the key in +* @lut: Buffer to store the lookup table entries +* @lut_size: Size of buffer to store the lookup table entries +* +* Return: 0 on success, negative on failure +*/ +int ice_get_rss (struct ice_vsi *vsi,u8 *seed,u8 *lut,u16 lut_size) +{ +int err; + +if (seed) { + err =ice_get_rss_key (vsi, seed); +if (err) +return err; + } + +if (lut) { + err =ice_get_rss_lut (vsi, lut, lut_size); +if (err) +return err; + } + +return 0 ; +} +/** * ice_set_rss_hfunc - Set RSS HASH function * @vsi: Pointer to VSI structure
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/169 Revert "nfc/nci: Add the inconsistency check between the input data length and count"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf upstream.
This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979.
NFC packets may have NUL-bytes. Checking for string length is not a correct assumption here. As long as there is a check for the length copied from copy_from_user, all should be fine.
The fix only prevented the syzbot reproducer from triggering the bug because the packet is not enqueued anymore and the code that triggers the bug is not exercised.
The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the revert, 6 out of 8 tests pass.
--- drivers/nfc/virtual_ncidev.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/nfc/virtual_ncidev.c +0 -4
@@ -125,10 +125,6 @@ static ssize_t virtual_ncidev_write(strukfree_skb (skb);return -EFAULT ; } -if (strnlen (skb->data, count) != count) { -kfree_skb (skb); -return -EINVAL ; - }nci_recv_frame (vdev->ndev, skb);return count;
Greg Kroah-Hartman
maintainerPATCH 74/169 net: hns3: fix data race in hns3_fetch_stats
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit 748a81c8ceda1fdbdcd0af595947422e810442aa ]
In hns3_fetch_stats(), ring statistics, protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics are already accumulated by hns3_ring_stats_update(). Fix this by reading them into a temporary buffer first.
--- .../net/ethernet/hisilicon/hns3/hns3_enet.c | 69 ++++++++++--------- 1 file changed, 36 insertions(+), 33 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +36 -33
@@ -2500,44 +2500,47 @@ static netdev_features_t hns3_features_check(struct sk_buff *skb,static void hns3_fetch_stats (struct rtnl_link_stats64 *stats,struct hns3_enet_ring *ring,bool is_tx) { +struct ring_stats ring_stats;unsigned int start;do { start =u64_stats_fetch_begin (&ring->syncp); -if (is_tx) { - stats->tx_bytes += ring->stats.tx_bytes; - stats->tx_packets += ring->stats.tx_pkts; - stats->tx_dropped += ring->stats.sw_err_cnt; - stats->tx_dropped += ring->stats.tx_vlan_err; - stats->tx_dropped += ring->stats.tx_l4_proto_err; - stats->tx_dropped += ring->stats.tx_l2l3l4_err; - stats->tx_dropped += ring->stats.tx_tso_err; - stats->tx_dropped += ring->stats.over_max_recursion; - stats->tx_dropped += ring->stats.hw_limitation; - stats->tx_dropped += ring->stats.copy_bits_err; - stats->tx_dropped += ring->stats.skb2sgl_err; - stats->tx_dropped += ring->stats.map_sg_err; - stats->tx_errors += ring->stats.sw_err_cnt; - stats->tx_errors += ring->stats.tx_vlan_err; - stats->tx_errors += ring->stats.tx_l4_proto_err; - stats->tx_errors += ring->stats.tx_l2l3l4_err; - stats->tx_errors += ring->stats.tx_tso_err; - stats->tx_errors += ring->stats.over_max_recursion; - stats->tx_errors += ring->stats.hw_limitation; - stats->tx_errors += ring->stats.copy_bits_err; - stats->tx_errors += ring->stats.skb2sgl_err; - stats->tx_errors += ring->stats.map_sg_err; - }else { - stats->rx_bytes += ring->stats.rx_bytes; - stats->rx_packets += ring->stats.rx_pkts; - stats->rx_dropped += ring->stats.l2_err; - stats->rx_errors += ring->stats.l2_err; - stats->rx_errors += ring->stats.l3l4_csum_err; - stats->rx_crc_errors += ring->stats.l2_err; - stats->multicast += ring->stats.rx_multicast; - stats->rx_length_errors += ring->stats.err_pkt_len; - } + ring_stats = ring->stats; }while (u64_stats_fetch_retry (&ring->syncp, start)); + +if (is_tx) { + stats->tx_bytes += ring_stats.tx_bytes; + stats->tx_packets += ring_stats.tx_pkts; + stats->tx_dropped += ring_stats.sw_err_cnt; + stats->tx_dropped += ring_stats.tx_vlan_err; + stats->tx_dropped += ring_stats.tx_l4_proto_err; + stats->tx_dropped += ring_stats.tx_l2l3l4_err; + stats->tx_dropped += ring_stats.tx_tso_err; + stats->tx_dropped += ring_stats.over_max_recursion; + stats->tx_dropped += ring_stats.hw_limitation; + stats->tx_dropped += ring_stats.copy_bits_err; + stats->tx_dropped += ring_stats.skb2sgl_err; + stats->tx_dropped += ring_stats.map_sg_err; + stats->tx_errors += ring_stats.sw_err_cnt; + stats->tx_errors += ring_stats.tx_vlan_err; + stats->tx_errors += ring_stats.tx_l4_proto_err; + stats->tx_errors += ring_stats.tx_l2l3l4_err; + stats->tx_errors += ring_stats.tx_tso_err; + stats->tx_errors += ring_stats.over_max_recursion; + stats->tx_errors += ring_stats.hw_limitation; + stats->tx_errors += ring_stats.copy_bits_err; + stats->tx_errors += ring_stats.skb2sgl_err; + stats->tx_errors += ring_stats.map_sg_err; + }else { + stats->rx_bytes += ring_stats.rx_bytes; + stats->rx_packets += ring_stats.rx_pkts; + stats->rx_dropped += ring_stats.l2_err; + stats->rx_errors += ring_stats.l2_err; + stats->rx_errors += ring_stats.l3l4_csum_err; + stats->rx_crc_errors += ring_stats.l2_err; + stats->multicast += ring_stats.rx_multicast; + stats->rx_length_errors += ring_stats.err_pkt_len; + } } static void hns3_nic_get_stats64(struct net_device *netdev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/169 be2net: fix data race in be_get_new_eqd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit 302e5b481caa7b3d11ec0e058434c1fc95195e50 ]
In be_get_new_eqd(), statistics of pkts, protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. Before the commit in question, these statistics were retrieved one by one directly from queues. Fix this by reading them into temporary variables first.
--- drivers/net/ethernet/emulex/benet/be_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +5 -3
@@ -2141,7 +2141,7 @@ static int be_get_new_eqd(struct be_eq_obj *eqo)struct be_aic_obj *aic;struct be_rx_obj *rxo;struct be_tx_obj *txo; -u64 rx_pkts =0 , tx_pkts =0 ; +u64 rx_pkts =0 , tx_pkts =0 , pkts;ulong now;u32 pps, delta;int i;
@@ -2157,15 +2157,17 @@ static int be_get_new_eqd(struct be_eq_obj *eqo) for_all_rx_queues_on_eq(adapter, eqo, rxo, i) {do { start =u64_stats_fetch_begin (&rxo->stats.sync); - rx_pkts += rxo->stats.rx_pkts; + pkts = rxo->stats.rx_pkts; }while (u64_stats_fetch_retry (&rxo->stats.sync, start)); + rx_pkts += pkts; } for_all_tx_queues_on_eq(adapter, eqo, txo, i) {do { start =u64_stats_fetch_begin (&txo->stats.sync); - tx_pkts += txo->stats.tx_reqs; + pkts = txo->stats.tx_reqs; }while (u64_stats_fetch_retry (&txo->stats.sync, start)); + tx_pkts += pkts; }/* Skip, if wrapped around or first calculation */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/169 net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit d57c67c956a1bad15115eba6e59d77a6dfeba01d ]
HCLGE_FD_AD_COUNTER_NUM_M should be at GENMASK(19, 13), rather than at GENMASK(20, 13), because bit 20 is HCLGE_FD_AD_NXT_STEP_B.
This patch corrects the wrong definition.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +1 -1
@@ -731,7 +731,7 @@ struct hclge_fd_tcam_config_3_cmd {#define HCLGE_FD_AD_QID_M GENMASK(11, 2)#define HCLGE_FD_AD_USE_COUNTER_B 12#define HCLGE_FD_AD_COUNTER_NUM_S 13 -#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13) +#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)#define HCLGE_FD_AD_NXT_STEP_B 20#define HCLGE_FD_AD_NXT_KEY_S 21#define HCLGE_FD_AD_NXT_KEY_M GENMASK(25, 21)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/169 net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit f87e034d16e43af984380a95c32c25201b7759a7 ]
Use next_input_key instead of counter_id to set HCLGE_FD_AD_NXT_KEY.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -1
@@ -5700,7 +5700,7 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc, HCLGE_FD_AD_COUNTER_NUM_S, action->counter_id);hnae3_set_bit (ad_data,HCLGE_FD_AD_NXT_STEP_B , action->use_next_stage);hnae3_set_field (ad_data,HCLGE_FD_AD_NXT_KEY_M ,HCLGE_FD_AD_NXT_KEY_S , - action->counter_id); + action->next_input_key); req->ad_data =cpu_to_le64 (ad_data); ret =hclge_cmd_send (&hdev->hw, &desc,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/169 mISDN: annotate data-race around dev->work
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 8175dbf174d487afab81e936a862a8d9b8a1ccb6 ]
dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.
BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read
write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline] mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112 do_loop_readv_writev fs/read_write.c:847 [inline] vfs_readv+0x3fb/0x690 fs/read_write.c:1020 do_readv+0xe7/0x210 fs/read_write.c:1080 __do_sys_readv fs/read_write.c:1165 [inline] __se_sys_readv fs/read_write.c:1162 [inline] __x64_sys_readv+0x45/0x50 fs/read_write.c:1162 x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000000 -> 0x00000001
--- drivers/isdn/mISDN/timerdev.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/isdn/mISDN/timerdev.c +8 -5
@@ -109,14 +109,14 @@ mISDN_read(struct file *filep, char __user *buf, size_t count, loff_t *off)spin_unlock_irq (&dev->lock);if (filep->f_flags &O_NONBLOCK )return -EAGAIN ; -wait_event_interruptible (dev->wait, (dev->work || +wait_event_interruptible (dev->wait, (READ_ONCE (dev->work) || !list_empty (list)));if (signal_pending (current))return -ERESTARTSYS ;spin_lock_irq (&dev->lock); }if (dev->work) - dev->work =0 ; +WRITE_ONCE (dev->work,0 );if (!list_empty (list)) { timer = list_first_entry(list, struct mISDNtimer, list);list_del (&timer->list);
@@ -141,13 +141,16 @@ mISDN_poll(struct file *filep, poll_table *wait)if (*debug &DEBUG_TIMER )printk (KERN_DEBUG "%s(%p, %p)\n" , __func__, filep, wait);if (dev) { +u32 work; +poll_wait (filep, &dev->wait, wait); mask =0 ; -if (dev->work || !list_empty (&dev->expired)) + work =READ_ONCE (dev->work); +if (work || !list_empty (&dev->expired)) mask |= (EPOLLIN |EPOLLRDNORM );if (*debug &DEBUG_TIMER )printk (KERN_DEBUG "%s work(%d) empty(%d)\n" , __func__, - dev->work,list_empty (&dev->expired)); + work,list_empty (&dev->expired)); }return mask; }
@@ -172,7 +175,7 @@ misdn_add_timer(struct mISDNtimerdev *dev, int timeout)struct mISDNtimer *timer;if (!timeout) { - dev->work =1 ; +WRITE_ONCE (dev->work,1 );wake_up_interruptible (&dev->wait); id =0 ; }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/169 Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: gongqi <[email protected]>
commit 19a5d9ba6208e9006a2a9d5962aea4d6e427d8ab upstream.
The MECHREVO Wujie 15X Pro requires several i8042 quirks to function correctly. Specifically, NOMUX, RESET_ALWAYS, NOLOOP, and NOPNP are needed to ensure the keyboard and touchpad work reliably.
--- drivers/input/serio/i8042-acpipnpio.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +7 -0
@@ -1176,6 +1176,13 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, /* * A lot of modern Clevo barebones have touchpad and/or keyboard issues * after suspend fixable with the forcenorestore quirk.
Greg Kroah-Hartman
maintainerPATCH 49/169 Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: feng <[email protected]>
commit 2934325f56150ad8dab8ab92cbe2997242831396 upstream.
The ASUS Zenbook UX425QA_UM425QA fails to initialize the keyboard after a cold boot.
A quirk already exists for "ZenBook UX425", but some Zenbooks report "Zenbook" with a lowercase 'b'. Since DMI matching is case-sensitive, the existing quirk is not applied to these "extra special" Zenbooks.
Testing confirms that this model needs the same quirks as the ZenBook UX425 variants.
--- drivers/input/serio/i8042-acpipnpio.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +11 -0
@@ -116,6 +116,17 @@ static const struct dmi_system_id i8042_ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER) }, { +/* +* ASUS Zenbook UX425QA_UM425QA +* Some Zenbooks report "Zenbook" with a lowercase b. +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Zenbook UX425QA_UM425QA"), + }, + .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER |SERIO_QUIRK_RESET_NEVER ) + }, + {/* ASUS ZenBook UX425UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 50/169 scsi: storvsc: Process unsupported MODE_SENSE_10
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit 9eacec5d18f98f89be520eeeef4b377acee3e4b8 upstream.
The Hyper-V host does not support MODE_SENSE_10 and MODE_SENSE. The driver handles MODE_SENSE as unsupported command, but not for MODE_SENSE_10. Add MODE_SENSE_10 to the same handling logic and return correct code to SCSI layer.
--- drivers/scsi/storvsc_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/storvsc_drv.c +2 -1
@@ -1145,7 +1145,7 @@ static void storvsc_on_io_completion(str* The current SCSI handling on the host side does * not correctly handle: * INQUIRY command with page code parameter set to 0x80 -* MODE_SENSE command with cmd[2] == 0x1c +* MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c * MAINTENANCE_IN is not supported by HyperV FC passthrough * * Setup srb and scsi status so this won't be fatal.
@@ -1155,6 +1155,7 @@ static void storvsc_on_io_completion(strif ((stor_pkt->vm_srb.cdb[0 ] ==INQUIRY ) || (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE ) || + (stor_pkt->vm_srb.cdb[0 ] ==MODE_SENSE_10 ) || (stor_pkt->vm_srb.cdb[0 ] ==MAINTENANCE_IN &&hv_dev_is_fc (device))) { vstor_packet->vm_srb.scsi_status =0 ;
Greg Kroah-Hartman
maintainerPATCH 51/169 scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
commit 901a5f309daba412e2a30364d7ec1492fa11c32c upstream.
Memory allocated for struct vscsiblk_info in scsiback_probe() is not freed in scsiback_remove() leading to potential memory leaks on remove, as well as in the scsiback_probe() error paths. Fix that by freeing it in scsiback_remove().
--- drivers/xen/xen-scsiback.c | 1 + 1 file changed, 1 insertion(+)
drivers/xen/xen-scsiback.c +1 -0
@@ -1262,6 +1262,7 @@ static void scsiback_remove(struct xenbugnttab_page_cache_shrink (&info->free_pages,0 );dev_set_drvdata (&dev->dev,NULL ); +kfree (info); } static int scsiback_probe(struct xenbus_device *dev,
Greg Kroah-Hartman
maintainerPATCH 52/169 arm64: dts: rockchip: remove dangerous max-link-speed from helios64
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <[email protected]>
commit 0368e4afcf20f377c81fa77b1c7d0dee4a625a44 upstream.
Shawn Lin from Rockchip strongly discourages attempts to use their RK3399 PCIe core at 5.0 GT/s speed, citing concerns about catastrophic failures that may happen. Even if the odds are low, drop from last user of this non-default property for the RK3399 platform, helios64 board dts.
--- arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts +0 -1
@@ -424,7 +424,6 @@ &pcie0 { ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>; - max-link-speed = <2>; num-lanes = <2>; pinctrl-names = "default"; status = "okay";
Greg Kroah-Hartman
maintainerPATCH 53/169 arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Jirman <[email protected]>
commit 5497ffe305b2ea31ae62d4a311d7cabfb671f54a upstream.
Previously sometimes pressing the volume-down button would register as a volume-up button. Match the thresholds as shown in the Pinephone Pro schematic.
Tests:
~ $ evtest
// Mashed the volume down ~100 times with varying intensity
Event: time xxx, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 1
Event: time xxx, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 0 // Mashed the volume up ~100 times with varying intensity
Event: time xxx, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 1
Event: time xxx, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 0
--- arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts +2 -2
@@ -40,13 +40,13 @@ button-up { label = "Volume Up"; linux,code = <KEY_VOLUMEUP>; - press-threshold-microvolt = <100000>; + press-threshold-microvolt = <2000>; }; button-down { label = "Volume Down"; linux,code = <KEY_VOLUMEDOWN>; - press-threshold-microvolt = <600000>; + press-threshold-microvolt = <300000>; }; };
Greg Kroah-Hartman
maintainerPATCH 44/169 comedi: dmm32at: serialize use of paged registers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream.
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15:
00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved
11 => Calibration registers are accessible
The interrupt service routine (dmm32at_isr()) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the dm32at_8255_io() function (used for Comedi instruction handling on the digital I/O subdevice).
Make use of the generic Comedi device spin-lock dev->spinlock (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers.
--- drivers/comedi/drivers/dmm32at.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/comedi/drivers/dmm32at.c +30 -2
@@ -330,6 +330,7 @@ static int dmm32at_ai_cmdtest(struct comstatic void dmm32at_setaitimer (struct comedi_device *dev,unsigned int nansec) { +unsigned long irq_flags;unsigned char lo1, lo2, hi2;unsigned short both2;
@@ -342,6 +343,9 @@ static void dmm32at_setaitimer(struct co/* set counter clocks to 10MHz, disable all aux dio */ outb (0 , dev->iobase +DMM32AT_CTRDIO_CFG_REG ); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the clock regs */ outb (DMM32AT_CTRL_PAGE_8254 , dev->iobase +DMM32AT_CTRL_REG );
@@ -354,6 +358,8 @@ static void dmm32at_setaitimer(struct cooutb (lo2, dev->iobase +DMM32AT_CLK2 );outb (hi2, dev->iobase +DMM32AT_CLK2 ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* enable the ai conversion interrupt and the clock to start scans */ outb(DMM32AT_INTCLK_ADINT | DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL,
@@ -363,13 +369,19 @@ static void dmm32at_setaitimer(struct costatic int dmm32at_ai_cmd (struct comedi_device *dev,struct comedi_subdevice *s) {struct comedi_cmd *cmd = &s->async->cmd; +unsigned long irq_flags;int ret;dmm32at_ai_set_chanspec (dev, s, cmd->chanlist[0 ], cmd->chanlist_len); +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* reset the interrupt just in case */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); +spin_unlock_irqrestore (&dev->spinlock, irq_flags); +/* * wait for circuit to settle * we don't have the 'insn' here but it's not needed
@@ -429,8 +441,13 @@ static irqreturn_t dmm32at_isr(int irq,comedi_handle_events (dev, s); } +/* serialize access to control register and paged registers */ +spin_lock (&dev->spinlock); +/* reset the interrupt */ outb (DMM32AT_CTRL_INTRST , dev->iobase +DMM32AT_CTRL_REG ); + +spin_unlock (&dev->spinlock);return IRQ_HANDLED ; }
@@ -481,14 +498,25 @@ static int dmm32at_ao_insn_write(structstatic int dmm32at_8255_io (struct comedi_device *dev,int dir,int port,int data,unsigned long regbase) { +unsigned long irq_flags; +int ret; + +/* serialize access to control register and paged registers */ +spin_lock_irqsave (&dev->spinlock, irq_flags); +/* get access to the DIO regs */ outb (DMM32AT_CTRL_PAGE_8255 , dev->iobase +DMM32AT_CTRL_REG );if (dir) {outb (data, dev->iobase + regbase + port); -return 0 ; + ret =0 ; + }else { + ret =inb (dev->iobase + regbase + port); } -return inb (dev->iobase + regbase + port); + +spin_unlock_irqrestore (&dev->spinlock, irq_flags); + +return ret; }/* Make sure the board is there and put it to a known state */
Greg Kroah-Hartman
maintainerPATCH 80/169 usbnet: limit max_mtu based on devices hard_mtu
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Vivier <[email protected]>
[ Upstream commit c7159e960f1472a5493ac99aff0086ab1d683594 ]
The usbnet driver initializes net->max_mtu to ETH_MAX_MTU before calling the device's bind() callback. When the bind() callback sets dev->hard_mtu based the device's actual capability (from CDC Ethernet's wMaxSegmentSize descriptor), max_mtu is never updated to reflect this hardware limitation).
This allows userspace (DHCP or IPv6 RA) to configure MTU larger than the device can handle, leading to silent packet drops when the backend sends packet exceeding the device's buffer size.
Fix this by limiting net->max_mtu to the device's hard_mtu after the bind callback returns.
See https://gitlab.com/qemu-project/qemu/-/issues/3268 and
https://bugs.passt.top/attachment.cgi?bugid=189
--- drivers/net/usb/usbnet.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/usb/usbnet.c +6 -3
@@ -1797,9 +1797,12 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)if ((dev->driver_info->flags &FLAG_NOARP ) !=0 ) net->flags |=IFF_NOARP ; -/* maybe the remote can't receive an Ethernet MTU */ -if (net->mtu > (dev->hard_mtu - net->hard_header_len)) - net->mtu = dev->hard_mtu - net->hard_header_len; +if (net->max_mtu > (dev->hard_mtu - net->hard_header_len)) + net->max_mtu = dev->hard_mtu - net->hard_header_len; + +if (net->mtu > net->max_mtu) + net->mtu = net->max_mtu; + }else if (!info->in || !info->out) status =usbnet_get_endpoints (dev, udev);else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/169 bonding: provide a net pointer to __skb_flow_dissect()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 5f9b329096596b7e53e07d041d7fca4cbe1be752 ]
After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev, skb->sk, or a user provided pointer.
In the following case, syzbot was able to cook a bare skb.
WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: <TASK> bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline] __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157 bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline] bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline] bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515 xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388 bpf_prog_run_xdp include/net/xdp.h:700 [inline] bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421 bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
--- drivers/net/bonding/bond_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/bonding/bond_main.c +3 -2
@@ -4263,8 +4263,9 @@ static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb, const vcase BOND_XMIT_POLICY_ENCAP23 :case BOND_XMIT_POLICY_ENCAP34 :memset (fk,0 ,sizeof (*fk)); -return __skb_flow_dissect (NULL , skb, &flow_keys_bonding, - fk, data, l2_proto, nhoff, hlen,0 ); +return __skb_flow_dissect (dev_net (bond->dev), skb, + &flow_keys_bonding, fk, data, + l2_proto, nhoff, hlen,0 );default :break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/169 net: dsa: fix off-by-one in maximum bridge ID determination
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit dfca045cd4d0ea07ff4198ba392be3e718acaddc ]
Prior to the blamed commit, the bridge_num range was from 0 to ds->max_num_bridges - 1. After the commit, it is from 1 to ds->max_num_bridges.
So this check:
if (bridge_num >= max) return 0; must be updated to: if (bridge_num > max) return 0;
in order to allow the last bridge_num value (==max) to be used.
This is easiest visible when a driver sets ds->max_num_bridges=1. The observed behaviour is that even the first created bridge triggers the netlink extack "Range of offloadable bridges exceeded" warning, and is handled in software rather than being offloaded.
--- net/dsa/dsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dsa/dsa.c +1 -1
@@ -157,7 +157,7 @@ unsigned int dsa_bridge_num_get(const struct net_device *bridge_dev, int max) bridge_num =find_next_zero_bit (&dsa_fwd_offloading_bridges,DSA_MAX_NUM_OFFLOADING_BRIDGES ,1 ); -if (bridge_num >= max) +if (bridge_num > max)return 0 ;set_bit (bridge_num, &dsa_fwd_offloading_bridges);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/169 octeontx2-af: Fix error handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <[email protected]>
[ Upstream commit 19e4175e997a5b85eab97d522f00cc99abd1873c ]
This commit adds error handling and rollback logic to rvu_mbox_handler_attach_resources() to properly clean up partially attached resources when rvu_attach_block() fails.
--- .../net/ethernet/marvell/octeontx2/af/rvu.c | 86 ++++++++++++++----- 1 file changed, 64 insertions(+), 22 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +64 -22
@@ -1546,8 +1546,8 @@ static int rvu_get_attach_blkaddr(struct rvu *rvu, int blktype,return -ENODEV ; } -static void rvu_attach_block (struct rvu *rvu,int pcifunc,int blktype, -int num_lfs,struct rsrc_attach *attach) +static int rvu_attach_block (struct rvu *rvu,int pcifunc,int blktype, +int num_lfs,struct rsrc_attach *attach) {struct rvu_pfvf *pfvf =rvu_get_pfvf (rvu, pcifunc);struct rvu_hwinfo *hw = rvu->hw;
@@ -1557,21 +1557,21 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,u64 cfg;if (!num_lfs) -return ; +return -EINVAL ; blkaddr =rvu_get_attach_blkaddr (rvu, blktype, pcifunc, attach);if (blkaddr <0 ) -return ; +return -EFAULT ; block = &hw->block[blkaddr];if (!block->lf.bmap) -return ; +return -ESRCH ;for (slot =0 ; slot < num_lfs; slot++) {/* Allocate the resource */ lf =rvu_alloc_rsrc (&block->lf);if (lf <0 ) -return ; +return -EFAULT ; cfg = (1ULL <<63 ) | (pcifunc <<8 ) | slot; rvu_write64(rvu, blkaddr, block->lfcfg_reg |
@@ -1582,6 +1582,8 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,/* Set start MSIX vector for this LF within this PF/VF */ rvu_set_msix_offset (rvu, pfvf, block, lf); } + +return 0 ; } static int rvu_check_rsrc_availability(struct rvu *rvu,
@@ -1719,22 +1721,31 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,int err;/* If first request, detach all existing attached resources */ -if (!attach->modify) -rvu_detach_rsrcs (rvu,NULL , pcifunc); +if (!attach->modify) { + err =rvu_detach_rsrcs (rvu,NULL , pcifunc); +if (err) +return err; + }mutex_lock (&rvu->rsrc_lock);/* Check if the request can be accommodated */ err =rvu_check_rsrc_availability (rvu, attach, pcifunc);if (err) - goto exit; + goto fail1;/* Now attach the requested resources */ -if (attach->npalf) -rvu_attach_block (rvu, pcifunc,BLKTYPE_NPA ,1 , attach); +if (attach->npalf) { + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_NPA ,1 , attach); +if (err) + goto fail1; + } -if (attach->nixlf) -rvu_attach_block (rvu, pcifunc,BLKTYPE_NIX ,1 , attach); +if (attach->nixlf) { + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_NIX ,1 , attach); +if (err) + goto fail2; + }if (attach->sso) {/* RVU func doesn't know which exact LF or slot is attached
@@ -1744,33 +1755,64 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,*/ if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_SSO ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_SSO , - attach->sso, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_SSO , + attach->sso, attach); +if (err) + goto fail3; }if (attach->ssow) {if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_SSOW ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_SSOW , - attach->ssow, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_SSOW , + attach->ssow, attach); +if (err) + goto fail4; }if (attach->timlfs) {if (attach->modify)rvu_detach_block (rvu, pcifunc,BLKTYPE_TIM ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_TIM , - attach->timlfs, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_TIM , + attach->timlfs, attach); +if (err) + goto fail5; }if (attach->cptlfs) {if (attach->modify &&rvu_attach_from_same_block (rvu,BLKTYPE_CPT , attach))rvu_detach_block (rvu, pcifunc,BLKTYPE_CPT ); -rvu_attach_block (rvu, pcifunc,BLKTYPE_CPT , - attach->cptlfs, attach); + err =rvu_attach_block (rvu, pcifunc,BLKTYPE_CPT , + attach->cptlfs, attach); +if (err) + goto fail6; } -exit: +mutex_unlock (&rvu->rsrc_lock); +return 0 ; + +fail6: +if (attach->timlfs) +rvu_detach_block (rvu, pcifunc,BLKTYPE_TIM ); + +fail5: +if (attach->ssow) +rvu_detach_block (rvu, pcifunc,BLKTYPE_SSOW ); + +fail4: +if (attach->sso) +rvu_detach_block (rvu, pcifunc,BLKTYPE_SSO ); + +fail3: +if (attach->nixlf) +rvu_detach_block (rvu, pcifunc,BLKTYPE_NIX ); + +fail2: +if (attach->npalf) +rvu_detach_block (rvu, pcifunc,BLKTYPE_NPA ); + +fail1:mutex_unlock (&rvu->rsrc_lock);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/169 net: openvswitch: fix data race in ovs_vport_get_upcall_stats
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Yang <[email protected]>
[ Upstream commit cc4816bdb08639e5cd9acb295a02d6f0f09736b4 ]
In ovs_vport_get_upcall_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics are already accumulated by u64_stats_inc(). Fix this by reading them into temporary variables first.
--- net/openvswitch/vport.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/openvswitch/vport.c +6 -5
@@ -310,22 +310,23 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)*/ int ovs_vport_get_upcall_stats (struct vport *vport,struct sk_buff *skb) { +u64 tx_success =0 , tx_fail =0 ;struct nlattr *nla;int i; -__u64 tx_success =0 ; -__u64 tx_fail =0 ; -for_each_possible_cpu (i) {const struct vport_upcall_stats_percpu *stats; +u64 n_success, n_fail;unsigned int start; stats =per_cpu_ptr (vport->upcall_stats, i);do { start =u64_stats_fetch_begin (&stats->syncp); - tx_success +=u64_stats_read (&stats->n_success); - tx_fail +=u64_stats_read (&stats->n_fail); + n_success =u64_stats_read (&stats->n_success); + n_fail =u64_stats_read (&stats->n_fail); }while (u64_stats_fetch_retry (&stats->syncp, start)); + tx_success += n_success; + tx_fail += n_fail; } nla =nla_nest_start_noflag (skb,OVS_VPORT_ATTR_UPCALL_STATS );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/169 vsock/virtio: fix potential underflow in virtio_transport_get_credit()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <[email protected]>
[ Upstream commit 3ef3d52a1a9860d094395c7a3e593f3aa26ff012 ]
The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic:
ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle.
Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that.
--- net/vmw_vsock/virtio_transport_common.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
net/vmw_vsock/virtio_transport_common.c +9 -7
@@ -28,6 +28,7 @@static void virtio_transport_cancel_close_work (struct vsock_sock *vsk,bool cancel_timeout); +static s64 virtio_transport_has_space (struct virtio_vsock_sock *vvs);static const struct virtio_transport *virtio_transport_get_ops (struct vsock_sock *vsk)
@@ -497,9 +498,7 @@ u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 credit)return 0 ;spin_lock_bh (&vvs->tx_lock); - ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); -if (ret > credit) - ret = credit; + ret =min_t (u32, credit,virtio_transport_has_space (vvs)); vvs->tx_cnt += ret; vvs->bytes_unsent += ret;spin_unlock_bh (&vvs->tx_lock);
@@ -875,11 +874,14 @@ u32 virtio_transport_seqpacket_has_data(struct vsock_sock *vsk) }EXPORT_SYMBOL_GPL (virtio_transport_seqpacket_has_data); -static s64 virtio_transport_has_space (struct vsock_sock *vsk) +static s64 virtio_transport_has_space (struct virtio_vsock_sock *vvs) { -struct virtio_vsock_sock *vvs = vsk->trans;s64 bytes; +/* Use s64 arithmetic so if the peer shrinks peer_buf_alloc while +* we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction +* does not underflow. +*/ bytes = (s64 )vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);if (bytes <0 ) bytes =0 ;
@@ -893,7 +895,7 @@ s64 virtio_transport_stream_has_space(struct vsock_sock *vsk)s64 bytes;spin_lock_bh (&vvs->tx_lock); - bytes =virtio_transport_has_space (vsk); + bytes =virtio_transport_has_space (vvs);spin_unlock_bh (&vvs->tx_lock);return bytes;
@@ -1507,7 +1509,7 @@ static bool virtio_transport_space_update(struct sock *sk,spin_lock_bh (&vvs->tx_lock); vvs->peer_buf_alloc =le32_to_cpu (hdr->buf_alloc); vvs->peer_fwd_cnt =le32_to_cpu (hdr->fwd_cnt); - space_available =virtio_transport_has_space (vsk); + space_available =virtio_transport_has_space (vvs);spin_unlock_bh (&vvs->tx_lock);return space_available; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/169 vsock/test: fix seqpacket message bounds test
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <[email protected]>
[ Upstream commit 0a98de80136968bab7db37b16282b37f044694d3 ]
The test requires the sender (client) to send all messages before waking up the receiver (server).
Since virtio-vsock had a bug and did not respect the size of the TX buffer, this test worked, but now that we are going to fix the bug, the test hangs because the sender would fill the TX buffer before waking up the receiver.
Set the buffer size in the sender (client) as well, as we already do for the receiver (server).
--- tools/testing/vsock/vsock_test.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/vsock/vsock_test.c +11 -0
@@ -359,6 +359,7 @@ static void test_stream_msg_peek_server(const struct test_opts *opts)static void test_seqpacket_msg_bounds_client (const struct test_opts *opts) { +unsigned long long sock_buf_size;unsigned long curr_hash;size_t max_msg_size;int page_size;
@@ -371,6 +372,16 @@ static void test_seqpacket_msg_bounds_client(const struct test_opts *opts)exit (EXIT_FAILURE ); } + sock_buf_size =SOCK_BUF_SIZE ; + +setsockopt_ull_check (fd,AF_VSOCK ,SO_VM_SOCKETS_BUFFER_MAX_SIZE , + sock_buf_size, +"setsockopt(SO_VM_SOCKETS_BUFFER_MAX_SIZE)" ); + +setsockopt_ull_check (fd,AF_VSOCK ,SO_VM_SOCKETS_BUFFER_SIZE , + sock_buf_size, +"setsockopt(SO_VM_SOCKETS_BUFFER_SIZE)" ); +/* Wait, until receiver sets buffer size. */ control_expectln ("SRVREADY" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/169 vsock/virtio: cap TX credit to local buffer size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <[email protected]>
[ Upstream commit 8ee784fdf006cbe8739cfa093f54d326cbf54037 ]
The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.
On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory.
The same thing would happen in the guest with a malicious host, since virtio transports share the same code base.
Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc.
This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings.
On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited.
With this patch applied:
Before:
MemFree: ~61.6 GiB
Slab: ~142 MiB
SUnreclaim: ~117 MiBAfter 32 high-credit connections:
MemFree: ~61.5 GiB
Slab: ~178 MiB
SUnreclaim: ~152 MiBOnly ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive.
Compatibility with non-virtio transports:
- VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured.
- Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes.
- The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport.
This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have.
--- net/vmw_vsock/virtio_transport_common.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/vmw_vsock/virtio_transport_common.c +12 -2
@@ -819,6 +819,15 @@ virtio_transport_seqpacket_dequeue(struct vsock_sock *vsk, }EXPORT_SYMBOL_GPL (virtio_transport_seqpacket_dequeue); +static u32 virtio_transport_tx_buf_size (struct virtio_vsock_sock *vvs) +{ +/* The peer advertises its receive buffer via peer_buf_alloc, but we +* cap it to our local buf_alloc so a remote peer cannot force us to +* queue more data than our own buffer configuration allows. +*/ +return min (vvs->peer_buf_alloc, vvs->buf_alloc); +} + int virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk, struct msghdr *msg,
@@ -828,7 +837,7 @@ virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk,spin_lock_bh (&vvs->tx_lock); -if (len > vvs->peer_buf_alloc) { +if (len >virtio_transport_tx_buf_size (vvs)) {spin_unlock_bh (&vvs->tx_lock);return -EMSGSIZE ; }
@@ -882,7 +891,8 @@ static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs)* we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction * does not underflow. */ - bytes = (s64 )vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); + bytes = (s64 )virtio_transport_tx_buf_size (vvs) - + (vvs->tx_cnt - vvs->peer_fwd_cnt);if (bytes <0 ) bytes =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/169 net/sched: act_ife: avoid possible NULL deref
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 27880b0b0d35ad1c98863d09788254e36f874968 ]
tcf_ife_encode() must make sure ife_encode() does not return NULL.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101 tcf_ife_encode net/sched/act_ife.c:841 [inline] tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877 tc_act include/net/tc_wrapper.h:130 [inline] tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152 tcf_exts_exec include/net/pkt_cls.h:349 [inline] mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798
--- net/sched/act_ife.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/act_ife.c +4 -2
@@ -821,6 +821,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,/* could be stupid policy setup or mtu config * so lets be conservative.. */ if ((action ==TC_ACT_SHOT ) || exceed_mtu) { +drop:qstats_drop_inc (this_cpu_ptr (ife->common.cpu_qstats));return TC_ACT_SHOT ; }
@@ -829,6 +830,8 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,skb_push (skb, skb->dev->hard_header_len); ife_meta =ife_encode (skb, metalen); +if (!ife_meta) + goto drop;spin_lock (&ife->tcf_lock);
@@ -844,8 +847,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,if (err <0 ) {/* too corrupt to keep around if overwritten */ spin_unlock (&ife->tcf_lock); -qstats_drop_inc (this_cpu_ptr (ife->common.cpu_qstats)); -return TC_ACT_SHOT ; + goto drop; } skboff += err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/169 dpll: Prevent duplicate registrations
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit f3ddbaaaaf4d0633b40482f471753f9c71294a4a ]
Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add() to reject duplicate registration attempts.
Previously, if a caller attempted to register the same pin multiple times (with the same ops, priv, and cookie) on the same device, the core silently increments the reference count and return success. This behavior is incorrect because if the caller makes these duplicate registrations then for the first one dpll_pin_registration is allocated and for others the associated dpll_pin_ref.refcount is incremented. During the first unregistration the associated dpll_pin_registration is freed and for others WARN is fired.
Fix this by updating the logic to return -EEXIST if a matching registration is found to enforce a strict "register once" policy.
--- drivers/dpll/dpll_core.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
drivers/dpll/dpll_core.c +4 -8
@@ -83,10 +83,8 @@ dpll_xa_ref_pin_add(struct xarray *xa_pins, struct dpll_pin *pin,if (ref->pin != pin)continue ; reg =dpll_pin_registration_find (ref, ops, priv, cookie); -if (reg) { -refcount_inc (&ref->refcount); -return 0 ; - } +if (reg) +return -EEXIST ; ref_exists = true;break ; }
@@ -164,10 +162,8 @@ dpll_xa_ref_dpll_add(struct xarray *xa_dplls, struct dpll_device *dpll,if (ref->dpll != dpll)continue ; reg =dpll_pin_registration_find (ref, ops, priv, cookie); -if (reg) { -refcount_inc (&ref->refcount); -return 0 ; - } +if (reg) +return -EEXIST ; ref_exists = true;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/169 x86: make page fault handling disable interrupts properly
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cedric Xing <[email protected]>
[ Upstream commit 614da1d3d4cdbd6e41aea06bc97ec15aacff6daf ]
There's a big comment in the x86 do_page_fault() about our interrupt disabling code:
* User address page fault handling might have reenabled
* interrupts. Fixing up all potential exit points of
* do_user_addr_fault() and its leaf functions is just not
* doable w/o creating an unholy mess or turning the code
* upside down.
but it turns out that comment is subtly wrong, and the code as a result is also wrong.
Because it's certainly true that we may have re-enabled interrupts when handling user page faults. And it's most certainly true that we don't want to bother fixing up all the cases.
But what isn't true is that it's limited to user address page faults.
The confusion stems from the fact that we have logic here that depends on the address range of the access, but other code then depends on the _context_ the access was done in. The two are not related, even though both of them are about user-vs-kernel.
In other words, both user and kernel addresses can cause interrupts to have been enabled (eg when __bad_area_nosemaphore() gets called for user accesses to kernel addresses). As a result we should make sure to disable interrupts again regardless of the address range before returning to the low-level fault handling code.
The __bad_area_nosemaphore() code actually did disable interrupts again after enabling them, just not consistently. Ironically, as noted in the original comment, fixing up all the cases is just not worth it, when the simple solution is to just do it unconditionally in one single place.
So remove the incomplete case that unsuccessfully tried to do what the comment said was "not doable" in commit ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code"), and just make it do the simple and straightforward thing.
--- arch/x86/mm/fault.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
arch/x86/mm/fault.c +5 -10
@@ -823,8 +823,6 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,force_sig_pkuerr ((void __user *)address, pkey); else force_sig_fault(SIGSEGV, si_code, (void __user *)address); - -local_irq_disable (); }static noinline void
@@ -1479,15 +1477,12 @@ handle_page_fault(struct pt_regs *regs, unsigned long error_code,do_kern_addr_fault (regs, error_code, address); }else {do_user_addr_fault (regs, error_code, address); -/* -* User address page fault handling might have reenabled -* interrupts. Fixing up all potential exit points of -* do_user_addr_fault() and its leaf functions is just not -* doable w/o creating an unholy mess or turning the code -* upside down. -*/ -local_irq_disable (); } +/* +* page fault handling might have reenabled interrupts, +* make sure to disable them again. +*/ +local_irq_disable (); }DEFINE_IDTENTRY_RAW_ERRORCODE (exc_page_fault)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/169 clocksource: Reduce watchdog readout delay limit to prevent false positives
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit c06343be0b4e03fe319910dd7a5d5b9929e1c0cb ]
The "valid" readout delay between the two reads of the watchdog is larger than the valid delta between the resulting watchdog and clocksource intervals, which results in false positive watchdog results.
Assume TSC is the clocksource and HPET is the watchdog and both have a uncertainty margin of 250us (default). The watchdog readout does:
1) wdnow = read(HPET);
2) csnow = read(TSC);
3) wdend = read(HPET);
The valid window for the delta between #1 and #3 is calculated by the uncertainty margins of the watchdog and the clocksource:
m = 2 * watchdog.uncertainty_margin + cs.uncertainty margin;
which results in 750us for the TSC/HPET case.
The actual interval comparison uses a smaller margin:
m = watchdog.uncertainty_margin + cs.uncertainty margin;
which results in 500us for the TSC/HPET case.
That means the following scenario will trigger the watchdog:
Watchdog cycle N:
1) wdnow[N] = read(HPET); 2) csnow[N] = read(TSC); 3) wdend[N] = read(HPET);
Assume the delay between #1 and #2 is 100us and the delay between #1 and
Watchdog cycle N + 1:
4) wdnow[N + 1] = read(HPET); 5) csnow[N + 1] = read(TSC); 6) wdend[N + 1] = read(HPET);
If the delay between #4 and #6 is within the 750us margin then any delay between #4 and #5 which is larger than 600us will fail the interval check and mark the TSC unstable because the intervals are calculated against the previous value:
wd_int = wdnow[N + 1] - wdnow[N];
cs_int = csnow[N + 1] - csnow[N];Putting the above delays in place this results in:
cs_int = (wdnow[N + 1] + 610us) - (wdnow[N] + 100us);
-> cs_int = wd_int + 510us;
which is obviously larger than the allowed 500us margin and results in marking TSC unstable.
Fix this by using the same margin as the interval comparison. If the delay between two watchdog reads is larger than that, then the readout was either disturbed by interconnect congestion, NMIs or SMIs.
--- kernel/time/clocksource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/time/clocksource.c +1 -1
@@ -244,7 +244,7 @@ enum wd_read_status {static enum wd_read_status cs_watchdog_read (struct clocksource *cs,u64 *csnow,u64 *wdnow) { -int64_t md =2 * watchdog->uncertainty_margin; +int64_t md = watchdog->uncertainty_margin;unsigned int nretries, max_retries;int64_t wd_delay, wd_seq_delay;u64 wd_end, wd_end2;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/169 tpm: Compare HMAC values in constant time
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
[ Upstream commit 2c2615c8423890b5ef8e0a186b65607ef5fdeda1 ]
In tpm_buf_check_hmac_response(), compare the HMAC values in constant time using crypto_memneq() instead of in variable time using memcmp().
This is worthwhile to follow best practices and to be consistent with MAC comparisons elsewhere in the kernel. However, in this driver the side channel seems to have been benign: the HMAC input data is guaranteed to always be unique, which makes the usual MAC forgery via timing side channel not possible. Specifically, the HMAC input data in tpm_buf_check_hmac_response() includes the "our_nonce" field, which was generated by the kernel earlier, remains under the control of the kernel, and is unique for each call to tpm_buf_check_hmac_response().
Stable-dep-of: 6342969dafbc ("keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal")
--- drivers/char/tpm/Kconfig | 1 + drivers/char/tpm/tpm2-sessions.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/char/tpm/Kconfig +1 -0
@@ -33,6 +33,7 @@ config TCG_TPM2_HMAC select CRYPTO_ECDH select CRYPTO_LIB_AESCFB select CRYPTO_LIB_SHA256 + select CRYPTO_LIB_UTILS help Setting this causes us to deploy a scheme which uses request and response HMACs in addition to encryption for
drivers/char/tpm/tpm2-sessions.c +3 -3
@@ -71,6 +71,7 @@#include <crypto/ecdh.h> #include <crypto/hash.h> #include <crypto/hmac.h> +#include <crypto/utils.h> /* maximum number of names the TPM must remember for authorization */ #define AUTH_MAX_NAMES 3
@@ -888,12 +889,11 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,/* we're done with the rphash, so put our idea of the hmac there */ tpm2_hmac_final (&sctx, auth->session_key,sizeof (auth->session_key) + auth->passphrase_len, rphash); -if (memcmp (rphash, &buf->data[offset_s],SHA256_DIGEST_SIZE ) ==0 ) { - rc =0 ; - }else { +if (crypto_memneq (rphash, &buf->data[offset_s],SHA256_DIGEST_SIZE )) {dev_err (&chip->dev,"TPM: HMAC check failed\n" ); goto out; } + rc =0 ;/* now do response decryption */ if (auth->attrs &TPM2_SA_ENCRYPT ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/169 keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srish Srinivasan <[email protected]>
[ Upstream commit 6342969dafbc63597cfc221aa13c3b123c2800c5 ]
TPM2_Unseal[1] expects the handle of a loaded data object, and not the handle of the parent key. But the tpm2_unseal_cmd provides the parent keyhandle instead of blob_handle for the session HMAC calculation. This causes unseal to fail.
Fix this by passing blob_handle to tpm_buf_append_name().
References:
[1] trustedcomputinggroup.org/wp-content/uploads/
Trusted-Platform-Module-2.0-Library-Part-3-Version-184_pub.pdf
--- security/keys/trusted-keys/trusted_tpm2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/keys/trusted-keys/trusted_tpm2.c +2 -2
@@ -489,7 +489,7 @@ static int tpm2_load_cmd(struct tpm_chip *chip, }/** -* tpm2_unseal_cmd() - execute a TPM2_Unload command +* tpm2_unseal_cmd() - execute a TPM2_Unseal command * * @chip: TPM chip to use * @payload: the key data in clear and encrypted form
@@ -520,7 +520,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,return rc; } - rc =tpm_buf_append_name (chip, &buf, options->keyhandle,NULL ); + rc =tpm_buf_append_name (chip, &buf, blob_handle,NULL );if (rc) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/169 leds: led-class: Only Add LED to leds_list when it is fully ready
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit d1883cefd31752f0504b94c3bcfa1f6d511d6e87 upstream.
Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized.
This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work.
This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in:
------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998
Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call.
--- drivers/leds/led-class.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/leds/led-class.c +5 -5
@@ -547,11 +547,6 @@ int led_classdev_register_ext(struct dev#ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED led_cdev->brightness_hw_changed =-1 ;#endif -/* add to the list of leds */ -down_write (&leds_list_lock); -list_add_tail (&led_cdev->node, &leds_list); -up_write (&leds_list_lock); -if (!led_cdev->max_brightness) led_cdev->max_brightness =LED_FULL ;
@@ -559,6 +554,11 @@ int led_classdev_register_ext(struct devled_init_core (led_cdev); +/* add to the list of leds */ +down_write (&leds_list_lock); +list_add_tail (&led_cdev->node, &leds_list); +up_write (&leds_list_lock); +#ifdef CONFIG_LEDS_TRIGGERS led_trigger_set_default (led_cdev);#endif
Greg Kroah-Hartman
maintainerPATCH 102/169 of: fix reference count leak in of_alias_scan()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <[email protected]>
commit 81122fba08fa3ccafab6ed272a5c6f2203923a7e upstream.
of_find_node_by_path() returns a device_node with its refcount incremented. When kstrtoint() fails or dt_alloc() fails, the function continues to the next iteration without calling of_node_put(), causing a reference count leak.
Add of_node_put(np) before continue on both error paths to properly release the device_node reference.
--- drivers/of/base.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/of/base.c +6 -2
@@ -1822,13 +1822,17 @@ void of_alias_scan(void * (*dt_alloc)(u6 end--; len = end - start; -if (kstrtoint (end,10 , &id) <0 ) +if (kstrtoint (end,10 , &id) <0 ) { +of_node_put (np);continue ; + }/* Allocate an alias_prop with enough space for the stem */ ap = dt_alloc(sizeof(*ap) + len + 1, __alignof__(*ap)); -if (!ap) +if (!ap) { +of_node_put (np);continue ; + }memset (ap,0 ,sizeof (*ap) + len +1 ); ap->alias = start;of_alias_add (ap, np, id, start, len);
Greg Kroah-Hartman
maintainerPATCH 103/169 of: platform: Use default match table for /firmware
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
commit 48e6a9c4a20870e09f85ff1a3628275d6bce31c0 upstream.
Calling of_platform_populate() without a match table will only populate the immediate child nodes under /firmware. This is usually fine, but in the case of something like a "simple-mfd" node such as "raspberrypi,bcm2835-firmware", those child nodes will not be populated. And subsequent calls won't work either because the /firmware node is marked as processed already.
Switch the call to of_platform_default_populate() to solve this problem. It should be a nop for existing cases.
--- drivers/of/platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/platform.c +1 -1
@@ -570,7 +570,7 @@ static int __init of_platform_default_po node =of_find_node_by_path ("/firmware" );if (node) { -of_platform_populate (node,NULL ,NULL ,NULL ); +of_platform_default_populate (node,NULL ,NULL );of_node_put (node); }
Greg Kroah-Hartman
maintainerPATCH 104/169 iio: accel: adxl380: fix handling of unavailable "INT1" interrupt
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
commit 4ff39d6de4bf359ec6d5cd2be34b36d077dd0a07 upstream.
fwnode_irq_get_byname() returns a negative value on failure; if a negative value is returned, use it as err argument for dev_err_probe(). While at it, add a missing trailing newline to the dev_err_probe() error message.
--- drivers/iio/accel/adxl380.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/accel/adxl380.c +3 -3
@@ -1730,9 +1730,9 @@ static int adxl380_config_irq(struct iio st->int_map[1 ] =ADXL380_INT0_MAP1_REG ; }else { st->irq =fwnode_irq_get_byname (dev_fwnode (st->dev),"INT1" ); -if (st->irq >0 ) -return dev_err_probe (st->dev, -ENODEV , -"no interrupt name specified" ); +if (st->irq <0 ) +return dev_err_probe (st->dev, st->irq, +"no interrupt name specified\n" ); st->int_map[0 ] =ADXL380_INT1_MAP0_REG ; st->int_map[1 ] =ADXL380_INT1_MAP1_REG ; }
Greg Kroah-Hartman
maintainerPATCH 105/169 iio: accel: iis328dq: fix gain values
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Koeniger <[email protected]>
commit b8f15d1df2e73322e2112de21a4a7f3553c7fb60 upstream.
The sensors IIS328DQ and H3LIS331DL share one configuration but H3LIS331DL has different gain parameters, configs therefore need to be split up.
The gain parameters for the IIS328DQ are 0.98, 1.95 and 3.91, depending on the selected measurement range.
See sensor manuals, chapter 2.1 "mechanical characteristics", parameter "Sensitivity".
Datasheet: https://www.st.com/resource/en/datasheet/iis328dq.pdf
Datasheet: https://www.st.com/resource/en/datasheet/h3lis331dl.pdf
--- drivers/iio/accel/st_accel_core.c | 72 +++++++++++++++++++++++++++++++++++++- 1 file changed, 71 insertions(+), 1 deletion(-)
drivers/iio/accel/st_accel_core.c +71 -1
@@ -517,7 +517,6 @@ static const struct st_sensor_settings s .wai_addr = ST_SENSORS_DEFAULT_WAI_ADDRESS, .sensors_supported = { [0] = H3LIS331DL_ACCEL_DEV_NAME, - [1] = IIS328DQ_ACCEL_DEV_NAME, }, .ch = (struct iio_chan_spec *)st_accel_12bit_channels, .odr = {
@@ -561,6 +560,77 @@ static const struct st_sensor_settings s }, }, }, + .bdu = { + .addr = 0x23, + .mask = 0x80, + }, + .drdy_irq = { + .int1 = { + .addr = 0x22, + .mask = 0x02, + }, + .int2 = { + .addr = 0x22, + .mask = 0x10, + }, + .addr_ihl = 0x22, + .mask_ihl = 0x80, + }, + .sim = { + .addr = 0x23, + .value = BIT(0), + }, + .multi_read_bit = true, + .bootime = 2, + }, + { + .wai = 0x32, + .wai_addr = ST_SENSORS_DEFAULT_WAI_ADDRESS, + .sensors_supported = { + [0] = IIS328DQ_ACCEL_DEV_NAME, + }, + .ch = (struct iio_chan_spec *)st_accel_12bit_channels, + .odr = { + .addr = 0x20, + .mask = 0x18, + .odr_avl = { + { .hz = 50, .value = 0x00, }, + { .hz = 100, .value = 0x01, }, + { .hz = 400, .value = 0x02, }, + { .hz = 1000, .value = 0x03, }, + }, + }, + .pw = { + .addr = 0x20, + .mask = 0x20, + .value_on = ST_SENSORS_DEFAULT_POWER_ON_VALUE, + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .enable_axis = { + .addr = ST_SENSORS_DEFAULT_AXIS_ADDR, + .mask = ST_SENSORS_DEFAULT_AXIS_MASK, + }, + .fs = { + .addr = 0x23, + .mask = 0x30, + .fs_avl = { + [0] = { + .num = ST_ACCEL_FS_AVL_100G, + .value = 0x00, + .gain = IIO_G_TO_M_S_2(980), + }, + [1] = { + .num = ST_ACCEL_FS_AVL_200G, + .value = 0x01, + .gain = IIO_G_TO_M_S_2(1950), + }, + [2] = { + .num = ST_ACCEL_FS_AVL_400G, + .value = 0x03, + .gain = IIO_G_TO_M_S_2(3910), + }, + }, + }, .bdu = { .addr = 0x23, .mask = 0x80,
Greg Kroah-Hartman
maintainerPATCH 106/169 iio: adc: ad9467: fix ad9434 vref mask
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Melin <[email protected]>
commit 92452b1760ff2d1d411414965d4d06f75e1bda9a upstream.
The mask setting is 5 bits wide for the ad9434
(ref. data sheet register 0x18 FLEX_VREF). Apparently the settings from ad9265 were copied by mistake when support for the device was added to the driver.
--- drivers/iio/adc/ad9467.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/ad9467.c +1 -1
@@ -95,7 +95,7 @@#define CHIPID_AD9434 0x6A#define AD9434_DEF_OUTPUT_MODE 0x00 -#define AD9434_REG_VREF_MASK 0xC0 +#define AD9434_REG_VREF_MASK GENMASK(4, 0)/* * Analog Devices AD9467 16-Bit, 200/250 MSPS ADC
Greg Kroah-Hartman
maintainerPATCH 107/169 iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
commit dbdb442218cd9d613adeab31a88ac973f22c4873 upstream.
at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).
If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91_adc_workq_handler
at91_adc_remove |
iio_device_unregister(indio_dev) |
//free indio_dev a bit later |
| iio_push_to_buffers(indio_dev)
| //use indio_devFix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.
--- drivers/iio/adc/at91-sama5d2_adc.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/at91-sama5d2_adc.c +1 -0
@@ -2504,6 +2504,7 @@ static void at91_adc_remove(struct platfstruct at91_adc_state *st =iio_priv (indio_dev);iio_device_unregister (indio_dev); +cancel_work_sync (&st->touch_st.workq);at91_adc_dma_disable (st);
Greg Kroah-Hartman
maintainerPATCH 108/169 iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
commit da934ef0fdff5ba21e82ec3ab3f95fe73137b0c9 upstream.
The local variable 'curr_energy' was never clamped to PAC_193X_MIN_POWER_ACC or PAC_193X_MAX_POWER_ACC because the return value of clamp() was not used. Fix this by assigning the clamped value back to 'curr_energy'.
--- drivers/iio/adc/pac1934.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/adc/pac1934.c +3 -3
@@ -665,9 +665,9 @@ static int pac1934_reg_snapshot(struct p/* add the power_acc field */ curr_energy += inc; -clamp (curr_energy,PAC_193X_MIN_POWER_ACC ,PAC_193X_MAX_POWER_ACC ); - - reg_data->energy_sec_acc[cnt] = curr_energy; + reg_data->energy_sec_acc[cnt] =clamp (curr_energy, +PAC_193X_MIN_POWER_ACC , +PAC_193X_MAX_POWER_ACC ); } offset_reg_data_p +=PAC1934_VPOWER_ACC_REG_LEN ;
Greg Kroah-Hartman
maintainerPATCH 82/169 sched/fair: Fix pelt clock sync when entering idle
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Guittot <[email protected]>
[ Upstream commit 98c88dc8a1ace642d9021b103b28cba7b51e3abc ]
Samuel and Alex reported regressions of the util_avg of RT rq with commit 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection"). It happens that fair is updating and syncing the pelt clock with task one when pick_next_task_fair() fails to pick a task but before the prev scheduling class got a chance to update its pelt signals.
Move update_idle_rq_clock_pelt() in set_next_task_idle() which is called after prev class has been called.
--- kernel/sched/fair.c | 6 ------ kernel/sched/idle.c | 6 ++++++ 2 files changed, 6 insertions(+), 6 deletions(-)
kernel/sched/fair.c +0 -6
@@ -9033,12 +9033,6 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf goto again; } -/* -* rq is about to be idle, check if we need to update the -* lost_idle_time of clock_pelt -*/ -update_idle_rq_clock_pelt (rq); -return NULL ; }
kernel/sched/idle.c +6 -0
@@ -462,6 +462,12 @@ static void set_next_task_idle(struct rq *rq, struct task_struct *next, bool firscx_update_idle (rq, true, true);schedstat_inc (rq->sched_goidle); next->se.exec_start =rq_clock_task (rq); + +/* +* rq is about to be idle, check if we need to update the +* lost_idle_time of clock_pelt +*/ +update_idle_rq_clock_pelt (rq); }struct task_struct *pick_task_idle (struct rq *rq)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/169 iio: chemical: scd4x: fix reported channel endianness
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fiona Klute <[email protected]>
commit 81d5a5366d3c20203fb9d7345e1aa46d668445a2 upstream.
The driver converts values read from the sensor from BE to CPU endianness in scd4x_read_meas(). The result is then pushed into the buffer in scd4x_trigger_handler(), so on LE architectures parsing the buffer using the reported BE type gave wrong results.
scd4x_read_raw() which provides sysfs *_raw values is not affected, it used the values returned by scd4x_read_meas() without further conversion.
--- drivers/iio/chemical/scd4x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iio/chemical/scd4x.c +3 -3
@@ -585,7 +585,7 @@ static const struct iio_chan_spec scd4x_ .sign = 'u', .realbits = 16, .storagebits = 16, - .endianness = IIO_BE, + .endianness = IIO_CPU, }, }, {
@@ -600,7 +600,7 @@ static const struct iio_chan_spec scd4x_ .sign = 'u', .realbits = 16, .storagebits = 16, - .endianness = IIO_BE, + .endianness = IIO_CPU, }, }, {
@@ -613,7 +613,7 @@ static const struct iio_chan_spec scd4x_ .sign = 'u', .realbits = 16, .storagebits = 16, - .endianness = IIO_BE, + .endianness = IIO_CPU, }, }, };
Greg Kroah-Hartman
maintainerPATCH 110/169 iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kübrich, Andreas <[email protected]>
commit 441ac29923c9172bc5e4b2c4f52ae756192f5715 upstream.
The chip info for this variant (I2C, four channels, 14 bit, internal reference) seems to have been left out due to oversight, so ad5686_chip_info_tbl[ID_AD5695R] is all zeroes. Initialisation of an AD5695R still succeeds, but the resulting IIO device has no channels and no /dev/iio:device* node.
Add the missing chip info to the table.
--- drivers/iio/dac/ad5686.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/iio/dac/ad5686.c +6 -0
@@ -434,6 +434,12 @@ static const struct ad5686_chip_info ad5 .num_channels = 4, .regmap_type = AD5686_REGMAP, }, + [ID_AD5695R] = { + .channels = ad5685r_channels, + .int_vref_mv = 2500, + .num_channels = 4, + .regmap_type = AD5686_REGMAP, + }, [ID_AD5696] = { .channels = ad5686_channels, .num_channels = 4,
Greg Kroah-Hartman
maintainerPATCH 111/169 ALSA: ctxfi: Fix potential OOB access in audio mixer handling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 61006c540cbdedea83b05577dc7fb7fa18fe1276 upstream.
In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()).
As spotted recently by fuzzers, the current code causes OOB access at
those functions.
| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'
After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.
This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
--- sound/pci/ctxfi/ctamixer.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/ctxfi/ctamixer.c +2 -0
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer/* Set amixer specific operations */ amixer->rsc.ops = &amixer_basic_rsc_ops; + amixer->rsc.conj =0 ; amixer->ops = &amixer_ops; amixer->input =NULL ; amixer->sum =NULL ;
@@ -370,6 +371,7 @@ static int sum_rsc_init(struct sum *sum,return err; sum->rsc.ops = &sum_basic_rsc_ops; + sum->rsc.conj =0 ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 112/169 ALSA: scarlett2: Fix buffer overflow in config retrieval
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
commit 6f5c69f72e50d51be3a8c028ae7eda42c82902cb upstream.
The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1.
The code checks if (size == 2) where size is the total buffer size in bytes, then loops count times treating each element as u16 (2 bytes). This causes the loop to access count * 2 bytes when the buffer only has size bytes allocated.
Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type.
--- sound/usb/mixer_scarlett2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/usb/mixer_scarlett2.c +3 -3
@@ -2496,13 +2496,13 @@ static int scarlett2_usb_get_config( err =scarlett2_usb_get (mixer, config_item->offset, buf, size);if (err <0 )return err; -if (size ==2 ) { +if (config_item->size ==16 ) {u16 *buf_16 = buf;for (i =0 ; i < count; i++, buf_16++) *buf_16 =le16_to_cpu (*(__le16 *)buf_16); - }else if (size ==4 ) { -u32 *buf_32 = buf; + }else if (config_item->size ==32 ) { +u32 *buf_32 = (u32 *)buf;for (i =0 ; i < count; i++, buf_32++) *buf_32 =le32_to_cpu (*(__le32 *)buf_32);
Greg Kroah-Hartman
maintainerPATCH 113/169 ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Berk Cem Goksel <[email protected]>
commit 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2 upstream.
When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element.
--- sound/usb/mixer.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
sound/usb/mixer.c +14 -1
@@ -2938,10 +2938,23 @@ static int parse_audio_unit(struct mixerstatic void snd_usb_mixer_free (struct usb_mixer_interface *mixer) { +struct usb_mixer_elem_list *list, *next; +int id; +/* kill pending URBs */ snd_usb_mixer_disconnect (mixer); -kfree (mixer->id_elems); +/* Unregister controls first, snd_ctl_remove() frees the element */ +if (mixer->id_elems) { +for (id =0 ; id <MAX_ID_ELEMS ; id++) { +for (list = mixer->id_elems[id]; list; list = next) { + next = list->next_id_elem; +if (list->kctl) +snd_ctl_remove (mixer->chip->card, list->kctl); + } + } +kfree (mixer->id_elems); + }if (mixer->urb) {kfree (mixer->urb->transfer_buffer);usb_free_urb (mixer->urb);
Greg Kroah-Hartman
maintainerPATCH 83/169 drm/amd/pm: Dont clear SI SMC table when setting power limit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit d5077426e1a76d269e518e048bde2e9fc49b32ad ]
There is no reason to clear the SMC table.
We also don't need to recalculate the power limit then.
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +0 -10
@@ -2257,8 +2257,6 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,if (scaling_factor ==0 )return -EINVAL ; -memset (smc_table,0 ,sizeof (SISLANDS_SMC_STATETABLE )); - ret = si_calculate_adjusted_tdp_limits(adev, false, /* ??? */ adev->pm.dpm.tdp_adjustment,
@@ -2312,16 +2310,8 @@ static int si_populate_smc_tdp_limits_2(struct amdgpu_device *adev,if (ni_pi->enable_power_containment) {SISLANDS_SMC_STATETABLE *smc_table = &si_pi->smc_statetable; -u32 scaling_factor =si_get_smc_power_scaling_factor (adev);int ret; -memset (smc_table,0 ,sizeof (SISLANDS_SMC_STATETABLE )); - - smc_table->dpm2Params.NearTDPLimit = -cpu_to_be32 (si_scale_power_for_smc (adev->pm.dpm.near_tdp_limit_adjusted, scaling_factor) *1000 ); - smc_table->dpm2Params.SafePowerLimit = -cpu_to_be32 (si_scale_power_for_smc ((adev->pm.dpm.near_tdp_limit_adjusted *SISLANDS_DPM2_TDP_SAFE_LIMIT_PERCENT ) /100 , scaling_factor) *1000 ); - ret = amdgpu_si_copy_bytes_to_smc(adev, (si_pi->state_table_start + offsetof(SISLANDS_SMC_STATETABLE, dpm2Params) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/169 drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 764a90eb02268a23b1bb98be5f4a13671346804a ]
Radeon 430 and 520 are OEM GPUs from 2016~2017 They have the same device id: 0x6611 and revision: 0x87
On the Radeon 430, powertune is buggy and throttles the GPU, never allowing it to reach its maximum SCLK. Work around this bug by raising the TDP limits we program to the SMC from 24W (specified by the VBIOS on Radeon 430) to 32W.
Disabling powertune entirely is not a viable workaround,
because it causes the Radeon 520 to heat up above 100 C,
which I prefer to avoid.
Additionally, revise the maximum SCLK limit. Considering the above issue, these GPUs never reached a high SCLK on Linux, and the workarounds were added before the GPUs were released, so the workaround likely didn't target these specifically. Use 780 MHz (the maximum SCLK according to the VBIOS on the Radeon 430). Note that the Radeon 520 VBIOS has a higher maximum SCLK: 905 MHz, but in practice it doesn't seem to perform better with the higher clock, only heats up more.
v2:
Move the workaround to si_populate_smc_tdp_limits.
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +12 -1
@@ -2265,6 +2265,12 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,if (ret)return ret; +if (adev->pdev->device ==0x6611 && adev->pdev->revision ==0x87 ) { +/* Workaround buggy powertune on Radeon 430 and 520. */ + tdp_limit =32 ; + near_tdp_limit =28 ; + } + smc_table->dpm2Params.TDPLimit =cpu_to_be32 (si_scale_power_for_smc (tdp_limit, scaling_factor) *1000 ); smc_table->dpm2Params.NearTDPLimit =
@@ -3448,10 +3454,15 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, (adev->pdev->revision ==0x80 ) || (adev->pdev->revision ==0x81 ) || (adev->pdev->revision ==0x83 ) || - (adev->pdev->revision == 0x87) || + (adev->pdev->revision ==0x87 && + adev->pdev->device !=0x6611 ) || (adev->pdev->device ==0x6604 ) || (adev->pdev->device == 0x6605)) { max_sclk = 75000; + }else if (adev->pdev->revision ==0x87 && + adev->pdev->device ==0x6611 ) { +/* Radeon 430 and 520 */ + max_sclk =78000 ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/169 drm/nouveau: add missing DCB connector types
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Ramírez <[email protected]>
[ Upstream commit 3036b4ce4b209af690fa776e4616925892caba4c ]
* Add missing DCB connectors in conn.h as per the NVIDIA DCB specification.
A lot of connector logic was rewritten for Linux v6.5; some display connector types went unaccounted-for which caused kernel warnings on devices with the now-unsupported DCB connectors. This patch adds all of the DCB connectors as defined by NVIDIA to the dcb_connector_type enum to bring back support for these connectors to the new logic.
--- .../nouveau/include/nvkm/subdev/bios/conn.h | 95 +++++++++++++++---- 1 file changed, 74 insertions(+), 21 deletions(-)
drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h +74 -21
@@ -1,28 +1,81 @@/* SPDX-License-Identifier: MIT */ #ifndef __NVBIOS_CONN_H__#define __NVBIOS_CONN_H__ + +/* +* An enumerator representing all of the possible VBIOS connector types defined +* by Nvidia at +* https://nvidia.github.io/open-gpu-doc/DCB/DCB-4.x-Specification.html. +* +* [1] Nvidia's documentation actually claims DCB_CONNECTOR_HDMI_0 is a "3-Pin +* DIN Stereo Connector". This seems very likely to be a documentation typo +* or some sort of funny historical baggage, because we've treated this +* connector type as HDMI for years without issue. +* TODO: Check with Nvidia what's actually happening here. +*/ enum dcb_connector_type { -DCB_CONNECTOR_VGA =0x00 , -DCB_CONNECTOR_TV_0 =0x10 , -DCB_CONNECTOR_TV_1 =0x11 , -DCB_CONNECTOR_TV_3 =0x13 , -DCB_CONNECTOR_DVI_I =0x30 , -DCB_CONNECTOR_DVI_D =0x31 , -DCB_CONNECTOR_DMS59_0 =0x38 , -DCB_CONNECTOR_DMS59_1 =0x39 , -DCB_CONNECTOR_LVDS =0x40 , -DCB_CONNECTOR_LVDS_SPWG =0x41 , -DCB_CONNECTOR_DP =0x46 , - DCB_CONNECTOR_eDP =0x47 , - DCB_CONNECTOR_mDP =0x48 , -DCB_CONNECTOR_HDMI_0 =0x60 , -DCB_CONNECTOR_HDMI_1 =0x61 , -DCB_CONNECTOR_HDMI_C =0x63 , -DCB_CONNECTOR_DMS59_DP0 =0x64 , -DCB_CONNECTOR_DMS59_DP1 =0x65 , -DCB_CONNECTOR_WFD =0x70 , -DCB_CONNECTOR_USB_C =0x71 , -DCB_CONNECTOR_NONE =0xff +/* Analog outputs */ +DCB_CONNECTOR_VGA =0x00 ,// VGA 15-pin connector +DCB_CONNECTOR_DVI_A =0x01 ,// DVI-A +DCB_CONNECTOR_POD_VGA =0x02 ,// Pod - VGA 15-pin connector +DCB_CONNECTOR_TV_0 =0x10 ,// TV - Composite Out +DCB_CONNECTOR_TV_1 =0x11 ,// TV - S-Video Out +DCB_CONNECTOR_TV_2 =0x12 ,// TV - S-Video Breakout - Composite +DCB_CONNECTOR_TV_3 =0x13 ,// HDTV Component - YPrPb +DCB_CONNECTOR_TV_SCART =0x14 ,// TV - SCART Connector +DCB_CONNECTOR_TV_SCART_D =0x16 ,// TV - Composite SCART over D-connector +DCB_CONNECTOR_TV_DTERM =0x17 ,// HDTV - D-connector (EIAJ4120) +DCB_CONNECTOR_POD_TV_3 =0x18 ,// Pod - HDTV - YPrPb +DCB_CONNECTOR_POD_TV_1 =0x19 ,// Pod - S-Video +DCB_CONNECTOR_POD_TV_0 =0x1a ,// Pod - Composite + +/* DVI digital outputs */ +DCB_CONNECTOR_DVI_I_TV_1 =0x20 ,// DVI-I-TV-S-Video +DCB_CONNECTOR_DVI_I_TV_0 =0x21 ,// DVI-I-TV-Composite +DCB_CONNECTOR_DVI_I_TV_2 =0x22 ,// DVI-I-TV-S-Video Breakout-Composite +DCB_CONNECTOR_DVI_I =0x30 ,// DVI-I +DCB_CONNECTOR_DVI_D =0x31 ,// DVI-D +DCB_CONNECTOR_DVI_ADC =0x32 ,// Apple Display Connector (ADC) +DCB_CONNECTOR_DMS59_0 =0x38 ,// LFH-DVI-I-1 +DCB_CONNECTOR_DMS59_1 =0x39 ,// LFH-DVI-I-2 +DCB_CONNECTOR_BNC =0x3c ,// BNC Connector [for SDI?] + +/* LVDS / TMDS digital outputs */ +DCB_CONNECTOR_LVDS =0x40 ,// LVDS-SPWG-Attached [is this name correct?] +DCB_CONNECTOR_LVDS_SPWG =0x41 ,// LVDS-OEM-Attached (non-removable) +DCB_CONNECTOR_LVDS_REM =0x42 ,// LVDS-SPWG-Detached [following naming above] +DCB_CONNECTOR_LVDS_SPWG_REM =0x43 ,// LVDS-OEM-Detached (removable) +DCB_CONNECTOR_TMDS =0x45 ,// TMDS-OEM-Attached (non-removable) + +/* DP digital outputs */ +DCB_CONNECTOR_DP =0x46 ,// DisplayPort External Connector + DCB_CONNECTOR_eDP =0x47 ,// DisplayPort Internal Connector + DCB_CONNECTOR_mDP =0x48 ,// DisplayPort (Mini) External Connector + +/* Dock outputs (not used) */ +DCB_CONNECTOR_DOCK_VGA_0 =0x50 ,// VGA 15-pin if not docked +DCB_CONNECTOR_DOCK_VGA_1 =0x51 ,// VGA 15-pin if docked +DCB_CONNECTOR_DOCK_DVI_I_0 =0x52 ,// DVI-I if not docked +DCB_CONNECTOR_DOCK_DVI_I_1 =0x53 ,// DVI-I if docked +DCB_CONNECTOR_DOCK_DVI_D_0 =0x54 ,// DVI-D if not docked +DCB_CONNECTOR_DOCK_DVI_D_1 =0x55 ,// DVI-D if docked +DCB_CONNECTOR_DOCK_DP_0 =0x56 ,// DisplayPort if not docked +DCB_CONNECTOR_DOCK_DP_1 =0x57 ,// DisplayPort if docked + DCB_CONNECTOR_DOCK_mDP_0 =0x58 ,// DisplayPort (Mini) if not docked + DCB_CONNECTOR_DOCK_mDP_1 =0x59 ,// DisplayPort (Mini) if docked + +/* HDMI? digital outputs */ +DCB_CONNECTOR_HDMI_0 =0x60 ,// HDMI? See [1] in top-level enum comment above +DCB_CONNECTOR_HDMI_1 =0x61 ,// HDMI-A connector +DCB_CONNECTOR_SPDIF =0x62 ,// Audio S/PDIF connector +DCB_CONNECTOR_HDMI_C =0x63 ,// HDMI-C (Mini) connector + +/* Misc. digital outputs */ +DCB_CONNECTOR_DMS59_DP0 =0x64 ,// LFH-DP-1 +DCB_CONNECTOR_DMS59_DP1 =0x65 ,// LFH-DP-2 +DCB_CONNECTOR_WFD =0x70 ,// Virtual connector for Wifi Display (WFD) +DCB_CONNECTOR_USB_C =0x71 ,// [DP over USB-C; not present in docs] +DCB_CONNECTOR_NONE =0xff // Skip Entry }; struct nvbios_connT {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/169 drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Ramírez <[email protected]>
[ Upstream commit d0bd10792d6cc3725ddee43f03fd6ee234f24844 ]
* Implement missing DCB connectors in uconn.c previously defined in conn.h.
* Replace kernel WARN_ON macro with printk message to more gracefully signify an unknown connector was encountered.
With this patch, unknown connectors are explicitly marked with value 0 (DCB_CONNECTOR_VGA) to match the tested current behavior. Although 0xff (DCB_CONNECTOR_NONE) may be more suitable, I don't want to introduce a breaking change.
--- .../gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 73 ++++++++++++++----- 1 file changed, 53 insertions(+), 20 deletions(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c +53 -20
@@ -191,27 +191,60 @@ nvkm_uconn_new(const struct nvkm_oclass *oclass, void *argv, u32 argc, struct nvspin_lock (&disp->client.lock);if (!conn->object.func) {switch (conn->info.type) { -case DCB_CONNECTOR_VGA : args->v0.type =NVIF_CONN_V0_VGA ;break ; -case DCB_CONNECTOR_TV_0 : -case DCB_CONNECTOR_TV_1 : -case DCB_CONNECTOR_TV_3 : args->v0.type =NVIF_CONN_V0_TV ;break ; -case DCB_CONNECTOR_DMS59_0 : -case DCB_CONNECTOR_DMS59_1 : -case DCB_CONNECTOR_DVI_I : args->v0.type =NVIF_CONN_V0_DVI_I ;break ; -case DCB_CONNECTOR_DVI_D : args->v0.type =NVIF_CONN_V0_DVI_D ;break ; -case DCB_CONNECTOR_LVDS : args->v0.type =NVIF_CONN_V0_LVDS ;break ; -case DCB_CONNECTOR_LVDS_SPWG : args->v0.type =NVIF_CONN_V0_LVDS_SPWG ;break ; -case DCB_CONNECTOR_DMS59_DP0 : -case DCB_CONNECTOR_DMS59_DP1 : -case DCB_CONNECTOR_DP : -case DCB_CONNECTOR_mDP : -case DCB_CONNECTOR_USB_C : args->v0.type =NVIF_CONN_V0_DP ;break ; -case DCB_CONNECTOR_eDP : args->v0.type =NVIF_CONN_V0_EDP ;break ; -case DCB_CONNECTOR_HDMI_0 : -case DCB_CONNECTOR_HDMI_1 : -case DCB_CONNECTOR_HDMI_C : args->v0.type =NVIF_CONN_V0_HDMI ;break ; +/* VGA */ +case DCB_CONNECTOR_DVI_A : +case DCB_CONNECTOR_POD_VGA : +case DCB_CONNECTOR_VGA : args->v0.type =NVIF_CONN_V0_VGA ;break ; + +/* TV */ +case DCB_CONNECTOR_TV_0 : +case DCB_CONNECTOR_TV_1 : +case DCB_CONNECTOR_TV_2 : +case DCB_CONNECTOR_TV_SCART : +case DCB_CONNECTOR_TV_SCART_D : +case DCB_CONNECTOR_TV_DTERM : +case DCB_CONNECTOR_POD_TV_3 : +case DCB_CONNECTOR_POD_TV_1 : +case DCB_CONNECTOR_POD_TV_0 : +case DCB_CONNECTOR_TV_3 : args->v0.type =NVIF_CONN_V0_TV ;break ; + +/* DVI */ +case DCB_CONNECTOR_DVI_I_TV_1 : +case DCB_CONNECTOR_DVI_I_TV_0 : +case DCB_CONNECTOR_DVI_I_TV_2 : +case DCB_CONNECTOR_DVI_ADC : +case DCB_CONNECTOR_DMS59_0 : +case DCB_CONNECTOR_DMS59_1 : +case DCB_CONNECTOR_DVI_I : args->v0.type =NVIF_CONN_V0_DVI_I ;break ; +case DCB_CONNECTOR_TMDS : +case DCB_CONNECTOR_DVI_D : args->v0.type =NVIF_CONN_V0_DVI_D ;break ; + +/* LVDS */ +case DCB_CONNECTOR_LVDS : args->v0.type =NVIF_CONN_V0_LVDS ;break ; +case DCB_CONNECTOR_LVDS_SPWG : args->v0.type =NVIF_CONN_V0_LVDS_SPWG ;break ; + +/* DP */ +case DCB_CONNECTOR_DMS59_DP0 : +case DCB_CONNECTOR_DMS59_DP1 : +case DCB_CONNECTOR_DP : +case DCB_CONNECTOR_mDP : +case DCB_CONNECTOR_USB_C : args->v0.type =NVIF_CONN_V0_DP ;break ; +case DCB_CONNECTOR_eDP : args->v0.type =NVIF_CONN_V0_EDP ;break ; + +/* HDMI */ +case DCB_CONNECTOR_HDMI_0 : +case DCB_CONNECTOR_HDMI_1 : +case DCB_CONNECTOR_HDMI_C : args->v0.type =NVIF_CONN_V0_HDMI ;break ; + +/* +* Dock & unused outputs. +* BNC, SPDIF, WFD, and detached LVDS go here. +*/ default : -WARN_ON (1 ); +nvkm_warn (&disp->engine.subdev, +"unimplemented connector type 0x%02x\n" , + conn->info.type); + args->v0.type =NVIF_CONN_V0_VGA ; ret = -EINVAL ;break ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/169 be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <[email protected]>
[ Upstream commit 8215794403d264739cc676668087512950b2ff31 ]
When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is set to false, the driver may request the PMAC_ID from the firmware of the network card, and this function will store that PMAC_ID at the provided address pmac_id. This is the contract of this function.
However, there is a location within the driver where both pmac_id_valid == false and pmac_id == NULL are being passed. This could result in dereferencing a NULL pointer.
To resolve this issue, it is necessary to pass the address of a stub variable to the function.
--- drivers/net/ethernet/emulex/benet/be_cmds.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/emulex/benet/be_cmds.c +2 -1
@@ -3797,6 +3797,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac) {int status;bool pmac_valid = false; +u32 pmac_id;eth_zero_addr (mac);
@@ -3809,7 +3810,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac) adapter->if_handle, 0); }else { status =be_cmd_get_mac_from_list (adapter, mac, &pmac_valid, -NULL , adapter->if_handle,0 ); + &pmac_id, adapter->if_handle,0 ); }return status;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/169 selftests: net: amt: wait longer for connection before sending packets
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <[email protected]>
[ Upstream commit 04708606fd7bdc34b69089a4ff848ff36d7088f9 ]
Both send_mcast4() and send_mcast6() use sleep 2 to wait for the tunnel connection between the gateway and the relay, and for the listener socket to be created in the LISTENER namespace.
However, tests sometimes fail because packets are sent before the connection is fully established.
Increase the waiting time to make the tests more reliable, and use wait_local_port_listen() to explicitly wait for the listener socket.
--- tools/testing/selftests/net/amt.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/testing/selftests/net/amt.sh +5 -2
@@ -73,6 +73,8 @@ # +------------------------+ #============================================================================== +source lib.sh + readonly LISTENER=$(mktemp -u listener-XXXXXXXX) readonly GATEWAY=$(mktemp -u gateway-XXXXXXXX) readonly RELAY=$(mktemp -u relay-XXXXXXXX)
@@ -240,14 +242,15 @@ test_ipv6_forward() send_mcast4() { - sleep 2 + sleep 5 + wait_local_port_listen ${LISTENER} 4000 udp ip netns exec "${SOURCE}" bash -c \ 'printf "%s %128s" 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' & } send_mcast6() { - sleep 2 + wait_local_port_listen ${LISTENER} 6000 udp ip netns exec "${SOURCE}" bash -c \ 'printf "%s %128s" 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' & }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/169 ipv6: annotate data-race in ndisc_router_discovery()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9a063f96d87efc3a6cc667f8de096a3d38d74bb5 ]
syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1]
This looks fine, IFLA_INET6_RA_MTU is best effort.
Add READ_ONCE()/WRITE_ONCE() to document the race.
Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch.
[1]
BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery
read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1:
ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0:
ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
value changed: 0x00000000 -> 0xe5400659
--- net/ipv6/ndisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ndisc.c +2 -2
@@ -1582,8 +1582,8 @@ static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)memcpy (&n, ((u8 *)(ndopts.nd_opts_mtu+1 ))+2 ,sizeof (mtu)); mtu =ntohl (n); -if (in6_dev->ra_mtu != mtu) { - in6_dev->ra_mtu = mtu; +if (READ_ONCE (in6_dev->ra_mtu) != mtu) { +WRITE_ONCE (in6_dev->ra_mtu, mtu); send_ifinfo_notify = true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/169 mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
commit 3009738a855cf938bbfc9078bec725031ae623a4 upstream.
When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes.
Add a check to prevent illegal clock reduction through debugfs:
root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ...
--- drivers/mmc/host/sdhci-of-dwcmshc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/mmc/host/sdhci-of-dwcmshc.c +7 -0
@@ -650,6 +650,13 @@ static void dwcmshc_rk3568_set_clock(strsdhci_writel (host, extra, reg);if (clock <=52000000 ) { +if (host->mmc->ios.timing ==MMC_TIMING_MMC_HS200 || + host->mmc->ios.timing ==MMC_TIMING_MMC_HS400 ) { +dev_err (mmc_dev (host->mmc), +"Can't reduce the clock below 52MHz in HS200/HS400 mode" ); +return ; + } +/* * Disable DLL and reset both of sample and drive clock. * The bypass bit and start bit need to be set if DLL is not locked.
Greg Kroah-Hartman
maintainerPATCH 124/169 slimbus: core: fix runtime PM imbalance on report present
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 0eb4ff6596114aabba1070a66afa2c2f5593739f upstream.
Make sure to balance the runtime PM usage count in case slimbus device or address allocation fails on report present, which would otherwise prevent the controller from suspending.
--- drivers/slimbus/core.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/slimbus/core.c +9 -7
@@ -496,21 +496,23 @@ int slim_device_report_present(struct slif (ctrl->sched.clk_state !=SLIM_CLK_ACTIVE ) {dev_err (ctrl->dev,"slim ctrl not active,state:%d, ret:%d\n" , ctrl->sched.clk_state, ret); - goto slimbus_not_active; + goto out_put_rpm; } sbdev =slim_get_device (ctrl, e_addr); -if (IS_ERR (sbdev)) -return -ENODEV ; +if (IS_ERR (sbdev)) { + ret = -ENODEV ; + goto out_put_rpm; + }if (sbdev->is_laddr_valid) { *laddr = sbdev->laddr; -return 0 ; + ret =0 ; + }else { + ret =slim_device_alloc_laddr (sbdev, true); } - ret =slim_device_alloc_laddr (sbdev, true); - -slimbus_not_active: +out_put_rpm:pm_runtime_mark_last_busy (ctrl->dev);pm_runtime_put_autosuspend (ctrl->dev);return ret;
Greg Kroah-Hartman
maintainerPATCH 125/169 slimbus: core: fix device reference leak on report present
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 9391380eb91ea5ac792aae9273535c8da5b9aa01 upstream.
Slimbus devices can be allocated dynamically upon reception of report-present messages.
Make sure to drop the reference taken when looking up already registered devices.
Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated.
--- drivers/slimbus/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/slimbus/core.c +3 -0
@@ -378,6 +378,8 @@ struct slim_device *slim_get_device(stru sbdev =slim_alloc_device (ctrl, e_addr,NULL );if (!sbdev)return ERR_PTR (-ENOMEM ); + +get_device (&sbdev->dev); }return sbdev;
@@ -512,6 +514,7 @@ int slim_device_report_present(struct sl ret =slim_device_alloc_laddr (sbdev, true); } +put_device (&sbdev->dev); out_put_rpm:pm_runtime_mark_last_busy (ctrl->dev);pm_runtime_put_autosuspend (ctrl->dev);
Greg Kroah-Hartman
maintainerPATCH 126/169 tracing: Fix crash on synthetic stacktrace field usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit 90f9f5d64cae4e72defd96a2a22760173cb3c9ec upstream.
When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred:
~# cd /sys/kernel/tracing
~# echo 's:stack unsigned long stack[];' > dynamic_events
~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger
The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack").
~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events
~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger
~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger
The above makes another synthetic event called "syscall_stack" that attaches the first synthetic event (stack) to the sys_exit trace event and records the stacktrace from the stack event with the id of the system call that is exiting.
When enabling this event (or using it in a historgram):
~# echo 1 > events/synthetic/syscall_stack/enable
Produces a kernel crash!
BUG: unable to handle page fault for address: 0000000000400010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 1257 Comm: bash Not tainted 6.16.3+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.3-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:trace_event_raw_event_synth+0x90/0x380 Code: c5 00 00 00 00 85 d2 0f 84 e1 00 00 00 31 db eb 34 0f 1f 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 <49> 8b 04 24 48 83 c3 01 8d 0c c5 08 00 00 00 01 cd 41 3b 5d 40 0f RSP: 0018:ffffd2670388f958 EFLAGS: 00010202 RAX: ffff8ba1065cc100 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: fffff266ffda7b90 RDI: ffffd2670388f9b0 RBP: 0000000000000010 R08: ffff8ba104e76000 R09: ffffd2670388fa50 R10: ffff8ba102dd42e0 R11: ffffffff9a908970 R12: 0000000000400010 R13: ffff8ba10a246400 R14: ffff8ba10a710220 R15: fffff266ffda7b90 FS: 00007fa3bc63f740(0000) GS:ffff8ba2e0f48000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400010 CR3: 0000000107f9e003 CR4: 0000000000172ef0 Call Trace: <TASK> ? __tracing_map_insert+0x208/0x3a0 action_trace+0x67/0x70 event_hist_trigger+0x633/0x6d0 event_triggers_call+0x82/0x130 trace_event_buffer_commit+0x19d/0x250 trace_event_raw_event_sys_exit+0x62/0xb0 syscall_exit_work+0x9d/0x140 do_syscall_64+0x20a/0x2f0 ? trace_event_raw_event_sched_switch+0x12b/0x170 ? save_fpregs_to_fpstate+0x3e/0x90 ? _raw_spin_unlock+0xe/0x30 ? finish_task_switch.isra.0+0x97/0x2c0 ? __rseq_handle_notify_resume+0xad/0x4c0 ? __schedule+0x4b8/0xd00 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x1ef/0x2f0 ? do_fault+0x2e9/0x540 ? __handle_mm_fault+0x7d1/0xf70 ? count_memcg_events+0x167/0x1d0 ? handle_mm_fault+0x1d7/0x2e0 ? do_user_addr_fault+0x2c3/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The reason is that the stacktrace field is not labeled as such, and is treated as a normal field and not as a dynamic event that it is.
In trace_event_raw_event_synth() the event is field is still treated as a dynamic array, but the retrieval of the data is considered a normal field, and the reference is just the meta data:
// Meta data is retrieved instead of a dynamic array
str_val = (char *)(long)var_ref_vals[val_idx];
// Then when it tries to process it:
len = *((unsigned long *)str_val) + 1;
It triggers a kernel page fault.
To fix this, first when defining the fields of the first synthetic event, set the filter type to FILTER_STACKTRACE. This is used later by the second synthetic event to know that this field is a stacktrace. When creating the field of the new synthetic event, have it use this FILTER_STACKTRACE to know to create a stacktrace field to copy the stacktrace into.
--- kernel/trace/trace_events_hist.c | 9 +++++++++ kernel/trace/trace_events_synth.c | 8 +++++++- 2 files changed, 16 insertions(+), 1 deletion(-)
kernel/trace/trace_events_hist.c +9 -0
@@ -2040,6 +2040,15 @@ static struct hist_field *create_hist_fi hist_field->fn_num =HIST_FIELD_FN_RELDYNSTRING ; else hist_field->fn_num = HIST_FIELD_FN_PSTRING; + }else if (field->filter_type ==FILTER_STACKTRACE ) { + flags |=HIST_FIELD_FL_STACKTRACE ; + + hist_field->size =MAX_FILTER_STR_VAL ; + hist_field->type =kstrdup_const (field->type,GFP_KERNEL ); +if (!hist_field->type) + goto free; + + hist_field->fn_num =HIST_FIELD_FN_STACK ; }else { hist_field->size = field->size; hist_field->is_signed = field->is_signed;
kernel/trace/trace_events_synth.c +7 -1
@@ -137,7 +137,9 @@ static int synth_event_define_fields(strstruct synth_event *event = call->data;unsigned int i, size, n_u64;char *name, *type; +int filter_type;bool is_signed; +bool is_stack;int ret =0 ;for (i =0 , n_u64 =0 ; i < event->n_fields; i++) {
@@ -145,8 +147,12 @@ static int synth_event_define_fields(str is_signed = event->fields[i]->is_signed; type = event->fields[i]->type; name = event->fields[i]->name; + is_stack = event->fields[i]->is_stack; + + filter_type = is_stack ?FILTER_STACKTRACE :FILTER_OTHER ; + ret =trace_define_field (call, type, name, offset, size, - is_signed,FILTER_OTHER ); + is_signed, filter_type);if (ret)break ;
Greg Kroah-Hartman
maintainerPATCH 127/169 intel_th: fix device leak on output open()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 upstream.
Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close().
Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().
--- drivers/hwtracing/intel_th/core.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/hwtracing/intel_th/core.c +16 -3
@@ -810,9 +810,12 @@ static int intel_th_output_open(struct iint err; dev =bus_find_device_by_devt (&intel_th_bus, inode->i_rdev); -if (!dev || !dev->driver) { +if (!dev) +return -ENODEV ; + +if (!dev->driver) { err = -ENODEV ; - goto out_no_device; + goto out_put_device; } thdrv =to_intel_th_driver (dev->driver);
@@ -836,12 +839,22 @@ static int intel_th_output_open(struct i out_put_device:put_device (dev); -out_no_device: +return err; } +static int intel_th_output_release (struct inode *inode,struct file *file) +{ +struct intel_th_device *thdev = file->private_data; + +put_device (&thdev->dev); + +return 0 ; +} +static const struct file_operations intel_th_output_fops = { .open = intel_th_output_open, + .release = intel_th_output_release, .llseek = noop_llseek, };
Greg Kroah-Hartman
maintainerPATCH 128/169 mei: trace: treat reg parameter as string
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 06d5a7afe1d0b47102936d8fba568572c2b4b941 upstream.
The commitafd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") forbids to emit event with a plain char* without a wrapper.
The reg parameter always passed as static string and wrapper is not strictly required, contrary to dev parameter.
Use the string wrapper anyway to check sanity of the reg parameters, store it value independently and prevent internal kernel data leaks.
Since some code refactoring has taken place, explicit backporting may be needed for kernels older than 6.10.
--- drivers/misc/mei/mei-trace.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/misc/mei/mei-trace.h +9 -9
@@ -21,18 +21,18 @@ TRACE_EVENT(mei_reg_read, TP_ARGS(dev, reg, offs, val),TP_STRUCT__entry (__string (dev ,dev_name (dev )) - __field(const char *, reg) +__string (reg, reg)__field (u32, offs)__field (u32, val) ),TP_fast_assign ( __assign_str(dev); - __entry->reg = reg; +__assign_str (reg); __entry->offs = offs; __entry->val = val; ),TP_printk ("[%s] read %s:[%#x] = %#x" , -__get_str (dev), __entry->reg, __entry->offs, __entry->val) +__get_str (dev),__get_str (reg), __entry->offs, __entry->val) ); TRACE_EVENT(mei_reg_write,
@@ -40,18 +40,18 @@ TRACE_EVENT(mei_reg_write, TP_ARGS(dev, reg, offs, val),TP_STRUCT__entry (__string (dev ,dev_name (dev )) - __field(const char *, reg) +__string (reg, reg)__field (u32, offs)__field (u32, val) ),TP_fast_assign ( __assign_str(dev); - __entry->reg = reg; +__assign_str (reg); __entry->offs = offs; __entry->val = val; ),TP_printk ("[%s] write %s[%#x] = %#x" , -__get_str (dev), __entry->reg, __entry->offs, __entry->val) +__get_str (dev),__get_str (reg), __entry->offs, __entry->val) ); TRACE_EVENT(mei_pci_cfg_read,
@@ -59,18 +59,18 @@ TRACE_EVENT(mei_pci_cfg_read,TP_ARGS (dev, reg, offs, val),TP_STRUCT__entry ( __string(dev, dev_name(dev)) - __field(const char *, reg) + __string(reg, reg) __field(u32, offs)__field (u32, val) ),TP_fast_assign ( __assign_str(dev); - __entry->reg = reg; +__assign_str (reg); __entry->offs = offs; __entry->val = val; ),TP_printk ("[%s] pci cfg read %s:[%#x] = %#x" , -__get_str (dev), __entry->reg, __entry->offs, __entry->val) +__get_str (dev),__get_str (reg), __entry->offs, __entry->val) );#endif /* _MEI_TRACE_H_ */
Greg Kroah-Hartman
maintainerPATCH 129/169 s390/ap: Fix wrong APQN fill calculation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harald Freudenberger <[email protected]>
commit 3317785a8803db629efc759d811d0f589d3a0b2d upstream.
The upper limit of the firmware queue fill state for each APQN is reported by the hwinfo.qd field. This field shows the numbers 0-7 for 1-8 queue spaces available. But the exploiting code assumed the real boundary is stored there and thus stoppes queuing in messages one tick too early.
Correct the limit calculation and thus offer a boost of 12.5% performance for high traffic on one APQN.
--- drivers/s390/crypto/ap_card.c | 2 +- drivers/s390/crypto/ap_queue.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/s390/crypto/ap_card.c +1 -1
@@ -44,7 +44,7 @@ static ssize_t depth_show(struct device {struct ap_card *ac =to_ap_card (dev); -return sysfs_emit (buf,"%d\n" , ac->hwinfo.qd); +return sysfs_emit (buf,"%d\n" , ac->hwinfo.qd +1 ); }static DEVICE_ATTR_RO (depth);
drivers/s390/crypto/ap_queue.c +1 -1
@@ -268,7 +268,7 @@ static enum ap_sm_wait ap_sm_write(struclist_move_tail (&ap_msg->list, &aq->pendingq); aq->requestq_count--; aq->pendingq_count++; -if (aq->queue_count < aq->card->hwinfo.qd) { +if (aq->queue_count < aq->card->hwinfo.qd +1 ) { aq->sm_state =AP_SM_STATE_WORKING ;return AP_SM_WAIT_AGAIN ; }
Greg Kroah-Hartman
maintainerPATCH 130/169 uacce: fix cdev handling in the cleanup path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <[email protected]>
commit a3bece3678f6c88db1f44c602b2a63e84b4040ac upstream.
When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.
--- drivers/misc/uacce/uacce.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/misc/uacce/uacce.c +7 -1
@@ -556,6 +556,8 @@ EXPORT_SYMBOL_GPL(uacce_alloc);*/ int uacce_register (struct uacce_device *uacce) { +int ret; +if (!uacce)return -ENODEV ;
@@ -566,7 +568,11 @@ int uacce_register(struct uacce_device * uacce->cdev->ops = &uacce_fops; uacce->cdev->owner =THIS_MODULE ; -return cdev_device_add (uacce->cdev, &uacce->dev); + ret =cdev_device_add (uacce->cdev, &uacce->dev); +if (ret) + uacce->cdev =NULL ; + +return ret; }EXPORT_SYMBOL_GPL (uacce_register);
Greg Kroah-Hartman
maintainerPATCH 131/169 uacce: fix isolate sysfs check condition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
commit 98eec349259b1fd876f350b1c600403bcef8f85d upstream.
uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Currently, sysfs files are created as long as either isolate_err_threshold_read or isolate_err_threshold_write callback functions are present.
However, accessing a non-existent callback function may cause the system to crash. Therefore, intercept the creation of sysfs if neither read nor write exists; create sysfs if either is supported, but intercept unsupported operations at the call site.
--- drivers/misc/uacce/uacce.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/uacce/uacce.c +6 -0
@@ -382,6 +382,9 @@ static ssize_t isolate_strategy_show(strstruct uacce_device *uacce =to_uacce_device (dev);u32 val; +if (!uacce->ops->isolate_err_threshold_read) +return -ENOENT ; + val = uacce->ops->isolate_err_threshold_read (uacce);return sysfs_emit (buf,"%u\n" , val);
@@ -394,6 +397,9 @@ static ssize_t isolate_strategy_store(stunsigned long val;int ret; +if (!uacce->ops->isolate_err_threshold_write) +return -ENOENT ; +if (kstrtoul (buf,0 , &val) <0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 132/169 uacce: implement mremap in uacce_vm_ops to return -EPERM
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shen <[email protected]>
commit 02695347be532b628f22488300d40c4eba48b9b7 upstream.
The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users.
The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario:
An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok).
--- drivers/misc/uacce/uacce.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/misc/uacce/uacce.c +6 -0
@@ -214,8 +214,14 @@ static void uacce_vma_close(struct vm_ar } } +static int uacce_vma_mremap (struct vm_area_struct *area) +{ +return -EPERM ; +} +static const struct vm_operations_struct uacce_vm_ops = { .close = uacce_vma_close, + .mremap = uacce_vma_mremap, };static int uacce_fops_mmap (struct file *filep,struct vm_area_struct *vma)
Greg Kroah-Hartman
maintainerPATCH 133/169 uacce: ensure safe queue release with state management
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <[email protected]>
commit 26c08dabe5475d99a13f353d8dd70e518de45663 upstream.
Directly calling put_queue carries risks since it cannot guarantee that resources of uacce_queue have been fully released beforehand. So adding a stop_queue operation for the UACCE_CMD_PUT_Q command and leaving the put_queue operation to the final resource release ensures safety.
Queue states are defined as follows:
- UACCE_Q_ZOMBIE: Initial state
- UACCE_Q_INIT: After opening uacce
- UACCE_Q_STARTED: After start is issued via ioctl
When executing poweroff -f in virt while accelerator are still working, uacce_fops_release and uacce_remove may execute concurrently. This can cause uacce_put_queue within uacce_fops_release to access a NULL ops pointer. Therefore, add state checks to prevent accessing freed pointers.
--- drivers/misc/uacce/uacce.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/misc/uacce/uacce.c +21 -7
@@ -40,20 +40,34 @@ static int uacce_start_queue(struct uaccreturn 0 ; } -static int uacce_put_queue (struct uacce_queue *q) +static int uacce_stop_queue (struct uacce_queue *q) {struct uacce_device *uacce = q->uacce; -if ((q->state ==UACCE_Q_STARTED ) && uacce->ops->stop_queue) +if (q->state !=UACCE_Q_STARTED ) +return 0 ; + +if (uacce->ops->stop_queue) uacce->ops->stop_queue (q); -if ((q->state ==UACCE_Q_INIT || q->state ==UACCE_Q_STARTED ) && - uacce->ops->put_queue) + q->state =UACCE_Q_INIT ; + +return 0 ; +} + +static void uacce_put_queue (struct uacce_queue *q) +{ +struct uacce_device *uacce = q->uacce; + +uacce_stop_queue (q); + +if (q->state !=UACCE_Q_INIT ) +return ; + +if (uacce->ops->put_queue) uacce->ops->put_queue (q); q->state =UACCE_Q_ZOMBIE ; - -return 0 ; } static long uacce_fops_unl_ioctl(struct file *filep,
@@ -80,7 +94,7 @@ static long uacce_fops_unl_ioctl(struct ret =uacce_start_queue (q);break ;case UACCE_CMD_PUT_Q : - ret =uacce_put_queue (q); + ret =uacce_stop_queue (q);break ;default :if (uacce->ops->ioctl)
Greg Kroah-Hartman
maintainerPATCH 116/169 drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <[email protected]>
commit 604826acb3f53c6648a7ee99a3914ead680ab7fb upstream.
Apparently we never actually filled these in, despite the fact that we do in fact technically support atomic modesetting.
Since not having these filled in causes us to potentially forget to disable fbdev and friends during suspend/resume, let's fix it.
--- drivers/gpu/drm/nouveau/nouveau_display.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/nouveau/nouveau_display.c +2 -0
@@ -391,6 +391,8 @@ nouveau_user_framebuffer_create(struct dstatic const struct drm_mode_config_funcs nouveau_mode_config_funcs = { .fb_create = nouveau_user_framebuffer_create, + .atomic_commit = drm_atomic_helper_commit, + .atomic_check = drm_atomic_helper_check, };
Greg Kroah-Hartman
maintainerPATCH 134/169 netrom: fix double-free in nr_route_frame()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
commit ba1096c315283ee3292765f6aea4cca15816c4f7 upstream.
In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug.
Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb.
--- net/netrom/nr_route.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/netrom/nr_route.c +9 -4
@@ -752,7 +752,7 @@ int nr_route_frame(struct sk_buff *skb,unsigned char *dptr;ax25_cb *ax25s;int ret; -struct sk_buff *skbn; +struct sk_buff *nskb, *oskb;/* * Reject malformed packets early. Check that it contains at least 2
@@ -811,14 +811,16 @@ int nr_route_frame(struct sk_buff *skb,/* We are going to change the netrom headers so we should get our own skb, we also did not know until now how much header space we had to reserve... - RXQ */ -if ((skbn=skb_copy_expand (skb, dev->hard_header_len,0 ,GFP_ATOMIC )) ==NULL ) { + nskb =skb_copy_expand (skb, dev->hard_header_len,0 ,GFP_ATOMIC ); + +if (!nskb) {nr_node_unlock (nr_node);nr_node_put (nr_node);dev_put (dev);return 0 ; } -kfree_skb (skb); - skb=skbn; + oskb = skb; + skb = nskb; skb->data[14 ]--; dptr =skb_push (skb,1 );
@@ -837,6 +839,9 @@ int nr_route_frame(struct sk_buff *skb,nr_node_unlock (nr_node);nr_node_put (nr_node); +if (ret) +kfree_skb (oskb); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 135/169 platform/x86: hp-bioscfg: Fix automatic module loading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 467d4afc6caa64b84a6db1634f8091e931f4a7cb upstream.
hp-bioscfg has a MODULE_DEVICE_TABLE with a GUID in it that looks plausible, but the module doesn't automatically load on applicable systems.
This is because the GUID has some lower case characters and so it doesn't match the modalias during boot. Update the GUIDs to be all uppercase.
--- drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h +3 -3
@@ -57,14 +57,14 @@ enum mechanism_values {#define PASSWD_MECHANISM_TYPES "password" -#define HP_WMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4" +#define HP_WMI_BIOS_GUID "5FB7F034-2C63-45E9-BE91-3D44E2C707E4" -#define HP_WMI_BIOS_STRING_GUID "988D08E3-68F4-4c35-AF3E-6A1B8106F83C" +#define HP_WMI_BIOS_STRING_GUID "988D08E3-68F4-4C35-AF3E-6A1B8106F83C"#define HP_WMI_BIOS_INTEGER_GUID "8232DE3D-663D-4327-A8F4-E293ADB9BF05"#define HP_WMI_BIOS_ENUMERATION_GUID "2D114B49-2DFB-4130-B8FE-4A3C09E75133"#define HP_WMI_BIOS_ORDERED_LIST_GUID "14EA9746-CE1F-4098-A0E0-7045CB4DA745"#define HP_WMI_BIOS_PASSWORD_GUID "322F2028-0F84-4901-988E-015176049E2D" -#define HP_WMI_SET_BIOS_SETTING_GUID "1F4C91EB-DC5C-460b-951D-C7CB9B4B8D5E" +#define HP_WMI_SET_BIOS_SETTING_GUID "1F4C91EB-DC5C-460B-951D-C7CB9B4B8D5E"enum hp_wmi_spm_commandtype {HPWMI_SECUREPLATFORM_GET_STATE =0x10 ,
Greg Kroah-Hartman
maintainerPATCH 136/169 pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <[email protected]>
commit 3de49966499634454fd59e0e6fecd50baab7febd upstream.
For i.MX8MQ platform, the ADB in the VPUMIX domain has no separate reset and clock enable bits, but is ungated and reset together with the VPUs. So we can't reset G1 or G2 separately, it may led to the system hang. Remove rst_mask and clk_mask of imx8mq_vpu_blk_ctl_domain_data. Let imx8mq_vpu_power_notifier() do really vpu reset.
--- drivers/pmdomain/imx/imx8m-blk-ctrl.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/pmdomain/imx/imx8m-blk-ctrl.c +7 -4
@@ -846,22 +846,25 @@ static int imx8mq_vpu_power_notifier(strreturn NOTIFY_OK ; } +/* +* For i.MX8MQ, the ADB in the VPUMIX domain has no separate reset and clock +* enable bits, but is ungated and reset together with the VPUs. +* Resetting G1 or G2 separately may led to system hang. +* Remove the rst_mask and clk_mask from the domain data of G1 and G2, +* Let imx8mq_vpu_power_notifier() do really vpu reset. +*/ static const struct imx8m_blk_ctrl_domain_data imx8mq_vpu_blk_ctl_domain_data[] = { [IMX8MQ_VPUBLK_PD_G1 ] = { .name ="vpublk-g1" , .clk_names = (const char *[]){"g1" , }, .num_clks =1 , .gpc_name ="g1" , - .rst_mask =BIT (1 ), - .clk_mask =BIT (1 ), }, [IMX8MQ_VPUBLK_PD_G2 ] = { .name ="vpublk-g2" , .clk_names = (const char *[]){"g2" , }, .num_clks =1 , .gpc_name ="g2" , - .rst_mask =BIT (0 ), - .clk_mask =BIT (0 ), }, };
Greg Kroah-Hartman
maintainerPATCH 137/169 perf/x86/intel: Do not enable BTS for guests
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernand Sieber <[email protected]>
commit 91dcfae0ff2b9b9ab03c1ec95babaceefbffb9f4 upstream.
By default when users program perf to sample branch instructions (PERF_COUNT_HW_BRANCH_INSTRUCTIONS) with a sample period of 1, perf interprets this as a special case and enables BTS (Branch Trace Store) as an optimization to avoid taking an interrupt on every branch.
Since BTS doesn't virtualize, this optimization doesn't make sense when the request originates from a guest. Add an additional check that prevents this optimization for virtualized events (exclude_host).
--- arch/x86/events/perf_event.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
arch/x86/events/perf_event.h +11 -2
@@ -1513,13 +1513,22 @@ static inline bool intel_pmu_has_bts_perstruct hw_perf_event *hwc = &event->hw;unsigned int hw_event, bts_event; -if (event->attr.freq) +/* +* Only use BTS for fixed rate period==1 events. +*/ +if (event->attr.freq || period !=1 ) +return false; + +/* +* BTS doesn't virtualize. +*/ +if (event->attr.exclude_host)return false; hw_event = hwc->config &INTEL_ARCH_EVENT_MASK ; bts_event = x86_pmu.event_map (PERF_COUNT_HW_BRANCH_INSTRUCTIONS ); -return hw_event == bts_event && period ==1 ; +return hw_event == bts_event; }static inline bool intel_pmu_has_bts (struct perf_event *event)
Greg Kroah-Hartman
maintainerPATCH 138/169 irqchip/gic-v3-its: Avoid truncating memory addresses
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream.
On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations.
This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable.
Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address.
The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest.
--- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +4 -4
@@ -619,7 +619,7 @@ static struct its_collection *its_build_struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr;u8 size =ilog2 (desc->its_mapd_cmd.dev->nr_ites); itt_addr =virt_to_phys (desc->its_mapd_cmd.dev->itt);
@@ -790,7 +790,7 @@ static struct its_vpe *its_build_vmapp_c struct its_cmd_desc *desc) {struct its_vpe *vpe =valid_vpe (its, desc->its_vmapp_cmd.vpe); -unsigned long vpt_addr, vconf_addr; +phys_addr_t vpt_addr, vconf_addr;u64 target;bool alloc;
@@ -2395,10 +2395,10 @@ retry_baser: baser->psz = psz; tmp = indirect ?GITS_LVL1_ENTRY_SIZE : esz; -pr_info ("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n" , +pr_info ("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n" , &its->phys_base, (int )(PAGE_ORDER_TO_SIZE (order) / (int )tmp), its_base_type_string[type], - (unsigned long )virt_to_phys (base), + (u64 )virt_to_phys (base), indirect ?"indirect" :"flat" , (int )esz, psz /SZ_1K , (int )shr >>GITS_BASER_SHAREABILITY_SHIFT );
Greg Kroah-Hartman
maintainerPATCH 139/169 net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <[email protected]>
commit a92a6c50e35b75a8021265507f3c2a9084df0b94 upstream.
This is another one of those XGSPON ONU sticks that's using the X-ONU-SFPP internally, thus it also requires the potron quirk to avoid tx faults. So, add an entry for it in sfp_quirks[].
--- drivers/net/phy/sfp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/sfp.c +2 -0
@@ -513,6 +513,8 @@ static const struct sfp_quirk sfp_quirksSFP_QUIRK_F ("HALNy" ,"HL-GSFP" , sfp_fixup_halny_gsfp), +SFP_QUIRK_F ("H-COM" ,"SPP425H-GAB4" , sfp_fixup_potron), +// HG MXPD-483II-F 2.5G supports 2500Base-X, but incorrectly reports // 2600MBd in their EERPOM SFP_QUIRK_M("HG GENUINE", "MXPD-483II", sfp_quirk_2500basex),
Greg Kroah-Hartman
maintainerPATCH 140/169 can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 0ce73a0eb5a27070957b67fd74059b6da89cc516 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close().
Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.
--- drivers/net/can/usb/ems_usb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/ems_usb.c +7 -1
@@ -486,11 +486,17 @@ resubmit_urb: urb->transfer_buffer,RX_BUFFER_SIZE , ems_usb_read_bulk_callback, dev); +usb_anchor_urb (urb, &dev->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 141/169 can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 248e8e1a125fa875158df521b30f2cc7e27eeeaa upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In kvaser_usb_remove_interfaces() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +8 -1
@@ -361,7 +361,14 @@ resubmit_urb: urb->transfer_buffer,KVASER_USB_RX_BUFFER_SIZE , kvaser_usb_read_bulk_callback, dev); +usb_anchor_urb (urb, &dev->rx_submitted); + err =usb_submit_urb (urb,GFP_ATOMIC ); +if (!err) +return ; + +usb_unanchor_urb (urb); +if (err == -ENODEV ) {for (i =0 ; i < dev->nchannels; i++) {if (!dev->nets[i])
@@ -369,7 +376,7 @@ resubmit_urb:netif_device_detach (dev->nets[i]->netdev); } - }else if (err) { + }else {dev_err (&dev->intf->dev,"Failed resubmitting read bulk urb: %d\n" , err); }
Greg Kroah-Hartman
maintainerPATCH 142/169 can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 710a7529fb13c5a470258ff5508ed3c498d54729 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback mcba_usb_read_bulk_callback(), the URBs are processed and resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.
--- drivers/net/can/usb/mcba_usb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/mcba_usb.c +7 -1
@@ -608,11 +608,17 @@ resubmit_urb: urb->transfer_buffer,MCBA_USB_RX_BUFF_SIZE , mcba_usb_read_bulk_callback, priv); +usb_anchor_urb (urb, &priv->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 143/169 can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit f7a980b3b8f80fe367f679da376cf76e800f9480 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.
--- drivers/net/can/usb/usb_8dev.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/can/usb/usb_8dev.c +7 -1
@@ -541,11 +541,17 @@ resubmit_urb: urb->transfer_buffer,RX_BUFFER_SIZE , usb_8dev_read_bulk_callback, priv); +usb_anchor_urb (urb, &priv->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb);if (retval == -ENODEV )netif_device_detach (netdev); -else if (retval) +else netdev_err (netdev,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 117/169 wifi: ath10k: fix dma_free_coherent() pointer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f upstream.
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses.
--- drivers/net/wireless/ath/ath10k/ce.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/wireless/ath/ath10k/ce.c +8 -8
@@ -1727,8 +1727,8 @@ static void _ath10k_ce_free_pipe(struct (ce_state->src_ring->nentries *sizeof (struct ce_desc ) +CE_DESC_RING_ALIGN ), - ce_state->src_ring->base_addr_owner_space, - ce_state->src_ring->base_addr_ce_space); + ce_state->src_ring->base_addr_owner_space_unaligned, + ce_state->src_ring->base_addr_ce_space_unaligned);kfree (ce_state->src_ring); }
@@ -1737,8 +1737,8 @@ static void _ath10k_ce_free_pipe(struct (ce_state->dest_ring->nentries *sizeof (struct ce_desc ) +CE_DESC_RING_ALIGN ), - ce_state->dest_ring->base_addr_owner_space, - ce_state->dest_ring->base_addr_ce_space); + ce_state->dest_ring->base_addr_owner_space_unaligned, + ce_state->dest_ring->base_addr_ce_space_unaligned);kfree (ce_state->dest_ring); }
@@ -1758,8 +1758,8 @@ static void _ath10k_ce_free_pipe_64(stru (ce_state->src_ring->nentries *sizeof (struct ce_desc_64 ) +CE_DESC_RING_ALIGN ), - ce_state->src_ring->base_addr_owner_space, - ce_state->src_ring->base_addr_ce_space); + ce_state->src_ring->base_addr_owner_space_unaligned, + ce_state->src_ring->base_addr_ce_space_unaligned);kfree (ce_state->src_ring); }
@@ -1768,8 +1768,8 @@ static void _ath10k_ce_free_pipe_64(stru (ce_state->dest_ring->nentries *sizeof (struct ce_desc_64 ) +CE_DESC_RING_ALIGN ), - ce_state->dest_ring->base_addr_owner_space, - ce_state->dest_ring->base_addr_ce_space); + ce_state->dest_ring->base_addr_owner_space_unaligned, + ce_state->dest_ring->base_addr_ce_space_unaligned);kfree (ce_state->dest_ring); }
Greg Kroah-Hartman
maintainerPATCH 144/169 drm/amdgpu: remove frame cntl for gfx v12
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Likun Gao <[email protected]>
commit 10343253328e0dbdb465bff709a2619a08fe01ad upstream.
Remove emit_frame_cntl function for gfx v12, which is not support.
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +0 -12
@@ -248,7 +248,6 @@ static void gfx_v12_0_select_se_sh(struc u32 sh_num, u32 instance, int xcc_id);static u32 gfx_v12_0_get_wgp_active_bitmap_per_sh (struct amdgpu_device *adev); -static void gfx_v12_0_ring_emit_frame_cntl (struct amdgpu_ring *ring,bool start,bool secure);static void gfx_v12_0_ring_emit_wreg (struct amdgpu_ring *ring,uint32_t reg,uint32_t val);static int gfx_v12_0_wait_for_rlc_autoload_complete (struct amdgpu_device *adev);
@@ -4556,16 +4555,6 @@ static int gfx_v12_0_ring_preempt_ib(strreturn r; } -static void gfx_v12_0_ring_emit_frame_cntl (struct amdgpu_ring *ring, -bool start, -bool secure) -{ -uint32_t v = secure ?FRAME_TMZ :0 ; - -amdgpu_ring_write (ring,PACKET3 (PACKET3_FRAME_CONTROL ,0 )); -amdgpu_ring_write (ring, v |FRAME_CMD (start ?0 :1 )); -} -static void gfx_v12_0_ring_emit_rreg (struct amdgpu_ring *ring,uint32_t reg,uint32_t reg_val_offs) {
@@ -5316,7 +5305,6 @@ static const struct amdgpu_ring_funcs gf .emit_cntxcntl = gfx_v12_0_ring_emit_cntxcntl, .init_cond_exec = gfx_v12_0_ring_emit_init_cond_exec, .preempt_ib = gfx_v12_0_ring_preempt_ib, - .emit_frame_cntl = gfx_v12_0_ring_emit_frame_cntl, .emit_wreg = gfx_v12_0_ring_emit_wreg, .emit_reg_wait = gfx_v12_0_ring_emit_reg_wait, .emit_reg_write_reg_wait = gfx_v12_0_ring_emit_reg_write_reg_wait,
Greg Kroah-Hartman
maintainerPATCH 145/169 gpio: cdev: Correct return code on memory allocation failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
commit faff6846474e99295a139997f93ef6db222b5cee upstream.
-ENOMEM is a more appropriate return code for memory allocation failures. Correct it.
--- drivers/gpio/gpiolib-cdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpiolib-cdev.c +1 -1
@@ -2767,7 +2767,7 @@ static int gpio_chrdev_open(struct inode cdev =kzalloc (sizeof (*cdev),GFP_KERNEL );if (!cdev) -return -ENODEV ; +return -ENOMEM ; cdev->watched_lines =bitmap_zalloc (gdev->ngpio,GFP_KERNEL );if (!cdev->watched_lines)
Greg Kroah-Hartman
maintainerPATCH 146/169 migrate: correct lock ordering for hugetlb file folios
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
commit b7880cb166ab62c2409046b2347261abf701530e upstream.
Syzbot has found a deadlock (analyzed by Lance Yang):
1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock.
migrate_pages()
-> migrate_hugetlbs()
-> unmap_and_move_huge_page() <- Takes folio_lock!
-> remove_migration_ptes()
-> __rmap_walk_file()
-> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)!hugetlbfs_fallocate()
-> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)!
-> hugetlbfs_zero_partial_page()
-> filemap_lock_hugetlb_folio()
-> filemap_lock_folio()
-> __filemap_get_folio <- Waits for folio_lock!The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too.
This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.
--- mm/migrate.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
mm/migrate.c +6 -6
@@ -1439,6 +1439,7 @@ static int unmap_and_move_huge_page(new_int page_was_mapped =0 ;struct anon_vma *anon_vma =NULL ;struct address_space *mapping =NULL ; +enum ttu_flags ttu =0 ;if (folio_ref_count (src) ==1 ) {/* page was freed from under us. So we are done. */
@@ -1479,8 +1480,6 @@ static int unmap_and_move_huge_page(new_ goto put_anon;if (folio_mapped (src)) { -enum ttu_flags ttu =0 ; -if (!folio_test_anon (src)) {/* * In shared mappings, try_to_unmap could potentially
@@ -1497,9 +1496,6 @@ static int unmap_and_move_huge_page(new_try_to_migrate (src, ttu); page_was_mapped =1 ; - -if (ttu &TTU_RMAP_LOCKED ) -i_mmap_unlock_write (mapping); }if (!folio_mapped (src))
@@ -1507,7 +1503,11 @@ static int unmap_and_move_huge_page(new_if (page_was_mapped)remove_migration_ptes (src, - rc ==MIGRATEPAGE_SUCCESS ? dst : src,0 ); + rc ==MIGRATEPAGE_SUCCESS ? dst : src, + ttu ?RMP_LOCKED :0 ); + +if (ttu &TTU_RMAP_LOCKED ) +i_mmap_unlock_write (mapping); unlock_put_anon:folio_unlock (dst);
Greg Kroah-Hartman
maintainerPATCH 147/169 dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
commit 566beb347eded7a860511164a7a163bc882dc4d0 upstream.
The SoC DMA resources for UDMA, BCDMA and PKTDMA can be described via a combination of up to two resource ranges. The first resource range handles the default partitioning wherein all resources belonging to that range are allocated to a single entity and form a continuous range. For use-cases where the resources are shared across multiple entities and require to be described via discontinuous ranges, a second resource range is required.
Currently, udma_setup_resources() supports handling resources that belong to the second range. Extend bcdma_setup_resources() and pktdma_setup_resources() to support the same.
--- drivers/dma/ti/k3-udma.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)
drivers/dma/ti/k3-udma.c +36 -0
@@ -4876,6 +4876,12 @@ static int bcdma_setup_resources(struct irq_res.desc[i].start = rm_res->desc[i].start + oes->bcdma_bchan_ring; irq_res.desc[i].num = rm_res->desc[i].num; + +if (rm_res->desc[i].num_sec) { + irq_res.desc[i].start_sec = rm_res->desc[i].start_sec + + oes->bcdma_bchan_ring; + irq_res.desc[i].num_sec = rm_res->desc[i].num_sec; + } } } }else {
@@ -4899,6 +4905,15 @@ static int bcdma_setup_resources(struct irq_res.desc[i +1 ].start = rm_res->desc[j].start + oes->bcdma_tchan_ring; irq_res.desc[i +1 ].num = rm_res->desc[j].num; + +if (rm_res->desc[j].num_sec) { + irq_res.desc[i].start_sec = rm_res->desc[j].start_sec + + oes->bcdma_tchan_data; + irq_res.desc[i].num_sec = rm_res->desc[j].num_sec; + irq_res.desc[i +1 ].start_sec = rm_res->desc[j].start_sec + + oes->bcdma_tchan_ring; + irq_res.desc[i +1 ].num_sec = rm_res->desc[j].num_sec; + } } } }
@@ -4919,6 +4934,15 @@ static int bcdma_setup_resources(struct irq_res.desc[i +1 ].start = rm_res->desc[j].start + oes->bcdma_rchan_ring; irq_res.desc[i +1 ].num = rm_res->desc[j].num; + +if (rm_res->desc[j].num_sec) { + irq_res.desc[i].start_sec = rm_res->desc[j].start_sec + + oes->bcdma_rchan_data; + irq_res.desc[i].num_sec = rm_res->desc[j].num_sec; + irq_res.desc[i +1 ].start_sec = rm_res->desc[j].start_sec + + oes->bcdma_rchan_ring; + irq_res.desc[i +1 ].num_sec = rm_res->desc[j].num_sec; + } } } }
@@ -5053,6 +5077,12 @@ static int pktdma_setup_resources(struct irq_res.desc[i].start = rm_res->desc[i].start + oes->pktdma_tchan_flow; irq_res.desc[i].num = rm_res->desc[i].num; + +if (rm_res->desc[i].num_sec) { + irq_res.desc[i].start_sec = rm_res->desc[i].start_sec + + oes->pktdma_tchan_flow; + irq_res.desc[i].num_sec = rm_res->desc[i].num_sec; + } } } rm_res = tisci_rm->rm_ranges[RM_RANGE_RFLOW ];
@@ -5064,6 +5094,12 @@ static int pktdma_setup_resources(struct irq_res.desc[i].start = rm_res->desc[j].start + oes->pktdma_rchan_flow; irq_res.desc[i].num = rm_res->desc[j].num; + +if (rm_res->desc[j].num_sec) { + irq_res.desc[i].start_sec = rm_res->desc[j].start_sec + + oes->pktdma_rchan_flow; + irq_res.desc[i].num_sec = rm_res->desc[j].num_sec; + } } } ret =ti_sci_inta_msi_domain_alloc_irqs (ud->dev, &irq_res);
Greg Kroah-Hartman
maintainerPATCH 148/169 can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 5a4391bdc6c8357242f62f22069c865b792406b3 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:gs_usb_receive_bulk_callback(): fix URB memory leak").
In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close().
Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.
--- drivers/net/can/usb/esd_usb.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/can/usb/esd_usb.c +8 -1
@@ -539,13 +539,20 @@ resubmit_urb: urb->transfer_buffer,ESD_USB_RX_BUFFER_SIZE , esd_usb_read_bulk_callback, dev); +usb_anchor_urb (urb, &dev->rx_submitted); + retval =usb_submit_urb (urb,GFP_ATOMIC ); +if (!retval) +return ; + +usb_unanchor_urb (urb); +if (retval == -ENODEV ) {for (i =0 ; i < dev->net_count; i++) {if (dev->nets[i])netif_device_detach (dev->nets[i]->netdev); } - }else if (retval) { + }else {dev_err (dev->udev->dev.parent,"failed resubmitting read bulk urb: %d\n" , retval); }
Greg Kroah-Hartman
maintainerPATCH 118/169 wifi: ath12k: fix dma_free_coherent() pointer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit bb97131fbf9b708dd9616ac2bdc793ad102b5c48 upstream.
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses.
--- drivers/net/wireless/ath/ath12k/ce.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath12k/ce.c +6 -6
@@ -893,8 +893,8 @@ void ath12k_ce_free_pipes(struct ath12k_dma_free_coherent (ab->dev, pipe->src_ring->nentries * desc_sz +CE_DESC_RING_ALIGN , - pipe->src_ring->base_addr_owner_space, - pipe->src_ring->base_addr_ce_space); + pipe->src_ring->base_addr_owner_space_unaligned, + pipe->src_ring->base_addr_ce_space_unaligned);kfree (pipe->src_ring); pipe->src_ring =NULL ; }
@@ -904,8 +904,8 @@ void ath12k_ce_free_pipes(struct ath12k_dma_free_coherent (ab->dev, pipe->dest_ring->nentries * desc_sz +CE_DESC_RING_ALIGN , - pipe->dest_ring->base_addr_owner_space, - pipe->dest_ring->base_addr_ce_space); + pipe->dest_ring->base_addr_owner_space_unaligned, + pipe->dest_ring->base_addr_ce_space_unaligned);kfree (pipe->dest_ring); pipe->dest_ring =NULL ; }
@@ -916,8 +916,8 @@ void ath12k_ce_free_pipes(struct ath12k_dma_free_coherent (ab->dev, pipe->status_ring->nentries * desc_sz +CE_DESC_RING_ALIGN , - pipe->status_ring->base_addr_owner_space, - pipe->status_ring->base_addr_ce_space); + pipe->status_ring->base_addr_owner_space_unaligned, + pipe->status_ring->base_addr_ce_space_unaligned);kfree (pipe->status_ring); pipe->status_ring =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 119/169 wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 2120f3a3738a65730c81bf10447b1ff776078915 upstream.
The "i" iterator variable is used to count two different things but unfortunately we can't store two different numbers in the same variable. Use "i" for the outside loop and "j" for the inside loop.
--- drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +3 -3
@@ -825,7 +825,7 @@ void mwifiex_update_rxreor_flags(structstatic void mwifiex_update_ampdu_rxwinsize (struct mwifiex_adapter *adapter,bool coex_flag) { -u8 i; +u8 i, j;u32 rx_win_size;struct mwifiex_private *priv;
@@ -863,8 +863,8 @@ static void mwifiex_update_ampdu_rxwinsiif (rx_win_size != priv->add_ba_param.rx_win_size) {if (!priv->media_connected)continue ; -for (i =0 ; i <MAX_NUM_TID ; i++) -mwifiex_11n_delba (priv, i); +for (j =0 ; j <MAX_NUM_TID ; j++) +mwifiex_11n_delba (priv, j); } } }
Greg Kroah-Hartman
maintainerPATCH 120/169 wifi: rsi: Fix memory corruption due to not set vif driver data size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 4f431d88ea8093afc7ba55edf4652978c5a68f33 upstream.
The struct ieee80211_vif contains trailing space for vif driver data, when struct ieee80211_vif is allocated, the total memory size that is allocated is sizeof(struct ieee80211_vif) + size of vif driver data. The size of vif driver data is set by each WiFi driver as needed.
The RSI911x driver does not set vif driver data size, no trailing space for vif driver data is therefore allocated past struct ieee80211_vif . The RSI911x driver does however use the vif driver data to store its vif driver data structure "struct vif_priv". An access to vif->drv_priv leads to access out of struct ieee80211_vif bounds and corruption of some memory.
In case of the failure observed locally, rsi_mac80211_add_interface() would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv; vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member struct list_head new_flows . The flow = list_first_entry(head, struct fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus address, which when accessed causes a crash.
The trigger is very simple, boot the machine with init=/bin/sh , mount devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1", "ip link set wlan0 down" and the crash occurs.
Fix this by setting the correct size of vif driver data, which is the size of "struct vif_priv", so that memory is allocated and the driver can store its driver data in it, instead of corrupting memory around it.
--- drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_mac80211.c +1 -0
@@ -2028,6 +2028,7 @@ int rsi_mac80211_attach(struct rsi_commo hw->queues =MAX_HW_QUEUES ; hw->extra_tx_headroom =RSI_NEEDED_HEADROOM ; + hw->vif_data_size =sizeof (struct vif_priv ); hw->max_rates =1 ; hw->max_rate_tries =MAX_RETRIES ;
Greg Kroah-Hartman
maintainerPATCH 121/169 arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 upstream.
The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can place a task into an invalid state where TIF_SME is set but the task's sve_state is NULL.
In legitimate but uncommon cases where the ZA signal context was NOT created by the kernel in the context of the same task (e.g. if the task is saved/restored with something like CRIU), we have no guarantee that sve_state had been allocated previously. In these cases, userspace can enter streaming mode without trapping while sve_state is NULL, causing a later NULL pointer dereference when the kernel attempts to store the register state:
| # ./sigreturn-za | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000046 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x06: level 2 translation fault | Data abort info: | ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00 | [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000 | Internal error: Oops: 0000000096000046 [#1] SMP | Modules linked in: | CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT | Hardware name: linux,dummy-virt (DT) | pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : sve_save_state+0x4/0xf0 | lr : fpsimd_save_user_state+0xb0/0x1c0 | sp : ffff80008070bcc0 | x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658 | x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40 | x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000 | x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c | x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020 | x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0 | x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48 | x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000 | x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440 | Call trace: | sve_save_state+0x4/0xf0 (P) | fpsimd_thread_switch+0x48/0x198 | __switch_to+0x20/0x1c0 | __schedule+0x36c/0xce0 | schedule+0x34/0x11c | exit_to_user_mode_loop+0x124/0x188 | el0_interrupt+0xc8/0xd8 | __el0_irq_handler_common+0x18/0x24 | el0t_64_irq_handler+0x10/0x1c | el0t_64_irq+0x198/0x19c | Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) | ---[ end trace 0000000000000000 ]---
Fix this by having restore_za_context() ensure that the task's sve_state is allocated, matching what we do when taking an SME trap. Any live SVE/SSVE state (which is restored earlier from a separate signal context) must be preserved, and hence this is not zeroed.
--- arch/arm64/kernel/signal.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/kernel/signal.c +4 -0
@@ -590,6 +590,10 @@ static int restore_za_context(struct usefpsimd_flush_task_state (current);/* From now, fpsimd_thread_switch() won't touch thread.sve_state */ +sve_alloc (current, false); +if (!current->thread.sve_state) +return -ENOMEM ; +sme_alloc (current, true);if (!current->thread.sme_state) { current->thread.svcr &= ~SVCR_ZA_MASK ;
Greg Kroah-Hartman
maintainerPATCH 122/169 arm64: Set __nocfi on swsusp_arch_resume()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <[email protected]>
commit e2f8216ca2d8e61a23cb6ec355616339667e0ba6 upstream.
A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not have a CFI hash, but swsusp_arch_resume() will attempt to verify the CFI hash when calling a copy of swsusp_arch_suspend_exit().
Given that there's an existing requirement that the entrypoint to swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text section, we cannot fix this by marking swsusp_arch_suspend_exit() with SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in swsusp_arch_resume().
Mark swsusp_arch_resume() as __nocfi to disable the CFI check.
[1]
[ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc [ 22.991934][ T1] Mem abort info: [ 22.991934][ T1] ESR = 0x0000000096000007 [ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits [ 22.991934][ T1] SET = 0, FnV = 0 [ 22.991934][ T1] EA = 0, S1PTW = 0 [ 22.991934][ T1] FSC = 0x07: level 3 translation fault [ 22.991934][ T1] Data abort info: [ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper [ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP [ 22.991934][ T1] Dumping ftrace buffer: [ 22.991934][ T1] (ftrace buffer empty) [ 22.991934][ T1] Modules linked in: [ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419 [ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT) [ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344 [ 22.991934][ T1] sp : ffffffc08006b960 [ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000 [ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820 [ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000 [ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058 [ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004 [ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000 [ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000 [ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b [ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530 [ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000 [ 22.991934][ T1] Call trace: [ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] hibernation_restore+0x158/0x18c [ 22.991934][ T1] load_image_and_restore+0xb0/0xec [ 22.991934][ T1] software_resume+0xf4/0x19c [ 22.991934][ T1] software_resume_initcall+0x34/0x78 [ 22.991934][ T1] do_one_initcall+0xe8/0x370 [ 22.991934][ T1] do_initcall_level+0xc8/0x19c [ 22.991934][ T1] do_initcalls+0x70/0xc0 [ 22.991934][ T1] do_basic_setup+0x1c/0x28 [ 22.991934][ T1] kernel_init_freeable+0xe0/0x148 [ 22.991934][ T1] kernel_init+0x20/0x1a8 [ 22.991934][ T1] ret_from_fork+0x10/0x20 [ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110)
--- arch/arm64/kernel/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/hibernate.c +1 -1
@@ -396,7 +396,7 @@ int swsusp_arch_suspend(void)* Memory allocated by get_safe_page() will be dealt with by the hibernate code, * we don't need to free it here. */ -int swsusp_arch_resume (void ) +int __nocfi swsusp_arch_resume(void) {int rc;void *zero_page;
Greg Kroah-Hartman
maintainerPATCH 123/169 octeontx2: Fix otx2_dma_map_page() error return code
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit d998b0e5afffa90d0f03770bad31083767079858 upstream.
0 is a valid DMA address [1] so using it as the error value can lead to errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error() to test the return value of otx2_dma_map_page(). This means that they would not detect an error in otx2_dma_map_page().
Make otx2_dma_map_page() return the raw value of dma_map_page_attrs().
[1] https://lore.kernel.org/all/[email protected]
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +1 -6
@@ -894,13 +894,8 @@ static inline dma_addr_t otx2_dma_map_pa size_t offset, size_t size, enum dma_data_direction dir) { - dma_addr_t iova; - - iova =dma_map_page_attrs (pfvf->dev, page, + return dma_map_page_attrs(pfvf->dev, page,offset ,size ,dir ,DMA_ATTR_SKIP_CPU_SYNC ); -if (unlikely (dma_mapping_error (pfvf->dev, iova))) -return (dma_addr_t )NULL ; -return iova; } static inline void otx2_dma_unmap_page(struct otx2_nic *pfvf,
Greg Kroah-Hartman
maintainerPATCH 114/169 mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <[email protected]>
commit 122610220134b32c742cc056eaf64f7017ac8cd9 upstream.
rtsx_pci_sdmmc does not have an sdmmc_card_busy function, so any voltage switches cause a kernel warning, "mmc0: cannot verify signal voltage switch."
Copy the sdmmc_card_busy function from rtsx_pci_usb to rtsx_pci_sdmmc to fix this.
--- drivers/mmc/host/rtsx_pci_sdmmc.c | 41 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)
drivers/mmc/host/rtsx_pci_sdmmc.c +41 -0
@@ -1308,6 +1308,46 @@ out:return err; } +static int sdmmc_card_busy (struct mmc_host *mmc) +{ +struct realtek_pci_sdmmc *host =mmc_priv (mmc); +struct rtsx_pcr *pcr = host->pcr; +int err; +u8 stat; +u8 mask =SD_DAT3_STATUS |SD_DAT2_STATUS |SD_DAT1_STATUS + |SD_DAT0_STATUS ; + +mutex_lock (&pcr->pcr_mutex); + +rtsx_pci_start_run (pcr); + + err =rtsx_pci_write_register (pcr,SD_BUS_STAT , +SD_CLK_TOGGLE_EN |SD_CLK_FORCE_STOP , +SD_CLK_TOGGLE_EN ); +if (err) + goto out; + +mdelay (1 ); + + err =rtsx_pci_read_register (pcr,SD_BUS_STAT , &stat); +if (err) + goto out; + + err =rtsx_pci_write_register (pcr,SD_BUS_STAT , +SD_CLK_TOGGLE_EN |SD_CLK_FORCE_STOP ,0 ); +out: +mutex_unlock (&pcr->pcr_mutex); + +if (err) +return err; + +/* check if any pin between dat[0:3] is low */ +if ((stat & mask) != mask) +return 1 ; +else +return 0 ; +} +static int sdmmc_execute_tuning (struct mmc_host *mmc,u32 opcode) {struct realtek_pci_sdmmc *host =mmc_priv (mmc);
@@ -1420,6 +1460,7 @@ static const struct mmc_host_ops realtek .get_ro = sdmmc_get_ro, .get_cd = sdmmc_get_cd, .start_signal_voltage_switch = sdmmc_switch_voltage, + .card_busy = sdmmc_card_busy, .execute_tuning = sdmmc_execute_tuning, .init_sd_express = sdmmc_init_sd_express, };
Greg Kroah-Hartman
maintainerPATCH 150/169 bpf: Do not let BPF test infra emit invalid GSO types to stack
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 04a899573fb87273a656f178b5f920c505f68875 upstream.
Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_features_check(). When a BPF program - triggered via BPF test infra - pushes the packet to the loopback device via bpf_clone_redirect() then mentioned offload warning can be seen. GSO-related features are then rightfully disabled.
We get into this situation due to convert___skb_to_skb() setting gso_segs and gso_size but not gso_type. Technically, it makes sense that this warning triggers since the GSO properties are malformed due to the gso_type. Potentially, the gso_type could be marked non-trustworthy through setting it at least to SKB_GSO_DODGY without any other specific assumptions, but that also feels wrong given we should not go further into the GSO engine in the first place.
The checks were added in 121d57af308d ("gso: validate gso_type in GSO handlers") because there were malicious (syzbot) senders that combine a protocol with a non-matching gso_type. If we would want to drop such packets, gso_features_check() currently only returns feature flags via netif_skb_features(), so one location for potentially dropping such skbs could be validate_xmit_unreadable_skb(), but then otoh it would be an additional check in the fast-path for a very corner case. Given bpf_clone_redirect() is the only place where BPF test infra could emit such packets, lets reject them right there.
--- net/bpf/test_run.c | 5 +++++ net/core/filter.c | 7 +++++++ 2 files changed, 12 insertions(+)
net/bpf/test_run.c +5 -0
@@ -944,6 +944,11 @@ static int convert___skb_to_skb(struct sif (__skb->gso_segs >GSO_MAX_SEGS )return -EINVAL ; + +/* Currently GSO type is zero/unset. If this gets extended with +* a small list of accepted GSO types in future, the filter for +* an unset GSO type in bpf_clone_redirect() can be lifted. +*/ skb_shinfo (skb)->gso_segs = __skb->gso_segs;skb_shinfo (skb)->gso_size = __skb->gso_size;skb_shinfo (skb)->hwtstamps.hwtstamp = __skb->hwtstamp;
net/core/filter.c +7 -0
@@ -2466,6 +2466,13 @@ BPF_CALL_3(bpf_clone_redirect, struct skif (unlikely (flags & (~(BPF_F_INGRESS ) |BPF_F_REDIRECT_INTERNAL )))return -EINVAL ; +/* BPF test infra's convert___skb_to_skb() can create type-less +* GSO packets. gso_features_check() will detect this as a bad +* offload. However, lets not leak them out in the first place. +*/ +if (unlikely (skb_is_gso (skb) && !skb_shinfo (skb)->gso_type)) +return -EBADMSG ; + dev =dev_get_by_index_rcu (dev_net (skb->dev), ifindex);if (unlikely (!dev))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 159/169 accel/ivpu: Fix race condition when unbinding BOs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Rusinowicz <[email protected]>
[ Upstream commit 00812636df370bedf4e44a0c81b86ea96bca8628 ]
Fix 'Memory manager not clean during takedown' warning that occurs when ivpu_gem_bo_free() removes the BO from the BOs list before it gets unmapped. Then file_priv_unbind() triggers a warning in drm_mm_takedown() during context teardown.
Protect the unmapping sequence with bo_list_lock to ensure the BO is always fully unmapped when removed from the list. This ensures the BO is either fully unmapped at context teardown time or present on the list and unmapped by file_priv_unbind().
[ The context change is due to the commit e0c0891cd63b ("accel/ivpu: Rework bind/unbind of imported buffers") and the proper adoption is done. ]
--- drivers/accel/ivpu/ivpu_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/accel/ivpu/ivpu_gem.c +2 -1
@@ -240,7 +240,6 @@ static void ivpu_gem_bo_free(struct drm_mutex_lock (&vdev->bo_list_lock);list_del (&bo->bo_list_node); -mutex_unlock (&vdev->bo_list_lock);drm_WARN_ON (&vdev->drm, !drm_gem_is_imported (&bo->base.base) && !dma_resv_test_signaled (obj->resv,DMA_RESV_USAGE_READ ));
@@ -248,6 +247,8 @@ static void ivpu_gem_bo_free(struct drm_drm_WARN_ON (&vdev->drm, bo->base.vaddr);ivpu_bo_unbind_locked (bo); +mutex_unlock (&vdev->bo_list_lock); +drm_WARN_ON (&vdev->drm, bo->mmu_mapped);drm_WARN_ON (&vdev->drm, bo->ctx);
Greg Kroah-Hartman
maintainerPATCH 160/169 btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 38e818718c5e04961eea0fa8feff3f100ce40408 ]
Quoted 1 line
From the memory-barriers.txt document regarding memory barrier ordering
guarantees:
(*) These guarantees do not apply to bitfields, because compilers often
generate code to modify these using non-atomic read-modify-write sequences. Do not attempt to use bitfields to synchronize parallel algorithms.
(*) Even in cases where bitfields are protected by locks, all fields
in a given bitfield must be protected by one lock. If two fields in a given bitfield are protected by different locks, the compiler's non-atomic read-modify-write sequences can cause an update to one field to corrupt the value of an adjacent field.
btrfs_space_info has a bitfield sharing an underlying word consisting of the fields full, chunk_alloc, and flush:
struct btrfs_space_info {
struct btrfs_fs_info * fs_info; /* 0 8 */
struct btrfs_space_info * parent; /* 8 8 */ ...
int clamp; /* 172 4 */
unsigned int full:1; /* 176: 0 4 */
unsigned int chunk_alloc:1; /* 176: 1 4 */
unsigned int flush:1; /* 176: 2 4 */
...
Therefore, to be safe from parallel read-modify-writes losing a write to one of the bitfield members protected by a lock, all writes to all the bitfields must use the lock. They almost universally do, except for btrfs_clear_space_info_full() which iterates over the space_infos and writes out found->full = 0 without a lock.
Imagine that we have one thread completing a transaction in which we finished deleting a block_group and are thus calling btrfs_clear_space_info_full() while simultaneously the data reclaim ticket infrastructure is running do_async_reclaim_data_space():
T1 T2btrfs_commit_transaction
btrfs_clear_space_info_full
data_sinfo->full = 0
READ: full:0, chunk_alloc:0, flush:1
do_async_reclaim_data_space(data_sinfo)
spin_lock(&space_info->lock);
if(list_empty(tickets))
space_info->flush = 0;
READ: full: 0, chunk_alloc:0, flush:1
MOD/WRITE: full: 0, chunk_alloc:0, flush:0
spin_unlock(&space_info->lock);
return;MOD/WRITE: full:0, chunk_alloc:0, flush:1
and now data_sinfo->flush is 1 but the reclaim worker has exited. This breaks the invariant that flush is 0 iff there is no work queued or running. Once this invariant is violated, future allocations that go into __reserve_bytes() will add tickets to space_info->tickets but will see space_info->flush is set to 1 and not queue the work. After this, they will block forever on the resulting ticket, as it is now impossible to kick the worker again.
I also confirmed by looking at the assembly of the affected kernel that it is doing RMW operations. For example, to set the flush (3rd) bit to 0, the assembly is:
andb $0xfb,0x60(%rbx)
and similarly for setting the full (1st) bit to 0:
andb $0xfe,-0x20(%rax)
So I think this is really a bug on practical systems. I have observed a number of systems in this exact state, but am currently unable to reproduce it.
Rather than leaving this footgun lying around for the future, take advantage of the fact that there is room in the struct anyway, and that it is already quite large and simply change the three bitfield members to bools. This avoids writes to space_info->full having any effect on writes to space_info->flush, regardless of locking.
[ The context change is due to the commit cc0517fe779f ("btrfs: tweak extent/chunk allocation for space_info sub-space") in v6.16 which is irrelevant to the logic of this patch. ]
--- fs/btrfs/block-group.c | 6 +++--- fs/btrfs/space-info.c | 22 +++++++++++----------- fs/btrfs/space-info.h | 6 +++--- 3 files changed, 17 insertions(+), 17 deletions(-)
fs/btrfs/block-group.c +3 -3
@@ -4195,7 +4195,7 @@ int btrfs_chunk_alloc(struct btrfs_transmutex_unlock (&fs_info->chunk_mutex); }else {/* Proceed with allocation */ - space_info->chunk_alloc =1 ; + space_info->chunk_alloc = true; wait_for_alloc = false;spin_unlock (&space_info->lock); }
@@ -4244,7 +4244,7 @@ int btrfs_chunk_alloc(struct btrfs_transspin_lock (&space_info->lock);if (ret <0 ) {if (ret == -ENOSPC ) - space_info->full =1 ; + space_info->full = true;else goto out; }else {
@@ -4254,7 +4254,7 @@ int btrfs_chunk_alloc(struct btrfs_trans space_info->force_alloc =CHUNK_ALLOC_NO_FORCE ; out: - space_info->chunk_alloc =0 ; + space_info->chunk_alloc = false;spin_unlock (&space_info->lock);mutex_unlock (&fs_info->chunk_mutex);
fs/btrfs/space-info.c +11 -11
@@ -183,7 +183,7 @@ void btrfs_clear_space_info_full(structstruct btrfs_space_info *found;list_for_each_entry (found, head, list) - found->full =0 ; + found->full = false; }/*
@@ -364,7 +364,7 @@ void btrfs_add_bg_to_space_info(struct b found->bytes_readonly += block_group->bytes_super;btrfs_space_info_update_bytes_zone_unusable (info, found, block_group->zone_unusable);if (block_group->length >0 ) - found->full =0 ; + found->full = false;btrfs_try_granting_tickets (info, found);spin_unlock (&found->lock);
@@ -1140,7 +1140,7 @@ static void btrfs_async_reclaim_metadataspin_lock (&space_info->lock); to_reclaim =btrfs_calc_reclaim_metadata_size (fs_info, space_info);if (!to_reclaim) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1152,7 +1152,7 @@ static void btrfs_async_reclaim_metadataflush_space (fs_info, space_info, to_reclaim, flush_state, false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1195,7 +1195,7 @@ static void btrfs_async_reclaim_metadata flush_state =FLUSH_DELAYED_ITEMS_NR ; commit_cycles--; }else { - space_info->flush =0 ; + space_info->flush = false; } }else { flush_state =FLUSH_DELAYED_ITEMS_NR ;
@@ -1357,7 +1357,7 @@ static void btrfs_async_reclaim_data_spaspin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1368,7 +1368,7 @@ static void btrfs_async_reclaim_data_spaflush_space (fs_info, space_info,U64_MAX ,ALLOC_CHUNK_FORCE , false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1385,7 +1385,7 @@ static void btrfs_async_reclaim_data_spa data_flush_states[flush_state], false);spin_lock (&space_info->lock);if (list_empty (&space_info->tickets)) { - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock);return ; }
@@ -1402,7 +1402,7 @@ static void btrfs_async_reclaim_data_spaif (maybe_fail_all_tickets (fs_info, space_info)) flush_state =0 ;else - space_info->flush =0 ; + space_info->flush = false; }else { flush_state =0 ; }
@@ -1418,7 +1418,7 @@ static void btrfs_async_reclaim_data_spa aborted_fs:maybe_fail_all_tickets (fs_info, space_info); - space_info->flush =0 ; + space_info->flush = false;spin_unlock (&space_info->lock); }
@@ -1787,7 +1787,7 @@ static int __reserve_bytes(struct btrfs_*/ maybe_clamp_preempt (fs_info, space_info); - space_info->flush =1 ; + space_info->flush = true; trace_btrfs_trigger_flush(fs_info, space_info->flags, orig_bytes, flush,
fs/btrfs/space-info.h +3 -3
@@ -136,11 +136,11 @@ struct btrfs_space_info {flushing. The value is >> clamp, so turns out to be a 2^clamp divisor. */ - unsigned int full:1; /* indicates that we cannot allocate any more +bool full;/* indicates that we cannot allocate any more chunks for this space */ - unsigned int chunk_alloc:1; /* set if we are allocating a chunk */ +bool chunk_alloc;/* set if we are allocating a chunk */ - unsigned int flush:1; /* set if we are trying to make space */ +bool flush;/* set if we are trying to make space */ unsigned int force_alloc;/* set if we need to force a chunk alloc for this space */
Greg Kroah-Hartman
maintainerPATCH 161/169 wifi: ath11k: fix RCU stall while reaping monitor destination ring
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: P Praneesh <[email protected]>
[ Upstream commit 16c6c35c03ea73054a1f6d3302a4ce4a331b427d ]
While processing the monitor destination ring, MSDUs are reaped from the link descriptor based on the corresponding buf_id.
However, sometimes the driver cannot obtain a valid buffer corresponding to the buf_id received from the hardware. This causes an infinite loop in the destination processing, resulting in a kernel crash.
kernel log:ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309 ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed ath11k_pci 0000:58:00.0: data msdu_pop: invalid buf_id 309 ath11k_pci 0000:58:00.0: data dp_rx_monitor_link_desc_return failed
Fix this by skipping the problematic buf_id and reaping the next entry, replacing the break with the next MSDU processing.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +2 -2
@@ -4777,7 +4777,7 @@ ath11k_dp_rx_mon_mpdu_pop(struct ath11kif (!msdu) {ath11k_dbg (ar->ab,ATH11K_DBG_DATA ,"msdu_pop: invalid buf_id %d\n" , buf_id); -break ; + goto next_msdu; } rxcb =ATH11K_SKB_RXCB (msdu);if (!rxcb->unmapped) {
@@ -5404,7 +5404,7 @@ ath11k_dp_rx_full_mon_mpdu_pop(struct at"full mon msdu_pop: invalid buf_id %d\n" , buf_id);spin_unlock_bh (&rx_ring->idr_lock); -break ; + goto next_msdu; }idr_remove (&rx_ring->bufs_idr, buf_id);spin_unlock_bh (&rx_ring->idr_lock);
Greg Kroah-Hartman
maintainerPATCH 162/169 vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[Upstream commit 87dbae5e36613a6020f3d64a2eaeac0a1e0e6dc6]
virtio_vsock_skb_rx_put() only calls skb_put() if the length in the packet header is not zero even though skb_put() handles this case gracefully.
Remove the functionally redundant check from virtio_vsock_skb_rx_put() and, on the assumption that this is a worthwhile optimisation for handling credit messages, augment the existing length checks in virtio_transport_rx_work() to elide the call for zero-length payloads. Since the callers all have the length, extend virtio_vsock_skb_rx_put() to take it as an additional parameter rather than fish it back out of the packet header.
Note that the vhost code already has similar logic in vhost_vsock_alloc_skb().
Message-Id: <[email protected]>
--- drivers/vhost/vsock.c | 2 +- include/linux/virtio_vsock.h | 9 ++------- net/vmw_vsock/virtio_transport.c | 4 +++- 3 files changed, 6 insertions(+), 9 deletions(-)
drivers/vhost/vsock.c +1 -1
@@ -376,7 +376,7 @@ vhost_vsock_alloc_skb(struct vhost_virtqreturn NULL ; } -virtio_vsock_skb_rx_put (skb); +virtio_vsock_skb_rx_put (skb, payload_len); nbytes =copy_from_iter (skb->data, payload_len, &iov_iter);if (nbytes != payload_len) {
include/linux/virtio_vsock.h +2 -7
@@ -47,14 +47,9 @@ static inline void virtio_vsock_skb_cleaVIRTIO_VSOCK_SKB_CB (skb)->tap_delivered = false; } -static inline void virtio_vsock_skb_rx_put (struct sk_buff *skb) +static inline void virtio_vsock_skb_rx_put (struct sk_buff *skb,u32 len) { -u32 len; - - len =le32_to_cpu (virtio_vsock_hdr (skb)->len); - -if (len >0 ) -skb_put (skb, len); +skb_put (skb, len); }static inline struct sk_buff *virtio_vsock_alloc_skb (unsigned int size,gfp_t mask)
net/vmw_vsock/virtio_transport.c +3 -1
@@ -656,7 +656,9 @@ static void virtio_transport_rx_work(strcontinue ; } -virtio_vsock_skb_rx_put (skb); +if (payload_len) +virtio_vsock_skb_rx_put (skb, payload_len); +virtio_transport_deliver_tap_pkt (skb);virtio_transport_recv_pkt (&virtio_transport, skb); }
Greg Kroah-Hartman
maintainerPATCH 163/169 vsock/virtio: Rename virtio_vsock_alloc_skb()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
[Upstream commit 2304c64a2866c58534560c63dc6e79d09b8f8d8d]
In preparation for nonlinear allocations for large SKBs, rename virtio_vsock_alloc_skb() to virtio_vsock_alloc_linear_skb() to indicate that it returns linear SKBs unconditionally and switch all callers over to this new interface for now.
No functional change.
Message-Id: <[email protected]>
--- drivers/vhost/vsock.c | 2 +- include/linux/virtio_vsock.h | 3 ++- net/vmw_vsock/virtio_transport.c | 2 +- net/vmw_vsock/virtio_transport_common.c | 2 +- 4 files changed, 5 insertions(+), 4 deletions(-)
drivers/vhost/vsock.c +1 -1
@@ -349,7 +349,7 @@ vhost_vsock_alloc_skb(struct vhost_virtqreturn NULL ;/* len contains both payload and hdr */ - skb =virtio_vsock_alloc_skb (len,GFP_KERNEL ); + skb =virtio_vsock_alloc_linear_skb (len,GFP_KERNEL );if (!skb)return NULL ;
include/linux/virtio_vsock.h +2 -1
@@ -52,7 +52,8 @@ static inline void virtio_vsock_skb_rx_pskb_put (skb, len); } -static inline struct sk_buff *virtio_vsock_alloc_skb (unsigned int size,gfp_t mask) +static inline struct sk_buff * +virtio_vsock_alloc_linear_skb (unsigned int size,gfp_t mask) {struct sk_buff *skb;
net/vmw_vsock/virtio_transport.c +1 -1
@@ -316,7 +316,7 @@ static void virtio_vsock_rx_fill(struct vq = vsock->vqs[VSOCK_VQ_RX ]; do { - skb = virtio_vsock_alloc_skb(total_len, GFP_KERNEL); + skb = virtio_vsock_alloc_linear_skb(total_len, GFP_KERNEL); if (!skb) break;
net/vmw_vsock/virtio_transport_common.c +1 -1
@@ -263,7 +263,7 @@ static struct sk_buff *virtio_transport_if (!zcopy) skb_len += payload_len; - skb =virtio_vsock_alloc_skb (skb_len,GFP_KERNEL ); + skb =virtio_vsock_alloc_linear_skb (skb_len,GFP_KERNEL );if (!skb)return NULL ;