6.12.69-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 1/87 can: at91_can: Fix memory leak in at91_can_probe()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 0baa4d3170d72a2a8dc93bf729d6d04ad113dc72 ]
In at91_can_probe(), the dev structure is allocated via alloc_candev(). However, if the subsequent call to devm_phy_optional_get() fails, the code jumps directly to exit_iounmap, missing the call to free_candev(). This results in a memory leak of the allocated net_device structure.
Fix this by jumping to the exit_free label instead, which ensures that free_candev() is called to properly release the memory.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/can/at91_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/at91_can.c +1 -1
@@ -1100,7 +1100,7 @@ static int at91_can_probe(struct platform_device *pdev)if (IS_ERR (transceiver)) { err =PTR_ERR (transceiver);dev_err_probe (&pdev->dev, err,"failed to get phy\n" ); - goto exit_iounmap; + goto exit_free; } dev->netdev_ops = &at91_netdev_ops;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/87 ipv6: use the right ifindex when replying to icmpv6 from localhost
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 03cbcdf93866e61beb0063392e6dbb701f03aea2 ]
When replying to a ICMPv6 echo request that comes from localhost address the right output ifindex is 1 (lo) and not rt6i_idev dev index. Use the skb device ifindex instead. This fixes pinging to a local address from localhost source address.
$ ping6 -I ::1 2001:1:1::2 -c 3 PING 2001:1:1::2 (2001:1:1::2) from ::1 : 56 data bytes 64 bytes from 2001:1:1::2: icmp_seq=1 ttl=64 time=0.037 ms 64 bytes from 2001:1:1::2: icmp_seq=2 ttl=64 time=0.069 ms 64 bytes from 2001:1:1::2: icmp_seq=3 ttl=64 time=0.122 ms
2001:1:1::2 ping statistics
3 packets transmitted, 3 received, 0% packet loss, time 2032ms rtt min/avg/max/mdev = 0.037/0.076/0.122/0.035 ms
--- net/ipv6/icmp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/icmp.c +3 -1
@@ -770,7 +770,9 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) fl6.daddr =ipv6_hdr (skb)->saddr;if (saddr) fl6.saddr = *saddr; - fl6.flowi6_oif =icmp6_iif (skb); + fl6.flowi6_oif =ipv6_addr_loopback (&fl6.daddr) ? + skb->dev->ifindex : +icmp6_iif (skb); fl6.fl6_icmp_type = type; fl6.flowi6_mark = mark; fl6.flowi6_uid =sock_net_uid (net,NULL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/87 net: wwan: t7xx: fix potential skb->frags overflow in RX path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6 ]
When receiving data in the DPMAIF RX path,
the t7xx_dpmaif_set_frag_to_skb() function adds
page fragments to an skb without checking if the number of fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and potentially causing kernel crashes or other undefined behavior.
This issue was identified through static code analysis by comparing with a similar vulnerability fixed in the mt76 driver commit b102f0c522cf ("mt76:
fix array overflow on receiving too many fragments for a packet").
The vulnerability could be triggered if the modem firmware sends packets with excessive fragments. While under normal protocol conditions (MTU 3080 bytes, BAT buffer 3584 bytes),
a single packet should not require additional
fragments, the kernel should not blindly trust firmware behavior. Malicious, buggy, or compromised firmware could potentially craft packets with more fragments than the kernel expects.
Fix this by adding a bounds check before calling skb_add_rx_frag() to ensure nr_frags does not exceed MAX_SKB_FRAGS.
The check must be performed before unmapping to avoid a page leak and double DMA unmap during device teardown.
--- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c +7 -2
@@ -394,6 +394,7 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq, struct sk_buff *skb) {unsigned long long data_bus_addr, data_base_addr; +struct skb_shared_info *shinfo =skb_shinfo (skb);struct device *dev = rxq->dpmaif_ctrl->dev;struct dpmaif_bat_page *page_info;unsigned int data_len;
@@ -401,18 +402,22 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq, page_info = rxq->bat_frag->bat_skb; page_info +=t7xx_normal_pit_bid (pkt_info); -dma_unmap_page (dev, page_info->data_bus_addr, page_info->data_len,DMA_FROM_DEVICE );if (!page_info->page)return -EINVAL ; +if (shinfo->nr_frags >=MAX_SKB_FRAGS ) +return -EINVAL ; + +dma_unmap_page (dev, page_info->data_bus_addr, page_info->data_len,DMA_FROM_DEVICE ); + data_bus_addr =le32_to_cpu (pkt_info->pd.data_addr_h); data_bus_addr = (data_bus_addr <<32 ) +le32_to_cpu (pkt_info->pd.data_addr_l); data_base_addr = page_info->data_bus_addr; data_offset = data_bus_addr - data_base_addr; data_offset += page_info->offset; data_len =FIELD_GET (PD_PIT_DATA_LEN ,le32_to_cpu (pkt_info->header)); -skb_add_rx_frag (skb,skb_shinfo (skb)->nr_frags, page_info->page, +skb_add_rx_frag (skb, shinfo->nr_frags, page_info->page, data_offset, data_len, page_info->data_len); page_info->page =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/87 Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Hong Su <[email protected]>
[ Upstream commit 0c3cd7a0b862c37acbee6d9502107146cc944398 ]
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.
The race condition is:
CPU0 CPU1
---- ----
hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
--- drivers/bluetooth/hci_ldisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bluetooth/hci_ldisc.c +2 -2
@@ -685,6 +685,8 @@ static int hci_uart_register_dev(struct hci_uart *hu)return err; } +set_bit (HCI_UART_PROTO_INIT , &hu->flags); +if (test_bit (HCI_UART_INIT_PENDING , &hu->hdev_flags))return 0 ;
@@ -712,8 +714,6 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) hu->proto = p; -set_bit (HCI_UART_PROTO_INIT , &hu->flags); - err =hci_uart_register_dev (hu);if (err) {return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/87 Bluetooth: MGMT: Fix memory leak in set_ssp_complete
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianpeng Chang <[email protected]>
[ Upstream commit 1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2 ]
Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list.
Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit.
This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes.
Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete().
--- net/bluetooth/mgmt.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/mgmt.c +3 -0
@@ -1943,6 +1943,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) }mgmt_cmd_status (cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); +mgmt_pending_free (cmd);return ; }
@@ -1961,6 +1962,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)sock_put (match.sk);hci_update_eir_sync (hdev); +mgmt_pending_free (cmd); }static int set_ssp_sync (struct hci_dev *hdev,void *data)
@@ -6455,6 +6457,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)hci_dev_clear_flag (hdev,HCI_ADVERTISING );settings_rsp (cmd, &match); +mgmt_pending_free (cmd);new_settings (hdev, match.sk);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/87 net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 108948f723b13874b7ebf6b3f1cc598a7de38622 ]
In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails, the function returns directly without releasing the previously created counter, leading to a memory leak.
Fix this by jumping to the out label instead of returning directly, which aligns with the error handling logic of other paths in this function.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +1 -1
@@ -188,7 +188,7 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,if (IS_ERR (vport->ingress.acl)) { err =PTR_ERR (vport->ingress.acl); vport->ingress.acl =NULL ; -return err; + goto out; } err =esw_acl_ingress_lgcy_groups_create (esw, vport);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/87 can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 494fc029f662c331e06b7c2031deff3c64200eed ]
Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback():
unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message.
In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit.
--- drivers/net/can/usb/gs_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/usb/gs_usb.c +2 -2
@@ -607,7 +607,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) {struct gs_usb *parent = urb->context;struct gs_can *dev; -struct net_device *netdev; +struct net_device *netdev =NULL ;int rc;struct net_device_stats *stats;struct gs_host_frame *hf = urb->transfer_buffer;
@@ -765,7 +765,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) } }else if (rc != -ESHUTDOWN &&net_ratelimit ()) {netdev_info (netdev,"failed to re-submit IN URB: %pe\n" , -ERR_PTR (urb->status)); +ERR_PTR (rc)); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/87 net: bcmasp: fix early exit leak with fixed phy
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
[ Upstream commit 6de4436bf369e1444606445e4cd5df5bcfc74b48 ]
We are not deregistering the fixed phy link when hitting the early exit condition. Add the correct early exit sequence.
--- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c +4 -1
@@ -1253,7 +1253,7 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv,netdev_err (intf->ndev,"invalid PHY mode: %s for port %d\n" ,phy_modes (intf->phy_interface), intf->port); ret = -EINVAL ; - goto err_free_netdev; + goto err_deregister_fixed_link; } ret =of_get_ethdev_address (ndev_dn, ndev);
@@ -1276,6 +1276,9 @@ struct bcmasp_intf *bcmasp_interface_create(struct bcmasp_priv *priv,return intf; +err_deregister_fixed_link: +if (of_phy_is_fixed_link (ndev_dn)) +of_phy_deregister_fixed_link (ndev_dn); err_free_netdev:free_netdev (ndev); err:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/87 octeon_ep: Fix memory leak in octep_device_setup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 8016dc5ee19a77678c264f8ba368b1e873fa705b ]
In octep_device_setup(), if octep_ctrl_net_init() fails, the function returns directly without unmapping the mapped resources and freeing the allocated configuration memory.
Fix this by jumping to the unsupported_dev label, which performs the necessary cleanup. This aligns with the error handling logic of other paths in this function.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +1 -1
@@ -1283,7 +1283,7 @@ int octep_device_setup(struct octep_device *oct) ret =octep_ctrl_net_init (oct);if (ret) -return ret; + goto unsupported_dev;INIT_WORK (&oct->tx_timeout_task, octep_tx_timeout_task);INIT_WORK (&oct->ctrl_mbox_task, octep_ctrl_mbox_task);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/87 bonding: annotate data-races around slave->last_rx
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f6c3665b6dc53c3ab7d31b585446a953a74340ef ]
slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.
syzbot reported:
BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
...
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline]
...
value changed: 0x0000000100005365 -> 0x0000000100005366
--- drivers/net/bonding/bond_main.c | 18 ++++++++++-------- drivers/net/bonding/bond_options.c | 8 ++++---- include/net/bonding.h | 13 +++++++------ 3 files changed, 21 insertions(+), 18 deletions(-)
drivers/net/bonding/bond_main.c +10 -8
@@ -3214,8 +3214,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32 __func__, &sip);return ; } - slave->last_rx = jiffies; - slave->target_last_arp_rx[i] = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); +WRITE_ONCE (slave->target_last_arp_rx[i], jiffies); } static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3434,8 +3434,8 @@ static void bond_validate_na(struct bonding *bond, struct slave *slave, __func__, saddr);return ; } - slave->last_rx = jiffies; - slave->target_last_arp_rx[i] = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); +WRITE_ONCE (slave->target_last_arp_rx[i], jiffies); } static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3505,7 +3505,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond, (slave_do_arp_validate_only(bond) && is_ipv6) || #endif !slave_do_arp_validate_only(bond)) - slave->last_rx = jiffies; +WRITE_ONCE (slave->last_rx, jiffies); return RX_HANDLER_ANOTHER; }else if (is_arp) {return bond_arp_rcv (skb, bond, slave);
@@ -3573,7 +3573,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)if (slave->link !=BOND_LINK_UP ) {if (bond_time_in_interval (bond, last_tx,1 ) && -bond_time_in_interval (bond, slave->last_rx,1 )) { +bond_time_in_interval (bond,READ_ONCE (slave->last_rx),1 )) {bond_propose_link_state (slave,BOND_LINK_UP ); slave_state_changed =1 ;
@@ -3597,8 +3597,10 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)* when the source ip is 0, so don't take the link down * if we don't know our ip yet */ -if (!bond_time_in_interval (bond, last_tx, bond->params.missed_max) || - !bond_time_in_interval (bond, slave->last_rx, bond->params.missed_max)) { +if (!bond_time_in_interval (bond, last_tx, + bond->params.missed_max) || + !bond_time_in_interval (bond,READ_ONCE (slave->last_rx), + bond->params.missed_max)) {bond_propose_link_state (slave,BOND_LINK_DOWN ); slave_state_changed =1 ;
drivers/net/bonding/bond_options.c +4 -4
@@ -1124,7 +1124,7 @@ static void _bond_options_arp_ip_target_set(struct bonding *bond, int slot,if (slot >=0 && slot <BOND_MAX_ARP_TARGETS ) {bond_for_each_slave (bond, slave, iter) - slave->target_last_arp_rx[slot] = last_rx; +WRITE_ONCE (slave->target_last_arp_rx[slot], last_rx); targets[slot] = target; } }
@@ -1193,8 +1193,8 @@ static int bond_option_arp_ip_target_rem(struct bonding *bond, __be32 target)bond_for_each_slave (bond, slave, iter) { targets_rx = slave->target_last_arp_rx;for (i = ind; (i <BOND_MAX_ARP_TARGETS -1 ) && targets[i+1 ]; i++) - targets_rx[i] = targets_rx[i+1 ]; - targets_rx[i] =0 ; +WRITE_ONCE (targets_rx[i],READ_ONCE (targets_rx[i+1 ])); +WRITE_ONCE (targets_rx[i],0 ); }for (i = ind; (i <BOND_MAX_ARP_TARGETS -1 ) && targets[i+1 ]; i++) targets[i] = targets[i+1 ];
@@ -1349,7 +1349,7 @@ static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot,if (slot >=0 && slot <BOND_MAX_NS_TARGETS ) {bond_for_each_slave (bond, slave, iter) { - slave->target_last_arp_rx[slot] = last_rx; +WRITE_ONCE (slave->target_last_arp_rx[slot], last_rx);slave_set_ns_maddr (bond, slave, target, &targets[slot]); } targets[slot] = *target;
include/net/bonding.h +7 -6
@@ -519,13 +519,14 @@ static inline int bond_is_ip6_target_ok(struct in6_addr *addr)static inline unsigned long slave_oldest_target_arp_rx (struct bonding *bond,struct slave *slave) { +unsigned long tmp, ret =READ_ONCE (slave->target_last_arp_rx[0 ]);int i =1 ; -unsigned long ret = slave->target_last_arp_rx[0 ]; - -for (; (i <BOND_MAX_ARP_TARGETS ) && bond->params.arp_targets[i]; i++) -if (time_before (slave->target_last_arp_rx[i], ret)) - ret = slave->target_last_arp_rx[i]; +for (; (i <BOND_MAX_ARP_TARGETS ) && bond->params.arp_targets[i]; i++) { + tmp =READ_ONCE (slave->target_last_arp_rx[i]); +if (time_before (tmp, ret)) + ret = tmp; + }return ret; }
@@ -535,7 +536,7 @@ static inline unsigned long slave_last_rx(struct bonding *bond,if (bond->params.arp_all_targets ==BOND_ARP_TARGETS_ALL )return slave_oldest_target_arp_rx (bond, slave); -return slave->last_rx; +return READ_ONCE (slave->last_rx); }static inline void slave_update_last_tx (struct slave *slave)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/87 net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 09f979d1f312627b31d2ee1e46f9692e442610cd ]
In mvpp2_ethtool_cls_rule_ins(), the ethtool_rule is allocated by ethtool_rx_flow_rule_create(). If the subsequent conversion to flow type fails, the function jumps to the clean_rule label.
However, the clean_rule label only frees efs, skipping the cleanup of ethtool_rule, which leads to a memory leak.
Fix this by jumping to the clean_eth_rule label, which properly calls ethtool_rx_flow_rule_destroy() before freeing efs.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c +1 -1
@@ -1389,7 +1389,7 @@ int mvpp2_ethtool_cls_rule_ins(struct mvpp2_port *port, efs->rule.flow_type =mvpp2_cls_ethtool_flow_to_type (info->fs.flow_type);if (efs->rule.flow_type <0 ) { ret = efs->rule.flow_type; - goto clean_rule; + goto clean_eth_rule; } ret =mvpp2_cls_rfs_parse_rule (&efs->rule);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainercover 6.12.69-rc1 review
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.69-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.12.69-rc1
Alexis Lothoré (eBPF Foundation) <[email protected]>
bpf/selftests: test_select_reuseport_kern: Remove unused header
Long Li <[email protected]>
RDMA/mana_ib: Handle net event for pointing to the current netdev
Long Li <[email protected]>
net: mana: Change the function signature of mana_get_primary_netdev_rcu
Bartosz Golaszewski <[email protected]>
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: adjust KGQ reset sequence
Laveesh Bansal <[email protected]>
writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
Steven Rostedt <[email protected]>
perf: sched: Fix perf crash with new is_user_task() helper
Josh Poimboeuf <[email protected]>
perf: Simplify get_perf_callchain() user logic
Matthieu Baerts (NGI0) <[email protected]>
mptcp: avoid dup SUB_CLOSED events after disconnect
Krzysztof Kozlowski <[email protected]>
pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
Chen Ni <[email protected]>
net/sched: act_ife: convert comma to semicolon
JP Kobryn <[email protected]>
btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate()
John Ogness <[email protected]>
Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
Kang Yang <[email protected]>
wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
Pimyn Girgis <[email protected]>
mm/kfence: randomize the freelist on initialization
Mikhail Gavrilov <[email protected]>
libbpf: Fix -Wdiscarded-qualifiers under C23
Thomas Fourier <[email protected]>
ksmbd: smbd: fix dma_unmap_sg() nents
David Howells <[email protected]>
rxrpc: Fix data-race warning and potential load/store tearing
T.J. Mercier <[email protected]>
cgroup: Fix kernfs_node UAF in css_free_rwork_fn
Miguel Ojeda <[email protected]>
rust: kbuild: support -Cjump-tables=n for Rust 1.93.0
Andy Shevchenko <[email protected]>
gpiolib: acpi: Fix potential out-of-boundary left shift
Alex Deucher <[email protected]>
drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
Jon Doron <[email protected]>
drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/gfx10: fix wptr reset in KGQ init
Alex Deucher <[email protected]>
drm/amdgpu/soc21: fix xclk for APUs
Johan Hovold <[email protected]>
drm/imx/tve: fix probe device leak
Johan Hovold <[email protected]>
drm/msm/a6xx: fix bogus hwcg register updates
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer: compile sysroot with correct edition
Onur Özkan <[email protected]>
scripts: generate_rust_analyzer: remove sysroot assertion
Jibin Zhang <[email protected]>
net: fix segmentation of forwarding fraglist GRO
Kairui Song <[email protected]>
mm/shmem, swap: fix race of truncate and swap entry split
Jane Chu <[email protected]>
mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn
Jane Chu <[email protected]>
mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
Jan Kara <[email protected]>
flex_proportions: make fprop_new_period() hardirq safe
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: fix local endp not being tracked
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check subflow errors in close events
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: check no dup close events after error
Matthieu Baerts (NGI0) <[email protected]>
mptcp: only reset subflow errors when propagated
Andrey Ryabinin <[email protected]>
mm/kasan: fix KASAN poisoning in vrealloc()
Robin Murphy <[email protected]>
gpio: rockchip: Stop calling pinctrl for set_direction
Ming Lei <[email protected]>
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
Kohei Enju <[email protected]>
efivarfs: fix error propagation in efivar_entry_get()
Thomas Fourier <[email protected]>
scsi: qla2xxx: edif: Fix dma_free_coherent() size
Martin Larsson <[email protected]>
gpio: pca953x: mask interrupts in irq shutdown
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
Haoxiang Li <[email protected]>
scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
Fabio Estevam <[email protected]>
ASoC: fsl: imx-card: Do not force slot width to sample width
Miguel Ojeda <[email protected]>
rust: kbuild: give --config-path to rustfmt in .rsi target
Hang Shu <[email protected]>
rust: rbtree: fix documentation typo in CursorMut peek_next method
Han Gao <[email protected]>
riscv: compat: fix COMPAT_UTS_MACHINE definition
Bartosz Golaszewski <[email protected]>
pinctrl: meson: mark the GPIO controller as sleeping
Peter Zijlstra <[email protected]>
sched/deadline: Fix 'stuck' dl_server
Peter Zijlstra <[email protected]>
sched/deadline: Document dl_server
Sai Sree Kartheek Adivi <[email protected]>
dma/pool: distinguish between missing and exhausted atomic pools
Shida Zhang <[email protected]>
bcache: fix I/O accounting leak in detached_dev_do_request
Shida Zhang <[email protected]>
bcache: use bio cloning for detached device requests
Shida Zhang <[email protected]>
bcache: fix improper use of bi_end_io
Yuhao Huang <[email protected]>
gpio: virtuser: fix UAF in configfs release path
Denis Sergeev <[email protected]>
gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
Tagir Garaev <[email protected]>
ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
Kery Qi <[email protected]>
scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
Jianbo Liu <[email protected]>
net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
Parav Pandit <[email protected]>
net/mlx5: Fix vhca_id access call trace use before alloc
Cosmin Ratiu <[email protected]>
net/mlx5: Initialize events outside devlink lock
Shay Drory <[email protected]>
net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
Wei Fang <[email protected]>
net: phy: micrel: fix clk warning when removing the driver
Martin Kaiser <[email protected]>
net: bridge: fix static key check
Kuniyuki Iwashima <[email protected]>
nfc: nci: Fix race between rfkill and nci_unregister_device().
Mark Bloch <[email protected]>
net/mlx5e: TC, delete flows only for existing peers
Jesse Brandeburg <[email protected]>
ice: stop counting UDP csum mismatch as rx_errors
Aaron Ma <[email protected]>
ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
Kuniyuki Iwashima <[email protected]>
nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Kery Qi <[email protected]>
rocker: fix memory leak in rocker_world_port_post_fini()
Kery Qi <[email protected]>
net: wwan: t7xx: fix potential skb->frags overflow in RX path
Fernando Fernandez Mancera <[email protected]>
ipv6: use the right ifindex when replying to icmpv6 from localhost
Zilin Guan <[email protected]>
net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
Eric Dumazet <[email protected]>
bonding: annotate data-races around slave->last_rx
Zilin Guan <[email protected]>
octeon_ep: Fix memory leak in octep_device_setup()
Justin Chen <[email protected]>
net: bcmasp: fix early exit leak with fixed phy
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
Zilin Guan <[email protected]>
net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
Jianpeng Chang <[email protected]>
Bluetooth: MGMT: Fix memory leak in set_ssp_complete
Jia-Hong Su <[email protected]>
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
Zilin Guan <[email protected]>
can: at91_can: Fix memory leak in at91_can_probe()
-------------
Diffstat:
Makefile | 4 +- arch/arm64/configs/defconfig | 1 - arch/riscv/include/asm/compat.h | 2 +- arch/x86/Makefile | 2 +- drivers/bluetooth/hci_ldisc.c | 4 +- drivers/gpio/gpio-pca953x.c | 2 + drivers/gpio/gpio-rockchip.c | 8 - drivers/gpio/gpio-virtuser.c | 8 +- drivers/gpio/gpiolib-acpi-core.c | 21 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 47 ++--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +- drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 ++ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 - drivers/gpu/drm/nouveau/nouveau_display.c | 2 - drivers/infiniband/hw/mana/device.c | 54 +++++- drivers/infiniband/hw/mana/mana_ib.h | 2 + drivers/md/bcache/bcache.h | 9 + drivers/md/bcache/request.c | 82 ++++---- drivers/md/bcache/super.c | 12 +- drivers/net/bonding/bond_main.c | 18 +- drivers/net/bonding/bond_options.c | 8 +- drivers/net/can/at91_can.c | 2 +- drivers/net/can/usb/gs_usb.c | 4 +- drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 5 +- drivers/net/ethernet/intel/ice/ice_lib.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 1 - drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 16 ++ .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +- .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 36 ++-- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 22 ++- drivers/net/ethernet/rocker/rocker_main.c | 5 +- drivers/net/phy/micrel.c | 17 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +- drivers/nvme/target/io-cmd-bdev.c | 3 +- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 9 +- drivers/pinctrl/qcom/Kconfig | 15 +- drivers/pinctrl/qcom/Makefile | 1 - drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 ++ drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c | 3 + drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c | 151 --------------- drivers/scsi/be2iscsi/be_mgmt.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 2 +- drivers/target/sbp/sbp_target.c | 4 +- fs/btrfs/relocation.c | 14 ++ fs/efivarfs/vars.c | 2 +- fs/fs-writeback.c | 14 +- fs/smb/server/transport_rdma.c | 15 +- include/linux/kasan.h | 14 ++ include/linux/sched.h | 5 + include/net/bonding.h | 13 +- include/net/mana/mana.h | 4 +- include/net/nfc/nfc.h | 2 + kernel/cgroup/cgroup.c | 2 +- kernel/dma/pool.c | 7 +- kernel/events/callchain.c | 20 +- kernel/events/core.c | 6 +- kernel/sched/deadline.c | 206 +++++++++++++++++++++ lib/flex_proportions.c | 5 +- mm/kasan/common.c | 21 +++ mm/kfence/core.c | 23 ++- mm/memory-failure.c | 99 ++++++---- mm/shmem.c | 45 +++-- mm/vmalloc.c | 7 +- net/bluetooth/mgmt.c | 3 + net/bridge/br_input.c | 2 +- net/core/filter.c | 2 + net/ipv4/tcp_offload.c | 3 +- net/ipv4/udp_offload.c | 3 +- net/ipv6/icmp.c | 4 +- net/ipv6/tcpv6_offload.c | 3 +- net/mptcp/protocol.c | 13 +- net/nfc/core.c | 27 ++- net/nfc/llcp_commands.c | 17 +- net/nfc/llcp_core.c | 4 +- net/nfc/nci/core.c | 4 +- net/rxrpc/ar-internal.h | 9 +- net/rxrpc/conn_event.c | 2 +- net/rxrpc/output.c | 10 +- net/rxrpc/peer_event.c | 17 +- net/rxrpc/proc.c | 4 +- net/rxrpc/rxkad.c | 4 +- net/sched/act_ife.c | 6 +- rust/kernel/rbtree.rs | 2 +- scripts/Makefile.build | 2 +- scripts/generate_rust_analyzer.py | 34 +++- sound/soc/amd/yc/acp6x-mach.c | 8 + sound/soc/fsl/imx-card.c | 1 - sound/soc/intel/boards/sof_es8336.c | 2 +- tools/lib/bpf/libbpf.c | 4 +- .../bpf/progs/test_select_reuseport_kern.c | 1 - tools/testing/selftests/net/mptcp/mptcp_join.sh | 81 +++++++- 104 files changed, 1001 insertions(+), 498 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 13/87 nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 165c34fb6068ff153e3fc99a932a80a9d5755709 ]
syzbot reported various memory leaks related to NFC, struct nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
The leading log hinted that nfc_llcp_send_ui_frame() failed to allocate skb due to sock_error(sk) being -ENXIO.
ENXIO is set by nfc_llcp_socket_release() when struct nfc_llcp_local is destroyed by local_cleanup().
The problem is that there is no synchronisation between nfc_llcp_send_ui_frame() and local_cleanup(), and skb could be put into local->tx_queue after it was purged in local_cleanup():
CPU1 CPU2
---- ----
nfc_llcp_send_ui_frame() local_cleanup()
|- do { '
|- pdu = nfc_alloc_send_skb(..., &err)
| .
| |- nfc_llcp_socket_release(local, false, ENXIO);
| |- skb_queue_purge(&local->tx_queue); |
| ' |
|- skb_queue_tail(&local->tx_queue, pdu); | ... |
|- pdu = nfc_alloc_send_skb(..., &err) |
^._________________________________.'
local_cleanup() is called for struct nfc_llcp_local only after nfc_llcp_remove_local() unlinks it from llcp_devices.
If we hold local->tx_queue.lock then, we can synchronise the thread and nfc_llcp_send_ui_frame().
Let's do that and check list_empty(&local->list) before queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().
[0]:
[ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6)
[ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
BUG: memory leak
unreferenced object 0xffff8881272f6800 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942766
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc da58d84d):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__do_kmalloc_node mm/slub.c:5645 [inline]
__kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
kmalloc_noprof include/linux/slab.h:961 [inline]
sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239
sk_alloc+0x36/0x360 net/core/sock.c:2295
nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
__sock_create+0x1a9/0x340 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xb9/0x1a0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x1b/0x30 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810fbd9800 (size 240):
comm "syz.0.17", pid 6096, jiffies 4294942850
hex dump (first 32 bytes):
68 f0 ff 08 81 88 ff ff 68 f0 ff 08 81 88 ff ff h.......h.......
00 00 00 00 00 00 00 00 00 68 2f 27 81 88 ff ff .........h/'....
backtrace (crc 6cc652b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5336
__alloc_skb+0x203/0x240 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
sock_alloc_send_skb include/net/sock.h:1859 [inline]
nfc_alloc_send_skb+0x45/0x80 net/nfc/core.c:724
nfc_llcp_send_ui_frame+0x162/0x360 net/nfc/llcp_commands.c:766
llcp_sock_sendmsg+0x14c/0x1d0 net/nfc/llcp_sock.c:814
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x2d8/0x2f0 net/socket.c:2244
__do_sys_sendto net/socket.c:2251 [inline]
__se_sys_sendto net/socket.c:2247 [inline]
__x64_sys_sendto+0x28/0x30 net/socket.c:2247
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/nfc/llcp_commands.c | 17 ++++++++++++++++- net/nfc/llcp_core.c | 4 +++- 2 files changed, 19 insertions(+), 2 deletions(-)
net/nfc/llcp_commands.c +16 -1
@@ -778,8 +778,23 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,if (likely (frag_len >0 ))skb_put_data (pdu, msg_ptr, frag_len); +spin_lock (&local->tx_queue.lock); + +if (list_empty (&local->list)) { +spin_unlock (&local->tx_queue.lock); + +kfree_skb (pdu); + + len -= remaining_len; +if (len ==0 ) + len = -ENXIO ; +break ; + } +/* No need to check for the peer RW for UI frames */ -skb_queue_tail (&local->tx_queue, pdu); +__skb_queue_tail (&local->tx_queue, pdu); + +spin_unlock (&local->tx_queue.lock); remaining_len -= frag_len; msg_ptr += frag_len;
net/nfc/llcp_core.c +3 -1
@@ -314,7 +314,9 @@ static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)spin_lock (&llcp_devices_lock);list_for_each_entry_safe (local, tmp, &llcp_devices, list)if (local->dev == dev) { -list_del (&local->list); +spin_lock (&local->tx_queue.lock); +list_del_init (&local->list); +spin_unlock (&local->tx_queue.lock);spin_unlock (&llcp_devices_lock);return local; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/87 net/mlx5: Fix vhca_id access call trace use before alloc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
[ Upstream commit a8f930b7be7be3f18f14446df461e17137400407 ]
HCA CAP structure is allocated in mlx5_hca_caps_alloc(). mlx5_mdev_init()
mlx5_hca_caps_alloc()
And HCA CAP is read from the device in mlx5_init_one().
The vhca_id's debugfs file is published even before above two operations are done.
Due to this when user reads the vhca id before the initialization, following call trace is observed.
Fix this by deferring debugfs publication until the HCA CAP is allocated and read from the device.
BUG: kernel NULL pointer dereference, address: 0000000000000004 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 23 UID: 0 PID: 6605 Comm: cat Kdump: loaded Not tainted 6.18.0-rc7-sf+ #110 PREEMPT(full) Hardware name: Supermicro SYS-6028U-TR4+/X10DRU-i+, BIOS 2.0b 08/09/2016 RIP: 0010:vhca_id_show+0x17/0x30 [mlx5_core] Code: cb 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 70 48 c7 c6 45 f0 12 c1 48 8b 80 70 03 00 00 <8b> 50 04 0f ca 0f b7 d2 e8 8c 82 47 cb 31 c0 c3 cc cc cc cc 0f 1f RSP: 0018:ffffd37f4f337d40 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8f18445c9b40 RCX: 0000000000000001 RDX: ffff8f1109825180 RSI: ffffffffc112f045 RDI: ffff8f18445c9b40 RBP: 0000000000000000 R08: 0000645eac0d2928 R09: 0000000000000006 R10: ffffd37f4f337d48 R11: 0000000000000000 R12: ffffd37f4f337dd8 R13: ffffd37f4f337db0 R14: ffff8f18445c9b68 R15: 0000000000000001 FS: 00007f3eea099580(0000) GS:ffff8f2090f1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000004 CR3: 00000008b64e4006 CR4: 00000000003726f0 Call Trace: <TASK> seq_read_iter+0x11f/0x4f0 ? _raw_spin_unlock+0x15/0x30 ? do_anonymous_page+0x104/0x810 seq_read+0xf6/0x120 ? srso_alias_untrain_ret+0x1/0x10 full_proxy_read+0x5c/0x90 vfs_read+0xad/0x320 ? handle_mm_fault+0x1ab/0x290 ksys_read+0x52/0xd0 do_syscall_64+0x61/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- .../net/ethernet/mellanox/mlx5/core/debugfs.c | 16 ++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 +++----------- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + 4 files changed, 21 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/debugfs.c +16 -0
@@ -613,3 +613,19 @@ void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq) cq->dbg =NULL ; } } + +static int vhca_id_show (struct seq_file *file,void *priv) +{ +struct mlx5_core_dev *dev = file->private; + +seq_printf (file,"0x%x\n" ,MLX5_CAP_GEN (dev, vhca_id)); +return 0 ; +} + +DEFINE_SHOW_ATTRIBUTE (vhca_id); + +void mlx5_vhca_debugfs_init (struct mlx5_core_dev *dev) +{ +debugfs_create_file ("vhca_id" ,0400 , dev->priv.dbg.dbg_root, dev, + &vhca_id_fops); +}
drivers/net/ethernet/mellanox/mlx5/core/main.c +3 -11
@@ -1810,16 +1810,6 @@ static int mlx5_hca_caps_alloc(struct mlx5_core_dev *dev)return -ENOMEM ; } -static int vhca_id_show (struct seq_file *file,void *priv) -{ -struct mlx5_core_dev *dev = file->private; - -seq_printf (file,"0x%x\n" ,MLX5_CAP_GEN (dev, vhca_id)); -return 0 ; -} - -DEFINE_SHOW_ATTRIBUTE (vhca_id); -static int mlx5_notifiers_init (struct mlx5_core_dev *dev) {int err;
@@ -1862,7 +1852,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) priv->numa_node =dev_to_node (mlx5_core_dma_dev (dev)); priv->dbg.dbg_root =debugfs_create_dir (dev_name (dev->device), mlx5_debugfs_root); -debugfs_create_file ("vhca_id" ,0400 , priv->dbg.dbg_root, dev, &vhca_id_fops); +INIT_LIST_HEAD (&priv->traps); err =mlx5_cmd_init (dev);
@@ -2000,6 +1990,8 @@ static int probe_one(struct pci_dev *pdev, const struct pci_device_id *id) goto err_init_one; } +mlx5_vhca_debugfs_init (dev); +pci_save_state (pdev);return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +1 -0
@@ -251,6 +251,7 @@ int mlx5_wait_for_pages(struct mlx5_core_dev *dev, int *pages);void mlx5_cmd_flush (struct mlx5_core_dev *dev);void mlx5_cq_debugfs_init (struct mlx5_core_dev *dev);void mlx5_cq_debugfs_cleanup (struct mlx5_core_dev *dev); +void mlx5_vhca_debugfs_init (struct mlx5_core_dev *dev);int mlx5_query_pcam_reg (struct mlx5_core_dev *dev,u32 *pcam,u8 feature_group,u8 access_reg_group);
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +1 -0
@@ -76,6 +76,7 @@ static int mlx5_sf_dev_probe(struct auxiliary_device *adev, const struct auxilia goto init_one_err; } +mlx5_vhca_debugfs_init (mdev);return 0 ; init_one_err:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/87 net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <[email protected]>
[ Upstream commit 011be342dd24b5168a5dcf408b14c3babe503341 ]
Commit a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size") introduced logic to setup the ESN replay window size. This logic is only valid for packet offload.
However, the check to skip this block only covered outbound offloads. It was not skipped for crypto offload, causing it to fall through to the new switch statement and trigger its WARN_ON default case (for instance, if a window larger than 256 bits was configured).
Fix this by amending the condition to also skip the replay window setup if the offload type is not XFRM_DEV_OFFLOAD_PACKET.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +2 -1
@@ -347,7 +347,8 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, attrs->replay_esn.esn = sa_entry->esn_state.esn; attrs->replay_esn.esn_msb = sa_entry->esn_state.esn_msb; attrs->replay_esn.overlap = sa_entry->esn_state.overlap; -if (attrs->dir ==XFRM_DEV_OFFLOAD_OUT ) +if (attrs->dir ==XFRM_DEV_OFFLOAD_OUT || + x->xso.type !=XFRM_DEV_OFFLOAD_PACKET ) goto skip_replay_window;switch (x->replay_esn->replay_window) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/87 scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit b2d6b1d443009ed4da2d69f5423ab38e5780505a ]
The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of "tpg->tport_tpgt" is u16. This causes a type truncation issue.
When a user creates a TPG via configfs mkdir, for example:
mkdir /sys/kernel/config/target/sbp/<wwn>/tpgt_70000
The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt, the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the value the user specified to differ from what is actually stored, leading to confusion and potential unexpected behavior.
Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which will properly reject values outside the u16 range.
--- drivers/target/sbp/sbp_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/sbp/sbp_target.c +2 -2
@@ -1961,12 +1961,12 @@ static struct se_portal_group *sbp_make_tpg(struct se_wwn *wwn, container_of(wwn, struct sbp_tport, tport_wwn);struct sbp_tpg *tpg; -unsigned long tpgt; +u16 tpgt;int ret;if (strstr (name,"tpgt_" ) != name)return ERR_PTR (-EINVAL ); -if (kstrtoul (name +5 ,10 , &tpgt) || tpgt >UINT_MAX ) +if (kstrtou16 (name +5 ,10 , &tpgt))return ERR_PTR (-EINVAL );if (tport->tpg) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/87 ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tagir Garaev <[email protected]>
[ Upstream commit 213c4e51267fd825cd21a08a055450cac7e0b7fb ]
The headphone GPIO should be set to the inverse of speaker_en. When speakers are enabled, headphones should be disabled and vice versa.
Currently both GPIOs are set to the same value (speaker_en), causing audio to play through both speakers and headphones simultaneously when headphones are plugged in.
Tested on Huawei Matebook (BOD-WXX9) with ES8336 codec.
--- sound/soc/intel/boards/sof_es8336.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/boards/sof_es8336.c +1 -1
@@ -120,7 +120,7 @@ static void pcm_pop_work_events(struct work_struct *work)gpiod_set_value_cansleep (priv->gpio_speakers, priv->speaker_en);if (quirk &SOF_ES8336_HEADPHONE_GPIO ) -gpiod_set_value_cansleep (priv->gpio_headphone, priv->speaker_en); +gpiod_set_value_cansleep (priv->gpio_headphone, !priv->speaker_en); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/87 gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Sergeev <[email protected]>
[ Upstream commit c0ae43d303e45764918fa8c1dc13d6a5db59c479 ]
The BIT() macro uses unsigned long, which is 32 bits on 32-bit architectures. When iterating over GPIO pins with index >= 32, the expression (*value & BIT(i)) causes undefined behavior due to shifting by a value >= type width.
Since 'value' is a pointer to u64, use BIT_ULL() to ensure correct 64-bit mask on all architectures.
Found by Linux Verification Center (linuxtesting.org) with Svace.
--- drivers/gpio/gpiolib-acpi-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpiolib-acpi-core.c +1 -1
@@ -1149,7 +1149,7 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,mutex_unlock (&achip->conn_lock);if (function ==ACPI_WRITE ) -gpiod_set_raw_value_cansleep (desc, !!(*value &BIT (i))); +gpiod_set_raw_value_cansleep (desc, !!(*value &BIT_ULL (i)));else *value |= (u64 )gpiod_get_raw_value_cansleep (desc) << i; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/87 gpio: virtuser: fix UAF in configfs release path
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Huang <[email protected]>
[ Upstream commit 53ad4a948a4586359b841d607c08fb16c5503230 ]
The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory.
Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free.
Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called.
--- drivers/gpio/gpio-virtuser.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpio/gpio-virtuser.c +4 -4
@@ -1738,10 +1738,10 @@ static void gpio_virtuser_device_config_group_release(struct config_item *item) {struct gpio_virtuser_device *dev =to_gpio_virtuser_device (item); -guard (mutex)(&dev->lock); - -if (gpio_virtuser_device_is_live (dev)) -gpio_virtuser_device_deactivate (dev); + scoped_guard(mutex, &dev->lock) { +if (gpio_virtuser_device_is_live (dev)) +gpio_virtuser_device_deactivate (dev); + }mutex_destroy (&dev->lock);ida_free (&gpio_virtuser_ida, dev->id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/87 bcache: fix improper use of bi_end_io
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
Don't call bio->bi_end_io() directly. Use the bio_endio() helper function instead, which handles completion more safely and uniformly.
Stable-dep-of: 4da7c5c3ec34 ("bcache: fix I/O accounting leak in detached_dev_do_request")
--- drivers/md/bcache/request.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/md/bcache/request.c +3 -3
@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio) }kfree (ddip); - bio->bi_end_io (bio); +bio_endio (bio); } static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio, ddip =kzalloc (sizeof (struct detached_dev_io_private ),GFP_NOIO );if (!ddip) { bio->bi_status =BLK_STS_RESOURCE ; - bio->bi_end_io (bio); +bio_endio (bio);return ; }
@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,if ((bio_op (bio) ==REQ_OP_DISCARD ) && !bdev_max_discard_sectors (dc->bdev)) - bio->bi_end_io (bio); +detached_dev_end_io (bio);else submit_bio_noacct (bio); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/87 bcache: use bio cloning for detached device requests
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 3ef825dfd4e487d6f92b23ee2df2455814583ef4 ]
Previously, bcache hijacked the bi_end_io and bi_private fields of the incoming bio when the backing device was in a detached state. This is fragile and breaks if the bio is needed to be processed by other layers.
This patch transitions to using a cloned bio embedded within a private structure. This ensures the original bio's metadata remains untouched.
Stable-dep-of: 4da7c5c3ec34 ("bcache: fix I/O accounting leak in detached_dev_do_request")
--- drivers/md/bcache/bcache.h | 9 +++++ drivers/md/bcache/request.c | 79 ++++++++++++++++--------------------- drivers/md/bcache/super.c | 12 +++++- 3 files changed, 54 insertions(+), 46 deletions(-)
drivers/md/bcache/bcache.h +9 -0
@@ -273,6 +273,8 @@ struct bcache_device {struct bio_set bio_split; +struct bio_set bio_detached; + unsigned int data_csum:1; int (*cache_miss)(struct btree *b, struct search *s,
@@ -755,6 +757,13 @@ struct bbio {struct bio bio; }; +struct detached_dev_io_private { +struct bcache_device *d; +unsigned long start_time; +struct bio *orig_bio; +struct bio bio; +}; +#define BTREE_PRIO USHRT_MAX#define INITIAL_PRIO 32768U
drivers/md/bcache/request.c +35 -44
122 lines not on this page · raw message
drivers/md/bcache/super.c +10 -2
@@ -887,6 +887,7 @@ static void bcache_device_free(struct bcache_device *d) }bioset_exit (&d->bio_split); +bioset_exit (&d->bio_detached);kvfree (d->full_dirty_stripes);kvfree (d->stripe_sectors_dirty);
@@ -949,6 +950,11 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER)) goto out_ida_remove; +if (bioset_init (&d->bio_detached,4 , + offsetof(struct detached_dev_io_private , bio), +BIOSET_NEED_BVECS |BIOSET_NEED_RESCUER )) + goto out_bioset_split_exit; +if (lim.logical_block_size >PAGE_SIZE && cached_bdev) {/* * This should only happen with BCACHE_SB_VERSION_BDEV.
@@ -964,7 +970,7 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, d->disk =blk_alloc_disk (&lim,NUMA_NO_NODE );if (IS_ERR (d->disk)) - goto out_bioset_exit; + goto out_bioset_detach_exit;set_capacity (d->disk, sectors);snprintf (d->disk->disk_name,DISK_NAME_LEN ,"bcache%i" , idx);
@@ -976,7 +982,9 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, d->disk->private_data = d;return 0 ; -out_bioset_exit: +out_bioset_detach_exit: +bioset_exit (&d->bio_detached); +out_bioset_split_exit:bioset_exit (&d->bio_split); out_ida_remove:ida_free (&bcache_device_idx, idx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/87 bcache: fix I/O accounting leak in detached_dev_do_request
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f ]
When a bcache device is detached, discard requests are completed immediately. However, the I/O accounting started in cached_dev_make_request() is not ended, leading to 100% disk utilization reports in iostat. Add the missing bio_end_io_acct() call.
--- drivers/md/bcache/request.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/bcache/request.c +1 -0
@@ -1107,6 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d,if (bio_op (orig_bio) ==REQ_OP_DISCARD && !bdev_max_discard_sectors (dc->bdev)) { +bio_end_io_acct (orig_bio, start_time);bio_endio (orig_bio);return ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/87 dma/pool: distinguish between missing and exhausted atomic pools
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sai Sree Kartheek Adivi <[email protected]>
[ Upstream commit 56c430c7f06d838fe3b2077dbbc4cc0bf992312b ]
Currently, dma_alloc_from_pool() unconditionally warns and dumps a stack trace when an allocation fails, with the message "Failed to get suitable pool".
This conflates two distinct failure modes:
1. Configuration error: No atomic pool is available for the requested DMA mask (a fundamental system setup issue)
2. Resource Exhaustion: A suitable pool exists but is currently full (a recoverable runtime state)
This lack of distinction prevents drivers from using __GFP_NOWARN to suppress error messages during temporary pressure spikes, such as when awaiting synchronous reclaim of descriptors.
Refactor the error handling to distinguish these cases:
- If no suitable pool is found, keep the unconditional WARN regarding the missing pool.
- If a pool was found but is exhausted, respect __GFP_NOWARN and update the warning message to explicitly state "DMA pool exhausted".
--- kernel/dma/pool.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/dma/pool.c +6 -1
@@ -268,15 +268,20 @@ struct page *dma_alloc_from_pool(struct device *dev, size_t size, {struct gen_pool *pool =NULL ;struct page *page; +bool pool_found = false;while ((pool =dma_guess_pool (pool, gfp))) { + pool_found = true; page =__dma_alloc_from_pool (dev, size, pool, cpu_addr, phys_addr_ok);if (page)return page; } -WARN (1 ,"Failed to get suitable pool for %s\n" ,dev_name (dev)); +if (pool_found) +WARN (!(gfp & __GFP_NOWARN),"DMA pool exhausted for %s\n" ,dev_name (dev)); +else +WARN (1 ,"Failed to get suitable pool for %s\n" ,dev_name (dev));return NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/87 ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
[ Upstream commit 9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85 ]
Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL.
Tested adaptor:
60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02)
Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]
SR-IOV state: both disabled and enabled can reproduce this issue.
kernel version: v6.18
Reproduce steps:
Boot up and execute suspend like systemctl suspend or rtcwake.
Log:
<1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 <4>[ 231.451629] PKRU: 55555554 <4>[ 231.452076] Call Trace: <4>[ 231.452549] <TASK> <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.454425] pci_pm_resume+0x8c/0x140 <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.455347] dpm_run_callback+0x5f/0x160 <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 <4>[ 231.456244] device_resume+0x177/0x270 <4>[ 231.456708] dpm_resume+0x209/0x2f0 <4>[ 231.457151] dpm_resume_end+0x15/0x30 <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 <4>[ 231.458054] enter_state+0x10e/0x570
Add defensive checks for both the ring pointer and its q_vector before dereferencing, allowing the system to resume successfully even when q_vectors are unmapped.
--- drivers/net/ethernet/intel/ice/ice_lib.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +6 -4
@@ -2731,12 +2731,14 @@ void ice_vsi_set_napi_queues(struct ice_vsi *vsi)return ;ice_for_each_rxq (vsi, q_idx) -netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_RX , - &vsi->rx_rings[q_idx]->q_vector->napi); +if (vsi->rx_rings[q_idx] && vsi->rx_rings[q_idx]->q_vector) +netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_RX , + &vsi->rx_rings[q_idx]->q_vector->napi);ice_for_each_txq (vsi, q_idx) -netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_TX , - &vsi->tx_rings[q_idx]->q_vector->napi); +if (vsi->tx_rings[q_idx] && vsi->tx_rings[q_idx]->q_vector) +netif_queue_set_napi (netdev, q_idx,NETDEV_QUEUE_TYPE_TX , + &vsi->tx_rings[q_idx]->q_vector->napi);/* Also set the interrupt number for the NAPI */ ice_for_each_q_vector (vsi, v_idx) {struct ice_q_vector *q_vector = vsi->q_vectors[v_idx];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/87 sched/deadline: Document dl_server
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 2614069c5912e9d6f1f57c262face1b368fb8c93 ]
Place the notes that resulted from going through the dl_server code in a comment.
Stable-dep-of: 115135422562 ("sched/deadline: Fix 'stuck' dl_server")
--- kernel/sched/deadline.c | 194 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 194 insertions(+)
kernel/sched/deadline.c +194 -0
@@ -1624,6 +1624,200 @@ void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec)update_curr_dl_se (dl_se->rq, dl_se, delta_exec); } +/* +* dl_server && dl_defer: +* +* 6 +* +--------------------+ +* v | +* +-------------+ 4 +-----------+ 5 +------------------+ +* +-> | A:init | <--- | D:running | -----> | E:replenish-wait | +* | +-------------+ +-----------+ +------------------+ +* | | | 1 ^ ^ | +* | | 1 +----------+ | 3 | +* | v | | +* | +--------------------------------+ 2 | +* | | | ----+ | +* | 8 | B:zero_laxity-wait | | | +* | | | <---+ | +* | +--------------------------------+ | +* | | ^ ^ 2 | +* | | 7 | 2 +--------------------+ +* | v | +* | +-------------+ | +* +-- | C:idle-wait | -+ +* +-------------+ +* ^ 7 | +* +---------+ +* +* +* [A] - init +* dl_server_active = 0 +* dl_throttled = 0 +* dl_defer_armed = 0 +* dl_defer_running = 0/1 +* dl_defer_idle = 0 +* +* [B] - zero_laxity-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 1 +* dl_defer_running = 0 +* dl_defer_idle = 0 +* +* [C] - idle-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 1 +* dl_defer_running = 0 +* dl_defer_idle = 1 +* +* [D] - running +* dl_server_active = 1 +* dl_throttled = 0 +* dl_defer_armed = 0 +* dl_defer_running = 1 +* dl_defer_idle = 0 +* +* [E] - replenish-wait +* dl_server_active = 1 +* dl_throttled = 1 +* dl_defer_armed = 0 +* dl_defer_running = 1 +* dl_defer_idle = 0 +* +* +* [1] A->B, A->D +* dl_server_start() +* dl_server_active = 1; +* enqueue_dl_entity() +* update_dl_entity(WAKEUP) +* if (!dl_defer_running) +* dl_defer_armed = 1; +* dl_throttled = 1; +* if (dl_throttled && start_dl_timer()) +* return; // [B] +* __enqueue_dl_entity(); +* // [D] +* +* // deplete server runtime from client-class +* [2] B->B, C->B, E->B +* dl_server_update() +* update_curr_dl_se() // idle = false +* if (dl_defer_idle) +* dl_defer_idle = 0; +* if (dl_defer && dl_throttled && dl_runtime_exceeded()) +* dl_defer_running = 0; +* hrtimer_try_to_cancel(); // stop timer +* replenish_dl_new_period() +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; +* start_dl_timer(); // restart timer +* // [B] +* +* // timer actually fires means we have runtime +* [3] B->D +* dl_server_timer() +* if (dl_defer_armed) +* dl_defer_running = 1; +* enqueue_dl_entity(REPLENISH) +* replenish_dl_entity() +* // fwd period +* if (dl_throttled) +* dl_throttled = 0; +* if (dl_defer_armed) +* dl_defer_armed = 0; +* __enqueue_dl_entity(); +* // [D] +* +* // schedule server +* [4] D->A +* pick_task_dl() +* p = server_pick_task(); +* if (!p) +* dl_server_stop() +* dequeue_dl_entity(); +* hrtimer_try_to_cancel(); +* dl_defer_armed = 0; +* dl_throttled = 0; +* dl_server_active = 0; +* // [A] +* return p; +* +* // server running +* [5] D->E +* update_curr_dl_se() +* if (dl_runtime_exceeded()) +* dl_throttled = 1; +* dequeue_dl_entity(); +* start_dl_timer(); +* // [E] +* +* // server replenished +* [6] E->D +* dl_server_timer() +* enqueue_dl_entity(REPLENISH) +* replenish_dl_entity() +* fwd-period +* if (dl_throttled) +* dl_throttled = 0; +* __enqueue_dl_entity(); +* // [D] +* +* // deplete server runtime from idle +* [7] B->C, C->C +* dl_server_update_idle() +* update_curr_dl_se() // idle = true +* if (dl_defer && dl_throttled && dl_runtime_exceeded()) +* if (dl_defer_idle) +* return; +* dl_defer_running = 0; +* hrtimer_try_to_cancel(); +* replenish_dl_new_period() +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; +* dl_defer_idle = 1; +* start_dl_timer(); // restart timer +* // [C] +* +* // stop idle server +* [8] C->A +* dl_server_timer() +* if (dl_defer_idle) +* dl_server_stop(); +* // [A] +* +* +* digraph dl_server { +* "A:init" -> "B:zero_laxity-wait" [label="1:dl_server_start"] +* "A:init" -> "D:running" [label="1:dl_server_start"] +* "B:zero_laxity-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "B:zero_laxity-wait" -> "C:idle-wait" [label="7:dl_server_update_idle"] +* "B:zero_laxity-wait" -> "D:running" [label="3:dl_server_timer"] +* "C:idle-wait" -> "A:init" [label="8:dl_server_timer"] +* "C:idle-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "C:idle-wait" -> "C:idle-wait" [label="7:dl_server_update_idle"] +* "D:running" -> "A:init" [label="4:pick_task_dl"] +* "D:running" -> "E:replenish-wait" [label="5:update_curr_dl_se"] +* "E:replenish-wait" -> "B:zero_laxity-wait" [label="2:dl_server_update"] +* "E:replenish-wait" -> "D:running" [label="6:dl_server_timer"] +* } +* +* +* Notes: +* +* - When there are fair tasks running the most likely loop is [2]->[2]. +* the dl_server never actually runs, the timer never fires. +* +* - When there is actual fair starvation; the timer fires and starts the +* dl_server. This will then throttle and replenish like a normal DL +* task. Notably it will not 'defer' again. +* +* - When idle it will push the actication forward once, and then wait +* for the timer to hit or a non-idle update to restart things. +*/ void dl_server_start (struct sched_dl_entity *dl_se) {struct rq *rq = dl_se->rq;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/87 sched/deadline: Fix stuck dl_server
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 115135422562e2f791e98a6f55ec57b2da3b3a95 ]
Andrea reported the dl_server getting stuck for him. He tracked it down to a state where dl_server_start() saw dl_defer_running==1, but the dl_server's job is no longer valid at the time of dl_server_start().
In the state diagram this corresponds to [4] D->A (or dl_server_stop() due to no more runnable tasks) followed by [1], which in case of a lapsed deadline must then be A->B.
Now our A has dl_defer_running==1, while B demands dl_defer_running==0, therefore it must get cleared when the CBS wakeup rules demand a replenish.
--- kernel/sched/deadline.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
kernel/sched/deadline.c +12 -0
@@ -1086,6 +1086,12 @@ static void update_dl_entity(struct sched_dl_entity *dl_se)return ; } +/* +* When [4] D->A is followed by [1] A->B, dl_defer_running +* needs to be cleared, otherwise it will fail to properly +* start the zero-laxity timer. +*/ + dl_se->dl_defer_running =0 ;replenish_dl_new_period (dl_se, rq); }else if (dl_server (dl_se) && dl_se->dl_defer) {/*
@@ -1692,6 +1698,12 @@ void dl_server_update(struct sched_dl_entity *dl_se, s64 delta_exec)* dl_server_active = 1; * enqueue_dl_entity() * update_dl_entity(WAKEUP) +* if (dl_time_before() || dl_entity_overflow()) +* dl_defer_running = 0; +* replenish_dl_new_period(); +* // fwd period +* dl_throttled = 1; +* dl_defer_armed = 1; * if (!dl_defer_running) * dl_defer_armed = 1; * dl_throttled = 1;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/87 pinctrl: meson: mark the GPIO controller as sleeping
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
commit 28f24068387169722b508bba6b5257cb68b86e74 upstream.
The GPIO controller is configured as non-sleeping but it uses generic pinctrl helpers which use a mutex for synchronization.
This can cause the following lockdep splat with shared GPIOs enabled on boards which have multiple devices using the same GPIO:
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:591in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name:
kworker/u25:3preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 46379 hardirqs last enabled at (46379): [<ffff8000813acb24>] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (46378): [<ffff8000813abf38>] _raw_spin_lock_irqsave+0x84/0x88 softirqs last enabled at (46330): [<ffff8000800c71b4>] handle_softirqs+0x4c4/0x4dc softirqs last disabled at (46295): [<ffff800080010674>] __do_softirq+0x14/0x20 CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C 6.19.0-rc4-next-20260105+ #11963 PREEMPT Tainted: [C]=CRAP Hardware name: Khadas VIM3 (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 __might_resched+0x144/0x248 __might_sleep+0x48/0x98 __mutex_lock+0x5c/0x894 mutex_lock_nested+0x24/0x30 pinctrl_get_device_gpio_range+0x44/0x128 pinctrl_gpio_set_config+0x40/0xdc gpiochip_generic_config+0x28/0x3c gpio_do_set_config+0xa8/0x194 gpiod_set_config+0x34/0xfc gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy] gpio_do_set_config+0xa8/0x194 gpiod_set_transitory+0x4c/0xf0 gpiod_configure_flags+0xa4/0x480 gpiod_find_and_request+0x1a0/0x574 gpiod_get_index+0x58/0x84 devm_gpiod_get_index+0x20/0xb4 devm_gpiod_get+0x18/0x24 mmc_pwrseq_emmc_probe+0x40/0xb8 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0xdc/0x164 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x80/0xdc __device_attach+0xa8/0x1b0
--- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson.c +1 -1
@@ -619,7 +619,7 @@ static int meson_gpiolib_register(struct pc->chip.set = meson_gpio_set; pc->chip.base =-1 ; pc->chip.ngpio = pc->data->num_pins; - pc->chip.can_sleep = false; + pc->chip.can_sleep = true; ret =gpiochip_add_data (&pc->chip, pc);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 35/87 riscv: compat: fix COMPAT_UTS_MACHINE definition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Gao <[email protected]>
commit 0ea05c4f7527a98f5946f96c829733788934311d upstream.
The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv". Change it to "riscv32" to reflect the correct 32-bit compat name.
--- arch/riscv/include/asm/compat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/include/asm/compat.h +1 -1
@@ -2,7 +2,7 @@#ifndef __ASM_COMPAT_H#define __ASM_COMPAT_H -#define COMPAT_UTS_MACHINE "riscv\0\0" +#define COMPAT_UTS_MACHINE "riscv32\0\0"/* * Architecture specific compatibility types
Greg Kroah-Hartman
maintainerPATCH 36/87 rust: rbtree: fix documentation typo in CursorMut peek_next method
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Shu <[email protected]>
commit 45f6aed8a835ee2bdd0a5d5ee626a91fe285014f upstream.
The peek_next method's doc comment incorrectly stated it accesses the "previous" node when it actually accesses the next node.
Fix the documentation to accurately reflect the method's behavior.
--- rust/kernel/rbtree.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/kernel/rbtree.rs +1 -1
@@ -838,7 +838,7 @@ impl<'a, K, V> Cursor<'a, K, V> { self.peek (Direction ::Prev ) } -/// Access the previous node without moving the cursor. +/// Access the next node without moving the cursor. pub fn peek_next (&self) ->Option <(&K , &V )> { self.peek (Direction ::Next ) }
Greg Kroah-Hartman
maintainerPATCH 37/87 rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit af20ae33e7dd949f2e770198e74ac8f058cb299d upstream.
rustfmt is configured via the .rustfmt.toml file in the source tree, and we apply rustfmt to the macro expanded sources generated by the .rsi target.
However, under an O= pointing to an external folder (i.e. not just a subdir), rustfmt will not find the file when checking the parent folders. Since the edition is configured in this file, this can lead to errors when it encounters newer syntax, e.g.
error: expected one of `!`, `.`, `::`, `;`, `?`, `where`, `{`, or an operator, found `"rust_minimal"`
--> samples/rust/rust_minimal.rsi:29:49
|
28 | impl ::kernel::ModuleMetadata for RustMinimal {
| - while parsing this item list starting here
29 | const NAME: &'static ::kernel::str::CStr = c"rust_minimal";
| ^^^^^^^^^^^^^^ expected one of 8 possible tokens
30 | }
| - the item list ends here
|
= note: you may be trying to write a c-string literal
= note: c-string literals require Rust 2021 or later
= help: pass `--edition 2024` to `rustc`
= note: for more on editions, read https://doc.rust-lang.org/edition-guideA workaround is to use RUSTFMT=n, which is documented in the Makefile help for cases where macro expanded source may happen to break rustfmt for other reasons, but this is not one of those cases.
One solution would be to pass --edition, but we want rustfmt to use the entire configuration, even if currently we essentially use the default configuration.
Thus explicitly give the path to the config file to rustfmt instead.
--- scripts/Makefile.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.build +1 -1
@@ -286,7 +286,7 @@ $(obj)/%.o: $(obj)/%.rs FORCE quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ cmd_rustc_rsi_rs = \ $(rust_common_cmd) -Zunpretty=expanded $< >$@; \ - command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) $@ + command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) --config-path $(srctree)/.rustfmt.toml $@ $(obj)/%.rsi: $(obj)/%.rs FORCE +$(call if_changed_dep,rustc_rsi_rs)
Greg Kroah-Hartman
maintainerPATCH 38/87 ASoC: fsl: imx-card: Do not force slot width to sample width
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream.
imx-card currently sets the slot width to the physical sample width for I2S links. This breaks controllers that use fixed-width slots (e.g. 32-bit FIFO words), causing the unused bits in the slot to contain undefined data when playing 16-bit streams.
Do not override the slot width in the machine driver and let the CPU DAI select an appropriate default instead. This matches the behavior of simple-audio-card and avoids embedding controller-specific policy in the machine driver.
On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, playing 16-bit audio resulted in spurious frequencies and an incorrect SAI data waveform, as the slot width was forced to 16 bits. After this change, audio artifacts are eliminated and the 16-bit samples correctly occupy the first half of the 32-bit slot, with the remaining bits padded with zeroes.
--- sound/soc/fsl/imx-card.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/fsl/imx-card.c +0 -1
@@ -313,7 +313,6 @@ static int imx_aif_hw_params(struct snd_SND_SOC_DAIFMT_PDM ; }else { slots =2 ; - slot_width =params_physical_width (params); fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK ) |SND_SOC_DAIFMT_I2S ; }
Greg Kroah-Hartman
maintainerPATCH 39/87 scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <[email protected]>
commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream.
If nonemb_cmd->va fails to be allocated, free the allocation previously made by alloc_mcc_wrb().
--- drivers/scsi/be2iscsi/be_mgmt.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/be2iscsi/be_mgmt.c +1 -0
@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru &nonemb_cmd->dma, GFP_KERNEL);if (!nonemb_cmd->va) { +free_mcc_wrb (ctrl, tag);mutex_unlock (&ctrl->mbox_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 40/87 ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream.
Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the issue where the internal microphone was not detected.
--- sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +8 -0
@@ -661,6 +661,14 @@ static const struct dmi_system_id yc_acp DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "RB"), + DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"), + } + }, + {} };
Greg Kroah-Hartman
maintainerPATCH 41/87 gpio: pca953x: mask interrupts in irq shutdown
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Larsson <[email protected]>
commit d02f20a4de0c498fbba2b0e3c1496e72c630a91e upstream.
In the existing implementation irq_shutdown does not mask the interrupts in hardware. This can cause spurious interrupts from the IO expander. Add masking to irq_shutdown to prevent spurious interrupts.
--- drivers/gpio/gpio-pca953x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpio/gpio-pca953x.c +2 -0
@@ -817,6 +817,8 @@ static void pca953x_irq_shutdown(structclear_bit (hwirq, chip->irq_trig_fall);clear_bit (hwirq, chip->irq_trig_level_low);clear_bit (hwirq, chip->irq_trig_level_high); + +pca953x_irq_mask (d); }static void pca953x_irq_print_chip (struct irq_data *data,struct seq_file *p)
Greg Kroah-Hartman
maintainerPATCH 15/87 ice: stop counting UDP csum mismatch as rx_errors
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <[email protected]>
[ Upstream commit 05faf2c0a76581d0a7fdbb8ec46477ba183df95b ]
Since the beginning, the Intel ice driver has counted receive checksum offload mismatches into the rx_errors member of the rtnl_link_stats64 struct. In ethtool -S these show up as rx_csum_bad.nic.
I believe counting these in rx_errors is fundamentally wrong, as it's pretty clear from the comments in if_link.h and from every other statistic the driver is summing into rx_errors, that all of them would cause a "hardware drop" except for the UDP checksum mismatch, as well as the fact that all the other causes for rx_errors are L2 reasons, and this L4 UDP "mismatch" is an outlier.
A last nail in the coffin is that rx_errors is monitored in production and can indicate a bad NIC/cable/Switch port, but instead some random series of UDP packets with bad checksums will now trigger this alert. This false positive makes the alert useless and affects us as well as other companies.
This packet with presumably a bad UDP checksum is *already* passed to the stack, just not marked as offloaded by the hardware/driver. If it is dropped by the stack it will show up as UDP_MIB_CSUMERRORS.
And one more thing, none of the other Intel drivers, and at least bnxt_en and mlx5 both don't appear to count UDP offload mismatches as rx_errors.
Here is a related customer complaint:
https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125
--- drivers/net/ethernet/intel/ice/ice_main.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_main.c +0 -1
@@ -6974,7 +6974,6 @@ void ice_update_vsi_stats(struct ice_vsi *vsi) cur_ns->rx_errors = pf->stats.crc_errors + pf->stats.illegal_bytes + pf->stats.rx_undersize + - pf->hw_csum_rx_error + pf->stats.rx_jabber + pf->stats.rx_fragments + pf->stats.rx_oversize;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/87 scsi: qla2xxx: edif: Fix dma_free_coherent() size
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream.
Earlier in the function, the ha->flt buffer is allocated with size sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error path with size SFP_DEV_SIZE.
--- drivers/scsi/qla2xxx/qla_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_os.c +1 -1
@@ -4484,7 +4484,7 @@ fail_lsrjt: fail_elsrej:dma_pool_destroy (ha->purex_dma_pool); fail_flt: -dma_free_coherent (&ha->pdev->dev,SFP_DEV_SIZE , +dma_free_coherent (&ha->pdev->dev,sizeof (struct qla_flt_header ) +FLT_REGIONS_SIZE , ha->flt, ha->flt_dma); fail_flt_buffer:
Greg Kroah-Hartman
maintainerPATCH 43/87 efivarfs: fix error propagation in efivar_entry_get()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <[email protected]>
commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream.
efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors.
This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path.
Fix it by returning the error from __efivar_entry_get().
--- fs/efivarfs/vars.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/efivarfs/vars.c +1 -1
@@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry err =__efivar_entry_get (entry, attributes, size, data);efivar_unlock (); -return 0 ; +return err; }/**
Greg Kroah-Hartman
maintainerPATCH 44/87 nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e upstream.
There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():
1. nvmet_bio_done() is called when a bio completes
2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)
3. The queue_response callback can re-queue and re-submit the same request
4. The re-submission reuses the same inline_bio from nvmet_req
5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL
6. The re-submitted bio enters submit_bio_noacct_nocheck()
7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:
BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0
Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
--- drivers/nvme/target/io-cmd-bdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/target/io-cmd-bdev.c +2 -1
@@ -176,9 +176,10 @@ u16 blk_to_nvme_status(struct nvmet_reqstatic void nvmet_bio_done (struct bio *bio) {struct nvmet_req *req = bio->bi_private; +blk_status_t blk_status = bio->bi_status; -nvmet_req_complete (req,blk_to_nvme_status (req, bio->bi_status));nvmet_req_bio_put (req, bio); +nvmet_req_complete (req,blk_to_nvme_status (req, blk_status)); }#ifdef CONFIG_BLK_DEV_INTEGRITY
Greg Kroah-Hartman
maintainerPATCH 45/87 gpio: rockchip: Stop calling pinctrl for set_direction
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 7ca497be00163610afb663867db24ac408752f13 upstream.
Marking the whole controller as sleeping due to the pinctrl calls in the .direction_{input,output} callbacks has the unfortunate side effect that legitimate invocations of .get and .set, which cannot themselves sleep, in atomic context now spew WARN()s from gpiolib.
However, as Heiko points out, the driver doing this is a bit silly to begin with, as the pinctrl .gpio_set_direction hook doesn't even care about the direction, the hook is only used to claim the mux. And sure enough, the .gpio_request_enable hook exists to serve this very purpose, so switch to that and remove the problematic business entirely.
--- drivers/gpio/gpio-rockchip.c | 8 -------- drivers/pinctrl/pinctrl-rockchip.c | 9 ++++----- 2 files changed, 4 insertions(+), 13 deletions(-)
drivers/gpio/gpio-rockchip.c +0 -8
@@ -18,7 +18,6 @@#include <linux/of.h> #include <linux/of_address.h> #include <linux/of_irq.h> -#include <linux/pinctrl/consumer.h> #include <linux/pinctrl/pinconf-generic.h> #include <linux/platform_device.h> #include <linux/regmap.h>
@@ -157,12 +156,6 @@ static int rockchip_gpio_set_direction(sunsigned long flags;u32 data = input ?0 :1 ; - -if (input) -pinctrl_gpio_direction_input (chip, offset); -else -pinctrl_gpio_direction_output (chip, offset); -raw_spin_lock_irqsave (&bank->slock, flags);rockchip_gpio_writel_bit (bank, offset, data, bank->gpio_regs->port_ddr);raw_spin_unlock_irqrestore (&bank->slock, flags);
@@ -584,7 +577,6 @@ static int rockchip_gpiolib_register(str gc->ngpio = bank->nr_pins; gc->label = bank->name; gc->parent = bank->dev; - gc->can_sleep = true; ret =gpiochip_add_data (gc, bank);if (ret) {
drivers/pinctrl/pinctrl-rockchip.c +4 -5
@@ -2922,10 +2922,9 @@ static int rockchip_pmx_set(struct pinctreturn 0 ; } -static int rockchip_pmx_gpio_set_direction (struct pinctrl_dev *pctldev, -struct pinctrl_gpio_range *range, -unsigned offset, -bool input) +static int rockchip_pmx_gpio_request_enable (struct pinctrl_dev *pctldev, +struct pinctrl_gpio_range *range, +unsigned int offset) {struct rockchip_pinctrl *info =pinctrl_dev_get_drvdata (pctldev);struct rockchip_pin_bank *bank;
@@ -2939,7 +2938,7 @@ static const struct pinmux_ops rockchip_ .get_function_name = rockchip_pmx_get_func_name, .get_function_groups = rockchip_pmx_get_groups, .set_mux = rockchip_pmx_set, - .gpio_set_direction = rockchip_pmx_gpio_set_direction, + .gpio_request_enable = rockchip_pmx_gpio_request_enable, };/*
Greg Kroah-Hartman
maintainerPATCH 46/87 mm/kasan: fix KASAN poisoning in vrealloc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <[email protected]>
commit 9b47d4eea3f7c1f620e95bda1d6221660bde7d7b upstream.
A KASAN warning can be triggered when vrealloc() changes the requested size to a value that is not aligned to KASAN_GRANULE_SIZE.
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1 at mm/kasan/shadow.c:174 kasan_unpoison+0x40/0x48
...
pc : kasan_unpoison+0x40/0x48
lr : __kasan_unpoison_vmalloc+0x40/0x68
Call trace:
kasan_unpoison+0x40/0x48 (P)
vrealloc_node_align_noprof+0x200/0x320
bpf_patch_insn_data+0x90/0x2f0
convert_ctx_accesses+0x8c0/0x1158
bpf_check+0x1488/0x1900
bpf_prog_load+0xd20/0x1258
__sys_bpf+0x96c/0xdf0
__arm64_sys_bpf+0x50/0xa0
invoke_syscall+0x90/0x160Introduce a dedicated kasan_vrealloc() helper that centralizes KASAN handling for vmalloc reallocations. The helper accounts for KASAN granule alignment when growing or shrinking an allocation and ensures that partial granules are handled correctly.
Use this helper from vrealloc_node_align_noprof() to fix poisoning logic.
--- include/linux/kasan.h | 14 ++++++++++++++ mm/kasan/common.c | 21 +++++++++++++++++++++ mm/vmalloc.c | 7 ++----- 3 files changed, 37 insertions(+), 5 deletions(-)
include/linux/kasan.h +14 -0
@@ -618,6 +618,17 @@ kasan_unpoison_vmap_areas(struct vm_stru__kasan_unpoison_vmap_areas (vms, nr_vms, flags); } +void __kasan_vrealloc (const void *start,unsigned long old_size, +unsigned long new_size); + +static __always_inline void kasan_vrealloc(const void *start, +unsigned long old_size, +unsigned long new_size) +{ +if (kasan_enabled ()) +__kasan_vrealloc (start, old_size, new_size); +} +#else /* CONFIG_KASAN_VMALLOC */ static inline void kasan_populate_early_vm_area_shadow(void *start,
@@ -647,6 +658,9 @@ kasan_unpoison_vmap_areas(struct vm_stru kasan_vmalloc_flags_t flags) { } +static inline void kasan_vrealloc (const void *start,unsigned long old_size, +unsigned long new_size) { } +#endif /* CONFIG_KASAN_VMALLOC */ #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
mm/kasan/common.c +21 -0
@@ -590,4 +590,25 @@ void __kasan_unpoison_vmap_areas(struct __kasan_unpoison_vmalloc(addr, size, flags | KASAN_VMALLOC_KEEP_TAG); } } + +void __kasan_vrealloc (const void *addr,unsigned long old_size, +unsigned long new_size) +{ +if (new_size < old_size) { +kasan_poison_last_granule (addr, new_size); + + new_size =round_up (new_size,KASAN_GRANULE_SIZE ); + old_size =round_up (old_size,KASAN_GRANULE_SIZE ); +if (new_size < old_size) +__kasan_poison_vmalloc (addr + new_size, + old_size - new_size); + }else if (new_size > old_size) { + old_size =round_down (old_size,KASAN_GRANULE_SIZE ); +__kasan_unpoison_vmalloc (addr + old_size, + new_size - old_size, +KASAN_VMALLOC_PROT_NORMAL | +KASAN_VMALLOC_VM_ALLOC | +KASAN_VMALLOC_KEEP_TAG ); + } +}#endif
mm/vmalloc.c +2 -5
@@ -4109,7 +4109,7 @@ void *vrealloc_noprof(const void *p, sizif (want_init_on_free () ||want_init_on_alloc (flags))memset ((void *)p + size,0 , old_size - size); vm->requested_size = size; -kasan_poison_vmalloc (p + size, old_size - size); +kasan_vrealloc (p, old_size, size);return (void *)p; }
@@ -4117,16 +4117,13 @@ void *vrealloc_noprof(const void *p, siz* We already have the bytes available in the allocation; use them. */ if (size <= alloced_size) { -kasan_unpoison_vmalloc (p + old_size, size - old_size, -KASAN_VMALLOC_PROT_NORMAL | -KASAN_VMALLOC_VM_ALLOC | -KASAN_VMALLOC_KEEP_TAG );/* * No need to zero memory here, as unused memory will have * already been zeroed at initial allocation time or during * realloc shrink time. */ vm->requested_size = size; +kasan_vrealloc (p, old_size, size);return (void *)p; }
Greg Kroah-Hartman
maintainerPATCH 47/87 mptcp: only reset subflow errors when propagated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream.
Some subflow socket errors need to be reported to the MPTCP socket: the initial subflow connect (MP_CAPABLE), and the ones from the fallback sockets. The others are not propagated.
The issue is that sock_error() was used to retrieve the error, which was also resetting the sk_err field. Because of that, when notifying the userspace about subflow close events later on from the MPTCP worker, the ssk->sk_err field was always 0.
Now, the error (sk_err) is only reset when propagating it to the msk.
--- net/mptcp/protocol.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/mptcp/protocol.c +5 -4
@@ -798,11 +798,8 @@ static bool __mptcp_ofo_queue(struct mptstatic bool __mptcp_subflow_error_report (struct sock *sk,struct sock *ssk) { -int err =sock_error (ssk);int ssk_state; - -if (!err) -return false; +int err;/* only propagate errors on fallen-back sockets or * on MPC connect
@@ -810,6 +807,10 @@ static bool __mptcp_subflow_error_reportif (sk->sk_state !=TCP_SYN_SENT && !__mptcp_check_fallback (mptcp_sk (sk)))return false; + err =sock_error (ssk); +if (!err) +return false; +/* We need to propagate only transition to CLOSE state. * Orphaned socket will see such state change via * subflow_sched_work_if_closed() and that path will properly
Greg Kroah-Hartman
maintainerPATCH 16/87 net/mlx5e: TC, delete flows only for existing peers
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <[email protected]>
[ Upstream commit f67666938ae626cbda63fbf5176b3583c07e7124 ]
When deleting TC steering flows, iterate only over actual devcom peers instead of assuming all possible ports exist. This avoids touching non-existent peers and ensures cleanup is limited to devices the driver is currently connected to.
BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 133c8a067 P4D 0 Oops: Oops: 0002 [#1] SMP CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff <48> 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49 RSP: 0018:ff11000143867528 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000 RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0 RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002 R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78 R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0 FS: 00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0 Call Trace: <TASK> mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] mlx5e_flow_put+0x25/0x50 [mlx5_core] mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core] tc_setup_cb_reoffload+0x20/0x80 fl_reoffload+0x26f/0x2f0 [cls_flower] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] tcf_block_playback_offloads+0x9e/0x1c0 tcf_block_unbind+0x7b/0xd0 tcf_block_setup+0x186/0x1d0 tcf_block_offload_cmd.isra.0+0xef/0x130 tcf_block_offload_unbind+0x43/0x70 __tcf_block_put+0x85/0x160 ingress_destroy+0x32/0x110 [sch_ingress] __qdisc_destroy+0x44/0x100 qdisc_graft+0x22b/0x610 tc_get_qdisc+0x183/0x4d0 rtnetlink_rcv_msg+0x2d7/0x3d0 ? rtnl_calcit.isra.0+0x100/0x100 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x249/0x320 ? __alloc_skb+0x102/0x1f0 netlink_sendmsg+0x1e3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1ef/0x230 ? copy_msghdr_from_user+0x6c/0xa0 ___sys_sendmsg+0x7f/0xc0 ? ___sys_recvmsg+0x8a/0xc0 ? __sys_sendto+0x119/0x180 __sys_sendmsg+0x61/0xb0 do_syscall_64+0x55/0x640 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f35238bb764 Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764 RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003 RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20 R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790 R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780
--- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +13 -6
@@ -2143,11 +2143,14 @@ static void mlx5e_tc_del_fdb_peer_flow(struct mlx5e_tc_flow *flow,static void mlx5e_tc_del_fdb_peers_flow (struct mlx5e_tc_flow *flow) { +struct mlx5_devcom_comp_dev *devcom; +struct mlx5_devcom_comp_dev *pos; +struct mlx5_eswitch *peer_esw;int i; -for (i =0 ; i <MLX5_MAX_PORTS ; i++) { -if (i ==mlx5_get_dev_index (flow->priv->mdev)) -continue ; + devcom = flow->priv->mdev->priv.eswitch->devcom; +mlx5_devcom_for_each_peer_entry (devcom, peer_esw, pos) { + i =mlx5_get_dev_index (peer_esw->dev);mlx5e_tc_del_fdb_peer_flow (flow, i); } }
@@ -5504,12 +5507,16 @@ int mlx5e_tc_num_filters(struct mlx5e_priv *priv, unsigned long flags)void mlx5e_tc_clean_fdb_peer_flows (struct mlx5_eswitch *esw) { +struct mlx5_devcom_comp_dev *devcom; +struct mlx5_devcom_comp_dev *pos;struct mlx5e_tc_flow *flow, *tmp; +struct mlx5_eswitch *peer_esw;int i; -for (i =0 ; i <MLX5_MAX_PORTS ; i++) { -if (i ==mlx5_get_dev_index (esw->dev)) -continue ; + devcom = esw->devcom; + +mlx5_devcom_for_each_peer_entry (devcom, peer_esw, pos) { + i =mlx5_get_dev_index (peer_esw->dev);list_for_each_entry_safe (flow, tmp, &esw->offloads.peer_flows[i], peer[i])mlx5e_tc_del_fdb_peers_flow (flow); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/87 nfc: nci: Fix race between rfkill and nci_unregister_device().
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d2492688bb9fed6ab6e313682c387ae71a66ebae ]
syzbot reported the splat below [0] without a repro.
It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill.
nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev.
The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister().
So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed.
Let's unregister the device from rfkill first in nci_unregister_device().
Note that we cannot call nfc_unregister_device() before nci_close_device() because
1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list
2) nci_rx_work() could try to queue nci_conn_info to
ndev->conn_info_list which could be leaked
Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device().
[0]:DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349 Modules linked in: CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline] RIP: 0010:__lock_acquire+0x3a4/0x2cf0 kernel/locking/lockdep.c:5187 Code: 18 00 4c 8b 74 24 08 75 27 90 e8 17 f2 fc 02 85 c0 74 1c 83 3d 50 e0 4e 0e 00 75 13 48 8d 3d 43 f7 51 0e 48 c7 c6 8b 3a de 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f RSP: 0018:ffffc9000c767680 EFLAGS: 00010046 RAX: 0000000000000001 RBX: 0000000000040000 RCX: 0000000000080000 RDX: ffffc90013080000 RSI: ffffffff8dde3a8b RDI: ffffffff8ff24ca0 RBP: 0000000000000003 R08: ffffffff8fef35a3 R09: 1ffffffff1fde6b4 R10: dffffc0000000000 R11: fffffbfff1fde6b5 R12: 00000000000012a2 R13: ffff888030338ba8 R14: ffff888030338000 R15: ffff888030338b30 FS: 00007fa5995f66c0(0000) GS:ffff8881256f8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e72f842d0 CR3: 00000000485a0000 CR4: 00000000003526f0 Call Trace: <TASK> lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3940 __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:3982 nci_close_device+0x302/0x630 net/nfc/nci/core.c:567 nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639 nfc_dev_down+0x152/0x290 net/nfc/core.c:161 nfc_rfkill_set_block+0x2d/0x100 net/nfc/core.c:179 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_fop_write+0x461/0x5a0 net/rfkill/core.c:1301 vfs_write+0x29a/0xb90 fs/read_write.c:684 ksys_write+0x150/0x270 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa59b39acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa5995f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa59b615fa0 RCX: 00007fa59b39acb9 RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000007 RBP: 00007fa59b408bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa59b616038 R14: 00007fa59b615fa0 R15: 00007ffc82218788 </TASK>
--- include/net/nfc/nfc.h | 2 ++ net/nfc/core.c | 27 ++++++++++++++++++++++++--- net/nfc/nci/core.c | 4 +++- 3 files changed, 29 insertions(+), 4 deletions(-)
include/net/nfc/nfc.h +2 -0
@@ -215,6 +215,8 @@ static inline void nfc_free_device(struct nfc_dev *dev)int nfc_register_device (struct nfc_dev *dev); +void nfc_unregister_rfkill (struct nfc_dev *dev); +void nfc_remove_device (struct nfc_dev *dev);void nfc_unregister_device (struct nfc_dev *dev);/**
net/nfc/core.c +24 -3
@@ -1147,14 +1147,14 @@ int nfc_register_device(struct nfc_dev *dev)EXPORT_SYMBOL (nfc_register_device);/** -* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* nfc_unregister_rfkill - unregister a nfc device in the rfkill subsystem * * @dev: The nfc device to unregister */ -void nfc_unregister_device (struct nfc_dev *dev) +void nfc_unregister_rfkill (struct nfc_dev *dev) { -int rc;struct rfkill *rfk =NULL ; +int rc;pr_debug ("dev_name=%s\n" ,dev_name (&dev->dev));
@@ -1175,7 +1175,16 @@ void nfc_unregister_device(struct nfc_dev *dev)rfkill_unregister (rfk);rfkill_destroy (rfk); } +} +EXPORT_SYMBOL (nfc_unregister_rfkill); +/** +* nfc_remove_device - remove a nfc device in the nfc subsystem +* +* @dev: The nfc device to remove +*/ +void nfc_remove_device (struct nfc_dev *dev) +{if (dev->ops->check_presence) {del_timer_sync (&dev->check_pres_timer);cancel_work_sync (&dev->check_pres_work);
@@ -1188,6 +1197,18 @@ void nfc_unregister_device(struct nfc_dev *dev)device_del (&dev->dev);mutex_unlock (&nfc_devlist_mutex); } +EXPORT_SYMBOL (nfc_remove_device); + +/** +* nfc_unregister_device - unregister a nfc device in the nfc subsystem +* +* @dev: The nfc device to unregister +*/ +void nfc_unregister_device (struct nfc_dev *dev) +{ +nfc_unregister_rfkill (dev); +nfc_remove_device (dev); +}EXPORT_SYMBOL (nfc_unregister_device);static int __init nfc_init (void )
net/nfc/nci/core.c +3 -1
@@ -1292,6 +1292,8 @@ void nci_unregister_device(struct nci_dev *ndev) {struct nci_conn_info *conn_info, *n; +nfc_unregister_rfkill (ndev->nfc_dev); +/* This set_bit is not protected with specialized barrier, * However, it is fine because the mutex_lock(&ndev->req_lock); * in nci_close_device() will help to emit one.
@@ -1309,7 +1311,7 @@ void nci_unregister_device(struct nci_dev *ndev)/* conn_info is allocated with devm_kzalloc */ } -nfc_unregister_device (ndev->nfc_dev); +nfc_remove_device (ndev->nfc_dev); }EXPORT_SYMBOL (nci_unregister_device);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/87 net: bridge: fix static key check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <[email protected]>
[ Upstream commit cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d ]
Fix the check if netfilter's static keys are available. netfilter defines and exports static keys if CONFIG_JUMP_LABEL is enabled. (HAVE_JUMP_LABEL is never defined.)
--- net/bridge/br_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bridge/br_input.c +1 -1
@@ -260,7 +260,7 @@ static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)int ret; net =dev_net (skb->dev); -#ifdef HAVE_JUMP_LABEL +#ifdef CONFIG_JUMP_LABEL if (!static_key_false (&nf_hooks_needed[NFPROTO_BRIDGE ][NF_BR_PRE_ROUTING ])) goto frame_finish;#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/87 net: phy: micrel: fix clk warning when removing the driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 2aa1545ba8d4801fba5be83a404e28014b80196a ]
Since the commit 25c6a5ab151f ("net: phy: micrel: Dynamically control external clock of KSZ PHY"), the clock of Micrel PHY has been enabled by phy_driver::resume() and disabled by phy_driver::suspend(). However, devm_clk_get_optional_enabled() is used in kszphy_probe(), so the clock will automatically be disabled when the device is unbound from the bus. Therefore, this could cause the clock to be disabled twice, resulting in clk driver warnings.
For example, this issue can be reproduced on i.MX6ULL platform, and we can see the following logs when removing the FEC MAC drivers.
$ echo 2188000.ethernet > /sys/bus/platform/drivers/fec/unbind $ echo 20b4000.ethernet > /sys/bus/platform/drivers/fec/unbind [ 109.758207] ------------[ cut here ]------------ [ 109.758240] WARNING: drivers/clk/clk.c:1188 at clk_core_disable+0xb4/0xd0, CPU#0: sh/639 [ 109.771011] enet2_ref already disabled [ 109.793359] Call trace: [ 109.822006] clk_core_disable from clk_disable+0x28/0x34 [ 109.827340] clk_disable from clk_disable_unprepare+0xc/0x18 [ 109.833029] clk_disable_unprepare from devm_clk_release+0x1c/0x28 [ 109.839241] devm_clk_release from devres_release_all+0x98/0x100 [ 109.845278] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 109.851571] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 109.859170] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 109.866243] bus_remove_device from device_del+0x140/0x458 [ 109.871757] device_del from phy_mdio_device_remove+0xc/0x24 [ 109.877452] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 109.883918] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 109.890125] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 109.896076] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4 [ 109.962748] WARNING: drivers/clk/clk.c:1047 at clk_core_unprepare+0xfc/0x13c, CPU#0: sh/639 [ 109.975805] enet2_ref already unprepared [ 110.002866] Call trace: [ 110.031758] clk_core_unprepare from clk_unprepare+0x24/0x2c [ 110.037440] clk_unprepare from devm_clk_release+0x1c/0x28 [ 110.042957] devm_clk_release from devres_release_all+0x98/0x100 [ 110.048989] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 110.055280] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 110.062877] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 110.069950] bus_remove_device from device_del+0x140/0x458 [ 110.075469] device_del from phy_mdio_device_remove+0xc/0x24 [ 110.081165] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 110.087632] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 110.093836] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 110.099782] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4
After analyzing the process of removing the FEC driver, as shown below, it can be seen that the clock was disabled twice by the PHY driver.
fec_drv_remove()
--> fec_enet_close()
--> phy_stop()
--> phy_suspend()
--> kszphy_suspend() #1 The clock is disabled
--> fec_enet_mii_remove()
--> mdiobus_unregister()
--> phy_mdio_device_remove()
--> device_del()
--> devm_clk_release() #2 The clock is disabled againTherefore, devm_clk_get_optional() is used to fix the above issue. And to avoid the issue mentioned by the commit 985329462723 ("net: phy:
micrel: use devm_clk_get_optional_enabled for the rmii-ref clock"), the clock is enabled by clk_prepare_enable() to get the correct clock rate.
--- drivers/net/phy/micrel.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/net/phy/micrel.c +13 -4
@@ -2268,11 +2268,21 @@ static int kszphy_probe(struct phy_device *phydev)kszphy_parse_led_mode (phydev); - clk =devm_clk_get_optional_enabled (&phydev->mdio.dev,"rmii-ref" ); + clk =devm_clk_get_optional (&phydev->mdio.dev,"rmii-ref" );/* NOTE: clk may be NULL if building without CONFIG_HAVE_CLK */ if (!IS_ERR_OR_NULL (clk)) { -unsigned long rate =clk_get_rate (clk);bool rmii_ref_clk_sel_25_mhz; +unsigned long rate; +int err; + + err =clk_prepare_enable (clk); +if (err) { +phydev_err (phydev,"Failed to enable rmii-ref clock\n" ); +return err; + } + + rate =clk_get_rate (clk); +clk_disable_unprepare (clk);if (type) priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel;
@@ -2290,13 +2300,12 @@ static int kszphy_probe(struct phy_device *phydev) } }else if (!clk) {/* unnamed clock from the generic ethernet-phy binding */ - clk =devm_clk_get_optional_enabled (&phydev->mdio.dev,NULL ); + clk =devm_clk_get_optional (&phydev->mdio.dev,NULL ); }if (IS_ERR (clk))return PTR_ERR (clk); -clk_disable_unprepare (clk); priv->clk = clk;if (ksz8041_fiber_mode (phydev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/87 net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shay Drory <[email protected]>
[ Upstream commit 2610a3d65691a1301ab10c92ff6ebab0bedf9199 ]
The capability check for reset_root_to_default was inverted, causing the function to return -EOPNOTSUPP when the capability IS supported, rather than when it is NOT supported.
Fix the capability check condition.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c +2 -1
@@ -1166,7 +1166,8 @@ int mlx5_fs_cmd_set_tx_flow_table_root(struct mlx5_core_dev *dev, u32 ft_id, boou32 out[MLX5_ST_SZ_DW (set_flow_table_root_out)] = {};u32 in[MLX5_ST_SZ_DW (set_flow_table_root_in)] = {}; -if (disconnect &&MLX5_CAP_FLOWTABLE_NIC_TX (dev, reset_root_to_default)) +if (disconnect && + !MLX5_CAP_FLOWTABLE_NIC_TX (dev, reset_root_to_default))return -EOPNOTSUPP ; MLX5_SET(set_flow_table_root_in, in, opcode,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/87 net/mlx5: Initialize events outside devlink lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit b6b03097f9826db72aeb3f751774c5e9edd9a5b3 ]
Move event init/cleanup outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions.
By doing this, we avoid the events being reinitialized on devlink reload and, more importantly, the events->sw_nh notifier chain becomes available earlier in the init procedure, which will be used in subsequent patches. This makes sense because the events struct is pure software, independent of any HW details.
Stable-dep-of: a8f930b7be7b ("net/mlx5: Fix vhca_id access call trace use before alloc")
--- .../net/ethernet/mellanox/mlx5/core/main.c | 34 +++++++++++++------ 1 file changed, 24 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +24 -10
@@ -1016,16 +1016,10 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) goto err_irq_cleanup; } - err =mlx5_events_init (dev); -if (err) { -mlx5_core_err (dev,"failed to initialize events\n" ); - goto err_eq_cleanup; - } - err =mlx5_fw_reset_init (dev);if (err) {mlx5_core_err (dev,"failed to initialize fw reset events\n" ); - goto err_events_cleanup; + goto err_eq_cleanup; }mlx5_cq_debugfs_init (dev);
@@ -1121,8 +1115,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev)mlx5_cleanup_reserved_gids (dev);mlx5_cq_debugfs_cleanup (dev);mlx5_fw_reset_cleanup (dev); -err_events_cleanup: -mlx5_events_cleanup (dev); err_eq_cleanup:mlx5_eq_table_cleanup (dev); err_irq_cleanup:
@@ -1155,7 +1147,6 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev)mlx5_cleanup_reserved_gids (dev);mlx5_cq_debugfs_cleanup (dev);mlx5_fw_reset_cleanup (dev); -mlx5_events_cleanup (dev);mlx5_eq_table_cleanup (dev);mlx5_irq_table_cleanup (dev);mlx5_unregister_hca_devcom_comp (dev);
@@ -1829,6 +1820,24 @@ static int vhca_id_show(struct seq_file *file, void *priv)DEFINE_SHOW_ATTRIBUTE (vhca_id); +static int mlx5_notifiers_init (struct mlx5_core_dev *dev) +{ +int err; + + err =mlx5_events_init (dev); +if (err) { +mlx5_core_err (dev,"failed to initialize events\n" ); +return err; + } + +return 0 ; +} + +static void mlx5_notifiers_cleanup (struct mlx5_core_dev *dev) +{ +mlx5_events_cleanup (dev); +} +int mlx5_mdev_init (struct mlx5_core_dev *dev,int profile_idx) {struct mlx5_priv *priv = &dev->priv;
@@ -1884,6 +1893,10 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx)if (err) goto err_hca_caps; + err =mlx5_notifiers_init (dev); +if (err) + goto err_hca_caps; +/* The conjunction of sw_vhca_id with sw_owner_id will be a global * unique id per function which uses mlx5_core. * Those values are supplied to FW as part of the init HCA command to
@@ -1926,6 +1939,7 @@ void mlx5_mdev_uninit(struct mlx5_core_dev *dev)if (priv->sw_vhca_id >0 )ida_free (&sw_vhca_ida, dev->priv.sw_vhca_id); +mlx5_notifiers_cleanup (dev);mlx5_hca_caps_free (dev);mlx5_adev_cleanup (dev);mlx5_pagealloc_cleanup (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/87 rocker: fix memory leak in rocker_world_port_post_fini()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <[email protected]>
[ Upstream commit 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 ]
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set:
if (!wops->port_post_fini)
return;
wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal.
Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists.
--- drivers/net/ethernet/rocker/rocker_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/rocker/rocker_main.c +2 -3
@@ -1524,9 +1524,8 @@ static void rocker_world_port_post_fini(struct rocker_port *rocker_port) {struct rocker_world_ops *wops = rocker_port->rocker->wops; -if (!wops->port_post_fini) -return ; - wops->port_post_fini (rocker_port); +if (wops->port_post_fini) + wops->port_post_fini (rocker_port);kfree (rocker_port->wpriv); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/87 selftests: mptcp: check subflow errors in close events
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 2ef9e3a3845d0a20b62b01f5b731debd0364688d upstream.
This validates the previous commit: subflow closed events should contain an error field when a subflow got closed with an error, e.g. reset or timeout.
For this test, the chk_evt_nr helper has been extended to check attributes in the matched events.
In this test, the 2 subflow closed events should have an error.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +20 -3
@@ -3481,21 +3481,28 @@ userspace_pm_chk_get_addr() fi } -# $1: ns ; $2: event type ; $3: count +# $1: ns ; $2: event type ; $3: count ; [ $4: attr ; $5: attr count ] chk_evt_nr() { local ns=${1} local evt_name="${2}" local exp="${3}" + local attr="${4}" + local attr_exp="${5}" local evts="${evts_ns1}" local evt="${!evt_name}" + local attr_name local count + if [ -n "${attr}" ]; then + attr_name=", ${attr}: ${attr_exp}" + fi + evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_ [ "${ns}" == "ns2" ] && evts="${evts_ns2}" - print_check "event ${ns} ${evt_name} (${exp})" + print_check "event ${ns} ${evt_name} (${exp}${attr_name})" if [[ "${evt_name}" = "LISTENER_"* ]] && ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then
@@ -3507,6 +3514,16 @@ chk_evt_nr() if [ "${count}" != "${exp}" ]; then fail_test "got ${count} events, expected ${exp}" cat "${evts}" + return + elif [ -z "${attr}" ]; then + print_ok + return + fi + + count=$(grep -w "type:${evt}" "${evts}" | grep -c ",${attr}:") + if [ "${count}" != "${attr_exp}" ]; then + fail_test "got ${count} event attributes, expected ${attr_exp}" + grep -w "type:${evt}" "${evts}" else print_ok fi
@@ -3763,7 +3780,7 @@ userspace_tests() chk_subflows_total 1 1 userspace_pm_add_sf $ns2 10.0.1.2 0 wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 error 2 fi kill_events_pids mptcp_lib_kill_group_wait $tests_pid
Greg Kroah-Hartman
maintainerPATCH 58/87 scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit 5157c328edb35bac05ce77da473c3209d20e0bbb upstream.
Add a dependency edge from compiler_builtins to core to scripts/generate_rust_analyzer.py to match rust/Makefile. This has been incorrect since commit 8c4555ccc55c ("scripts: add generate_rust_analyzer.py")
--- scripts/generate_rust_analyzer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/generate_rust_analyzer.py +1 -1
@@ -98,7 +98,7 @@ def generate_crates(srctree, objtree, sy append_crate( "compiler_builtins", srctree / "rust" / "compiler_builtins.rs", - [], + ["core"], ) append_crate(
Greg Kroah-Hartman
maintainerPATCH 59/87 drm/msm/a6xx: fix bogus hwcg register updates
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit dedb897f11c5d7e32c0e0a0eff7cec23a8047167 upstream.
The hw clock gating register sequence consists of register value pairs that are written to the GPU during initialisation.
The a690 hwcg sequence has two GMU registers in it that used to amount to random writes in the GPU mapping, but since commit 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as the updated offsets now lie outside the mapping. This in turn breaks boot of machines like the Lenovo ThinkPad X13s.
Note that the updates of these GMU registers is already taken care of properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC properties on a6xx too"), but for some reason these two entries were left in the table.
Patchwork: https://patchwork.freedesktop.org/patch/695778/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_catalog.c +0 -2
@@ -501,8 +501,6 @@ static const struct adreno_reglist a690_ {REG_A6XX_RBBM_CLOCK_CNTL_GMU_GX, 0x00000222}, {REG_A6XX_RBBM_CLOCK_DELAY_GMU_GX, 0x00000111}, {REG_A6XX_RBBM_CLOCK_HYST_GMU_GX, 0x00000555}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_DELAY_CNTL, 0x10111}, - {REG_A6XX_GPU_GMU_AO_GMU_CGC_HYST_CNTL, 0x5555}, {} };
Greg Kroah-Hartman
maintainerPATCH 60/87 drm/imx/tve: fix probe device leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit e535c23513c63f02f67e3e09e0787907029efeaf upstream.
Make sure to drop the reference taken to the DDC device during probe on probe failure (e.g. probe deferral) and on driver unbind.
--- drivers/gpu/drm/imx/ipuv3/imx-tve.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/gpu/drm/imx/ipuv3/imx-tve.c +13 -0
@@ -519,6 +519,13 @@ static const struct component_ops imx_tv .bind = imx_tve_bind, }; +static void imx_tve_put_device (void *_dev) +{ +struct device *dev = _dev; + +put_device (dev); +} +static int imx_tve_probe (struct platform_device *pdev) {struct device *dev = &pdev->dev;
@@ -540,6 +547,12 @@ static int imx_tve_probe(struct platformif (ddc_node) { tve->ddc =of_find_i2c_adapter_by_node (ddc_node);of_node_put (ddc_node); +if (tve->ddc) { + ret =devm_add_action_or_reset (dev, imx_tve_put_device, + &tve->ddc->dev); +if (ret) +return ret; + } } tve->mode =of_get_tve_mode (np);
Greg Kroah-Hartman
maintainerPATCH 61/87 drm/amdgpu/soc21: fix xclk for APUs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e7fbff9e7622a00c2b53cb14df481916f0019742 upstream.
The reference clock is supposed to be 100Mhz, but it appears to actually be slightly lower (99.81Mhz).
--- drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/soc21.c +7 -1
@@ -225,7 +225,13 @@ static u32 soc21_get_config_memsize(strustatic u32 soc21_get_xclk (struct amdgpu_device *adev) { -return adev->clock.spll.reference_freq; +u32 reference_clock = adev->clock.spll.reference_freq; + +/* reference clock is actually 99.81 Mhz rather than 100 Mhz */ +if ((adev->flags &AMD_IS_APU ) && reference_clock ==10000 ) +return 9981 ; + +return reference_clock; }
Greg Kroah-Hartman
maintainerPATCH 62/87 drm/amdgpu/gfx10: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit cc4f433b14e05eaa4a98fd677b836e9229422387 upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +1 -1
@@ -6729,7 +6729,7 @@ static int gfx_v10_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 63/87 drm/amdgpu/gfx11: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +1 -1
@@ -4026,7 +4026,7 @@ static int gfx_v11_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 64/87 drm/amdgpu/gfx12: fix wptr reset in KGQ init
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 9077d32a4b570fa20500aa26e149981c366c965d upstream.
wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs.
--- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +1 -1
@@ -2958,7 +2958,7 @@ static int gfx_v12_0_kgq_init_queue(strumemcpy_toio (mqd, adev->gfx.me.mqd_backup[mqd_idx],sizeof (*mqd));/* reset the ring */ ring->wptr =0 ; - *ring->wptr_cpu_addr =0 ; +atomic64_set ((atomic64_t *)ring->wptr_cpu_addr,0 );amdgpu_ring_clear_ring (ring); }
Greg Kroah-Hartman
maintainerPATCH 65/87 drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Doron <[email protected]>
commit 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 upstream.
On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and ih2 interrupt ring buffers are not initialized. This is by design, as these secondary IH rings are only available on discrete GPUs. See vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when AMD_IS_APU is set.
However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to get the timestamp of the last interrupt entry. When retry faults are enabled on APUs (noretry=0), this function is called from the SVM page fault recovery path, resulting in a NULL pointer dereference when amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[].
The crash manifests as:
BUG: kernel NULL pointer dereference, address: 0000000000000004 RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu] Call Trace: amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu] svm_range_restore_pages+0xae5/0x11c0 [amdgpu] amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu] gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu] amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu] amdgpu_ih_process+0x84/0x100 [amdgpu]
This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1") which changed the default for Renoir APU from noretry=1 to noretry=0, enabling retry fault handling and thus exercising the buggy code path.
Fix this by adding a check for ih1.ring_size before attempting to use it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu:
Rework retry fault removal"). This is needed if the hardware doesn't support secondary HW IH rings.
v2: additional updates (Alex)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +6 -1
@@ -482,8 +482,13 @@ void amdgpu_gmc_filter_faults_remove(strif (adev->irq.retry_cam_enabled)return ; +else if (adev->irq.ih1.ring_size) + ih = &adev->irq.ih1; +else if (adev->irq.ih_soft.enabled) + ih = &adev->irq.ih_soft; +else +return ; - ih = &adev->irq.ih1;/* Get the WPTR of the last entry in IH ring */ last_wptr =amdgpu_ih_get_wptr (adev, ih);/* Order wptr with ring data. */
Greg Kroah-Hartman
maintainerPATCH 66/87 drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit b1defcdc4457649db236415ee618a7151e28788c upstream.
The EXEC_COUNT field must be > 0. In the gfx shadow handling we always emit a cond_exec packet after the gfx_shadow packet, but the EXEC_COUNT never gets patched. This leads to a hang when we try and reset queues on gfx11 APUs.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +3 -2
@@ -223,7 +223,7 @@ int amdgpu_ib_schedule(struct amdgpu_rinamdgpu_ring_ib_begin (ring); -if (ring->funcs->emit_gfx_shadow) +if (ring->funcs->emit_gfx_shadow && adev->gfx.cp_gfx_shadow)amdgpu_ring_emit_gfx_shadow (ring, shadow_va, csa_va, gds_va, init_shadow, vmid);
@@ -279,7 +279,8 @@ int amdgpu_ib_schedule(struct amdgpu_rin fence_flags | AMDGPU_FENCE_FLAG_64BIT); } -if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec) { +if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec && + adev->gfx.cp_gfx_shadow) {amdgpu_ring_emit_gfx_shadow (ring,0 ,0 ,0 , false,0 );amdgpu_ring_init_cond_exec (ring, ring->cond_exe_gpu_addr); }
Greg Kroah-Hartman
maintainerPATCH 67/87 gpiolib: acpi: Fix potential out-of-boundary left shift
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d upstream.
GPIO Address Space handler gets a pointer to the in or out value. This value is supposed to be at least 64-bit, but it's not limited to be exactly 64-bit. When ACPI tables are being parsed, for the bigger Connection():s ACPICA creates a Buffer instead of regular Integer object. The Buffer exists as long as Namespace holds the certain Connection(). Hence we can access the necessary bits without worrying. On the other hand, the left shift, used in the code, is limited by 31 (on 32-bit platforms) and otherwise considered to be Undefined Behaviour. Also the code uses only the first 64-bit word for the value, and anything bigger than 63 will be also subject to UB. Fix all this by modifying the code to correctly set or clear the respective bit in the bitmap constructed of 64-bit words.
--- drivers/gpio/gpiolib-acpi-core.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/gpio/gpiolib-acpi-core.c +17 -4
@@ -1094,6 +1094,7 @@ acpi_gpio_adr_space_handler(u32 functionunsigned int pin = agpio->pin_table[i];struct acpi_gpio_connection *conn;struct gpio_desc *desc; +u16 word, shift;bool found;mutex_lock (&achip->conn_lock);
@@ -1148,10 +1149,22 @@ acpi_gpio_adr_space_handler(u32 functionmutex_unlock (&achip->conn_lock); -if (function ==ACPI_WRITE ) -gpiod_set_raw_value_cansleep (desc, !!(*value &BIT_ULL (i))); -else - *value |= (u64 )gpiod_get_raw_value_cansleep (desc) << i; +/* +* For the cases when OperationRegion() consists of more than +* 64 bits calculate the word and bit shift to use that one to +* access the value. +*/ + word = i /64 ; + shift = i %64 ; + +if (function ==ACPI_WRITE ) { +gpiod_set_raw_value_cansleep (desc, value[word] &BIT_ULL (shift)); + }else { +if (gpiod_get_raw_value_cansleep (desc)) + value[word] |=BIT_ULL (shift); +else + value[word] &= ~BIT_ULL (shift); + } } out:
Greg Kroah-Hartman
maintainerPATCH 50/87 selftests: mptcp: join: fix local endp not being tracked
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc upstream.
When running this mptcp_join.sh selftest on older kernel versions not supporting local endpoints tracking, this test fails because 3 MP_JOIN ACKs have been received, while only 2 were expected.
It is not clear why only 2 MP_JOIN ACKs were expected on old kernel versions, while 3 MP_JOIN SYN and SYN+ACK were expected. When testing on the v5.15.197 kernel, 3 MP_JOIN ACKs are seen, which is also what is expected in the selftests included in this kernel version, see commit f4480eaad489 ("selftests: mptcp: add missing join check").
Switch the expected MP_JOIN ACKs to 3. While at it, move this chk_join_nr helper out of the special condition for older kernel versions as it is now the same as with more recent ones. Also, invert the condition to be more logical: what's expected on newer kernel versions having such helper first.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -5
@@ -2162,17 +2162,16 @@ signal_address_tests() ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1 speed=slow \ run_tests $ns1 $ns2 10.0.1.1 + chk_join_nr 3 3 3 # It is not directly linked to the commit introducing this # symbol but for the parent one which is linked anyway. - if ! mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then - chk_join_nr 3 3 2 - chk_add_nr 4 4 - else - chk_join_nr 3 3 3 + if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then # the server will not signal the address terminating # the MPC subflow chk_add_nr 3 3 + else + chk_add_nr 4 4 fi fi }
Greg Kroah-Hartman
maintainerPATCH 68/87 rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 789521b4717fd6bd85164ba5c131f621a79c9736 upstream.
Rust 1.93.0 (expected 2026-01-22) is stabilizing -Zno-jump-tables [1][2] as -Cjump-tables=n [3].
Without this change, one would eventually see:
RUSTC L rust/core.o
error: unknown unstable option: no-jump-tables
Thus support the upcoming version.
--- arch/x86/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Makefile +1 -1
@@ -109,7 +109,7 @@ ifeq ($(CONFIG_X86_KERNEL_IBT),y) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104816 # KBUILD_CFLAGS += $(call cc-option,-fcf-protection=branch -fno-jump-tables) -KBUILD_RUSTFLAGS += -Zcf-protection=branch -Zno-jump-tables +KBUILD_RUSTFLAGS += -Zcf-protection=branch $(if $(call rustc-min-version,109300),-Cjump-tables=n,-Zno-jump-tables) else KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) endif
Greg Kroah-Hartman
maintainerPATCH 69/87 cgroup: Fix kernfs_node UAF in css_free_rwork_fn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "T.J. Mercier" <[email protected]>
This fix patch is not upstream, and is applicable only to kernels 6.10 (where the cgroup_rstat_lock tracepoint was added) through 6.15 after which commit 5da3bfa029d6 ("cgroup: use separate rstat trees for each subsystem") reordered cgroup_rstat_flush as part of a new feature addition and inadvertently fixed this UAF.
css_free_rwork_fn first releases the last reference on the cgroup's kernfs_node, and then calls cgroup_rstat_exit which attempts to use it in the cgroup_rstat_lock tracepoint:
kernfs_put(cgrp->kn);cgroup_rstat_exit
cgroup_rstat_flush
__cgroup_rstat_lock
trace_cgroup_rstat_locked:
TP_fast_assign(
__entry->root = cgrp->root->hierarchy_id;
__entry->id = cgroup_id(cgrp);Where cgroup_id is:
static inline u64 cgroup_id(const struct cgroup *cgrp)
{
return cgrp->kn->id;
}Fix this by reordering the kernfs_put after cgroup_rstat_exit.
[78782.605161][ T9861] BUG: KASAN: slab-use-after-free in trace_event_raw_event_cgroup_rstat+0x110/0x1dc [78782.605182][ T9861] Read of size 8 at addr ffffff890270e610 by task kworker/6:1/9861 [78782.605199][ T9861] CPU: 6 UID: 0 PID: 9861 Comm: kworker/6:1 Tainted: G W OE 6.12.23-android16-5-gabaf21382e8f-4k #1 0308449da8ad70d2d3649ae989c1d02f0fbf562c [78782.605220][ T9861] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [78782.605226][ T9861] Hardware name: Qualcomm Technologies, Inc. Alor QRD + WCN7750 WLAN + Kundu PD2536F_EX (DT) [78782.605235][ T9861] Workqueue: cgroup_destroy css_free_rwork_fn [78782.605251][ T9861] Call trace: [78782.605254][ T9861] dump_backtrace+0x120/0x170 [78782.605267][ T9861] show_stack+0x2c/0x40 [78782.605276][ T9861] dump_stack_lvl+0x84/0xb4 [78782.605286][ T9861] print_report+0x144/0x7a4 [78782.605301][ T9861] kasan_report+0xe0/0x140 [78782.605315][ T9861] __asan_load8+0x98/0xa0 [78782.605329][ T9861] trace_event_raw_event_cgroup_rstat+0x110/0x1dc [78782.605339][ T9861] __traceiter_cgroup_rstat_locked+0x78/0xc4 [78782.605355][ T9861] __cgroup_rstat_lock+0xe8/0x1dc [78782.605368][ T9861] cgroup_rstat_flush_locked+0x7dc/0xaec [78782.605383][ T9861] cgroup_rstat_flush+0x34/0x108 [78782.605396][ T9861] cgroup_rstat_exit+0x2c/0x120 [78782.605409][ T9861] css_free_rwork_fn+0x504/0xa18 [78782.605421][ T9861] process_scheduled_works+0x378/0x8e0 [78782.605435][ T9861] worker_thread+0x5a8/0x77c [78782.605446][ T9861] kthread+0x1c4/0x270 [78782.605455][ T9861] ret_from_fork+0x10/0x20 [78782.605470][ T9861] Allocated by task 2864 on cpu 7 at 78781.564561s: [78782.605467][ C5] ENHANCE: rpm_suspend+0x93c/0xafc: 0:0:0:0 ret=0 [78782.605481][ T9861] kasan_save_track+0x44/0x9c [78782.605497][ T9861] kasan_save_alloc_info+0x40/0x54 [78782.605507][ T9861] __kasan_slab_alloc+0x70/0x8c [78782.605521][ T9861] kmem_cache_alloc_noprof+0x1a0/0x428 [78782.605534][ T9861] __kernfs_new_node+0xd4/0x3e4 [78782.605545][ T9861] kernfs_new_node+0xbc/0x168 [78782.605554][ T9861] kernfs_create_dir_ns+0x58/0xe8 [78782.605565][ T9861] cgroup_mkdir+0x25c/0xc9c [78782.605576][ T9861] kernfs_iop_mkdir+0x130/0x214 [78782.605586][ T9861] vfs_mkdir+0x290/0x388 [78782.605599][ T9861] do_mkdirat+0xfc/0x27c [78782.605612][ T9861] __arm64_sys_mkdirat+0x5c/0x78 [78782.605625][ T9861] invoke_syscall+0x90/0x1e8 [78782.605634][ T9861] el0_svc_common+0x134/0x168 [78782.605643][ T9861] do_el0_svc+0x34/0x44 [78782.605652][ T9861] el0_svc+0x38/0x84 [78782.605667][ T9861] el0t_64_sync_handler+0x70/0xbc [78782.605681][ T9861] el0t_64_sync+0x19c/0x1a0 [78782.605695][ T9861] Freed by task 69 on cpu 1 at 78782.573275s: [78782.605705][ T9861] kasan_save_track+0x44/0x9c [78782.605719][ T9861] kasan_save_free_info+0x54/0x70 [78782.605729][ T9861] __kasan_slab_free+0x68/0x8c [78782.605743][ T9861] kmem_cache_free+0x118/0x488 [78782.605755][ T9861] kernfs_free_rcu+0xa0/0xb8 [78782.605765][ T9861] rcu_do_batch+0x324/0xaa0 [78782.605775][ T9861] rcu_nocb_cb_kthread+0x388/0x690 [78782.605785][ T9861] kthread+0x1c4/0x270 [78782.605794][ T9861] ret_from_fork+0x10/0x20 [78782.605809][ T9861] Last potentially related work creation: [78782.605814][ T9861] kasan_save_stack+0x40/0x70 [78782.605829][ T9861] __kasan_record_aux_stack+0xb0/0xcc [78782.605839][ T9861] kasan_record_aux_stack_noalloc+0x14/0x24 [78782.605849][ T9861] __call_rcu_common+0x54/0x390 [78782.605863][ T9861] call_rcu+0x18/0x28 [78782.605875][ T9861] kernfs_put+0x17c/0x28c [78782.605884][ T9861] css_free_rwork_fn+0x4f4/0xa18 [78782.605897][ T9861] process_scheduled_works+0x378/0x8e0 [78782.605910][ T9861] worker_thread+0x5a8/0x77c [78782.605923][ T9861] kthread+0x1c4/0x270 [78782.605932][ T9861] ret_from_fork+0x10/0x20 [78782.605947][ T9861] The buggy address belongs to the object at ffffff890270e5b0 [78782.605947][ T9861] which belongs to the cache kernfs_node_cache of size 144 [78782.605957][ T9861] The buggy address is located 96 bytes inside of [78782.605957][ T9861] freed 144-byte region [ffffff890270e5b0, ffffff890270e640)
--- kernel/cgroup/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/cgroup/cgroup.c +1 -1
@@ -5481,9 +5481,9 @@ static void css_free_rwork_fn(struct wor* children. */ cgroup_put (cgroup_parent (cgrp)); -kernfs_put (cgrp->kn);psi_cgroup_free (cgrp);cgroup_rstat_exit (cgrp); +kernfs_put (cgrp->kn);kfree (cgrp); }else {/*
Greg Kroah-Hartman
maintainerPATCH 70/87 rxrpc: Fix data-race warning and potential load/store tearing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b ]
Fix the following:
BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet
which is reporting an issue with the reads and writes to ->last_tx_at in:
conn->peer->last_tx_at = ktime_get_seconds();
and:
keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;
The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet.
Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch.
Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission.
--- net/rxrpc/ar-internal.h | 9 ++++++++- net/rxrpc/conn_event.c | 2 +- net/rxrpc/output.c | 10 +++++----- net/rxrpc/peer_event.c | 17 ++++++++++++++++- net/rxrpc/proc.c | 4 ++-- net/rxrpc/rxkad.c | 4 ++-- 6 files changed, 34 insertions(+), 12 deletions(-)
net/rxrpc/ar-internal.h +8 -1
@@ -335,7 +335,7 @@ struct rxrpc_peer {struct hlist_head error_targets;/* targets for net error distribution */ struct rb_root service_conns;/* Service connections */ struct list_head keepalive_link;/* Link in net->peer_keepalive[] */ -time64_t last_tx_at;/* Last time packet sent here */ +unsigned int last_tx_at;/* Last time packet sent here (time64_t LSW) */ seqlock_t service_conn_lock;spinlock_t lock;/* access lock */ unsigned int if_mtu;/* interface MTU for this peer */
@@ -1161,6 +1161,13 @@ void rxrpc_transmit_one(struct rxrpc_calvoid rxrpc_input_error (struct rxrpc_local *,struct sk_buff *);void rxrpc_peer_keepalive_worker (struct work_struct *); +/* Update the last transmission time on a peer for keepalive purposes. */ +static inline void rxrpc_peer_mark_tx (struct rxrpc_peer *peer) +{ +/* To avoid tearing on 32-bit systems, we only keep the LSW. */ +WRITE_ONCE (peer->last_tx_at,ktime_get_seconds ()); +} +/* * peer_object.c */
net/rxrpc/conn_event.c +1 -1
@@ -180,7 +180,7 @@ void rxrpc_conn_retransmit_call(struct r } ret =kernel_sendmsg (conn->local->socket, &msg, iov, ioc, len); - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer);if (ret <0 )trace_rxrpc_tx_fail (chan->call_debug_id, serial, ret, rxrpc_tx_point_call_final_resend);
net/rxrpc/output.c +5 -5
@@ -209,7 +209,7 @@ static void rxrpc_send_ack_packet(structiov_iter_kvec (&msg.msg_iter,WRITE , txb->kvec, txb->nr_kvec, txb->len);rxrpc_local_dont_fragment (conn->local, false); ret =do_udp_sendmsg (conn->local->socket, &msg, txb->len); - call->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (call->peer);if (ret <0 ) {trace_rxrpc_tx_fail (call->debug_id, txb->serial, ret, rxrpc_tx_point_call_ack);
@@ -310,7 +310,7 @@ int rxrpc_send_abort_packet(struct rxrpciov_iter_kvec (&msg.msg_iter,WRITE , iov,1 ,sizeof (pkt)); ret =do_udp_sendmsg (conn->local->socket, &msg,sizeof (pkt)); - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer);if (ret <0 )trace_rxrpc_tx_fail (call->debug_id, serial, ret, rxrpc_tx_point_call_abort);
@@ -486,7 +486,7 @@ retry:*/ rxrpc_inc_stat (call->rxnet, stat_tx_data_send); ret =do_udp_sendmsg (conn->local->socket, &msg, len); - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer);if (ret <0 ) {rxrpc_inc_stat (call->rxnet, stat_tx_data_send_fail);
@@ -573,7 +573,7 @@ void rxrpc_send_conn_abort(struct rxrpc_trace_rxrpc_tx_packet (conn->debug_id, &whdr, rxrpc_tx_point_conn_abort); - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer); }/*
@@ -692,7 +692,7 @@ void rxrpc_send_keepalive(struct rxrpc_ptrace_rxrpc_tx_packet (peer->debug_id, &whdr, rxrpc_tx_point_version_keepalive); - peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (peer);_leave ("" ); }
net/rxrpc/peer_event.c +16 -1
@@ -225,6 +225,21 @@ static void rxrpc_distribute_error(struc }/* +* Reconstruct the last transmission time. The difference calculated should be +* valid provided no more than ~68 years elapsed since the last transmission. +*/ +static time64_t rxrpc_peer_get_tx_mark (const struct rxrpc_peer *peer,time64_t base) +{ +s32 last_tx_at =READ_ONCE (peer->last_tx_at); +s32 base_lsw = base; +s32 diff = last_tx_at - base_lsw; + + diff =clamp (diff, -RXRPC_KEEPALIVE_TIME ,RXRPC_KEEPALIVE_TIME ); + +return diff + base; +} + +/* * Perform keep-alive pings. */ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
@@ -252,7 +267,7 @@ static void rxrpc_peer_keepalive_dispatcspin_unlock_bh (&rxnet->peer_hash_lock);if (use) { - keepalive_at = peer->last_tx_at +RXRPC_KEEPALIVE_TIME ; + keepalive_at =rxrpc_peer_get_tx_mark (peer, base) +RXRPC_KEEPALIVE_TIME ; slot = keepalive_at - base;_debug ("%02x peer %u t=%d {%pISp}" , cursor, peer->debug_id, slot, &peer->srx.transport);
net/rxrpc/proc.c +2 -2
@@ -299,13 +299,13 @@ static int rxrpc_peer_seq_show(struct se now =ktime_get_seconds ();seq_printf (seq,"UDP %-47.47s %-47.47s %3u" -" %3u %5u %6llus %8u %8u\n" , +" %3u %5u %6ds %8u %8u\n" , lbuff, rbuff,refcount_read (&peer->ref), peer->cong_ssthresh, peer->mtu, - now - peer->last_tx_at, + (s32 )now - (s32 )READ_ONCE (peer->last_tx_at), peer->srtt_us >>3 , peer->rto_us);
net/rxrpc/rxkad.c +2 -2
@@ -676,7 +676,7 @@ static int rxkad_issue_challenge(structreturn -EAGAIN ; } - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer);trace_rxrpc_tx_packet (conn->debug_id, &whdr, rxrpc_tx_point_rxkad_challenge);_leave (" = 0" );
@@ -734,7 +734,7 @@ static int rxkad_send_response(struct rxreturn -EAGAIN ; } - conn->peer->last_tx_at =ktime_get_seconds (); +rxrpc_peer_mark_tx (conn->peer);_leave (" = 0" );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 71/87 ksmbd: smbd: fix dma_unmap_sg() nents
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <[email protected]>
[ Upstream commit 98e3e2b561bc88f4dd218d1c05890672874692f6 ]
The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.
--- fs/smb/server/transport_rdma.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
fs/smb/server/transport_rdma.c +7 -8
@@ -1108,14 +1108,12 @@ static int get_sg_list(void *buf, int sistatic int get_mapped_sg_list (struct ib_device *device,void *buf,int size,struct scatterlist *sg_list,int nentries, -enum dma_data_direction dir) +enum dma_data_direction dir,int *npages) { -int npages; - - npages =get_sg_list (buf, size, sg_list, nentries); -if (npages <0 ) + *npages =get_sg_list (buf, size, sg_list, nentries); +if (*npages <0 )return -EINVAL ; -return ib_dma_map_sg (device, sg_list, npages, dir); +return ib_dma_map_sg (device, sg_list, *npages, dir); } static int post_sendmsg(struct smb_direct_transport *t,
@@ -1184,12 +1182,13 @@ static int smb_direct_post_send_data(strfor (i =0 ; i < niov; i++) {struct ib_sge *sge;int sg_cnt; +int npages;sg_init_table (sg,SMB_DIRECT_MAX_SEND_SGES -1 ); sg_cnt =get_mapped_sg_list (t->cm_id->device, iov[i].iov_base, iov[i].iov_len, sg,SMB_DIRECT_MAX_SEND_SGES -1 , -DMA_TO_DEVICE ); +DMA_TO_DEVICE , &npages);if (sg_cnt <=0 ) {pr_err ("failed to map buffer\n" ); ret = -ENOMEM ;
@@ -1197,7 +1196,7 @@ static int smb_direct_post_send_data(str }else if (sg_cnt + msg->num_sge >SMB_DIRECT_MAX_SEND_SGES ) {pr_err ("buffer not fitted into sges\n" ); ret = -E2BIG ; -ib_dma_unmap_sg (t->cm_id->device, sg, sg_cnt, +ib_dma_unmap_sg (t->cm_id->device, sg, npages,DMA_TO_DEVICE ); goto err; }
Greg Kroah-Hartman
maintainerPATCH 72/87 libbpf: Fix -Wdiscarded-qualifiers under C23
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <[email protected]>
commit d70f79fef65810faf64dbae1f3a1b5623cdb2345 upstream.
glibc ≥ 2.42 (GCC 15) defaults to -std=gnu23, which promotes -Wdiscarded-qualifiers to an error.
In C23, strstr() and strchr() return "const char *".
Change variable types to const char * where the pointers are never modified (res, sym_sfx, next_path).
[ shung-hsi.yu: needed to fix kernel build failure due to libbpf since glibc
2.43+ (which adds 'const' qualifier to strstr). 'sym_sfx' hunk dropped because commit f8a05692de06 ("libbpf: Work around kernel inconsistently stripping '.llvm.' suffix") is not present. ]
--- tools/lib/bpf/libbpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/lib/bpf/libbpf.c +2 -2
@@ -8174,7 +8174,7 @@ static int kallsyms_cb(unsigned long lonstruct bpf_object *obj = ctx;const struct btf_type *t;struct extern_desc *ext; -char *res; +const char *res; res =strstr (sym_name,".llvm." );if (sym_type =='d' && res)
@@ -11959,7 +11959,7 @@ static int resolve_full_path(const charif (!search_paths[i])continue ;for (s = search_paths[i]; s !=NULL ; s =strchr (s,':' )) { -char *next_path; +const char *next_path;int seg_len;if (s[0 ] ==':' )
Greg Kroah-Hartman
maintainerPATCH 73/87 mm/kfence: randomize the freelist on initialization
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pimyn Girgis <[email protected]>
commit 870ff19251bf3910dda7a7245da826924045fedd upstream.
Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below().
Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop.
--- mm/kfence/core.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
mm/kfence/core.c +19 -4
@@ -596,7 +596,7 @@ static unsigned long kfence_init_pool(vo {unsigned long addr;struct page *pages; -int i; +int i, rand;if (!arch_kfence_init_pool ())return (unsigned long )__kfence_pool;
@@ -645,13 +645,27 @@ static unsigned long kfence_init_pool(voINIT_LIST_HEAD (&meta->list);raw_spin_lock_init (&meta->lock); meta->state =KFENCE_OBJECT_UNUSED ; - meta->addr = addr;/* Initialize for validation in metadata_to_pageaddr(). */ -list_add_tail (&meta->list, &kfence_freelist); +/* Use addr to randomize the freelist. */ + meta->addr = i;/* Protect the right redzone. */ -if (unlikely (!kfence_protect (addr +PAGE_SIZE ))) +if (unlikely (!kfence_protect (addr +2 * i *PAGE_SIZE +PAGE_SIZE ))) goto reset_slab; + } + +for (i =CONFIG_KFENCE_NUM_OBJECTS ; i >0 ; i--) { + rand =get_random_u32_below (i); +swap (kfence_metadata_init[i -1 ].addr, kfence_metadata_init[rand].addr); + } +for (i =0 ; i <CONFIG_KFENCE_NUM_OBJECTS ; i++) { +struct kfence_metadata *meta_1 = &kfence_metadata_init[i]; +struct kfence_metadata *meta_2 = &kfence_metadata_init[meta_1->addr]; + +list_add_tail (&meta_2->list, &kfence_freelist); + } +for (i =0 ; i <CONFIG_KFENCE_NUM_OBJECTS ; i++) { + kfence_metadata_init[i].addr = addr; addr +=2 *PAGE_SIZE ; }
@@ -664,6 +678,7 @@ static unsigned long kfence_init_pool(voreturn 0 ; reset_slab: + addr +=2 * i *PAGE_SIZE ;for (i =0 ; i <KFENCE_POOL_SIZE /PAGE_SIZE ; i++) {struct slab *slab =page_slab (nth_page (pages, i));
Greg Kroah-Hartman
maintainerPATCH 74/87 wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <[email protected]>
[ Upstream commit 63b7af49496d0e32f7a748b6af3361ec138b1bd3 ]
ath11k_hal_srng_* should be used with srng->lock to protect srng data.
For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(), they use ath11k_hal_srng_* for many times but never call srng->lock.
So when running (full) monitor mode, warning will occur:
RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] Call Trace: ? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k] ? idr_alloc_u32+0x97/0xd0 ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k] ath11k_dp_service_srng+0x289/0x5a0 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k] __napi_poll+0x30/0x1f0 net_rx_action+0x198/0x320 __do_softirq+0xdd/0x319
So add srng->lock for them to avoid such warnings.
Inorder to fetch the srng->lock, should change srng's definition from 'void' to 'struct hal_srng'. And initialize them elsewhere to prevent one line of code from being too long. This is consistent with other ring process functions, such as ath11k_dp_process_rx().
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +8 -2
@@ -5142,7 +5142,7 @@ static void ath11k_dp_rx_mon_dest_processtruct ath11k_mon_data *pmon = (struct ath11k_mon_data *)&dp->mon_data;const struct ath11k_hw_hal_params *hal_params;void *ring_entry; -void *mon_dst_srng; +struct hal_srng *mon_dst_srng;u32 ppdu_id;u32 rx_bufs_used;u32 ring_id;
@@ -5159,6 +5159,7 @@ static void ath11k_dp_rx_mon_dest_processpin_lock_bh (&pmon->mon_lock); +spin_lock_bh (&mon_dst_srng->lock);ath11k_hal_srng_access_begin (ar->ab, mon_dst_srng); ppdu_id = pmon->mon_ppdu_info.ppdu_id;
@@ -5217,6 +5218,7 @@ static void ath11k_dp_rx_mon_dest_proces mon_dst_srng); }ath11k_hal_srng_access_end (ar->ab, mon_dst_srng); +spin_unlock_bh (&mon_dst_srng->lock);spin_unlock_bh (&pmon->mon_lock);
@@ -5606,7 +5608,7 @@ static int ath11k_dp_full_mon_process_rxstruct hal_sw_mon_ring_entries *sw_mon_entries;struct ath11k_pdev_mon_stats *rx_mon_stats;struct sk_buff *head_msdu, *tail_msdu; -void *mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id]; +struct hal_srng *mon_dst_srng;void *ring_entry;u32 rx_bufs_used =0 , mpdu_rx_bufs_used;int quota =0 , ret;
@@ -5622,6 +5624,9 @@ static int ath11k_dp_full_mon_process_rx goto reap_status_ring; } + mon_dst_srng = &ar->ab->hal.srng_list[dp->rxdma_mon_dst_ring.ring_id]; +spin_lock_bh (&mon_dst_srng->lock); +ath11k_hal_srng_access_begin (ar->ab, mon_dst_srng);while ((ring_entry =ath11k_hal_srng_dst_peek (ar->ab, mon_dst_srng))) { head_msdu =NULL ;
@@ -5665,6 +5670,7 @@ next_entry: }ath11k_hal_srng_access_end (ar->ab, mon_dst_srng); +spin_unlock_bh (&mon_dst_srng->lock);spin_unlock_bh (&pmon->mon_lock);if (rx_bufs_used) {
Greg Kroah-Hartman
maintainerPATCH 75/87 Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
commit 6c65db809796717f0a96cf22f80405dbc1a31a4b upstream.
This reverts commit 604826acb3f53c6648a7ee99a3914ead680ab7fb.
Apparently there is more to supporting atomic modesetting than providing atomic_(check|commit) callbacks. Before this revert:
WARNING: [] drivers/gpu/drm/drm_plane.c:389 at .__drm_universal_plane_init+0x13c/0x794 [drm], CPU#1: modprobe/1790
BUG: Kernel NULL pointer dereference on read at 0x00000000 .drm_atomic_get_plane_state+0xd4/0x210 [drm] (unreliable) .drm_client_modeset_commit_atomic+0xf8/0x338 [drm] .drm_client_modeset_commit_locked+0x80/0x260 [drm] .drm_client_modeset_commit+0x40/0x7c [drm] .__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0xfc/0x108 [drm_kms_helper] .drm_fb_helper_set_par+0x8c/0xb8 [drm_kms_helper] .fbcon_init+0x31c/0x618 [...] .__drm_fb_helper_initial_config_and_unlock+0x474/0x7f4 [drm_kms_helper] .drm_fbdev_client_hotplug+0xb0/0x120 [drm_client_lib] .drm_client_register+0x88/0xe4 [drm] .drm_fbdev_client_setup+0x12c/0x19b4 [drm_client_lib] .drm_client_setup+0x15c/0x18c [drm_client_lib] .nouveau_drm_probe+0x19c/0x268 [nouveau]
--- drivers/gpu/drm/nouveau/nouveau_display.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/nouveau/nouveau_display.c +0 -2
@@ -391,8 +391,6 @@ nouveau_user_framebuffer_create(struct dstatic const struct drm_mode_config_funcs nouveau_mode_config_funcs = { .fb_create = nouveau_user_framebuffer_create, - .atomic_commit = drm_atomic_helper_commit, - .atomic_check = drm_atomic_helper_check, };
Greg Kroah-Hartman
maintainerPATCH 76/87 btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn <[email protected]>
This is a stable-only patch. The issue was inadvertently fixed in 6.17 [0] as part of a refactoring, but this patch serves as a minimal targeted fix for prior kernels.
Users of filemap_lock_folio() need to guard against the situation where release_folio() has been invoked during reclaim but the folio was ultimately not removed from the page cache. This patch covers one location that was overlooked.
After acquiring the folio, use set_folio_extent_mapped() to ensure the folio private state is valid. This is especially important in the subpage case, where the private field is an allocated struct containing bitmap and lock data.
Without this protection, the race below is possible:
[mm] page cache reclaim path [fs] relocation in subpage modeshrink_folio_list()
folio_trylock() /* lock acquired */ filemap_release_folio()
mapping->a_ops->release_folio()
btrfs_release_folio()
__btrfs_release_folio()
clear_folio_extent_mapped()
btrfs_detach_subpage()
subpage = folio_detach_private(folio) btrfs_free_subpage(subpage)
kfree(subpage) /* point A */
prealloc_file_extent_cluster()
filemap_lock_folio()
folio_try_get() /* inc refcount */ folio_lock() /* wait for lock */
if (...)
...
else if (!mapping || !__remove_mapping(..))
/*
* __remove_mapping() returns zero when
* folio_ref_freeze(folio, refcount) fails /* point B */ */
goto keep_locked /* folio remains in cache */
keep_locked:
folio_unlock(folio) /* lock released */
/* lock acquired */
btrfs_subpage_clear_uptodate()
/* use-after-free */
subpage = folio_get_private(folio)[0] 4e346baee95f ("btrfs: reloc: unconditionally invalidate the page cache for each cluster")
--- fs/btrfs/relocation.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/btrfs/relocation.c +14 -0
@@ -2811,6 +2811,20 @@ static noinline_for_stack int prealloc_f* will re-read the whole page anyway. */ if (!IS_ERR (folio)) { +/* +* release_folio() could have cleared the folio private data +* while we were not holding the lock. Reset the mapping if +* needed so subpage operations can access a valid private +* folio state. +*/ + ret =set_folio_extent_mapped (folio); +if (ret) { +folio_unlock (folio); +folio_put (folio); + +return ret; + } +btrfs_subpage_clear_uptodate (fs_info, folio, i_size,round_up (i_size,PAGE_SIZE ) - i_size);folio_unlock (folio);
Greg Kroah-Hartman
maintainerPATCH 77/87 net/sched: act_ife: convert comma to semicolon
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
commit 205305c028ad986d0649b8b100bab6032dcd1bb5 upstream.
Replace comma between expressions with semicolons.
Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended.
Found by inspection.
No functional change intended.
Compile tested only.
--- net/sched/act_ife.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/sched/act_ife.c +3 -3
@@ -649,9 +649,9 @@ static int tcf_ife_dump(struct sk_buff *memset (&opt,0 ,sizeof (opt)); - opt.index = ife->tcf_index, - opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref, - opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, + opt.index = ife->tcf_index; + opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref; + opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind;spin_lock_bh (&ife->tcf_lock); opt.action = ife->tcf_action;
Greg Kroah-Hartman
maintainerPATCH 51/87 flex_proportions: make fprop_new_period() hardirq safe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream.
Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race:
<timer fires>run_timer_softirq - we are in softirq context
call_timer_fn
writeout_period
fprop_new_period
write_seqcount_begin(&p->sequence);
<hardirq is raised>
...
blk_mq_end_request()
blk_update_request()
ext4_end_bio()
folio_end_writeback()
__wb_writeout_add()
__fprop_add_percpu_max()
if (unlikely(max_frac < FPROP_FRAC_BASE)) {
fprop_fraction_percpu()
seq = read_seqcount_begin(&p->sequence);
- sees odd sequence so loops indefinitelyNote that a deadlock like this is only possible if the bdi has configured maximum fraction of writeout throughput which is very rare in general but frequent for example for FUSE bdis. To fix this problem we have to make sure write section of the sequence counter is irqsafe.
--- lib/flex_proportions.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/flex_proportions.c +3 -2
@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_gbool fprop_new_period (struct fprop_global *p,int periods) {s64 events =percpu_counter_sum (&p->events); +unsigned long flags;/* * Don't do anything if there are no events. */ if (events <=1 )return false; -preempt_disable_nested (); +local_irq_save (flags);write_seqcount_begin (&p->sequence);if (periods <64 ) events -= events >> periods;
@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_globapercpu_counter_add (&p->events, -events); p->period += periods;write_seqcount_end (&p->sequence); -preempt_enable_nested (); +local_irq_restore (flags);return true; }
Greg Kroah-Hartman
maintainerPATCH 78/87 pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 1fbe3abb449c5ef2178e1c3e3e8b9a43a7a410ac ]
Qualcomm SC7280 and SM8350 SoCs have slightly different LPASS audio blocks (v9.4.5 and v9.2), however the LPASS LPI pin controllers are exactly the same. The driver for SM8350 has two issues, which can be fixed by simply moving over to SC7280 driver which has them correct:
1. "i2s2_data_groups" listed twice GPIO12, but should have both GPIO12 and GPIO13,
2. "swr_tx_data_groups" contained GPIO5 for "swr_tx_data2" function, but that function is also available on GPIO14, thus listing it twice is not necessary. OTOH, GPIO5 has also "swr_rx_data1", so selecting swr_rx_data function should not block the TX one.
--- arch/arm64/configs/defconfig | 1 drivers/pinctrl/qcom/Kconfig | 15 -- drivers/pinctrl/qcom/Makefile | 1 drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c | 3 drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c | 151 ------------------------ 5 files changed, 6 insertions(+), 165 deletions(-) delete mode 100644 drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c
arch/arm64/configs/defconfig +0 -1
@@ -635,7 +635,6 @@ CONFIG_PINCTRL_LPASS_LPI=m CONFIG_PINCTRL_SC7280_LPASS_LPI=m CONFIG_PINCTRL_SM6115_LPASS_LPI=m CONFIG_PINCTRL_SM8250_LPASS_LPI=m -CONFIG_PINCTRL_SM8350_LPASS_LPI=m CONFIG_PINCTRL_SM8450_LPASS_LPI=m CONFIG_PINCTRL_SC8280XP_LPASS_LPI=m CONFIG_PINCTRL_SM8550_LPASS_LPI=m
drivers/pinctrl/qcom/Kconfig +3 -12
@@ -60,13 +60,14 @@ config PINCTRL_LPASS_LPI (Low Power Island) found on the Qualcomm Technologies Inc SoCs. config PINCTRL_SC7280_LPASS_LPI - tristate "Qualcomm Technologies Inc SC7280 LPASS LPI pin controller driver" + tristate "Qualcomm Technologies Inc SC7280 and SM8350 LPASS LPI pin controller driver" depends on ARM64 || COMPILE_TEST depends on PINCTRL_LPASS_LPI help This is the pinctrl, pinmux, pinconf and gpiolib driver for the Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI - (Low Power Island) found on the Qualcomm Technologies Inc SC7280 platform. + (Low Power Island) found on the Qualcomm Technologies Inc SC7280 + and SM8350 platforms. config PINCTRL_SM4250_LPASS_LPI tristate "Qualcomm Technologies Inc SM4250 LPASS LPI pin controller driver"
@@ -95,16 +96,6 @@ config PINCTRL_SM8250_LPASS_LPI Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI (Low Power Island) found on the Qualcomm Technologies Inc SM8250 platform. -config PINCTRL_SM8350_LPASS_LPI - tristate "Qualcomm Technologies Inc SM8350 LPASS LPI pin controller driver" - depends on ARM64 || COMPILE_TEST - depends on PINCTRL_LPASS_LPI - help - This is the pinctrl, pinmux, pinconf and gpiolib driver for the - Qualcomm Technologies Inc LPASS (Low Power Audio SubSystem) LPI - (Low Power Island) found on the Qualcomm Technologies Inc SM8350 - platform. - config PINCTRL_SM8450_LPASS_LPI tristate "Qualcomm Technologies Inc SM8450 LPASS LPI pin controller driver" depends on ARM64 || COMPILE_TEST
drivers/pinctrl/qcom/Makefile +0 -1
@@ -55,7 +55,6 @@ obj-$(CONFIG_PINCTRL_SM8150) += pinctrl- obj-$(CONFIG_PINCTRL_SM8250) += pinctrl-sm8250.o obj-$(CONFIG_PINCTRL_SM8250_LPASS_LPI) += pinctrl-sm8250-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8350) += pinctrl-sm8350.o -obj-$(CONFIG_PINCTRL_SM8350_LPASS_LPI) += pinctrl-sm8350-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8450) += pinctrl-sm8450.o obj-$(CONFIG_PINCTRL_SM8450_LPASS_LPI) += pinctrl-sm8450-lpass-lpi.o obj-$(CONFIG_PINCTRL_SM8550) += pinctrl-sm8550.o
drivers/pinctrl/qcom/pinctrl-sc7280-lpass-lpi.c +3 -0
@@ -131,6 +131,9 @@ static const struct of_device_id lpi_pin { .compatible = "qcom,sc7280-lpass-lpi-pinctrl", .data = &sc7280_lpi_data, + }, { + .compatible = "qcom,sm8350-lpass-lpi-pinctrl", + .data = &sc7280_lpi_data, }, { } };
drivers/pinctrl/qcom/pinctrl-sm8350-lpass-lpi.c deleted +0 -151
151 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 79/87 mptcp: avoid dup SUB_CLOSED events after disconnect
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <[email protected]>
[ Upstream commit 280d654324e33f8e6e3641f76764694c7b64c5db ]
In case of subflow disconnect(), which can also happen with the first subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset will reset most fields from the mptcp_subflow_context structure, including close_event_done. Then, when another subflow is closed, yet another SUB_CLOSED event for the disconnected initial subflow is sent. Because of the previous reset, there are no source address and destination port.
A solution is then to also check the subflow's local id: it shouldn't be negative anyway.
Another solution would be not to reset subflow->close_event_done at disconnect time, but when reused. But then, probably the whole reset could be done when being reused. Let's not change this logic, similar to TCP with tcp_disconnect().
--- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +2 -2
@@ -2591,8 +2591,8 @@ out:void mptcp_close_ssk (struct sock *sk,struct sock *ssk,struct mptcp_subflow_context *subflow) { -/* The first subflow can already be closed and still in the list */ -if (subflow->close_event_done) +/* The first subflow can already be closed or disconnected */ +if (subflow->close_event_done ||READ_ONCE (subflow->local_id) <0 )return ; subflow->close_event_done = true;
Greg Kroah-Hartman
maintainerPATCH 80/87 perf: Simplify get_perf_callchain() user logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit d77e3319e31098a6cb97b7ce4e71ba676e327fd7 ]
Simplify the get_perf_callchain() user logic a bit. task_pt_regs() should never be NULL.
Stable-dep-of: 76ed27608f7d ("perf: sched: Fix perf crash with new is_user_task() helper")
--- kernel/events/callchain.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
kernel/events/callchain.c +8 -10
@@ -246,21 +246,19 @@ get_perf_callchain(struct pt_regs *regs,if (user && !crosstask) {if (!user_mode (regs)) {if (current->flags & (PF_KTHREAD |PF_USER_WORKER )) - regs =NULL ; -else - regs =task_pt_regs (current); + goto exit_put; + regs =task_pt_regs (current); } -if (regs) { -if (add_mark) -perf_callchain_store_context (&ctx,PERF_CONTEXT_USER ); +if (add_mark) +perf_callchain_store_context (&ctx,PERF_CONTEXT_USER ); - start_entry_idx = entry->nr; -perf_callchain_user (&ctx, regs); -fixup_uretprobe_trampoline_entries (entry, start_entry_idx); - } + start_entry_idx = entry->nr; +perf_callchain_user (&ctx, regs); +fixup_uretprobe_trampoline_entries (entry, start_entry_idx); } +exit_put:put_callchain_entry (rctx);return entry;
Greg Kroah-Hartman
maintainerPATCH 81/87 perf: sched: Fix perf crash with new is_user_task() helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit 76ed27608f7dd235b727ebbb12163438c2fbb617 ]
In order to do a user space stacktrace the current task needs to be a user task that has executed in user space. It use to be possible to test if a task is a user task or not by simply checking the task_struct mm field. If it was non NULL, it was a user task and if not it was a kernel task.
But things have changed over time, and some kernel tasks now have their own mm field.
An idea was made to instead test PF_KTHREAD and two functions were used to wrap this check in case it became more complex to test if a task was a user task or not[1]. But this was rejected and the C code simply checked the PF_KTHREAD directly.
It was later found that not all kernel threads set PF_KTHREAD. The io-uring helpers instead set PF_USER_WORKER and this needed to be added as well.
But checking the flags is still not enough. There's a very small window when a task exits that it frees its mm field and it is set back to NULL. If perf were to trigger at this moment, the flags test would say its a user space task but when perf would read the mm field it would crash with at NULL pointer dereference.
Now there are flags that can be used to test if a task is exiting, but they are set in areas that perf may still want to profile the user space task (to see where it exited). The only real test is to check both the flags and the mm field.
Instead of making this modification in every location, create a new is_user_task() helper function that does all the tests needed to know if it is safe to read the user space memory or not.
[1] https://lore.kernel.org/all/[email protected]/
--- include/linux/sched.h | 5 +++++ kernel/events/callchain.c | 2 +- kernel/events/core.c | 6 +++--- 3 files changed, 9 insertions(+), 4 deletions(-)
include/linux/sched.h +5 -0
@@ -1739,6 +1739,11 @@ static __always_inline bool is_percpu_th#endif } +static __always_inline bool is_user_task(struct task_struct *task) +{ +return task->mm && !(task->flags & (PF_KTHREAD |PF_USER_WORKER )); +} +/* Per-process atomic flags. */ #define PFA_NO_NEW_PRIVS 0/* May not gain new privileges. */ #define PFA_SPREAD_PAGE 1/* Spread page cache over cpuset */
kernel/events/callchain.c +1 -1
@@ -245,7 +245,7 @@ get_perf_callchain(struct pt_regs *regs,if (user && !crosstask) {if (!user_mode (regs)) { -if (current->flags & (PF_KTHREAD |PF_USER_WORKER )) +if (!is_user_task (current)) goto exit_put; regs =task_pt_regs (current); }
kernel/events/core.c +3 -3
@@ -7095,7 +7095,7 @@ static void perf_sample_regs_user(structif (user_mode (regs)) { regs_user->abi =perf_reg_abi (current); regs_user->regs = regs; - }else if (!(current->flags & (PF_KTHREAD |PF_USER_WORKER ))) { + }else if (is_user_task (current)) {perf_get_regs_user (regs_user, regs); }else { regs_user->abi =PERF_SAMPLE_REGS_ABI_NONE ;
@@ -7735,7 +7735,7 @@ static u64 perf_virt_to_phys(u64 virt)* Try IRQ-safe get_user_page_fast_only first. * If failed, leave phys_addr as 0. */ -if (!(current->flags & (PF_KTHREAD |PF_USER_WORKER ))) { +if (is_user_task (current)) {struct page *p;pagefault_disable ();
@@ -7848,7 +7848,7 @@ perf_callchain(struct perf_event *event, {bool kernel = !event->attr.exclude_callchain_kernel;bool user = !event->attr.exclude_callchain_user && - !(current->flags & (PF_KTHREAD |PF_USER_WORKER )); +is_user_task (current);/* Disallow cross-task user callchains. */ bool crosstask = event->ctx->task && event->ctx->task != current;const u32 max_stack = event->attr.sample_max_stack;
Greg Kroah-Hartman
maintainerPATCH 82/87 writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laveesh Bansal <[email protected]>
[ Upstream commit 543467d6fe97e27e22a26e367fda972dbefebbff ]
When vm.dirtytime_expire_seconds is set to 0, wakeup_dirtytime_writeback() schedules delayed work with a delay of 0, causing immediate execution. The function then reschedules itself with 0 delay again, creating an infinite busy loop that causes 100% kworker CPU usage.
Fix by:
- Only scheduling delayed work in wakeup_dirtytime_writeback() when dirtytime_expire_interval is non-zero
- Cancelling the delayed work in dirtytime_interval_handler() when the interval is set to 0
- Adding a guard in start_dirtytime_writeback() for defensive coding
Tested by booting kernel in QEMU with virtme-ng:
- Before fix: kworker CPU spikes to ~73%
- After fix: CPU remains at normal levels
- Setting interval back to non-zero correctly resumes writeback
--- fs/fs-writeback.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/fs-writeback.c +10 -4
@@ -2418,12 +2418,14 @@ static void wakeup_dirtytime_writeback(swb_wakeup (wb); }rcu_read_unlock (); -schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); +if (dirtytime_expire_interval) +schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); }static int __init start_dirtytime_writeback (void ) { -schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ ); +if (dirtytime_expire_interval) +schedule_delayed_work (&dirtytime_work, dirtytime_expire_interval *HZ );return 0 ; }__initcall (start_dirtytime_writeback);
@@ -2434,8 +2436,12 @@ int dirtytime_interval_handler(const strint ret; ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos); -if (ret ==0 && write) -mod_delayed_work (system_wq, &dirtytime_work,0 ); +if (ret ==0 && write) { +if (dirtytime_expire_interval) +mod_delayed_work (system_wq, &dirtytime_work,0 ); +else +cancel_delayed_work_sync (&dirtytime_work); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 83/87 drm/amdgpu/gfx11: adjust KGQ reset sequence
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3eb46fbb601f9a0b4df8eba79252a0a85e983044 ]
Kernel gfx queues do not need to be reinitialized or remapped after a reset. This fixes queue reset failures on APUs.
v2: preserve init and remap for MMIO case.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 45 +++++++++++++++++---------------- 1 file changed, 24 insertions(+), 21 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +24 -21
@@ -6568,36 +6568,39 @@ static void gfx_v11_0_emit_mem_sync(strustatic int gfx_v11_0_reset_kgq (struct amdgpu_ring *ring,unsigned int vmid) {struct amdgpu_device *adev = ring->adev; +bool use_mmio = false;int r;if (amdgpu_sriov_vf (adev))return -EINVAL ; - r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, false); + r =amdgpu_mes_reset_legacy_queue (ring->adev, ring, vmid, use_mmio);if (r)return r; - r =amdgpu_bo_reserve (ring->mqd_obj, false); -if (unlikely (r !=0 )) { -dev_err (adev->dev,"fail to resv mqd_obj\n" ); -return r; - } - r =amdgpu_bo_kmap (ring->mqd_obj, (void **)&ring->mqd_ptr); -if (!r) { - r =gfx_v11_0_kgq_init_queue (ring, true); -amdgpu_bo_kunmap (ring->mqd_obj); - ring->mqd_ptr =NULL ; - } -amdgpu_bo_unreserve (ring->mqd_obj); -if (r) { -dev_err (adev->dev,"fail to unresv mqd_obj\n" ); -return r; - } +if (use_mmio) { + r =amdgpu_bo_reserve (ring->mqd_obj, false); +if (unlikely (r !=0 )) { +dev_err (adev->dev,"fail to resv mqd_obj\n" ); +return r; + } + r =amdgpu_bo_kmap (ring->mqd_obj, (void **)&ring->mqd_ptr); +if (!r) { + r =gfx_v11_0_kgq_init_queue (ring, true); +amdgpu_bo_kunmap (ring->mqd_obj); + ring->mqd_ptr =NULL ; + } +amdgpu_bo_unreserve (ring->mqd_obj); +if (r) { +dev_err (adev->dev,"fail to unresv mqd_obj\n" ); +return r; + } - r =amdgpu_mes_map_legacy_queue (adev, ring); -if (r) { -dev_err (adev->dev,"failed to remap kgq\n" ); -return r; + r =amdgpu_mes_map_legacy_queue (adev, ring); +if (r) { +dev_err (adev->dev,"failed to remap kgq\n" ); +return r; + } }return amdgpu_ring_test_ring (ring);
Greg Kroah-Hartman
maintainerPATCH 52/87 mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
commit a148a2040191b12b45b82cb29c281cb3036baf90 upstream.
When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both.
While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected.
--- mm/memory-failure.c | 93 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 56 insertions(+), 37 deletions(-)
mm/memory-failure.c +56 -37
@@ -1937,12 +1937,22 @@ static unsigned long __folio_free_raw_hwreturn count; } -static int folio_set_hugetlb_hwpoison (struct folio *folio,struct page *page) +#define MF_HUGETLB_FREED 0/* freed hugepage */ +#define MF_HUGETLB_IN_USED 1/* in-use hugepage */ +#define MF_HUGETLB_NON_HUGEPAGE 2/* not a hugepage */ +#define MF_HUGETLB_FOLIO_PRE_POISONED 3/* folio already poisoned */ +#define MF_HUGETLB_PAGE_PRE_POISONED 4/* exact page already poisoned */ +#define MF_HUGETLB_RETRY 5/* hugepage is busy, retry */ +/* +* Set hugetlb folio as hwpoisoned, update folio private raw hwpoison list +* to keep track of the poisoned pages. +*/ +static int hugetlb_update_hwpoison (struct folio *folio,struct page *page) {struct llist_head *head;struct raw_hwp_page *raw_hwp;struct raw_hwp_page *p; -int ret =folio_test_set_hwpoison (folio) ? -EHWPOISON :0 ; +int ret =folio_test_set_hwpoison (folio) ?MF_HUGETLB_FOLIO_PRE_POISONED :0 ;/* * Once the hwpoison hugepage has lost reliable raw error info,
@@ -1950,20 +1960,17 @@ static int folio_set_hugetlb_hwpoison(st* so skip to add additional raw error info. */ if (folio_test_hugetlb_raw_hwp_unreliable (folio)) -return -EHWPOISON ; +return MF_HUGETLB_FOLIO_PRE_POISONED ; head =raw_hwp_list_head (folio);llist_for_each_entry (p, head->first, node) {if (p->page == page) -return -EHWPOISON ; +return MF_HUGETLB_PAGE_PRE_POISONED ; } raw_hwp =kmalloc (sizeof (struct raw_hwp_page ),GFP_ATOMIC );if (raw_hwp) { raw_hwp->page = page;llist_add (&raw_hwp->node, head); -/* the first error event will be counted in action_result(). */ -if (ret) -num_poisoned_pages_inc (page_to_pfn (page)); }else {/* * Failed to save raw error info. We no longer trace all
@@ -2011,42 +2018,39 @@ void folio_clear_hugetlb_hwpoison(struct/* * Called from hugetlb code with hugetlb_lock held. -* -* Return values: -* 0 - free hugepage -* 1 - in-use hugepage -* 2 - not a hugepage -* -EBUSY - the hugepage is busy (try to retry) -* -EHWPOISON - the hugepage is already hwpoisoned */ int __get_huge_page_for_hwpoison (unsigned long pfn,int flags,bool *migratable_cleared) {struct page *page =pfn_to_page (pfn);struct folio *folio =page_folio (page); -int ret =2 ;/* fallback to normal page handling */ bool count_increased = false; +int ret, rc; -if (!folio_test_hugetlb (folio)) +if (!folio_test_hugetlb (folio)) { + ret =MF_HUGETLB_NON_HUGEPAGE ; goto out; - -if (flags &MF_COUNT_INCREASED ) { - ret =1 ; + }else if (flags &MF_COUNT_INCREASED ) { + ret =MF_HUGETLB_IN_USED ; count_increased = true; }else if (folio_test_hugetlb_freed (folio)) { - ret =0 ; + ret =MF_HUGETLB_FREED ; }else if (folio_test_hugetlb_migratable (folio)) { - ret =folio_try_get (folio); -if (ret) +if (folio_try_get (folio)) { + ret =MF_HUGETLB_IN_USED ; count_increased = true; + }else { + ret =MF_HUGETLB_FREED ; + } }else { - ret = -EBUSY ; + ret =MF_HUGETLB_RETRY ;if (!(flags &MF_NO_RETRY )) goto out; } -if (folio_set_hugetlb_hwpoison (folio, page)) { - ret = -EHWPOISON ; + rc =hugetlb_update_hwpoison (folio, page); +if (rc >=MF_HUGETLB_FOLIO_PRE_POISONED ) { + ret = rc; goto out; }
@@ -2071,10 +2075,16 @@ out:* with basic operations like hugepage allocation/free/demotion. * So some of prechecks for hwpoison (pinning, and testing/setting * PageHWPoison) should be done in single hugetlb_lock range. +* Returns: +* 0 - not hugetlb, or recovered +* -EBUSY - not recovered +* -EOPNOTSUPP - hwpoison_filter'ed +* -EHWPOISON - folio or exact page already poisoned +* -EFAULT - kill_accessing_process finds current->mm null */ static int try_memory_failure_hugetlb (unsigned long pfn,int flags,int *hugetlb) { -int res; +int res, rv;struct page *p =pfn_to_page (pfn);struct folio *folio;unsigned long page_flags;
@@ -2083,22 +2093,31 @@ static int try_memory_failure_hugetlb(un *hugetlb =1 ; retry: res =get_huge_page_for_hwpoison (pfn, flags, &migratable_cleared); -if (res ==2 ) {/* fallback to normal page handling */ +switch (res) { +case MF_HUGETLB_NON_HUGEPAGE :/* fallback to normal page handling */ *hugetlb =0 ;return 0 ; - }else if (res == -EHWPOISON ) { -if (flags &MF_ACTION_REQUIRED ) { - folio =page_folio (p); - res =kill_accessing_process (current,folio_pfn (folio), flags); - } -action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED ); -return res; - }else if (res == -EBUSY ) { +case MF_HUGETLB_RETRY :if (!(flags &MF_NO_RETRY )) { flags |=MF_NO_RETRY ; goto retry; }return action_result (pfn,MF_MSG_GET_HWPOISON ,MF_IGNORED ); +case MF_HUGETLB_FOLIO_PRE_POISONED : +case MF_HUGETLB_PAGE_PRE_POISONED : + rv = -EHWPOISON ; +if (flags &MF_ACTION_REQUIRED ) { + folio =page_folio (p); + rv =kill_accessing_process (current,folio_pfn (folio), flags); + } +if (res ==MF_HUGETLB_PAGE_PRE_POISONED ) +action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED ); +else +action_result (pfn,MF_MSG_HUGE ,MF_FAILED ); +return rv; +default : +WARN_ON ((res !=MF_HUGETLB_FREED ) && (res !=MF_HUGETLB_IN_USED )); +break ; } folio =page_folio (p);
@@ -2109,7 +2128,7 @@ retry:if (migratable_cleared)folio_set_hugetlb_migratable (folio);folio_unlock (folio); -if (res ==1 ) +if (res ==MF_HUGETLB_IN_USED )folio_put (folio);return -EOPNOTSUPP ; }
@@ -2118,7 +2137,7 @@ retry:* Handling free hugepage. The possible race with hugepage allocation * or demotion can be prevented by PageHWPoison flag. */ -if (res ==0 ) { +if (res ==MF_HUGETLB_FREED ) {folio_unlock (folio);if (__page_handle_poison (p) >0 ) {page_ref_inc (p);
Greg Kroah-Hartman
maintainerPATCH 53/87 mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jane Chu <[email protected]>
commit 057a6f2632c956483e2b2628477f0fcd1cd8a844 upstream.
When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload.
This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Further more, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page.
[1] https://lkml.kernel.org/r/[email protected]
[2] https://lkml.kernel.org/r/[email protected]
[3] https://lore.kernel.org/lkml/[email protected]/
--- mm/memory-failure.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
mm/memory-failure.c +8 -6
@@ -754,6 +754,8 @@ static int check_hwpoisoned_entry(pte_t unsigned long poisoned_pfn, struct to_kill *tk) { unsigned long pfn = 0; +unsigned long hwpoison_vaddr; +unsigned long mask;if (pte_present (pte)) { pfn =pte_pfn (pte);
@@ -764,10 +766,12 @@ static int check_hwpoisoned_entry(pte_t pfn =swp_offset_pfn (swp); } -if (!pfn || pfn != poisoned_pfn) + mask = ~((1UL << (shift -PAGE_SHIFT )) -1 ); +if (!pfn || pfn != (poisoned_pfn & mask))return 0 ; -set_to_kill (tk, addr, shift); + hwpoison_vaddr = addr + ((poisoned_pfn - pfn) <<PAGE_SHIFT ); +set_to_kill (tk, hwpoison_vaddr, shift);return 1 ; }
@@ -2106,10 +2110,8 @@ retry:case MF_HUGETLB_FOLIO_PRE_POISONED :case MF_HUGETLB_PAGE_PRE_POISONED : rv = -EHWPOISON ; -if (flags &MF_ACTION_REQUIRED ) { - folio =page_folio (p); - rv =kill_accessing_process (current,folio_pfn (folio), flags); - } +if (flags &MF_ACTION_REQUIRED ) + rv =kill_accessing_process (current, pfn, flags);if (res ==MF_HUGETLB_PAGE_PRE_POISONED )action_result (pfn,MF_MSG_ALREADY_POISONED ,MF_FAILED );else
Greg Kroah-Hartman
maintainerPATCH 54/87 mm/shmem, swap: fix race of truncate and swap entry split
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kairui Song <[email protected]>
commit 8a1968bd997f45a9b11aefeabdd1232e1b6c7184 upstream.
The helper for shmem swap freeing is not handling the order of swap entries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it gets the entry order before that using xa_get_order without lock protection, and it may get an outdated order value if the entry is split or changed in other ways after the xa_get_order and before the xa_cmpxchg_irq.
And besides, the order could grow and be larger than expected, and cause truncation to erase data beyond the end border. For example, if the target entry and following entries are swapped in or freed, then a large folio was added in place and swapped out, using the same entry, the xa_cmpxchg_irq will still succeed, it's very unlikely to happen though.
To fix that, open code the Xarray cmpxchg and put the order retrieval and value checking in the same critical section. Also, ensure the order won't exceed the end border, skip it if the entry goes across the border.
Skipping large swap entries crosses the end border is safe here. Shmem truncate iterates the range twice, in the first iteration, find_lock_entries already filtered such entries, and shmem will swapin the entries that cross the end border and partially truncate the folio (split the folio or at least zero part of it). So in the second loop here, if we see a swap entry that crosses the end order, it must at least have its content erased already.
I observed random swapoff hangs and kernel panics when stress testing ZSWAP with shmem. After applying this patch, all problems are gone.
--- mm/shmem.c | 45 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 11 deletions(-)
mm/shmem.c +34 -11
@@ -860,17 +860,29 @@ static void shmem_delete_from_page_cache* being freed). */ static long shmem_free_swap (struct address_space *mapping, -pgoff_t index,void *radswap) +pgoff_t index,pgoff_t end,void *radswap) { -int order =xa_get_order (&mapping->i_pages, index); -void *old; +XA_STATE (xas, &mapping->i_pages, index); +unsigned int nr_pages =0 ; +pgoff_t base; +void *entry; + +xas_lock_irq (&xas); + entry =xas_load (&xas); +if (entry == radswap) { + nr_pages =1 <<xas_get_order (&xas); + base =round_down (xas.xa_index, nr_pages); +if (base < index || base + nr_pages -1 > end) + nr_pages =0 ; +else +xas_store (&xas,NULL ); + } +xas_unlock_irq (&xas); - old =xa_cmpxchg_irq (&mapping->i_pages, index, radswap,NULL ,0 ); -if (old != radswap) -return 0 ; -free_swap_and_cache_nr (radix_to_swp_entry (radswap),1 << order); +if (nr_pages) +free_swap_and_cache_nr (radix_to_swp_entry (radswap), nr_pages); -return 1 << order; +return nr_pages; }/*
@@ -1022,8 +1034,8 @@ static void shmem_undo_range(struct inodif (xa_is_value (folio)) {if (unfalloc)continue ; - nr_swaps_freed +=shmem_free_swap (mapping, - indices[i], folio); + nr_swaps_freed +=shmem_free_swap (mapping, indices[i], + end -1 , folio);continue ; }
@@ -1089,12 +1101,23 @@ whole_folios: folio = fbatch.folios[i];if (xa_is_value (folio)) { +int order;long swaps_freed;if (unfalloc)continue ; - swaps_freed =shmem_free_swap (mapping, indices[i], folio); + swaps_freed =shmem_free_swap (mapping, indices[i], + end -1 , folio);if (!swaps_freed) { +/* +* If found a large swap entry cross the end border, +* skip it as the truncate_inode_partial_folio above +* should have at least zerod its content once. +*/ + order =shmem_confirm_swap (mapping, indices[i], +radix_to_swp_entry (folio)); +if (order >0 && indices[i] + (1 << order) > end) +continue ;/* Swap was replaced by page: retry */ index = indices[i];break ;
Greg Kroah-Hartman
maintainerPATCH 55/87 net: fix segmentation of forwarding fraglist GRO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jibin Zhang <[email protected]>
commit 426ca15c7f6cb6562a081341ca88893a50c59fa2 upstream.
This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface.
Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput.
To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.
--- net/core/filter.c | 2 ++ net/ipv4/tcp_offload.c | 3 ++- net/ipv4/udp_offload.c | 3 ++- net/ipv6/tcpv6_offload.c | 3 ++- 4 files changed, 8 insertions(+), 3 deletions(-)
net/core/filter.c +2 -0
@@ -3360,6 +3360,7 @@ static int bpf_skb_proto_4_to_6(struct s shinfo->gso_type &= ~SKB_GSO_TCPV4 ; shinfo->gso_type |=SKB_GSO_TCPV6 ; } + shinfo->gso_type |=SKB_GSO_DODGY ; }bpf_skb_change_protocol (skb,ETH_P_IPV6 );
@@ -3390,6 +3391,7 @@ static int bpf_skb_proto_6_to_4(struct s shinfo->gso_type &= ~SKB_GSO_TCPV6 ; shinfo->gso_type |=SKB_GSO_TCPV4 ; } + shinfo->gso_type |=SKB_GSO_DODGY ; }bpf_skb_change_protocol (skb,ETH_P_IP );
net/ipv4/tcp_offload.c +2 -1
@@ -107,7 +107,8 @@ static struct sk_buff *tcp4_gso_segment(if (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST ) {struct tcphdr *th =tcp_hdr (skb); -if (skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) +if ((skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) && + !(skb_shinfo (skb)->gso_type &SKB_GSO_DODGY ))return __tcp4_gso_segment_list (skb, features); skb->ip_summed =CHECKSUM_NONE ;
net/ipv4/udp_offload.c +2 -1
@@ -358,7 +358,8 @@ struct sk_buff *__udp_gso_segment(structif (skb_shinfo (gso_skb)->gso_type &SKB_GSO_FRAGLIST ) {/* Detect modified geometry and pass those to skb_segment. */ -if (skb_pagelen (gso_skb) -sizeof (*uh) ==skb_shinfo (gso_skb)->gso_size) +if ((skb_pagelen (gso_skb) -sizeof (*uh) ==skb_shinfo (gso_skb)->gso_size) && + !(skb_shinfo (gso_skb)->gso_type &SKB_GSO_DODGY ))return __udp_gso_segment_list (gso_skb, features, is_ipv6); ret =__skb_linearize (gso_skb);
net/ipv6/tcpv6_offload.c +2 -1
@@ -171,7 +171,8 @@ static struct sk_buff *tcp6_gso_segment(if (skb_shinfo (skb)->gso_type &SKB_GSO_FRAGLIST ) {struct tcphdr *th =tcp_hdr (skb); -if (skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) +if ((skb_pagelen (skb) - th->doff *4 ==skb_shinfo (skb)->gso_size) && + !(skb_shinfo (skb)->gso_type &SKB_GSO_DODGY ))return __tcp6_gso_segment_list (skb, features); skb->ip_summed =CHECKSUM_NONE ;
Greg Kroah-Hartman
maintainerPATCH 56/87 scripts: generate_rust_analyzer: remove sysroot assertion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Onur Özkan <[email protected]>
commit 1b83ef9f7ad4635c913b80ef5e718f95f48e85af upstream.
With nixpkgs's rustc, rust-src component is not bundled with the compiler by default and is instead provided from a separate store path, so this assumption does not hold.
The assertion assumes these paths are in the same location which causes make LLVM=1 rust-analyzer to fail on NixOS.
--- scripts/generate_rust_analyzer.py | 3 --- 1 file changed, 3 deletions(-)
scripts/generate_rust_analyzer.py +0 -3
@@ -170,9 +170,6 @@ def main(): level=logging.INFO if args.verbose else logging.WARNING ) - # Making sure that the `sysroot` and `sysroot_src` belong to the same toolchain. - assert args.sysroot in args.sysroot_src.parents - rust_project = { "crates": generate_crates(args.srctree, args.objtree, args.sysroot_src, args.exttree, args.cfgs, args.core_edition), "sysroot": str(args.sysroot),
Greg Kroah-Hartman
maintainerPATCH 57/87 scripts: generate_rust_analyzer: compile sysroot with correct edition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <[email protected]>
commit ac3c50b9a24e9ebeb585679078d6c47922034bb6 upstream.
Use core_edition for all sysroot crates rather than just core as all were updated to edition 2024 in Rust 1.87.
--- scripts/generate_rust_analyzer.py | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
scripts/generate_rust_analyzer.py +26 -3
@@ -53,7 +53,6 @@ def generate_crates(srctree, objtree, sy display_name, deps, cfg=[], - edition="2021", ): append_crate( display_name,
@@ -61,13 +60,37 @@ def generate_crates(srctree, objtree, sy deps, cfg, is_workspace_member=False, - edition=edition, + # Miguel Ojeda writes: + # + # > ... in principle even the sysroot crates may have different + # > editions. + # > + # > For instance, in the move to 2024, it seems all happened at once + # > in 1.87.0 in these upstream commits: + # > + # > 0e071c2c6a58 ("Migrate core to Rust 2024") + # > f505d4e8e380 ("Migrate alloc to Rust 2024") + # > 0b2489c226c3 ("Migrate proc_macro to Rust 2024") + # > 993359e70112 ("Migrate std to Rust 2024") + # > + # > But in the previous move to 2021, `std` moved in 1.59.0, while + # > the others in 1.60.0: + # > + # > b656384d8398 ("Update stdlib to the 2021 edition") + # > 06a1c14d52a8 ("Switch all libraries to the 2021 edition") + # + # Link: https://lore.kernel.org/all/CANiq72kd9bHdKaAm=8xCUhSHMy2csyVed69bOc4dXyFAW4sfuw@mail.gmail.com/ + # + # At the time of writing all rust versions we support build the + # sysroot crates with the same edition. We may need to relax this + # assumption if future edition moves span multiple rust versions. + edition=core_edition, ) # NB: sysroot crates reexport items from one another so setting up our transitive dependencies # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`. - append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []), edition=core_edition) + append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", [])) append_sysroot_crate("alloc", ["core"]) append_sysroot_crate("std", ["alloc", "core"]) append_sysroot_crate("proc_macro", ["core", "std"])
Greg Kroah-Hartman
maintainerPATCH 48/87 selftests: mptcp: check no dup close events after error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit 8467458dfa61b37e259e3485a5d3e415d08193c1 upstream.
This validates the previous commit: subflow closed events are re-sent with less info when the initial subflow is disconnected after an error and each time a subflow is closed after that.
In this new test, the userspace PM is involved because that's how it was discovered, but it is not specific to it. The initial subflow is terminated with a RESET, and that will cause the subflow disconnect. Then, a new subflow is initiated, but also got rejected, which cause a second subflow closed event, but not a third one.
While at it, in case of failure to get the expected amount of events, the events are printed.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 51 ++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +51 -0
@@ -3506,11 +3506,32 @@ chk_evt_nr() count=$(grep -cw "type:${evt}" "${evts}") if [ "${count}" != "${exp}" ]; then fail_test "got ${count} events, expected ${exp}" + cat "${evts}" else print_ok fi } +# $1: ns ; $2: event type ; $3: expected count +wait_event() +{ + local ns="${1}" + local evt_name="${2}" + local exp="${3}" + + local evt="${!evt_name}" + local evts="${evts_ns1}" + local count + + [ "${ns}" == "ns2" ] && evts="${evts_ns2}" + + for _ in $(seq 100); do + count=$(grep -cw "type:${evt}" "${evts}") + [ "${count}" -ge "${exp}" ] && break + sleep 0.1 + done +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3717,6 +3738,36 @@ userspace_tests() kill_events_pids mptcp_lib_kill_group_wait $tests_pid fi + + # userspace pm no duplicated spurious close events after an error + if reset_with_events "userspace pm no dup close events after error" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + set_userspace_pm $ns2 + pm_nl_set_limits $ns1 0 2 + { timeout_test=120 test_linkfail=128 speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null + local tests_pid=$! + wait_event ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + userspace_pm_add_sf $ns2 10.0.3.2 20 + chk_mptcp_info subflows 1 subflows 1 + chk_subflows_total 2 2 + + # force quick loss + ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1 + if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ + -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && + ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ + -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 + wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 + chk_subflows_total 1 1 + userspace_pm_add_sf $ns2 10.0.1.2 0 + wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + fi + kill_events_pids + mptcp_lib_kill_group_wait $tests_pid + fi } endpoint_tests()
Greg Kroah-Hartman
maintainerPATCH 85/87 net: mana: Change the function signature of mana_get_primary_netdev_rcu
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit a8445cfec101c42e9d64cdb2dac13973b22c205c upstream.
Change mana_get_primary_netdev_rcu() to mana_get_primary_netdev(), and return the ndev with refcount held. The caller is responsible for dropping the refcount.
Also drop the check for IFF_SLAVE as it is not necessary if the upper device is present.
--- drivers/infiniband/hw/mana/device.c | 7 +++---- drivers/infiniband/hw/mana/mana_ib.h | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 22 ++++++++++++++-------- include/net/mana/mana.h | 4 +++- 4 files changed, 21 insertions(+), 13 deletions(-)
drivers/infiniband/hw/mana/device.c +3 -4
@@ -84,10 +84,8 @@ static int mana_ib_probe(struct auxiliar dev->ib_dev.num_comp_vectors = mdev->gdma_context->max_num_queues; dev->ib_dev.dev.parent = mdev->gdma_context->dev; -rcu_read_lock ();/* required to get primary netdev */ - ndev =mana_get_primary_netdev_rcu (mc,0 ); + ndev =mana_get_primary_netdev (mc,0 , &dev->dev_tracker);if (!ndev) { -rcu_read_unlock (); ret = -ENODEV ;ibdev_err (&dev->ib_dev,"Failed to get netdev for IB port 1" ); goto free_ib_device;
@@ -95,7 +93,8 @@ static int mana_ib_probe(struct auxiliarether_addr_copy (mac_addr, ndev->dev_addr);addrconf_addr_eui48 ((u8 *)&dev->ib_dev.node_guid, ndev->dev_addr); ret =ib_device_set_netdev (&dev->ib_dev, ndev,1 ); -rcu_read_unlock (); +/* mana_get_primary_netdev() returns ndev with refcount held */ +netdev_put (ndev, &dev->dev_tracker);if (ret) {ibdev_err (&dev->ib_dev,"Failed to set ib netdev, ret %d" , ret); goto free_ib_device;
drivers/infiniband/hw/mana/mana_ib.h +1 -0
@@ -64,6 +64,7 @@ struct mana_ib_dev {struct gdma_queue **eqs;struct xarray qp_table_wq;struct mana_ib_adapter_caps adapter_caps; +netdevice_tracker dev_tracker; };struct mana_ib_wq {
drivers/net/ethernet/microsoft/mana/mana_en.c +14 -8
@@ -3000,21 +3000,27 @@ out:kfree (ac); } -struct net_device *mana_get_primary_netdev_rcu (struct mana_context *ac,u32 port_index) +struct net_device *mana_get_primary_netdev (struct mana_context *ac, +u32 port_index, +netdevice_tracker *tracker) {struct net_device *ndev; -RCU_LOCKDEP_WARN (!rcu_read_lock_held (), -"Taking primary netdev without holding the RCU read lock" );if (port_index >= ac->num_ports)return NULL ; -/* When mana is used in netvsc, the upper netdevice should be returned. */ -if (ac->ports[port_index]->flags &IFF_SLAVE ) - ndev =netdev_master_upper_dev_get_rcu (ac->ports[port_index]); -else +rcu_read_lock (); + +/* If mana is used in netvsc, the upper netdevice should be returned. */ + ndev =netdev_master_upper_dev_get_rcu (ac->ports[port_index]); + +/* If there is no upper device, use the parent Ethernet device */ +if (!ndev) ndev = ac->ports[port_index]; +netdev_hold (ndev, tracker,GFP_ATOMIC ); +rcu_read_unlock (); +return ndev; } -EXPORT_SYMBOL_NS (mana_get_primary_netdev_rcu,NET_MANA ); +EXPORT_SYMBOL_NS (mana_get_primary_netdev,NET_MANA );
include/net/mana/mana.h +3 -1
@@ -819,5 +819,7 @@ int mana_cfg_vport(struct mana_port_cont u32 doorbell_pg_id);void mana_uncfg_vport (struct mana_port_context *apc); -struct net_device *mana_get_primary_netdev_rcu (struct mana_context *ac,u32 port_index); +struct net_device *mana_get_primary_netdev (struct mana_context *ac, +u32 port_index, +netdevice_tracker *tracker);#endif /* _MANA_H */
Greg Kroah-Hartman
maintainerPATCH 86/87 RDMA/mana_ib: Handle net event for pointing to the current netdev
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <[email protected]>
commit bee35b7161aaaed9831e2f14876c374b9c566952 upstream.
When running under Hyper-V, the master device to the RDMA device is always bonded to this RDMA device. This is not user-configurable.
The master device can be unbind/bind from the kernel. During those events, the RDMA device should set to the current netdev to reflect the change of master device from those events.
--- drivers/infiniband/hw/mana/device.c | 47 +++++++++++++++++++++++++++++++++-- drivers/infiniband/hw/mana/mana_ib.h | 1 2 files changed, 46 insertions(+), 2 deletions(-)
drivers/infiniband/hw/mana/device.c +45 -2
@@ -51,6 +51,38 @@ static const struct ib_device_ops mana_i ib_ind_table), }; +static int mana_ib_netdev_event (struct notifier_block *this, +unsigned long event,void *ptr) +{ + struct mana_ib_dev *dev = container_of(this, struct mana_ib_dev, nb); +struct net_device *event_dev =netdev_notifier_info_to_dev (ptr); +struct gdma_context *gc = dev->gdma_dev->gdma_context; +struct mana_context *mc = gc->mana.driver_data; +struct net_device *ndev; + +/* Only process events from our parent device */ +if (event_dev != mc->ports[0 ]) +return NOTIFY_DONE ; + +switch (event) { +case NETDEV_CHANGEUPPER : + ndev =mana_get_primary_netdev (mc,0 , &dev->dev_tracker); +/* +* RDMA core will setup GID based on updated netdev. +* It's not possible to race with the core as rtnl lock is being +* held. +*/ +ib_device_set_netdev (&dev->ib_dev, ndev,1 ); + +/* mana_get_primary_netdev() returns ndev with refcount held */ +netdev_put (ndev, &dev->dev_tracker); + +return NOTIFY_OK ; +default : +return NOTIFY_DONE ; + } +} +static int mana_ib_probe (struct auxiliary_device *adev,const struct auxiliary_device_id *id) {
@@ -108,17 +140,25 @@ static int mana_ib_probe(struct auxiliar } dev->gdma_dev = &mdev->gdma_context->mana_ib; + dev->nb.notifier_call = mana_ib_netdev_event; + ret =register_netdevice_notifier (&dev->nb); +if (ret) { +ibdev_err (&dev->ib_dev,"Failed to register net notifier, %d" , + ret); + goto deregister_device; + } + ret =mana_ib_gd_query_adapter_caps (dev);if (ret) {ibdev_err (&dev->ib_dev,"Failed to query device caps, ret %d" , ret); - goto deregister_device; + goto deregister_net_notifier; } ret =mana_ib_create_eqs (dev);if (ret) {ibdev_err (&dev->ib_dev,"Failed to create EQs, ret %d" , ret); - goto deregister_device; + goto deregister_net_notifier; } ret =mana_ib_gd_create_rnic_adapter (dev);
@@ -147,6 +187,8 @@ destroy_rnic:mana_ib_gd_destroy_rnic_adapter (dev); destroy_eqs:mana_ib_destroy_eqs (dev); +deregister_net_notifier: +unregister_netdevice_notifier (&dev->nb); deregister_device:mana_gd_deregister_device (dev->gdma_dev); free_ib_device:
@@ -162,6 +204,7 @@ static void mana_ib_remove(struct auxilixa_destroy (&dev->qp_table_wq);mana_ib_gd_destroy_rnic_adapter (dev);mana_ib_destroy_eqs (dev); +unregister_netdevice_notifier (&dev->nb);mana_gd_deregister_device (dev->gdma_dev);ib_dealloc_device (&dev->ib_dev); }
drivers/infiniband/hw/mana/mana_ib.h +1 -0
@@ -65,6 +65,7 @@ struct mana_ib_dev {struct xarray qp_table_wq;struct mana_ib_adapter_caps adapter_caps;netdevice_tracker dev_tracker; +struct notifier_block nb; };struct mana_ib_wq {
Greg Kroah-Hartman
maintainerPATCH 87/87 bpf/selftests: test_select_reuseport_kern: Remove unused header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Lothoré (eBPF Foundation) <[email protected]>
commit 93cf4e537ed0c5bd9ba6cbdb2c33864547c1442f upstream.
test_select_reuseport_kern.c is currently including <stdlib.h>, but it does not use any definition from there.
Remove stdlib.h inclusion from test_select_reuseport_kern.c
[shung-hsi.yu: Fix compilation error mentioned in footer of Alexis' patch with newer glibc header:
[...]
CLNG-BPF [test_progs-cpuv4] test_select_reuseport_kern.bpf.o
In file included from progs/test_select_reuseport_kern.c:4:
/usr/include/bits/floatn.h:83:52: error: unsupported machine mode '__TC__'
83 | typedef _Complex float __cfloat128 __attribute__ ((__mode__
(__TC__)));
| ^
/usr/include/bits/floatn.h:97:9: error: __float128 is not supported on
this target
97 | typedef __float128 _Float128;I'm not certain when the problem starts to occur, but I'm quite sure test_select_reuseport_kern.c were not meant to be using the C standard library in the first place.]
--- tools/testing/selftests/bpf/progs/test_select_reuseport_kern.c | 1 - 1 file changed, 1 deletion(-)
tools/testing/selftests/bpf/progs/test_select_reuseport_kern.c +0 -1
@@ -1,7 +1,6 @@// SPDX-License-Identifier: GPL-2.0 /* Copyright (c) 2018 Facebook */ -#include <stdlib.h> #include <linux/in.h> #include <linux/ip.h> #include <linux/ipv6.h>
Greg Kroah-Hartman
maintainerPATCH 84/87 pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <[email protected]>
[ Upstream commit 4f0d22ec60cee420125f4055af76caa0f373a3fe ]
GPIO controller driver should typically implement the .get_direction() callback as GPIOLIB internals may try to use it to determine the state of a pin. Add it for the LPASS LPI driver.
--- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +17 -0
@@ -298,6 +298,22 @@ static const struct pinconf_ops lpi_gpio .pin_config_group_set = lpi_config_set, }; +static int lpi_gpio_get_direction (struct gpio_chip *chip,unsigned int pin) +{ +unsigned long config =pinconf_to_config_packed (PIN_CONFIG_OUTPUT ,0 ); +struct lpi_pinctrl *state =gpiochip_get_data (chip); +unsigned long arg; +int ret; + + ret =lpi_config_get (state->ctrl, pin, &config); +if (ret) +return ret; + + arg =pinconf_to_config_argument (config); + +return arg ?GPIO_LINE_DIRECTION_OUT :GPIO_LINE_DIRECTION_IN ; +} +static int lpi_gpio_direction_input (struct gpio_chip *chip,unsigned int pin) {struct lpi_pinctrl *state =gpiochip_get_data (chip);
@@ -395,6 +411,7 @@ static void lpi_gpio_dbg_show(struct seq#endif static const struct gpio_chip lpi_gpio_template = { + .get_direction = lpi_gpio_get_direction, .direction_input = lpi_gpio_direction_input, .direction_output = lpi_gpio_direction_output, .get = lpi_gpio_get,
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.69-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.12.69-rc1-g07626bd7083f #1 SMP PREEMPT_DYNAMIC Wed Feb 4 19:40:33 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.69-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.12:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.12.69-rc1-g07626bd7083f
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Am 04.02.2026 um 15:39 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.69-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Compiled and tested on
- Verdin AM62
- Verdin iMX8MP
- Toradex SMARC iMX8MP
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64 with our testing.
Thanks,
Harshit
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Re: [PATCH 6.12 75/87] Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
In reply to Greg Kroah-HartmanQuoted 7 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
commit
6c65db809796717f0a96cf22f80405dbc1a31a4bupstream.
Not questioning the need for it, but this revert does not exist in the upstream kernel ???
$ git describe v6.19-rc8-45-gf14faaf3a1fb $ git show 6c65db809796717f0a96cf22f80405dbc1a31a4b fatal: bad object 6c65db809796717f0a96cf22f80405dbc1a31a4b
Guenter
Quoted 48 lines
This reverts commit
604826acb3f53c6648a7ee99a3914ead680ab7fb.Apparently there is more to supporting atomic modesetting than providing
atomic_(check|commit)callbacks. Before this revert:WARNING: []
drivers/gpu/drm/drm_plane.c:389at .__drm_universal_plane_init+0x13c/0x794 [drm], CPU#1: modprobe/1790BUG: Kernel NULL pointer dereference on read at 0x00000000 .drm_atomic_get_plane_state+0xd4/0x210 [drm] (unreliable) .drm_client_modeset_commit_atomic+0xf8/0x338 [drm] .drm_client_modeset_commit_locked+0x80/0x260 [drm] .drm_client_modeset_commit+0x40/0x7c [drm] .__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0xfc/0x108 [drm_kms_helper] .drm_fb_helper_set_par+0x8c/0xb8 [drm_kms_helper] .fbcon_init+0x31c/0x618 [...] .__drm_fb_helper_initial_config_and_unlock+0x474/0x7f4 [drm_kms_helper] .drm_fbdev_client_hotplug+0xb0/0x120 [drm_client_lib] .drm_client_register+0x88/0xe4 [drm] .drm_fbdev_client_setup+0x12c/0x19b4 [drm_client_lib] .drm_client_setup+0x15c/0x18c [drm_client_lib] .nouveau_drm_probe+0x19c/0x268 [nouveau]Fixes 604826acb3f5 ("drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)")Reported-by John Ogness <[email protected]>Signed-off-by John Ogness <[email protected]>Tested-by Daniel Palmer <[email protected]>Signed-off-by Danilo Krummrich <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/gpu/drm/nouveau/nouveau_display.c | 2 -- 1 file changed, 2 deletions(-)drivers/gpu/drm/nouveau/nouveau_display.c +0
-2@@ -391,8 +391,6 @@ nouveau_user_framebuffer_create(struct dstatic const struct drm_mode_config_funcs nouveau_mode_config_funcs = { .fb_create = nouveau_user_framebuffer_create, - .atomic_commit = drm_atomic_helper_commit, - .atomic_check = drm_atomic_helper_check, };
Greg Kroah-Hartman
maintainerRe: [PATCH 6.12 75/87] Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)"
Quoted 9 lines · Guenter Roeck
Quoted 7 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
commit
6c65db809796717f0a96cf22f80405dbc1a31a4bupstream.
Quoted 7 lines
Not questioning the need for it, but this revert does not exist in the upstream kernel ???
$ git describe v6.19-rc8-45-gf14faaf3a1fb $ git show 6c65db809796717f0a96cf22f80405dbc1a31a4b fatal: bad object 6c65db809796717f0a96cf22f80405dbc1a31a4b
It is in linux-next and I was told it would be in 6.19-final, which is why I took it here.
thanks,
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.69-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.12.y
and the diffstat can be found below.thanks,
greg k-h
Builds successfully. Boots and works on qemu and Intel Core i7-10810U
Thanks,
Brett
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.12.69-rc1 on x86 and arm64 Azure VM.
Thanks,
Hardik
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
test_progs, test_progs-no_alu32, test_progs-cpuv4, test_maps, test_verifier in BPF selftests all passes[1] on x86_64.
1: https://github.com/shunghsiyu/libbpf/actions/runs/21724288947/job/62662113810
Quoted 8 lines · On Wed, 04 Feb 2026 15:39:58 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.12.69 release. There are 87 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
Thanks!
Cheers,
Miguel
Re: [PATCH 6.12 30/87] bcache: fix I/O accounting leak in detached_dev_do_request
In reply to Greg Kroah-HartmanHi,
Quoted 28 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit
4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f]When a bcache device is detached, discard requests are completed immediately. However, the I/O accounting started in
cached_dev_make_request()is not ended, leading to 100% disk utilization reports in iostat. Add the missingbio_end_io_acct()call.Fixes cafe56359144 ("bcache: A block layer cache")Signed-off-by Shida Zhang <[email protected]>Acked-by Coly Li <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/md/bcache/request.c | 1 + 1 file changed, 1 insertion(+)drivers/md/bcache/request.c +0
-0
drivers/md/bcache/request.c static void detached_dev_do_request(struct bcache_device *d, · line 1113
Quoted 7 lines
drivers/md/bcache/request.c +1
-0@@ -1107,6 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d,if (bio_op (orig_bio) ==REQ_OP_DISCARD && !bdev_max_discard_sectors (dc->bdev)) { +bio_end_io_acct (orig_bio, start_time);bio_endio (orig_bio);return ; }
In 6.12.y and v6.18.y, the code continues:
clone_bio = bio_alloc_clone(dc->bdev, orig_bio, GFP_NOIO,
&d->bio_detached);
if (!clone_bio) {
orig_bio->bi_status = BLK_STS_RESOURCE;
bio_endio(orig_bio);
return;
}The NULL check has been removed in the upstream kernel, so the error path does not exist there.
It seems that the above code is still having an accounting leak if bio_alloc_clone() returns NULL. Is this indeed the case, or am I missing something ?
If I am not missing something, is it necessary to add a call to bio_end_io_acct() into the error handling, or is the problem theoretic and can be addressed by backporting commit 6ea84d7a92cb ("bcache:
remove dead code in detached_dev_do_request") to v6.12.y and v6.18.y ?
Thanks,
Guenter
Greg Kroah-Hartman
maintainerRe: [PATCH 6.12 30/87] bcache: fix I/O accounting leak in detached_dev_do_request
Quoted 49 lines · Guenter Roeck
Hi,
Quoted 28 lines · Greg Kroah-Hartman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shida Zhang <[email protected]>
[ Upstream commit
4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f]When a bcache device is detached, discard requests are completed immediately. However, the I/O accounting started in
cached_dev_make_request()is not ended, leading to 100% disk utilization reports in iostat. Add the missingbio_end_io_acct()call.Fixes cafe56359144 ("bcache: A block layer cache")Signed-off-by Shida Zhang <[email protected]>Acked-by Coly Li <[email protected]>Reviewed-by Christoph Hellwig <[email protected]>Signed-off-by Jens Axboe <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/md/bcache/request.c | 1 + 1 file changed, 1 insertion(+)drivers/md/bcache/request.c +0
-0drivers/md/bcache/request.c static void detached_dev_do_request(struct bcache_device *d, · line 1113
Quoted 7 lines
drivers/md/bcache/request.c +1
-0@@ -1107,6 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d,if (bio_op (orig_bio) ==REQ_OP_DISCARD && !bdev_max_discard_sectors (dc->bdev)) { +bio_end_io_acct (orig_bio, start_time);bio_endio (orig_bio);return ; }In 6.12.y and v6.18.y, the code continues:
clone_bio = bio_alloc_clone(dc->bdev, orig_bio, GFP_NOIO, &d->bio_detached); if (!clone_bio) { orig_bio->bi_status = BLK_STS_RESOURCE; bio_endio(orig_bio); return; }
Quoted 6 lines
The NULL check has been removed in the upstream kernel, so the error path does not exist there.
It seems that the above code is still having an accounting leak if
bio_alloc_clone()returns NULL. Is this indeed the case, or am I missing something ?
Look at commit 6ea84d7a92cb ("bcache: remove dead code in detached_dev_do_request") which changes 6.19 to not check the result of bio_alloc_clone() as it can not fail here.
Quoted 4 lines
If I am not missing something, is it necessary to add a call to
bio_end_io_acct()into the error handling, or is the problem theoretic and can be addressed by backporting commit6ea84d7a92cb("bcache:
remove dead code indetached_dev_do_request") to v6.12.y and v6.18.y ?
We could apply that commit, but in the end, it's probably not an issue as this is impossible to hit. But hey, if someone wants to backport that commit and submit it for us to take, I'll not refuse :)
thanks,
greg k-h