6.18.19-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.18.19-rc1 review
This is the start of the stable review cycle for the 6.18.19 release. There are 333 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Mar 2026 16:28:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.19-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.18.19-rc1
SeongJae Park <[email protected]>
mm/damon/core: disallow non-power of two min_region_sz
Jens Axboe <[email protected]>
io_uring/eventfd: use ctx->rings_rcu for flags checking
Jens Axboe <[email protected]>
io_uring: ensure ctx->rings is stable for task work flags manipulation
Eric Biggers <[email protected]>
net/tcp-md5: Fix MAC comparison to be constant-time
Eric Biggers <[email protected]>
lib/crypto: tests: Depend on library options rather than selecting them
Eric Biggers <[email protected]>
ksmbd: Compare MACs in constant time
Eric Biggers <[email protected]>
smb: client: Compare MACs in constant time
Nathan Chancellor <[email protected]>
kbuild: Leave objtool binary around with 'make clean'
Sean Christopherson <[email protected]>
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
Naveen N Rao <[email protected]>
KVM: SVM: Add a helper to look up the max physical ID for AVIC
Naveen N Rao <[email protected]>
KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
Marc Zyngier <[email protected]>
KVM: arm64: Eagerly init vgic dist/redist on vgic creation
Sascha Bischoff <[email protected]>
KVM: arm64: gic: Set vgic_model before initing private IRQs
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Add memory clock auto-gating support
Shenghao Yang <[email protected]>
drm/gud: fix NULL crtc dereference on display disable
Ruben Wauters <[email protected]>
drm/gud: rearrange gud_probe() to prepare for function splitting
Thomas Hellström <[email protected]>
mm: Fix a hmm_range_fault() livelock / starvation problem
Keith Busch <[email protected]>
cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Consolidate spinlocks
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path
Adrian Hunter <[email protected]>
i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
Yasin Lee <[email protected]>
iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
Yasin Lee <[email protected]>
iio: proximity: hx9023s: fix assignment order for __counted_by
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch when turning buffer off
Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix odr switch to the same value
Antoniu Miclaus <[email protected]>
iio: light: bh1780: fix PM runtime leak on error path
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-i2c: fix pm_runtime error handling
Radu Sabau <[email protected]>
iio: imu: adis: Fix NULL pointer dereference in adis_init
Antoniu Miclaus <[email protected]>
iio: gyro: mpu3050-core: fix pm_runtime error handling
Nuno Sá <[email protected]>
iio: buffer: Fix wait_queue not being removed
Chris Spencer <[email protected]>
iio: chemical: bme680: Fix measurement wait duration calculation
Lukas Schmid <[email protected]>
iio: potentiometer: mcp4131: fix double application of wiper shift
Antoniu Miclaus <[email protected]>
iio: magnetometer: tlv493d: remove erroneous shift in X-axis data
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
Antoniu Miclaus <[email protected]>
iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
SeungJu Cheon <[email protected]>
iio: frequency: adf4377: Fix duplicated soft reset mask
Oleksij Rempel <[email protected]>
iio: dac: ds4424: reject -128 RAW value
Filipe Manana <[email protected]>
btrfs: abort transaction on failure to update root in the received subvol ioctl
Bart Van Assche <[email protected]>
btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()
Filipe Manana <[email protected]>
btrfs: fix transaction abort on set received ioctl due to item overflow
Filipe Manana <[email protected]>
btrfs: fix transaction abort on file creation due to name hash collision
Filipe Manana <[email protected]>
btrfs: fix transaction abort when snapshotting received subvolumes
Henrique Carvalho <[email protected]>
smb: client: fix iface port assignment in parse_server_interfaces
Bharath SM <[email protected]>
smb: client: fix in-place encryption corruption in SMB2_write()
Paulo Alcantara <[email protected]>
smb: client: fix atomic open with O_DIRECT & O_SYNC
Josh Law <[email protected]>
lib/bootconfig: check bounds before writing in __xbc_open_brace()
Josh Law <[email protected]>
lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
Masami Hiramatsu (Google) <[email protected]>
kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
Shashank Balaji <[email protected]>
x86/apic: Disable x2apic on resume if the kernel expects so
Junxiao Bi <[email protected]>
scsi: core: Fix error handling for scsi_alloc_sdev()
Josh Law <[email protected]>
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
Hari Bathini <[email protected]>
powerpc64/bpf: fix the address returned by bpf_get_func_ip
Hari Bathini <[email protected]>
powerpc64/bpf: fix kfunc call support
Nam Cao <[email protected]>
powerpc/pseries: Correct MSI allocation tracking
Stefan Haberland <[email protected]>
s390/dasd: Copy detected format information to secondary device
Stefan Haberland <[email protected]>
s390/dasd: Move quiesce state with pprc swap
Harald Freudenberger <[email protected]>
s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
Tejun Heo <[email protected]>
sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags
Long Li <[email protected]>
xfs: ensure dquot item is deleted from AIL only after log shutdown
Darrick J. Wong <[email protected]>
xfs: fix undersized l_iclog_roundoff values
Carlos Maiolino <[email protected]>
xfs: fix returned valued from xfs_defer_can_append
Long Li <[email protected]>
xfs: fix integer overflow in bmap intent sort comparator
Shyam Prasad N <[email protected]>
cifs: make default value of retrans as zero
Jens Axboe <[email protected]>
io_uring/kbuf: check if target buffer list is still legacy on recycle
Laurent Vivier <[email protected]>
qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
Paul Moses <[email protected]>
net-shapers: don't free reply skb after genlmsg_reply()
Calvin Owens <[email protected]>
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
Andrei-Alexandru Tachici <[email protected]>
tracing: Fix enabling multiple events on the kernel command line and bootconfig
Abhinav Kumar <[email protected]>
drm/msm/dpu: Correct the SA8775P intr_underrun/intr_underrun index
Mario Limonciello <[email protected]>
drm/amd: Fix a few more NULL pointer dereference in device cleanup
Thomas Fourier <[email protected]>
drm/msm: Fix dma_free_attrs() buffer size
Jouni Högander <[email protected]>
drm/i915/psr: Repeat Selective Update area alignment
Janusz Krzysztofik <[email protected]>
drm/i915: Fix potential overflow of shmem scatterlist length
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
Luca Ceresoli <[email protected]>
drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
Mario Limonciello <[email protected]>
drm/amd: Fix NULL pointer dereference in device cleanup
Mario Limonciello <[email protected]>
drm/amd: Set num IP blocks to 0 if discovery fails
Alysa Liu <[email protected]>
drm/amdgpu: Fix use-after-free race in VM acquire
Yang Wang <[email protected]>
drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
Bastien Curutchet (Schneider Electric) <[email protected]>
net: dsa: microchip: Fix error path in PTP IRQ setup
Fan Wu <[email protected]>
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
Jian Zhang <[email protected]>
net: ncsi: fix skb leak in error paths
Mehul Rao <[email protected]>
net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
Johan Hovold <[email protected]>
net: mctp: fix device leak on probe failure
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free by using call_rcu() for oplock_info
Marios Makassikis <[email protected]>
smb: server: fix use-after-free in smb2_open()
Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
Hao Li <[email protected]>
memcg: fix slab accounting in refill_obj_stock() trylock path
Vlastimil Babka <[email protected]>
slab: distinguish lock and trylock for sheaf_flush_main()
Vasily Gorbik <[email protected]>
s390/xor: Fix xor_xc_5() inline assembly
Dillon Varone <[email protected]>
drm/amd/display: Fallback to boot snapshot for dispclk
Heiko Carstens <[email protected]>
s390/xor: Fix xor_xc_2() inline assembly constraints
Maximilian Pezzullo <[email protected]>
ata: libata-core: Disable LPM on ST1000DM010-2EP102
Heiko Carstens <[email protected]>
s390/stackleak: Fix __stackleak_poison() inline assembly constraint
Ashish Kalra <[email protected]>
crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: Fix broken reset status read
Franz Schnyder <[email protected]>
regulator: pf9453: Respect IRQ trigger settings from firmware
Pavel Begunkov <[email protected]>
io_uring/net: reject SEND_VECTORIZED when unsupported
Helge Deller <[email protected]>
parisc: Check kernel mapping earlier at bootup
Piotr Jaroszynski <[email protected]>
arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
Helge Deller <[email protected]>
parisc: Fix initial page table creation for boot
Pavel Begunkov <[email protected]>
io_uring/zcrx: use READ_ONCE with user shared RQEs
Sanman Pradhan <[email protected]>
hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
Catalin Marinas <[email protected]>
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
Dave Airlie <[email protected]>
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
Helge Deller <[email protected]>
parisc: Increase initial mapping to 64 MB with KALLSYMS
Shawn Lin <[email protected]>
pmdomain: rockchip: Fix PD_VCODEC for RK3588
Matt Roper <[email protected]>
drm/xe/xe2_hpg: Correct implementation of Wa_16025250150
Sven Eckelmann <[email protected]>
batman-adv: Avoid double-rtnl_lock ELP metric worker
Eric Biggers <[email protected]>
net/tcp-ao: Fix MAC comparison to be constant-time
Huiwen He <[email protected]>
tracing: Fix syscall events activation by ensuring refcount hits zero
Jakub Staniszewski <[email protected]>
ice: fix retry for AQ command 0x06EE
Long Li <[email protected]>
net: mana: Ring doorbell at 4 CQ wraparounds
Ariel Silver <[email protected]>
media: dvb-net: fix OOB access in ULE extension header tables
Christian Brauner <[email protected]>
selftests: fix mntns iteration selftests
Andy Shevchenko <[email protected]>
pinctrl: cy8c95x0: Don't miss reading the last bank registers
Luka Gejak <[email protected]>
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
Greg Kroah-Hartman <[email protected]>
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
Artem Lytkin <[email protected]>
staging: sm750fb: add missing pci_release_region on error and removal
Harry Yoo <[email protected]>
mm/slab: fix an incorrect check in obj_exts_alloc_size()
Raul Pazemecxas De Andrade <[email protected]>
mm/damon/core: clear walk_control on inactive context in damos_walk()
Jedrzej Jagielski <[email protected]>
ixgbevf: fix link setup issue
Eric Biggers <[email protected]>
kunit: irq: Ensure timer doesn't fire too frequently
Jakub Staniszewski <[email protected]>
ice: reintroduce retry mechanism for indirect AQ
Darrick J. Wong <[email protected]>
iomap: reject delalloc mappings during writeback
Mark Harmstone <[email protected]>
btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()
Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports
Andy Shevchenko <[email protected]>
device property: Allow secondary lookup in fwnode_get_next_child_node()
Kuniyuki Iwashima <[email protected]>
nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
Catalin Marinas <[email protected]>
arm64: gcs: Honour mprotect(PROT_NONE) on shadow stack mappings
Jiri Olsa <[email protected]>
bpf: Fix kprobe_multi cookies access in show_fdinfo callback
Alexander Gordeev <[email protected]>
s390/pfault: Fix virtual vs physical address confusion
Shuicheng Lin <[email protected]>
drm/xe/sync: Cleanup partially initialized sync on parse failure
Corey Minyard <[email protected]>
ipmi:si: Fix check for a misbehaving BMC
Bartosz Golaszewski <[email protected]>
gpiolib: normalize the return value of gc->get() on behalf of buggy drivers
Jouni Högander <[email protected]>
drm/i915/alpm: ALPM disable fixes
Dave Airlie <[email protected]>
nouveau/gsp: drop WARN_ON in ACPI probes
Corey Minyard <[email protected]>
ipmi:si: Handle waiting messages when BMC failure detected
Franz Schnyder <[email protected]>
drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
Osama Abdelkader <[email protected]>
drm/bridge: samsung-dsim: Fix memory leak in error path
Corey Minyard <[email protected]>
ipmi:si: Use a long timeout when the BMC is misbehaving
Corey Minyard <[email protected]>
ipmi:si: Don't block module unload if the BMC is messed up
Mario Limonciello <[email protected]>
drm/amd: Disable MES LR compute W/A
Sunil Khatri <[email protected]>
drm/amdgpu: add upper bound check on user inputs in wait ioctl
Tvrtko Ursulin <[email protected]>
drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl
Sunil Khatri <[email protected]>
drm/amdgpu: add upper bound check on user inputs in signal ioctl
David Arcari <[email protected]>
cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()
Christian Brauner <[email protected]>
kthread: consolidate kthread exit paths to prevent use-after-free
Axel Rasmussen <[email protected]>
Revert "ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()"
Xu Yang <[email protected]>
Revert "tcpm: allow looking for role_sw device in the main node"
Xingui Yang <[email protected]>
scsi: hisi_sas: Fix NULL pointer exception during user_scan()
Wang Shuaiwei <[email protected]>
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
Viktor Malik <[email protected]>
powerpc, perf: Check that current->mm is alive before getting user callchain
Adrian Ng Ho Yin <[email protected]>
i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
Steven Rostedt <[email protected]>
time/jiffies: Mark jiffies_64_to_clock_t() notrace
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Improve Focusrite sample rate filtering
Max Kellermann <[email protected]>
ceph: fix memory leaks in ceph_mdsc_build_path()
Hristo Venev <[email protected]>
ceph: do not skip the first folio of the next object in writeback
Max Kellermann <[email protected]>
ceph: fix i_nlink underrun during async unlink
Ilya Dryomov <[email protected]>
libceph: admit message frames only in CEPH_CON_S_OPEN state
Raphael Zimmer <[email protected]>
libceph: Use u32 for non-negative values in ceph_monmap_decode()
Ilya Dryomov <[email protected]>
libceph: prevent potential out-of-bounds reads in process_message_header()
Ilya Dryomov <[email protected]>
libceph: reject preamble if control segment is empty
Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
Max Kellermann <[email protected]>
ceph: add a bunch of missing ceph_path_info initializers
Masami Hiramatsu (Google) <[email protected]>
kprobes: avoid crash when rmmod/insmod after ftrace killed
Mehul Rao <[email protected]>
tipc: fix divide-by-zero in tipc_sk_filter_connect()
Ravi Hothi <[email protected]>
ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
Penghe Geng <[email protected]>
mmc: core: Avoid bitfield RMW for claim/retune flags
Alexander Potapenko <[email protected]>
mm/kfence: disable KFENCE upon KASAN HW tags enablement
Felix Gu <[email protected]>
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
Alexander Potapenko <[email protected]>
mm/kfence: fix KASAN hardware tag faults during late enablement
Kalesh Singh <[email protected]>
mm/tracing: rss_stat: ensure curr is false from kthread context
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Fix net_device lifecycle with device_move
Kuen-Han Tsai <[email protected]>
Revert "usb: gadget: u_ether: add gether_opts for config caching"
Kuen-Han Tsai <[email protected]>
Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind"
Kuen-Han Tsai <[email protected]>
Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device"
Kuen-Han Tsai <[email protected]>
Revert "usb: legacy: ncm: Fix NPE in gncm_bind"
Kuen-Han Tsai <[email protected]>
Revert "usb: gadget: f_ncm: Fix atomic context locking issue"
Kuen-Han Tsai <[email protected]>
usb: legacy: ncm: Fix NPE in gncm_bind
Kuen-Han Tsai <[email protected]>
usb: gadget: f_ncm: Fix atomic context locking issue
Jiasheng Jiang <[email protected]>
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
Ziyi Guo <[email protected]>
usb: image: mdc800: kill download URB on timeout
Junzhong Pan <[email protected]>
usb: gadget: uvc: fix interval_duration calculation
Oliver Neukum <[email protected]>
usb: mdc800: handle signal and read racing
John Keeping <[email protected]>
usb: gadget: f_hid: fix SuperSpeed descriptors
Fan Wu <[email protected]>
usb: renesas_usbhs: fix use-after-free in ISR during device removal
Oliver Neukum <[email protected]>
usb: class: cdc-wdm: fix reordering issue in read code path
Alan Stern <[email protected]>
USB: core: Limit the length of unkillable synchronous timeouts
Alan Stern <[email protected]>
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
Alan Stern <[email protected]>
USB: usbcore: Introduce usb_bulk_msg_killable()
RD Babiera <[email protected]>
usb: typec: altmode/displayport: set displayport signaling rate in configure message
Xu Yang <[email protected]>
usb: roles: get usb role switch from parent only for usb-b-connector
Marc Zyngier <[email protected]>
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
Gabor Juhos <[email protected]>
usb: core: don't power off roothub PHYs if phy_set_mode() fails
Greg Kroah-Hartman <[email protected]>
usb: misc: uss720: properly clean up reference in uss720_probe()
Heikki Krogerus <[email protected]>
usb: dwc3: pci: add support for the Intel Nova Lake -H
Oliver Neukum <[email protected]>
usb: yurex: fix race in probe
Dayu Jiang <[email protected]>
usb: xhci: Prevent interrupt storm on host controller error (HCE)
Zilin Guan <[email protected]>
usb: xhci: Fix memory leak in xhci_disable_slot()
Vyacheslav Vahnenko <[email protected]>
USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
Christoffer Sandberg <[email protected]>
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
A1RM4X <[email protected]>
USB: add QUIRK_NO_BOS for video capture several devices
Marc Zyngier <[email protected]>
KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault
Sean Christopherson <[email protected]>
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
Jim Mattson <[email protected]>
KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
Marc Zyngier <[email protected]>
KVM: arm64: Fix protected mode handling of pages larger than 4kB
Zhang Heng <[email protected]>
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
Pedro Falcato <[email protected]>
ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
Alexandre Courbot <[email protected]>
rust: str: make NullTerminatedFormatter public
Miguel Ojeda <[email protected]>
rust: kbuild: allow unused_features
Alice Ryhl <[email protected]>
rust_binder: call set_notification_done() without proc lock
Alice Ryhl <[email protected]>
rust_binder: avoid reading the written value in offsets array
Alice Ryhl <[email protected]>
rust_binder: check ownership before using vma
Carlos Llamas <[email protected]>
rust_binder: fix oneway spam detection
Oleksij Rempel <[email protected]>
net: usb: lan78xx: skip LTM configuration for LAN7850
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix TX byte statistics for small packets
Oleksij Rempel <[email protected]>
net: usb: lan78xx: fix silent drop of packets with checksum errors
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): always configure bitrates before starting device
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
Mehul Rao <[email protected]>
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
Cheng-Yang Chou <[email protected]>
sched_ext: Remove redundant css_put() in scx_cgroup_init()
Qingye Zhao <[email protected]>
cgroup: fix race between task migration and iteration
Perry Yuan <[email protected]>
drm/amdgpu: ensure no_hw_access is visible before MMIO
Seungjin Bae <[email protected]>
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
Andreas Kemnade <[email protected]>
iio: imu: inv-mpu9150: fix irq ack preventing irq storms
Eric Dumazet <[email protected]>
net: prevent NULL deref in ip[6]tunnel_xmit()
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
Alok Tiwari <[email protected]>
octeontx2-af: devlink: fix NIX RAS reporter recovery condition
Chintan Vankar <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support
Vadim Fedorenko <[email protected]>
net: ti: am65-cpsw: move hw timestamping to ndo callback
Shiraz Saleem <[email protected]>
net/mana: Null service_wq on setup error to prevent double destroy
Sabrina Dubroca <[email protected]>
neighbour: restore protocol != 0 check in pneigh update
Marek Behún <[email protected]>
net: dsa: realtek: Fix LED group port bit for non-zero LED group
Ricardo B. Marlière <[email protected]>
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
Chuck Lever <[email protected]>
perf synthetic-events: Fix stale build ID in module MMAP2 records
Philip Yang <[email protected]>
drm/amdkfd: Unreserve bo if queue update failed
Casey Connolly <[email protected]>
ASoC: detect empty DMI strings
Chen Ni <[email protected]>
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
Ben Dooks <[email protected]>
ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
Nicolai Buchwitz <[email protected]>
net: bcmgenet: fix broken EEE by converting to phylib-managed state
Jakub Kicinski <[email protected]>
page_pool: store detach_time as ktime_t to avoid false-negatives
Matt Vollrath <[email protected]>
e1000/e1000e: Fix leak in DMA error cleanup
Alok Tiwari <[email protected]>
i40e: fix src IP mask checks and memcpy argument names in cloud filter
Petr Oros <[email protected]>
iavf: fix incorrect reset handling in callbacks
Petr Oros <[email protected]>
iavf: fix PTP use-after-free during reset
Nikolay Aleksandrov <[email protected]>
drivers: net: ice: fix devlink parameters get without irdma
Sungwoo Kim <[email protected]>
nvme-pci: Fix race bug in nvme_poll_irqdisable()
Sungwoo Kim <[email protected]>
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
Rafael J. Wysocki <[email protected]>
sched: idle: Make skipping governor callbacks more consistent
Chen Ni <[email protected]>
perf ftrace: Fix hashmap__new() error checking
Peng Fan <[email protected]>
regulator: pca9450: Correct probed name for PCA9452
Martijn de Gouw <[email protected]>
regulator: pca9450: Add support for setting debounce settings
Peng Fan <[email protected]>
regulator: pca9450: Correct interrupt type
Chen Ni <[email protected]>
perf annotate: Fix hashmap__new() error checking
Yuan Tan <[email protected]>
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Hyunwoo Kim <[email protected]>
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
David Dull <[email protected]>
netfilter: x_tables: guard option walkers against 1-byte tail reads
Jenny Guanni Qu <[email protected]>
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
Florian Westphal <[email protected]>
netfilter: nf_tables: always walk all pending catchall elements
Phil Sutter <[email protected]>
netfilter: nf_tables: Fix for duplicate device in netdev hooks
Weiming Shi <[email protected]>
net: add xmit recursion limit to tunnel xmit functions
Raju Rangoju <[email protected]>
amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
Raju Rangoju <[email protected]>
amd-xgbe: fix link status handling in xgbe_rx_adaptation
Chengfeng Ye <[email protected]>
mctp: route: hold key->lock in mctp_flow_prepare_output()
Jiayuan Chen <[email protected]>
bonding: fix type confusion in bond_setup_by_slave()
Hangbin Liu <[email protected]>
bonding: use common function to compute the features
Wenyuan Li <[email protected]>
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
Haiyue Wang <[email protected]>
mctp: i2c: fix skb memory leak in receive path
Pavan Chebbi <[email protected]>
bnxt_en: Fix RSS table size check when changing ethtool channels
Shuangpeng Bai <[email protected]>
serial: caif: hold tty->link reference in ldisc_open and ser_release
Álvaro Fernández Rojas <[email protected]>
net: sfp: improve Huawei MA5671a fixup
Sen Wang <[email protected]>
ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
matteo.cotifava <[email protected]>
ASoC: soc-core: flush delayed work before removing DAIs and widgets
matteo.cotifava <[email protected]>
ASoC: soc-core: drop delayed_work_pending() check before flush
Felix Gu <[email protected]>
spi: rockchip-sfc: Fix double-free in remove() callback
Felix Gu <[email protected]>
spi: amlogic: spifc-a4: Fix DMA mapping error handling
David Lechner <[email protected]>
drm/sitronix/st7586: fix bad pixel data due to byte swap
Vivian Wang <[email protected]>
net: spacemit: Fix error handling in emac_tx_mem_map()
Vivian Wang <[email protected]>
net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
Miaoqian Lin <[email protected]>
rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
Weiming Shi <[email protected]>
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
Dragos Tatulea <[email protected]>
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
Dragos Tatulea <[email protected]>
net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
Gal Pressman <[email protected]>
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
Carolina Jubran <[email protected]>
net/mlx5: Fix peer miss rules host disabled checks
Patrisious Haddad <[email protected]>
net/mlx5: Fix crash when moving to switchdev mode
Cosmin Ratiu <[email protected]>
net/mlx5: Fix deadlock between devlink lock and esw->wq
Hangbin Liu <[email protected]>
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
Hangbin Liu <[email protected]>
bonding: do not set usable_slaves for broadcast mode
Yang Wang <[email protected]>
drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
Yang Wang <[email protected]>
drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13
Pengyu Luo <[email protected]>
drm/msm/dsi: fix pclk rate calculation for bonded dsi
Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
Krzysztof Kozlowski <[email protected]>
dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo
Peter Collingbourne <[email protected]>
perf disasm: Fix off-by-one bug in outside check
Breno Leitao <[email protected]>
workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
Sun YangKai <[email protected]>
btrfs: hold space_info->lock when clearing periodic reclaim ready
Eric Badger <[email protected]>
xprtrdma: Decrement re_receiving on the early exit paths
Pengyu Luo <[email protected]>
drm/msm/dsi: fix hdisplay calculation when programming dsi registers
Roberto Bergantinos Corpas <[email protected]>
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
Guenter Roeck <[email protected]>
smb/server: Fix another refcount leak in smb2_open()
J. Neuschäfer <[email protected]>
powerpc: 83xx: km83xx: Fix keymile vendor prefix
Tzung-Bi Shih <[email protected]>
remoteproc: mediatek: Unprepare SCP clock during system suspend
Bjorn Andersson <[email protected]>
remoteproc: sysmon: Correct subsys_name_len type in QMI request
Sourabh Jain <[email protected]>
powerpc/crash: adjust the elfcorehdr size
Sourabh Jain <[email protected]>
powerpc/kexec/core: use big-endian types for crash variables
Ben Collins <[email protected]>
kexec: Include kernel-end even without crashkernel
Christophe Leroy (CS GROUP) <[email protected]>
powerpc/uaccess: Fix inline assembly for clang build on PPC32
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check max frame size for implicit feedback mode, too
sguttula <[email protected]>
drm/amdgpu/vcn5: Add SMU dpm interface type
Takashi Iwai <[email protected]>
ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
wangshuaiwei <[email protected]>
scsi: ufs: core: Fix shift out of bounds when MAXQ=32
Peter Wang <[email protected]>
scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
Charles Keepax <[email protected]>
ASoC: cs42l43: Report insert for exotic peripherals
Azamat Almazbek uulu <[email protected]>
ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
Tomas Henzl <[email protected]>
scsi: ses: Fix devices attaching to different hosts
Sofia Schneider <[email protected]>
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
Ramanathan Choodamani <[email protected]>
wifi: mac80211: set default WMM parameters on all links
Al Viro <[email protected]>
unshare: fix unshare_fs() handling
Sean Rhodes <[email protected]>
ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Add NULL checks when resetting request and reply queues
Edward Adam Davis <[email protected]>
fs: init flags_valid before calling vfs_fileattr_get
Won Jung <[email protected]>
scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode
Piotr Mazek <[email protected]>
ACPI: PM: Save NVS memory on Lenovo G70-35
Jan Kiszka <[email protected]>
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
-------------
Diffstat:
.../bindings/display/msm/qcom,sm8750-mdss.yaml | 2 +- Documentation/virt/kvm/api.rst | 8 + Makefile | 13 +- arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 2 +- arch/arm64/kvm/mmu.c | 12 +- arch/arm64/kvm/vgic/vgic-init.c | 34 ++-- arch/arm64/mm/contpte.c | 53 ++++++- arch/arm64/mm/mmap.c | 6 +- arch/parisc/include/asm/pgtable.h | 2 +- arch/parisc/kernel/head.S | 7 +- arch/parisc/kernel/setup.c | 20 ++- arch/powerpc/include/asm/uaccess.h | 2 +- arch/powerpc/kexec/core.c | 40 ++--- arch/powerpc/kexec/file_load_64.c | 14 +- arch/powerpc/net/bpf_jit_comp.c | 30 ++-- arch/powerpc/net/bpf_jit_comp64.c | 101 +++++++++++- arch/powerpc/perf/callchain.c | 5 + arch/powerpc/perf/callchain_32.c | 1 - arch/powerpc/perf/callchain_64.c | 1 - arch/powerpc/platforms/83xx/km83xx.c | 4 +- arch/powerpc/platforms/pseries/msi.c | 2 +- arch/s390/include/asm/processor.h | 2 +- arch/s390/lib/xor.c | 5 +- arch/s390/mm/pfault.c | 4 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/include/uapi/asm/kvm.h | 1 + arch/x86/kernel/apic/apic.c | 6 + arch/x86/kvm/svm/avic.c | 30 +++- arch/x86/kvm/svm/svm.c | 9 +- arch/x86/kvm/vmx/nested.c | 22 ++- drivers/acpi/osi.c | 13 ++ drivers/acpi/osl.c | 2 +- drivers/acpi/sleep.c | 8 + drivers/android/binder/page_range.rs | 83 +++++++--- drivers/android/binder/process.rs | 3 +- drivers/android/binder/range_alloc/array.rs | 35 +++- drivers/android/binder/range_alloc/mod.rs | 4 +- drivers/android/binder/range_alloc/tree.rs | 18 +-- drivers/android/binder/thread.rs | 17 +- drivers/ata/libata-core.c | 2 + drivers/base/property.c | 27 ++-- drivers/char/ipmi/ipmi_si_intf.c | 37 +++-- drivers/cpufreq/intel_pstate.c | 4 +- drivers/cpuidle/cpuidle.c | 10 -- drivers/crypto/ccp/sev-dev.c | 10 +- drivers/cxl/Kconfig | 1 + drivers/gpio/gpiolib.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 14 ++ drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 5 - drivers/gpu/drm/amd/amdgpu/mes_v12_0.c | 5 - drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 4 + .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + .../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 11 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 6 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 +- drivers/gpu/drm/bridge/samsung-dsim.c | 25 +-- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 13 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 6 +- drivers/gpu/drm/gud/gud_drv.c | 54 ++++--- drivers/gpu/drm/gud/gud_internal.h | 4 + drivers/gpu/drm/gud/gud_pipe.c | 54 ++++--- drivers/gpu/drm/i915/display/intel_alpm.c | 7 +- drivers/gpu/drm/i915/display/intel_psr.c | 50 ++++-- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 12 +- drivers/gpu/drm/msm/adreno/a2xx_gpummu.c | 2 +- .../drm/msm/disp/dpu1/catalog/dpu_8_4_sa8775p.h | 4 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 43 +++-- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 + .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 12 +- drivers/gpu/drm/sitronix/st7586.c | 15 +- drivers/gpu/drm/xe/xe_sync.c | 24 ++- drivers/gpu/drm/xe/xe_wa.c | 13 +- drivers/hwmon/pmbus/q54sj108a2.c | 19 +-- drivers/i3c/master/dw-i3c-master.c | 4 +- drivers/i3c/master/mipi-i3c-hci/cmd.h | 1 + drivers/i3c/master/mipi-i3c-hci/cmd_v1.c | 2 +- drivers/i3c/master/mipi-i3c-hci/cmd_v2.c | 2 +- drivers/i3c/master/mipi-i3c-hci/core.c | 9 +- drivers/i3c/master/mipi-i3c-hci/dma.c | 94 +++++++---- drivers/i3c/master/mipi-i3c-hci/hci.h | 2 + drivers/i3c/master/mipi-i3c-hci/pio.c | 16 +- drivers/iio/chemical/bme680_core.c | 2 +- drivers/iio/chemical/sps30_i2c.c | 2 +- drivers/iio/chemical/sps30_serial.c | 2 +- drivers/iio/dac/ds4424.c | 2 +- drivers/iio/frequency/adf4377.c | 2 +- drivers/iio/gyro/mpu3050-core.c | 18 ++- drivers/iio/gyro/mpu3050-i2c.c | 3 +- drivers/iio/imu/adis.c | 2 +- drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 4 + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 8 + drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 2 + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +- drivers/iio/industrialio-buffer.c | 6 +- drivers/iio/light/bh1780.c | 2 +- drivers/iio/magnetometer/tlv493d.c | 2 +- drivers/iio/potentiometer/mcp4131.c | 2 +- drivers/iio/proximity/hx9023s.c | 6 +- drivers/irqchip/irq-gic-v3-its.c | 4 + drivers/media/dvb-core/dvb_net.c | 3 + drivers/mmc/host/dw_mmc-rockchip.c | 44 +++++- drivers/mmc/host/mmci_qcom_dml.c | 1 + drivers/net/bonding/bond_main.c | 157 +++++++----------- drivers/net/caif/caif_serial.c | 3 + drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/usb/gs_usb.c | 22 ++- drivers/net/dsa/microchip/ksz_ptp.c | 11 +- drivers/net/dsa/realtek/rtl8365mb.c | 3 +- drivers/net/dsa/realtek/rtl8366rb-leds.c | 6 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 82 +++++++++- drivers/net/ethernet/amd/xgbe/xgbe.h | 4 + drivers/net/ethernet/arc/emac_main.c | 11 ++ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 31 ++-- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 5 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 - drivers/net/ethernet/intel/e1000e/netdev.c | 2 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +- drivers/net/ethernet/intel/iavf/iavf.h | 3 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 19 +-- drivers/net/ethernet/intel/iavf/iavf_main.c | 81 ++++------ drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 1 - drivers/net/ethernet/intel/ice/devlink/devlink.c | 4 +- drivers/net/ethernet/intel/ice/ice_common.c | 13 +- drivers/net/ethernet/intel/ice/ice_ethtool.c | 35 ++-- drivers/net/ethernet/intel/ixgbevf/vf.c | 3 +- .../ethernet/marvell/octeontx2/af/rvu_devlink.c | 6 +- .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 23 ++- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 45 +++--- drivers/net/ethernet/microsoft/mana/gdma_main.c | 1 + drivers/net/ethernet/microsoft/mana/mana_en.c | 23 ++- drivers/net/ethernet/spacemit/k1_emac.c | 19 ++- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 56 ++++--- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 +- drivers/net/mctp/mctp-i2c.c | 1 + drivers/net/mctp/mctp-usb.c | 3 +- drivers/net/phy/sfp.c | 8 +- drivers/net/usb/lan78xx.c | 12 +- drivers/net/usb/lan78xx.h | 3 + drivers/net/usb/qmi_wwan.c | 4 +- drivers/net/usb/usbnet.c | 7 +- drivers/nvme/host/pci.c | 8 +- drivers/pinctrl/pinctrl-cy8c95x0.c | 4 +- drivers/pmdomain/bcm/bcm2835-power.c | 6 +- drivers/pmdomain/rockchip/pm-domains.c | 2 +- drivers/regulator/pca9450-regulator.c | 172 +++++++++++++++++--- drivers/regulator/pf9453-regulator.c | 2 +- drivers/remoteproc/mtk_scp.c | 39 +++++ drivers/remoteproc/qcom_sysmon.c | 2 +- drivers/s390/block/dasd_eckd.c | 16 ++ drivers/s390/crypto/zcrypt_ccamisc.c | 12 +- drivers/s390/crypto/zcrypt_cex4.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 32 ++-- drivers/scsi/scsi_scan.c | 8 +- drivers/scsi/ses.c | 5 +- drivers/scsi/storvsc_drv.c | 5 +- drivers/spi/spi-amlogic-spifc-a4.c | 5 +- drivers/spi/spi-rockchip-sfc.c | 2 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 15 +- drivers/staging/rtl8723bs/core/rtw_mlme.c | 5 +- drivers/staging/sm750fb/sm750.c | 1 + drivers/staging/sm750fb/sm750_hw.c | 22 +-- drivers/ufs/core/ufshcd.c | 11 +- drivers/usb/class/cdc-acm.c | 5 + drivers/usb/class/cdc-acm.h | 1 + drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/class/usbtmc.c | 6 +- drivers/usb/core/message.c | 100 +++++++++--- drivers/usb/core/phy.c | 8 +- drivers/usb/core/quirks.c | 16 ++ drivers/usb/dwc3/dwc3-pci.c | 2 + drivers/usb/gadget/function/f_hid.c | 4 + drivers/usb/gadget/function/f_mass_storage.c | 12 +- drivers/usb/gadget/function/f_ncm.c | 144 +++++++++-------- drivers/usb/gadget/function/f_tcm.c | 14 ++ drivers/usb/gadget/function/u_ether.c | 67 +++----- drivers/usb/gadget/function/u_ether.h | 56 +++---- drivers/usb/gadget/function/u_ether_configfs.h | 176 --------------------- drivers/usb/gadget/function/u_ncm.h | 4 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/host/xhci-ring.c | 1 + drivers/usb/host/xhci.c | 4 +- drivers/usb/image/mdc800.c | 6 +- drivers/usb/misc/uss720.c | 2 +- drivers/usb/misc/yurex.c | 2 +- drivers/usb/renesas_usbhs/common.c | 9 ++ drivers/usb/roles/class.c | 7 +- drivers/usb/typec/altmodes/displayport.c | 7 +- drivers/usb/typec/tcpm/tcpm.c | 2 +- fs/afs/addr_list.c | 8 +- fs/btrfs/extent_io.c | 1 + fs/btrfs/inode.c | 19 +++ fs/btrfs/ioctl.c | 24 ++- fs/btrfs/space-info.c | 5 +- fs/btrfs/transaction.c | 16 ++ fs/btrfs/uuid-tree.c | 38 +++++ fs/btrfs/uuid-tree.h | 2 + fs/btrfs/volumes.c | 6 +- fs/ceph/addr.c | 1 - fs/ceph/debugfs.c | 4 +- fs/ceph/dir.c | 17 +- fs/ceph/file.c | 4 +- fs/ceph/inode.c | 2 +- fs/ceph/mds_client.c | 3 + fs/file_attr.c | 2 +- fs/iomap/ioend.c | 13 +- fs/nfs/nfs3proc.c | 7 +- fs/nfsd/nfsctl.c | 2 +- fs/smb/client/cifsencrypt.c | 3 +- fs/smb/client/cifsglob.h | 11 ++ fs/smb/client/dir.c | 1 + fs/smb/client/file.c | 18 +-- fs/smb/client/fs_context.c | 2 +- fs/smb/client/smb2ops.c | 14 +- fs/smb/client/smb2pdu.c | 5 +- fs/smb/client/smb2transport.c | 4 +- fs/smb/server/Kconfig | 1 + fs/smb/server/auth.c | 4 +- fs/smb/server/oplock.c | 35 ++-- fs/smb/server/oplock.h | 5 +- fs/smb/server/smb2pdu.c | 13 +- fs/xfs/libxfs/xfs_defer.c | 2 +- fs/xfs/xfs_bmap_item.c | 2 +- fs/xfs/xfs_dquot.c | 8 +- fs/xfs/xfs_log.c | 2 + include/kunit/run-in-irq-context.h | 44 ++++-- include/linux/io_uring_types.h | 1 + include/linux/irqchip/arm-gic-v3.h | 1 + include/linux/kthread.h | 21 ++- include/linux/migrate.h | 8 + include/linux/mm.h | 17 +- include/linux/mmc/host.h | 9 +- include/linux/netdevice.h | 32 ++++ include/linux/regulator/pca9450.h | 32 ++++ include/linux/usb.h | 8 +- include/linux/usb/usbnet.h | 1 + include/net/ip6_tunnel.h | 14 ++ include/net/ip_tunnels.h | 7 + include/net/page_pool/types.h | 2 +- include/trace/events/kmem.h | 8 +- io_uring/eventfd.c | 10 +- io_uring/io_uring.c | 25 ++- io_uring/kbuf.c | 13 +- io_uring/net.c | 2 + io_uring/register.c | 11 ++ io_uring/zcrx.c | 5 +- kernel/cgroup/cgroup.c | 1 + kernel/exit.c | 6 + kernel/fork.c | 2 +- kernel/kprobes.c | 8 +- kernel/kthread.c | 41 +---- kernel/sched/ext.c | 6 +- kernel/sched/idle.c | 11 +- kernel/time/time.c | 2 +- kernel/trace/bpf_trace.c | 4 +- kernel/trace/trace.c | 6 +- kernel/trace/trace_events.c | 58 +++++-- kernel/workqueue.c | 2 +- lib/bootconfig.c | 6 +- lib/crypto/tests/Kconfig | 20 +-- mm/damon/core.c | 10 +- mm/filemap.c | 13 +- mm/kfence/core.c | 29 +++- mm/memcontrol.c | 2 +- mm/memory.c | 3 +- mm/page_alloc.c | 3 +- mm/slub.c | 54 +++++-- net/batman-adv/bat_v_elp.c | 10 +- net/batman-adv/hard-interface.c | 8 +- net/batman-adv/hard-interface.h | 1 + net/ceph/auth.c | 6 +- net/ceph/messenger_v2.c | 31 ++-- net/ceph/mon_client.c | 6 +- net/core/dev.h | 35 ---- net/core/neighbour.c | 3 +- net/core/page_pool_user.c | 4 +- net/ipv4/Kconfig | 1 + net/ipv4/ip_tunnel_core.c | 15 ++ net/ipv4/nexthop.c | 14 +- net/ipv4/tcp.c | 3 +- net/ipv4/tcp_ao.c | 3 +- net/ipv4/tcp_ipv4.c | 3 +- net/ipv6/tcp_ipv6.c | 3 +- net/mac80211/link.c | 2 + net/mctp/route.c | 13 +- net/ncsi/ncsi-aen.c | 3 +- net/ncsi/ncsi-rsp.c | 16 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_cthelper.c | 8 +- net/netfilter/nfnetlink_queue.c | 4 +- net/netfilter/nft_chain_filter.c | 2 +- net/netfilter/nft_set_pipapo.c | 3 +- net/netfilter/xt_IDLETIMER.c | 6 + net/netfilter/xt_dccp.c | 4 +- net/netfilter/xt_tcpudp.c | 6 +- net/rxrpc/af_rxrpc.c | 8 +- net/sched/sch_teql.c | 1 + net/shaper/shaper.c | 11 +- net/sunrpc/xprtrdma/verbs.c | 7 +- net/tipc/socket.c | 2 + rust/kernel/str.rs | 4 +- sound/core/pcm_native.c | 19 ++- sound/hda/codecs/realtek/alc269.c | 25 +++ sound/soc/amd/acp3x-rt5682-max9836.c | 9 +- sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/cs42l43-jack.c | 1 + sound/soc/generic/simple-card-utils.c | 12 +- sound/soc/qcom/qdsp6/q6apm-dai.c | 1 + sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 1 + sound/soc/qcom/qdsp6/q6apm.c | 1 + sound/soc/soc-core.c | 11 +- sound/usb/endpoint.c | 1 + sound/usb/format.c | 70 +++++++- sound/usb/mixer_scarlett2.c | 2 + sound/usb/quirks.c | 2 + tools/objtool/Makefile | 8 +- tools/perf/builtin-ftrace.c | 9 +- tools/perf/util/annotate.c | 5 +- tools/perf/util/disasm.c | 2 +- tools/perf/util/synthetic-events.c | 5 + .../selftests/filesystems/nsfs/iterate_mntns.c | 25 +-- 336 files changed, 2962 insertions(+), 1604 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/333 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
[ Upstream commit 57297736c08233987e5d29ce6584c6ca2a831b12 ]
This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V:
[ 415.140818] BUG: scheduling while atomic: stress-ng-iomix/1048/0x00000002
[ 415.140822] INFO: lockdep is turned off.
[ 415.140823] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec ghash_clmulni_intel aesni_intel rapl binfmt_misc nls_ascii nls_cp437 vfat fat snd_pcm hyperv_drm snd_timer drm_client_lib drm_shmem_helper snd sg soundcore drm_kms_helper pcspkr hv_balloon hv_utils evdev joydev drm configfs efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common hv_sock vmw_vsock_vmci_transport vsock vmw_vmci efivarfs autofs4 ext4 crc16 mbcache jbd2 sr_mod sd_mod cdrom hv_storvsc serio_raw hid_generic scsi_transport_fc hid_hyperv scsi_mod hid hv_netvsc hyperv_keyboard scsi_common
[ 415.140846] Preemption disabled at:
[ 415.140847] [<ffffffffc0656171>] storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140854] CPU: 8 UID: 0 PID: 1048 Comm: stress-ng-iomix Not tainted 6.19.0-rc7 #30 PREEMPT_{RT,(full)}
[ 415.140856] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/04/2024
[ 415.140857] Call Trace:
[ 415.140861] <TASK>
[ 415.140861] ? storvsc_queuecommand+0x2e1/0xbe0 [hv_storvsc]
[ 415.140863] dump_stack_lvl+0x91/0xb0
[ 415.140870] __schedule_bug+0x9c/0xc0
[ 415.140875] __schedule+0xdf6/0x1300
[ 415.140877] ? rtlock_slowlock_locked+0x56c/0x1980
[ 415.140879] ? rcu_is_watching+0x12/0x60
[ 415.140883] schedule_rtlock+0x21/0x40
[ 415.140885] rtlock_slowlock_locked+0x502/0x1980
[ 415.140891] rt_spin_lock+0x89/0x1e0
[ 415.140893] hv_ringbuffer_write+0x87/0x2a0
[ 415.140899] vmbus_sendpacket_mpb_desc+0xb6/0xe0
[ 415.140900] ? rcu_is_watching+0x12/0x60
[ 415.140902] storvsc_queuecommand+0x669/0xbe0 [hv_storvsc]
[ 415.140904] ? HARDIRQ_verbose+0x10/0x10
[ 415.140908] ? __rq_qos_issue+0x28/0x40
[ 415.140911] scsi_queue_rq+0x760/0xd80 [scsi_mod]
[ 415.140926] __blk_mq_issue_directly+0x4a/0xc0
[ 415.140928] blk_mq_issue_direct+0x87/0x2b0
[ 415.140931] blk_mq_dispatch_queue_requests+0x120/0x440
[ 415.140933] blk_mq_flush_plug_list+0x7a/0x1a0
[ 415.140935] __blk_flush_plug+0xf4/0x150
[ 415.140940] __submit_bio+0x2b2/0x5c0
[ 415.140944] ? submit_bio_noacct_nocheck+0x272/0x360
[ 415.140946] submit_bio_noacct_nocheck+0x272/0x360
[ 415.140951] ext4_read_bh_lock+0x3e/0x60 [ext4]
[ 415.140995] ext4_block_write_begin+0x396/0x650 [ext4]
[ 415.141018] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ext4]
[ 415.141038] ext4_da_write_begin+0x1c4/0x350 [ext4]
[ 415.141060] generic_perform_write+0x14e/0x2c0
[ 415.141065] ext4_buffered_write_iter+0x6b/0x120 [ext4]
[ 415.141083] vfs_write+0x2ca/0x570
[ 415.141087] ksys_write+0x76/0xf0
[ 415.141089] do_syscall_64+0x99/0x1490
[ 415.141093] ? rcu_is_watching+0x12/0x60
[ 415.141095] ? finish_task_switch.isra.0+0xdf/0x3d0
[ 415.141097] ? rcu_is_watching+0x12/0x60
[ 415.141098] ? lock_release+0x1f0/0x2a0
[ 415.141100] ? rcu_is_watching+0x12/0x60
[ 415.141101] ? finish_task_switch.isra.0+0xe4/0x3d0
[ 415.141103] ? rcu_is_watching+0x12/0x60
[ 415.141104] ? __schedule+0xb34/0x1300
[ 415.141106] ? hrtimer_try_to_cancel+0x1d/0x170
[ 415.141109] ? do_nanosleep+0x8b/0x160
[ 415.141111] ? hrtimer_nanosleep+0x89/0x100
[ 415.141114] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 415.141116] ? xfd_validate_state+0x26/0x90
[ 415.141118] ? rcu_is_watching+0x12/0x60
[ 415.141120] ? do_syscall_64+0x1e0/0x1490
[ 415.141121] ? do_syscall_64+0x1e0/0x1490
[ 415.141123] ? rcu_is_watching+0x12/0x60
[ 415.141124] ? do_syscall_64+0x1e0/0x1490
[ 415.141125] ? do_syscall_64+0x1e0/0x1490
[ 415.141127] ? irqentry_exit+0x140/0x7e0
[ 415.141129] entry_SYSCALL_64_after_hwframe+0x76/0x7eget_cpu() disables preemption while the spinlock hv_ringbuffer_write is using is converted to an rt-mutex under PREEMPT_RT.
--- drivers/scsi/storvsc_drv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/storvsc_drv.c +3 -2
@@ -1855,8 +1855,9 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) cmd_request->payload_sz = payload_sz;/* Invokes the vsc to start an IO */ - ret =storvsc_do_io (dev, cmd_request,get_cpu ()); -put_cpu (); +migrate_disable (); + ret =storvsc_do_io (dev, cmd_request,smp_processor_id ()); +migrate_enable ();if (ret)scsi_dma_unmap (scmnd);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/333 ACPI: PM: Save NVS memory on Lenovo G70-35
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piotr Mazek <[email protected]>
[ Upstream commit 023cd6d90f8aa2ef7b72d84be84a18e61ecebd64 ]
[821d6f0359b0614792ab8e2fb93b503e25a65079] prevented machines produced later than 2012 from saving NVS region to accelerate S3.
Despite being made after 2012, Lenovo G70-35 still needs NVS memory saving during S3. A quirk is introduced for this platform.
--- drivers/acpi/sleep.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/sleep.c +8 -0
@@ -386,6 +386,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), }, }, + { + .callback = init_nvs_save_s3, + .ident = "Lenovo G70-35", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "80Q5"), + }, + },/* * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using * the Low Power S0 Idle firmware interface (see
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/333 scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Won Jung <[email protected]>
[ Upstream commit 5b313760059c9df7d60aba7832279bcb81b4aec0 ]
Ensures that UFS Runtime PM can achieve power saving after System PM suspend by resetting hba->urgent_bkops_lvl. Also modify the ufshcd_bkops_exception_event_handler to avoid setting urgent_bkops_lvl when status is 0, which helps maintain optimal power management.
On UFS devices supporting UFSHCD_CAP_AUTO_BKOPS_SUSPEND, a BKOPS exception event can lead to a situation where UFS Runtime PM can't enter low-power mode states even after the BKOPS exception has been resolved.
BKOPS exception with bkops status 0 occurs, the driver logs:
"ufshcd_bkops_exception_event_handler: device raised urgent BKOPS exception for bkops status 0"
When a BKOPS exception occurs, ufshcd_bkops_exception_event_handler() reads the BKOPS status and sets hba->urgent_bkops_lvl to BKOPS_STATUS_NO_OP(0). This allows the device to perform Runtime PM without changing the UFS power mode. (__ufshcd_wl_suspend(hba, UFS_RUNTIME_PM))
During system PM suspend, ufshcd_disable_auto_bkops() is called, disabling auto bkops. After UFS System PM Resume, when runtime PM attempts to suspend again, ufshcd_urgent_bkops() is invoked. Since hba->urgent_bkops_lvl remains at BKOPS_STATUS_NO_OP(0), ufshcd_enable_auto_bkops() is triggered.
However, in ufshcd_bkops_ctrl(), the driver compares the current BKOPS status with hba->urgent_bkops_lvl, and only enables auto bkops if curr_status >= hba->urgent_bkops_lvl. Since both values are 0, the condition is met
As a result, __ufshcd_wl_suspend(hba, UFS_RUNTIME_PM) skips power mode transitions and remains in an active state, preventing power saving even though no urgent BKOPS condition exists.
--- drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +2 -1
@@ -5946,6 +5946,7 @@ static int ufshcd_disable_auto_bkops(struct ufs_hba *hba) hba->auto_bkops_enabled = false;trace_ufshcd_auto_bkops_state (hba,"Disabled" ); + hba->urgent_bkops_lvl =BKOPS_STATUS_PERF_IMPACT ; hba->is_urgent_bkops_lvl_checked = false; out:return err;
@@ -6049,7 +6050,7 @@ static void ufshcd_bkops_exception_event_handler(struct ufs_hba *hba)* impacted or critical. Handle these device by determining their urgent * bkops status at runtime. */ -if (curr_status <BKOPS_STATUS_PERF_IMPACT ) { +if ((curr_status >BKOPS_STATUS_NO_OP ) && (curr_status <BKOPS_STATUS_PERF_IMPACT )) {dev_err (hba->dev,"%s: device raised urgent BKOPS exception for bkops status %d\n" , __func__, curr_status);/* update the current status as the urgent bkops level */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/333 fs: init flags_valid before calling vfs_fileattr_get
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit cb184dd19154fc486fa3d9e02afe70a97e54e055 ]
syzbot reported a uninit-value bug in [1].
Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa.
[1]
BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline]
Local variable fa.i created at:
__do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372
--- fs/file_attr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/file_attr.c +1 -1
@@ -379,7 +379,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, struct filename *name __free(putname) = NULL;unsigned int lookup_flags =0 ;struct file_attr fattr; -struct file_kattr fa; +struct file_kattr fa = { .flags_valid = true };/* hint only */ int error;BUILD_BUG_ON (sizeof (struct file_attr ) <FILE_ATTR_SIZE_VER0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/333 scsi: mpi3mr: Add NULL checks when resetting request and reply queues
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit fa96392ebebc8fade2b878acb14cce0f71016503 ]
The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first, but attempted to mem set the content of the freed memory, leading to a system crash.
Add NULL pointer checks for reply and request queues before accessing the reply/request memory during cleanup
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 34 ++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +19 -15
@@ -4705,21 +4705,25 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc) }for (i =0 ; i < mrioc->num_queues; i++) { - mrioc->op_reply_qinfo[i].qid =0 ; - mrioc->op_reply_qinfo[i].ci =0 ; - mrioc->op_reply_qinfo[i].num_replies =0 ; - mrioc->op_reply_qinfo[i].ephase =0 ; -atomic_set (&mrioc->op_reply_qinfo[i].pend_ios,0 ); -atomic_set (&mrioc->op_reply_qinfo[i].in_use,0 ); -mpi3mr_memset_op_reply_q_buffers (mrioc, i); - - mrioc->req_qinfo[i].ci =0 ; - mrioc->req_qinfo[i].pi =0 ; - mrioc->req_qinfo[i].num_requests =0 ; - mrioc->req_qinfo[i].qid =0 ; - mrioc->req_qinfo[i].reply_qid =0 ; -spin_lock_init (&mrioc->req_qinfo[i].q_lock); -mpi3mr_memset_op_req_q_buffers (mrioc, i); +if (mrioc->op_reply_qinfo) { + mrioc->op_reply_qinfo[i].qid =0 ; + mrioc->op_reply_qinfo[i].ci =0 ; + mrioc->op_reply_qinfo[i].num_replies =0 ; + mrioc->op_reply_qinfo[i].ephase =0 ; +atomic_set (&mrioc->op_reply_qinfo[i].pend_ios,0 ); +atomic_set (&mrioc->op_reply_qinfo[i].in_use,0 ); +mpi3mr_memset_op_reply_q_buffers (mrioc, i); + } + +if (mrioc->req_qinfo) { + mrioc->req_qinfo[i].ci =0 ; + mrioc->req_qinfo[i].pi =0 ; + mrioc->req_qinfo[i].num_requests =0 ; + mrioc->req_qinfo[i].qid =0 ; + mrioc->req_qinfo[i].reply_qid =0 ; +spin_lock_init (&mrioc->req_qinfo[i].q_lock); +mpi3mr_memset_op_req_q_buffers (mrioc, i); + } }atomic_set (&mrioc->pend_large_data_sz,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/333 ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Rhodes <[email protected]>
[ Upstream commit 1cb3c20688fc8380c9b365d03aea7e84faf6a9fd ]
On Star Labs StarFighter (Realtek ALC233/235), the internal speakers can emit an audible pop when entering or leaving runtime suspend.
Mute the speaker output paths via snd_hda_gen_shutup_speakers() in the Realtek shutup callback before the codec is powered down.
This is enough to avoid the pop without special EAPD handling.
Test results:
- runtime PM pop fixed
- still reaches D3 (PCI 0000:00:1f.3 power_state=D3hot)
- does not address pops on cold boot (G3 exit) or around display manager start/shutdown
journalctl -k (boot):
- snd_hda_codec_alc269 hdaudioC0D0: ALC233: picked fixup for PCI SSID 7017:2014
- snd_hda_codec_alc269 hdaudioC0D0: autoconfig for ALC233: line_outs=1 (0x1b/0x0/0x0/0x0/0x0) type:speaker
--- sound/hda/codecs/realtek/alc269.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
sound/hda/codecs/realtek/alc269.c +25 -0
@@ -1017,6 +1017,24 @@ static int alc269_resume(struct hda_codec *codec)return 0 ; } +#define STARLABS_STARFIGHTER_SHUTUP_DELAY_MS 30 + +static void starlabs_starfighter_shutup (struct hda_codec *codec) +{ +if (snd_hda_gen_shutup_speakers (codec)) +msleep (STARLABS_STARFIGHTER_SHUTUP_DELAY_MS ); +} + +static void alc233_fixup_starlabs_starfighter (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) + spec->shutup = starlabs_starfighter_shutup; +} +static void alc269_fixup_pincfg_no_hp_to_lineout (struct hda_codec *codec,const struct hda_fixup *fix,int action) {
@@ -3931,6 +3949,7 @@ enum {ALC245_FIXUP_CLEVO_NOISY_MIC ,ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE ,ALC233_FIXUP_MEDION_MTL_SPK , +ALC233_FIXUP_STARLABS_STARFIGHTER ,ALC294_FIXUP_BASS_SPEAKER_15 ,ALC283_FIXUP_DELL_HP_RESUME , ALC294_FIXUP_ASUS_CS35L41_SPI_2,
@@ -6380,6 +6399,10 @@ static const struct hda_fixup alc269_fixups[] = { { } }, }, + [ALC233_FIXUP_STARLABS_STARFIGHTER] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc233_fixup_starlabs_starfighter, + }, [ALC294_FIXUP_BASS_SPEAKER_15] = { .type = HDA_FIXUP_FUNC, .v.func = alc294_fixup_bass_speaker_15,
@@ -7485,6 +7508,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x2782 ,0x1705 ,"MEDION E15433" ,ALC269VC_FIXUP_INFINIX_Y4_MAX ),SND_PCI_QUIRK (0x2782 ,0x1707 ,"Vaio VJFE-ADL" ,ALC298_FIXUP_SPK_VOLUME ),SND_PCI_QUIRK (0x2782 ,0x4900 ,"MEDION E15443" ,ALC233_FIXUP_MEDION_MTL_SPK ), +SND_PCI_QUIRK (0x7017 ,0x2014 ,"Star Labs StarFighter" ,ALC233_FIXUP_STARLABS_STARFIGHTER ),SND_PCI_QUIRK (0x8086 ,0x2074 ,"Intel NUC 8" ,ALC233_FIXUP_INTEL_NUC8_DMIC ),SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
@@ -7581,6 +7605,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"}, {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"}, {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, + {.id = ALC233_FIXUP_STARLABS_STARFIGHTER, .name = "starlabs-starfighter"}, {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"}, {.id = ALC269_FIXUP_SONY_VAIO, .name = "vaio"}, {.id = ALC269_FIXUP_DELL_M101Z, .name = "dell-m101z"},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/333 unshare: fix unshare_fs() handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6c4b2243cb6c0755159bd567130d5e12e7b10d9f ]
There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() gets passed current->fs instead of a private copy, which causes interesting warts in proof of correctness]
Quoted 1 line
I guess if private means
fs->users== 1, the condition could still be true.
Unfortunately, it's worse than just a convoluted proof of correctness. Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS (and current->fs->users == 1).
We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and flips current->fs->{pwd,root} to corresponding locations in the new namespace. Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM). We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's destroyed and its mount tree is dissolved, but... current->fs->root and current->fs->pwd are both left pointing to now detached mounts.
They are pinning those, so it's not a UAF, but it leaves the calling process with unshare(2) failing with -ENOMEM _and_ leaving it with pwd and root on detached isolated mounts. The last part is clearly a bug.
There is other fun related to that mess (races with pivot_root(), including the one between pivot_root() and fork(), of all things), but this one is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new fs_struct even if it hadn't been shared in the first place". Sure, we could go for something like "if both CLONE_NEWNS *and* one of the things that might end up failing after copy_mnt_ns() call in create_new_namespaces() are set, force allocation of new fs_struct", but let's keep it simple - the cost of copy_fs_struct() is trivial.
Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets a freshly allocated fs_struct, yet to be attached to anything. That seriously simplifies the analysis...
FWIW, that bug had been there since the introduction of unshare(2) ;-/
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -3040,7 +3040,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)return 0 ;/* don't need lock here; in the worst case we'll do useless copy */ -if (fs->users ==1 ) +if (!(unshare_flags &CLONE_NEWNS ) && fs->users ==1 )return 0 ; *new_fsp =copy_fs_struct (fs);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/333 wifi: mac80211: set default WMM parameters on all links
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramanathan Choodamani <[email protected]>
[ Upstream commit 2259d14499d16b115ef8d5d2ddc867e2be7cb5b5 ]
Currently, mac80211 only initializes default WMM parameters on the deflink during do_open(). For MLO cases, this leaves the additional links without proper WMM defaults if hostapd does not supply per-link WMM parameters, leading to inconsistent QoS behavior across links.
Set default WMM parameters for each link during ieee80211_vif_update_links(), because this ensures all individual links in an MLD have valid WMM settings during bring-up and behave consistently across different BSS.
--- net/mac80211/link.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/link.c +2 -0
@@ -286,6 +286,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS ];struct ieee80211_link_data *old_data[IEEE80211_MLD_MAX_NUM_LINKS ];bool use_deflink = old_links ==0 ;/* set for error case */ +bool non_sta = sdata->vif.type !=NL80211_IFTYPE_STATION ;lockdep_assert_wiphy (sdata->local->hw.wiphy);
@@ -342,6 +343,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, link = links[link_id];ieee80211_link_init (sdata, link_id, &link->data, &link->conf);ieee80211_link_setup (&link->data); +ieee80211_set_wmm_default (&link->data, true, non_sta); }if (new_links ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/333 ACPI: OSI: Add DMI quirk for Acer Aspire One D255
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sofia Schneider <[email protected]>
[ Upstream commit 5ede90206273ff156a778254f0f972a55e973c89 ]
The screen backlight turns off during boot (specifically during udev device initialization) when returning true for _OSI("Windows 2009").
Analyzing the device's DSDT reveals that the firmware takes a different code path when Windows 7 is reported, which leads to the backlight shutoff. Add a DMI quirk to invoke dmi_disable_osi_win7 for this model.
--- drivers/acpi/osi.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/acpi/osi.c +13 -0
@@ -389,6 +389,19 @@ static const struct dmi_system_id acpi_osi_dmi_table[] __initconst = { }, }, +/* +* The screen backlight turns off during udev device creation +* when returning true for _OSI("Windows 2009") +*/ + { + .callback = dmi_disable_osi_win7, + .ident = "Acer Aspire One D255", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "AOD255"), + }, + }, + /* * The wireless hotkey does not work on those machines when * returning true for _OSI("Windows 2012")
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/333 scsi: ses: Fix devices attaching to different hosts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Henzl <[email protected]>
[ Upstream commit 70ca8caa96ce473647054f5c7b9dab5423902402 ]
On a multipath SAS system some devices don't end up with correct symlinks from the SCSI device to its enclosure. Some devices even have enclosure links pointing to enclosures attached to different SCSI hosts.
ses_match_to_enclosure() calls enclosure_for_each_device() which iterates over all enclosures on the system, not just enclosures attached to the current SCSI host.
Replace the iteration with a direct call to ses_enclosure_find_by_addr().
--- drivers/scsi/ses.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/scsi/ses.c +2 -3
@@ -529,9 +529,8 @@ struct efd { };static int ses_enclosure_find_by_addr (struct enclosure_device *edev, -void *data) +struct efd *efd) { -struct efd *efd = data;int i;struct ses_component *scomp;
@@ -684,7 +683,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,if (efd.addr) { efd.dev = &sdev->sdev_gendev; -enclosure_for_each_device (ses_enclosure_find_by_addr, &efd); +ses_enclosure_find_by_addr (edev, &efd); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/333 ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azamat Almazbek uulu <[email protected]>
[ Upstream commit 32fc4168fa56f6301d858c778a3d712774e9657e ]
The ASUS ExpertBook BM1503CDA (Ryzen 5 7535U, Barcelo-R) has an internal DMIC connected through the AMD ACP (Audio CoProcessor) but is missing from the DMI quirk table, so the acp6x machine driver probe returns -ENODEV and no DMIC capture device is created.
Add the DMI entry so the internal microphone works out of the box.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -703,6 +703,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Vivobook_ASUSLaptop M6501RR_M6501RR"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK BM1503CDA"), + } + }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/333 ASoC: cs42l43: Report insert for exotic peripherals
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 6510e1324bcdc8caf21f6d17efe27604c48f0d64 ]
For some exotic peripherals the type detect can return a reserved value of 0x4. This will currently return an error and not report anything to user-space, update this to report the insert normally.
--- sound/soc/codecs/cs42l43-jack.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/cs42l43-jack.c +1 -0
@@ -699,6 +699,7 @@ static int cs42l43_run_type_detect(struct cs42l43_codec *priv)switch (type &CS42L43_HSDET_TYPE_STS_MASK ) {case 0x0 :// CTIA case 0x1 :// OMTP +case 0x4 :return cs42l43_run_load_detect (priv, true);case 0x2 :// 3-pole return cs42l43_run_load_detect (priv, false);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/333 scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 30df81f2228d65bddf492db3929d9fcaffd38fc5 ]
The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL pointer dereference when accessing hwq->id. This can happen if ufshcd_mcq_req_to_hwq() returns NULL.
This patch adds a NULL check for hwq before accessing its id field to prevent a kernel crash.
Kernel log excerpt:
[<ffffffd5d192dc4c>] notify_die+0x4c/0x8c [<ffffffd5d1814e58>] __die+0x60/0xb0 [<ffffffd5d1814d64>] die+0x4c/0xe0 [<ffffffd5d181575c>] die_kernel_fault+0x74/0x88 [<ffffffd5d1864db4>] __do_kernel_fault+0x314/0x318 [<ffffffd5d2a3cdf8>] do_page_fault+0xa4/0x5f8 [<ffffffd5d2a3cd34>] do_translation_fault+0x34/0x54 [<ffffffd5d1864524>] do_mem_abort+0x50/0xa8 [<ffffffd5d2a297dc>] el1_abort+0x3c/0x64 [<ffffffd5d2a29718>] el1h_64_sync_handler+0x44/0xcc [<ffffffd5d181133c>] el1h_64_sync+0x80/0x88 [<ffffffd5d255c1dc>] ufshcd_add_command_trace+0x23c/0x320 [<ffffffd5d255bad8>] ufshcd_compl_one_cqe+0xa4/0x404 [<ffffffd5d2572968>] ufshcd_mcq_poll_cqe_lock+0xac/0x104 [<ffffffd5d11c7460>] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod] [<ffffffd5d19ab92c>] __handle_irq_event_percpu+0xc8/0x348 [<ffffffd5d19abca8>] handle_irq_event+0x3c/0xa8 [<ffffffd5d19b1f0c>] handle_fasteoi_irq+0xf8/0x294 [<ffffffd5d19aa778>] generic_handle_domain_irq+0x54/0x80 [<ffffffd5d18102bc>] gic_handle_irq+0x1d4/0x330 [<ffffffd5d1838210>] call_on_irq_stack+0x44/0x68 [<ffffffd5d183af30>] do_interrupt_handler+0x78/0xd8 [<ffffffd5d2a29c00>] el1_interrupt+0x48/0xa8 [<ffffffd5d2a29ba8>] el1h_64_irq_handler+0x14/0x24 [<ffffffd5d18113c4>] el1h_64_irq+0x80/0x88 [<ffffffd5d2527fb4>] arch_local_irq_enable+0x4/0x1c [<ffffffd5d25282e4>] cpuidle_enter+0x34/0x54 [<ffffffd5d195a678>] do_idle+0x1dc/0x2f8 [<ffffffd5d195a7c4>] cpu_startup_entry+0x30/0x3c [<ffffffd5d18155c4>] secondary_start_kernel+0x134/0x1ac [<ffffffd5d18640bc>] __secondary_switched+0xc4/0xcc
--- drivers/ufs/core/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -516,8 +516,8 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba, unsigned int tag,if (hba->mcq_enabled) {struct ufs_hw_queue *hwq =ufshcd_mcq_req_to_hwq (hba, rq); - - hwq_id = hwq->id; +if (hwq) + hwq_id = hwq->id; }else { doorbell =ufshcd_readl (hba,REG_UTP_TRANSFER_REQ_DOOR_BELL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/333 scsi: ufs: core: Fix shift out of bounds when MAXQ=32
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangshuaiwei <[email protected]>
[ Upstream commit 2f38fd99c0004676d835ae96ac4f3b54edc02c82 ]
According to JESD223F, the maximum number of queues (MAXQ) is 32. When MCQ is enabled and ESI is disabled, nr_hw_queues=32 causes a shift overflow problem.
Fix this by using 64-bit intermediate values to handle the nr_hw_queues=32 case safely.
--- drivers/ufs/core/ufshcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +1 -1
@@ -7078,7 +7078,7 @@ static irqreturn_t ufshcd_handle_mcq_cq_events(struct ufs_hba *hba) ret =ufshcd_vops_get_outstanding_cqs (hba, &outstanding_cqs);if (ret) - outstanding_cqs = (1U << hba->nr_hw_queues) -1 ; + outstanding_cqs = (1ULL << hba->nr_hw_queues) -1 ;/* Exclude the poll queues */ nr_queues = hba->nr_hw_queues - hba->nr_queues[HCTX_TYPE_POLL ];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/333 ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c5bf24c8aba1ff711226ee0f039ff01a5754692b ]
Although DIYINHK USB Audio 2.0 (ID 20b1:2009) shows the implicit feedback source for the capture stream, this would cause several problems for the playback. Namely, the device can get wMaxPackSize 1024 for 24/32 bit format with 6 channels, and when a high sample rate like 352.8kHz or 384kHz is played, the packet size overflows the max limit. Also, the device has another two playback altsets, and those aren't properly handled with the implicit feedback.
Since the device has been working well even before introducing the implicit feedback, we can assume that it works fine in the async mode. This patch adds the explicit skip of the implicit fb detection to make the playback running in the async mode.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2362,6 +2362,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),DEVICE_FLG (0x2040 ,0x7281 ,/* Hauppauge HVR-950Q-MXL */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), +DEVICE_FLG (0x20b1 ,0x2009 ,/* XMOS Ltd DIYINHK USB Audio 2.0 */ +QUIRK_FLAG_SKIP_IMPLICIT_FB |QUIRK_FLAG_DSD_RAW ),DEVICE_FLG (0x2040 ,0x8200 ,/* Hauppauge Woodbury */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/333 drm/amdgpu/vcn5: Add SMU dpm interface type
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sguttula <[email protected]>
[ Upstream commit a5fe1a54513196e4bc8f9170006057dc31e7155e ]
This will set AMDGPU_VCN_SMU_DPM_INTERFACE_* smu_type based on soc type and fixing ring timeout issue seen for DPM enabled case.
--- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +4 -0
@@ -174,6 +174,10 @@ static int vcn_v5_0_0_sw_init(struct amdgpu_ip_block *ip_block) fw_shared->present_flag_0 =cpu_to_le32 (AMDGPU_FW_SHARED_FLAG_0_UNIFIED_QUEUE ); fw_shared->sq.is_enabled =1 ; + fw_shared->present_flag_0 |=cpu_to_le32 (AMDGPU_VCN_SMU_DPM_INTERFACE_FLAG ); + fw_shared->smu_dpm_interface.smu_interface_type = (adev->flags &AMD_IS_APU ) ? +AMDGPU_VCN_SMU_DPM_INTERFACE_APU :AMDGPU_VCN_SMU_DPM_INTERFACE_DGPU ; +if (amdgpu_vcnfw_log)amdgpu_vcn_fwlog_init (&adev->vcn.inst[i]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/333 ALSA: usb-audio: Check max frame size for implicit feedback mode, too
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7cb2a5422f5bbdf1cf32eae0eda41000485b9346 ]
When the packet sizes are taken from the capture stream in the implicit feedback mode, the sizes might be larger than the upper boundary defined by the descriptor. As already done for other transfer modes, we have to cap the sizes accordingly at sending, otherwise this would lead to an error in USB core at submission of URBs.
--- sound/usb/endpoint.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/endpoint.c +1 -0
@@ -221,6 +221,7 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep, packet = ctx->packet_size[idx];if (packet) { + packet =min (packet, ep->maxframesize);if (avail && packet >= avail)return -EAGAIN ;return packet;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/333 powerpc/uaccess: Fix inline assembly for clang build on PPC32
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy (CS GROUP) <[email protected]>
[ Upstream commit 0ee95a1d458630272d0415d0ffa9424fcb606c90 ]
Test robot reports the following error with clang-16.0.6:
In file included from kernel/rseq.c:75:
include/linux/rseq_entry.h:141:3: error: invalid operand for instruction
unsafe_get_user(offset, &ucs->post_commit_offset, efault);
^
include/linux/uaccess.h:608:2: note: expanded from macro 'unsafe_get_user'
arch_unsafe_get_user(x, ptr, local_label); \
^
arch/powerpc/include/asm/uaccess.h:518:2: note: expanded from macro 'arch_unsafe_get_user'
__get_user_size_goto(__gu_val, __gu_addr, sizeof(*(p)), e); \
^
arch/powerpc/include/asm/uaccess.h:284:2: note: expanded from macro '__get_user_size_goto'
__get_user_size_allowed(x, ptr, size, __gus_retval); \
^
arch/powerpc/include/asm/uaccess.h:275:10: note: expanded from macro '__get_user_size_allowed'
case 8: __get_user_asm2(x, (u64 __user *)ptr, retval); break; \
^
arch/powerpc/include/asm/uaccess.h:258:4: note: expanded from macro '__get_user_asm2'
" li %1+1,0\n" \
^
<inline asm>:7:5: note: instantiated into assembly here
li 31+1,0
^
1 error generated.On PPC32, for 64 bits vars a pair of registers is used. Usually the lower register in the pair is the high part and the higher register is the low part. GCC uses r3/r4 ... r11/r12 ... r14/r15 ... r30/r31
In older kernel code inline assembly was using %1 and %1+1 to represent 64 bits values. However here it looks like clang uses r31 as high part, allthough r32 doesn't exist hence the error.
Allthoug %1+1 should work, most places now use %L1 instead of %1+1, so let's do the same here.
With that change, the build doesn't fail anymore and a disassembly shows clang uses r17/r18 and r31/r14 pair when GCC would have used r16/r17 and r30/r31:
Disassembly of section .fixup: 00000000 <.fixup>: 0: 38 a0 ff f2 li r5,-14 4: 3a 20 00 00 li r17,0 8: 3a 40 00 00 li r18,0 c: 48 00 00 00 b c <.fixup+0xc> c: R_PPC_REL24 .text+0xbc 10: 38 a0 ff f2 li r5,-14 14: 3b e0 00 00 li r31,0 18: 39 c0 00 00 li r14,0 1c: 48 00 00 00 b 1c <.fixup+0x1c> 1c: R_PPC_REL24 .text+0x144
--- arch/powerpc/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/uaccess.h +1 -1
@@ -253,7 +253,7 @@ __gus_failed: \".section .fixup,\"ax\"\n" \"4: li %0,%3\n" \" li %1,0\n" \ -" li %1+1,0\n" \ +" li %L1,0\n" \" b 3b\n" \".previous\n" \EX_TABLE (1b ,4b ) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/333 kexec: Include kernel-end even without crashkernel
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Collins <[email protected]>
[ Upstream commit 38c64dfe0af12778953846df5f259e913275cfe5 ]
Certain versions of kexec don't even work without kernel-end being added to the device-tree. Add it even if crash-kernel is disabled.
Stable-dep-of: 20197b967a6a ("powerpc/kexec/core: use big-endian types for crash variables")
--- arch/powerpc/kexec/core.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
arch/powerpc/kexec/core.c +15 -12
@@ -22,6 +22,8 @@#include <asm/setup.h> #include <asm/firmware.h> +#define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) +#ifdef CONFIG_CRASH_DUMP void machine_crash_shutdown (struct pt_regs *regs) {
@@ -136,17 +138,10 @@ int __init overlaps_crashkernel(unsigned long start, unsigned long size) }/* Values we need to export to the second kernel via the device tree. */ -static phys_addr_t kernel_end;static phys_addr_t crashk_base;static phys_addr_t crashk_size;static unsigned long long mem_limit; -static struct property kernel_end_prop = { - .name ="linux,kernel-end" , - .length =sizeof (phys_addr_t), - .value = &kernel_end, -}; -static struct property crashk_base_prop = { .name ="linux,crashkernel-base" , .length =sizeof (phys_addr_t),
@@ -165,8 +160,6 @@ static struct property memory_limit_prop = { .value = &mem_limit, }; -#define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) -static void __init export_crashk_values (struct device_node *node) {/* There might be existing crash kernel properties, but we can't
@@ -190,6 +183,15 @@ static void __init export_crashk_values(struct device_node *node) mem_limit =cpu_to_be_ulong (memory_limit); of_update_property(node, &memory_limit_prop); } +#endif /* CONFIG_CRASH_RESERVE */ + +static phys_addr_t kernel_end; + +static struct property kernel_end_prop = { + .name ="linux,kernel-end" , + .length =sizeof (phys_addr_t), + .value = &kernel_end, +};static int __init kexec_setup (void ) {
@@ -200,16 +202,17 @@ static int __init kexec_setup(void)return -ENOENT ;/* remove any stale properties so ours can be found */ -of_remove_property (node,of_find_property (node, kernel_end_prop.name,NULL )); +of_remove_property (node,of_find_property (node, kernel_end_prop.name, +NULL ));/* information needed by userspace when using default_machine_kexec */ kernel_end =cpu_to_be_ulong (__pa (_end));of_add_property (node, &kernel_end_prop); +#ifdef CONFIG_CRASH_RESERVE export_crashk_values (node); - +#endif of_node_put (node);return 0 ; }late_initcall (kexec_setup); -#endif /* CONFIG_CRASH_RESERVE */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/333 powerpc/kexec/core: use big-endian types for crash variables
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 20197b967a6a29dab81495f25a988515bda84cfe ]
Use explicit word-sized big-endian types for kexec and crash related variables. This makes the endianness unambiguous and avoids type mismatches that trigger sparse warnings.
The change addresses sparse warnings like below (seen on both 32-bit and 64-bit builds):
CHECK ../arch/powerpc/kexec/core.c
sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_base sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] crashk_size sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned long long static [addressable] [toplevel] mem_limit sparse: got restricted __be32 [usertype] sparse: warning: incorrect type in assignment (different base types) sparse: expected unsigned int static [addressable] [toplevel] [usertype] kernel_end sparse: got restricted __be32 [usertype]
No functional change intended.
--- arch/powerpc/kexec/core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
arch/powerpc/kexec/core.c +9 -8
@@ -23,6 +23,7 @@#include <asm/firmware.h> #define cpu_to_be_ulong __PASTE(cpu_to_be, BITS_PER_LONG) +#define __be_word __PASTE(__be, BITS_PER_LONG)#ifdef CONFIG_CRASH_DUMP void machine_crash_shutdown (struct pt_regs *regs)
@@ -138,25 +139,25 @@ int __init overlaps_crashkernel(unsigned long start, unsigned long size) }/* Values we need to export to the second kernel via the device tree. */ -static phys_addr_t crashk_base; -static phys_addr_t crashk_size; -static unsigned long long mem_limit; +static __be_word crashk_base; +static __be_word crashk_size; +static __be_word mem_limit;static struct property crashk_base_prop = { .name ="linux,crashkernel-base" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &crashk_base };static struct property crashk_size_prop = { .name ="linux,crashkernel-size" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &crashk_size, };static struct property memory_limit_prop = { .name ="linux,memory-limit" , - .length =sizeof (unsigned long long ), + .length =sizeof (__be_word), .value = &mem_limit, };
@@ -185,11 +186,11 @@ static void __init export_crashk_values(struct device_node *node) }#endif /* CONFIG_CRASH_RESERVE */ -static phys_addr_t kernel_end; +static __be_word kernel_end;static struct property kernel_end_prop = { .name ="linux,kernel-end" , - .length =sizeof (phys_addr_t), + .length =sizeof (__be_word), .value = &kernel_end, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/333 powerpc/crash: adjust the elfcorehdr size
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <[email protected]>
[ Upstream commit 04e707cb77c272cb0bb2e2e3c5c7f844d804a089 ]
With crash hotplug support enabled, additional memory is allocated to the elfcorehdr kexec segment to accommodate resources added during memory hotplug events. However, the kdump FDT is not updated with the same size, which can result in elfcorehdr corruption in the kdump kernel.
Update elf_headers_sz (the kimage member representing the size of the elfcorehdr kexec segment) to reflect the total memory allocated for the elfcorehdr segment instead of the elfcorehdr buffer size at the time of kdump load. This allows of_kexec_alloc_and_setup_fdt() to reserve the full elfcorehdr memory in the kdump FDT and prevents elfcorehdr corruption.
--- arch/powerpc/kexec/file_load_64.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/powerpc/kexec/file_load_64.c +13 -1
@@ -450,6 +450,11 @@ static int load_elfcorehdr_segment(struct kimage *image, struct kexec_buf *kbuf) kbuf->buffer = headers; kbuf->mem =KEXEC_BUF_MEM_UNKNOWN ; kbuf->bufsz = headers_sz; + +/* +* Account for extra space required to accommodate additional memory +* ranges in elfcorehdr due to memory hotplug events. +*/ kbuf->memsz = headers_sz +kdump_extra_elfcorehdr_size (cmem); kbuf->top_down = false;
@@ -460,7 +465,14 @@ static int load_elfcorehdr_segment(struct kimage *image, struct kexec_buf *kbuf) } image->elf_load_addr = kbuf->mem; - image->elf_headers_sz = headers_sz; + +/* +* If CONFIG_CRASH_HOTPLUG is enabled, the elfcorehdr kexec segment +* memsz can be larger than bufsz. Always initialize elf_headers_sz +* with memsz. This ensures the correct size is reserved for elfcorehdr +* memory in the FDT prepared for kdump. +*/ + image->elf_headers_sz = kbuf->memsz; image->elf_headers = headers; out:kfree (cmem);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/333 remoteproc: sysmon: Correct subsys_name_len type in QMI request
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Andersson <[email protected]>
[ Upstream commit da994db94e60f9a9411108ddf4d1836147ad4c9c ]
The QMI message encoder has up until recently read a single byte (as elem_size == 1), but with the introduction of big endian support it's become apparent that this field is expected to be a full u32 - regardless of the size of the length in the encoded message (which is what elem_size specifies).
The result is that the encoder now reads past the length byte and rejects the unreasonably large length formed when including the following 3 bytes from the subsys_name array.
Fix this by changing to the expected type.
--- drivers/remoteproc/qcom_sysmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/qcom_sysmon.c +1 -1
@@ -203,7 +203,7 @@ static const struct qmi_elem_info ssctl_shutdown_resp_ei[] = { };struct ssctl_subsys_event_req { -u8 subsys_name_len; +u32 subsys_name_len;char subsys_name[SSCTL_SUBSYS_NAME_LENGTH ];u32 event;u8 evt_driven_valid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/333 remoteproc: mediatek: Unprepare SCP clock during system suspend
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit 35c3f72a2d55dbf52f28f4ecae51c76be1acf545 ]
Prior to commit d935187cfb27 ("remoteproc: mediatek: Break lock dependency to prepare_lock"), scp->clk was prepared and enabled only when it needs to communicate with the SCP. The commit d935187cfb27 moved the prepare operation to remoteproc's prepare(), keeping the clock prepared as long as the SCP is running.
The power consumption due to the prolonged clock preparation can be negligible when the system is running, as SCP is designed to be a very power efficient processor.
However, the clock remains prepared even when the system enters system suspend. This prevents the underlying clock controller (and potentially the parent PLLs) from shutting down, which increases power consumption and may block the system from entering deep sleep states.
Add suspend and resume callbacks. Unprepare the clock in suspend() if it was active and re-prepare it in resume() to ensure the clock is properly disabled during system suspend, while maintaining the "always prepared" semantics while the system is active. The driver doesn't implement .attach() callback, hence it only checks for RPROC_RUNNING.
--- drivers/remoteproc/mtk_scp.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/remoteproc/mtk_scp.c +39 -0
@@ -1544,12 +1544,51 @@ static const struct of_device_id mtk_scp_of_match[] = { };MODULE_DEVICE_TABLE (of, mtk_scp_of_match); +static int __maybe_unused scp_suspend (struct device *dev) +{ +struct mtk_scp *scp =dev_get_drvdata (dev); +struct rproc *rproc = scp->rproc; + +/* +* Only unprepare if the SCP is running and holding the clock. +* +* Note: `scp_ops` doesn't implement .attach() callback, hence +* `rproc->state` can never be RPROC_ATTACHED. Otherwise, it +* should also be checked here. +*/ +if (rproc->state ==RPROC_RUNNING ) +clk_unprepare (scp->clk); +return 0 ; +} + +static int __maybe_unused scp_resume (struct device *dev) +{ +struct mtk_scp *scp =dev_get_drvdata (dev); +struct rproc *rproc = scp->rproc; + +/* +* Only prepare if the SCP was running and holding the clock. +* +* Note: `scp_ops` doesn't implement .attach() callback, hence +* `rproc->state` can never be RPROC_ATTACHED. Otherwise, it +* should also be checked here. +*/ +if (rproc->state ==RPROC_RUNNING ) +return clk_prepare (scp->clk); +return 0 ; +} + +static const struct dev_pm_ops scp_pm_ops = { +SET_SYSTEM_SLEEP_PM_OPS (scp_suspend, scp_resume) +}; +static struct platform_driver mtk_scp_driver = { .probe = scp_probe, .remove = scp_remove, .driver = { .name ="mtk-scp" , .of_match_table = mtk_scp_of_match, + .pm = &scp_pm_ops, }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/333 powerpc: 83xx: km83xx: Fix keymile vendor prefix
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Neuschäfer <[email protected]>
[ Upstream commit 691417ffe7821721e0a28bd25ad8c0dc0d4ae4ad ]
When kmeter.c was refactored into km83xx.c in 2011, the "keymile" vendor prefix was changed to upper-case "Keymile". The devicetree at arch/powerpc/boot/dts/kmeter1.dts never underwent the same change, suggesting that this was simply a mistake.
--- arch/powerpc/platforms/83xx/km83xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/platforms/83xx/km83xx.c +2 -2
@@ -155,8 +155,8 @@ machine_device_initcall(mpc83xx_km, mpc83xx_declare_of_platform_devices);/* list of the supported boards */ static char *board[]__initdata = { -"Keymile,KMETER1" , -"Keymile,kmpbec8321" , +"keymile,KMETER1" , +"keymile,kmpbec8321" ,NULL };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/333 smb/server: Fix another refcount leak in smb2_open()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit c15e7c62feb3751cbdd458555819df1d70374890 ]
If ksmbd_override_fsids() fails, we jump to err_out2. At that point, fp is NULL because it hasn't been assigned dh_info.fp yet, so ksmbd_fd_put(work, fp) will not be called. However, dh_info.fp was already inserted into the session file table by ksmbd_reopen_durable_fd(), so it will leak in the session file table until the session is closed.
Move fp = dh_info.fp; ahead of the ksmbd_override_fsids() check to fix the problem.
Found by an experimental AI code review agent at Google.
--- fs/smb/server/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +2 -1
@@ -3020,13 +3020,14 @@ int smb2_open(struct ksmbd_work *work) goto err_out2; } + fp = dh_info.fp; +if (ksmbd_override_fsids (work)) { rc = -ENOMEM ;ksmbd_put_durable_fd (dh_info.fp); goto err_out2; } - fp = dh_info.fp; file_info =FILE_OPENED ; rc =ksmbd_vfs_getattr (&fp->filp->f_path, &stat);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/333 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Bergantinos Corpas <[email protected]>
[ Upstream commit 410666a298c34ebd57256fde6b24c96bd23059a2 ]
If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this alias, but the original dentry we were adding and passed as parameter remains negative.
This later causes an oops on nfs_atomic_open_v23/finish_open since we supply a negative dentry to do_dentry_open.
This has been observed running lustre-racer, where dirs and files are created/removed concurrently with the same name and O_EXCL is not used to open files (frequent file redirection).
While d_splice_alias typically returns a directory alias or NULL, we explicitly check d_is_dir() to ensure that we don't attempt to perform file operations (like finish_open) on a directory inode, which triggers the observed oops.
--- fs/nfs/nfs3proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/nfs3proc.c +6 -1
@@ -392,8 +392,13 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,if (status !=0 ) goto out_release_acls; -if (d_alias) +if (d_alias) { +if (d_is_dir (d_alias)) { + status = -EISDIR ; + goto out_dput; + } dentry = d_alias; + }/* When we created the file with exclusive semantics, make * sure we set the attributes afterwards. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/333 drm/msm/dsi: fix hdisplay calculation when programming dsi registers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <[email protected]>
[ Upstream commit ac47870fd795549f03d57e0879fc730c79119f4b ]
Recently, the hdisplay calculation is working for 3:1 compressed ratio only. If we have a video panel with DSC BPP = 8, and BPC = 10, we still use the default bits_per_pclk = 24, then we get the wrong hdisplay. We can draw the conclusion by cross-comparing the calculation with the calculation in dsi_adjust_pclk_for_compression().
Since CMD mode does not use this, we can remove !(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) safely.
Patchwork: https://patchwork.freedesktop.org/patch/704822/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +8 -6
@@ -993,7 +993,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)if (msm_host->dsc) {struct drm_dsc_config *dsc = msm_host->dsc; -u32 bytes_per_pclk; +u32 bits_per_pclk;/* update dsc params with timing params */ if (!dsc || !mode->hdisplay || !mode->vdisplay) {
@@ -1015,7 +1015,9 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)/* * DPU sends 3 bytes per pclk cycle to DSI. If widebus is -* enabled, bus width is extended to 6 bytes. +* enabled, MDP always sends out 48-bit compressed data per +* pclk and on average, DSI consumes an amount of compressed +* data equivalent to the uncompressed pixel depth per pclk. * * Calculate the number of pclks needed to transmit one line of * the compressed data.
@@ -1027,12 +1029,12 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)* unused anyway. */ h_total -= hdisplay; -if (wide_bus_enabled && !(msm_host->mode_flags &MIPI_DSI_MODE_VIDEO )) - bytes_per_pclk =6 ; +if (wide_bus_enabled) + bits_per_pclk =mipi_dsi_pixel_format_to_bpp (msm_host->format);else - bytes_per_pclk =3 ; + bits_per_pclk =24 ; - hdisplay =DIV_ROUND_UP (msm_dsc_get_bytes_per_line (msm_host->dsc), bytes_per_pclk); + hdisplay =DIV_ROUND_UP (msm_dsc_get_bytes_per_line (msm_host->dsc) *8 , bits_per_pclk); h_total += hdisplay; ha_end = ha_start + hdisplay;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/333 xprtrdma: Decrement re_receiving on the early exit paths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Badger <[email protected]>
[ Upstream commit 7b6275c80a0c81c5f8943272292dfe67730ce849 ]
In the event that rpcrdma_post_recvs() fails to create a work request (due to memory allocation failure, say) or otherwise exits early, we should decrement ep->re_receiving before returning. Otherwise we will hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and the completion will never be triggered.
On a system with high memory pressure, this can appear as the following hung task:
INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.
Tainted: G S E 6.19.0 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000
Workqueue: xprtiod xprt_autoclose [sunrpc]
Call Trace:
<TASK>
__schedule+0x48b/0x18b0
? ib_post_send_mad+0x247/0xae0 [ib_core]
schedule+0x27/0xf0
schedule_timeout+0x104/0x110
__wait_for_common+0x98/0x180
? __pfx_schedule_timeout+0x10/0x10
wait_for_completion+0x24/0x40
rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]
xprt_rdma_close+0x12/0x40 [rpcrdma]
xprt_autoclose+0x5f/0x120 [sunrpc]
process_one_work+0x191/0x3e0
worker_thread+0x2e3/0x420
? __pfx_worker_thread+0x10/0x10
kthread+0x10d/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x273/0x2b0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30--- net/sunrpc/xprtrdma/verbs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/sunrpc/xprtrdma/verbs.c +4 -3
@@ -1362,7 +1362,7 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) needed +=RPCRDMA_MAX_RECV_BATCH ;if (atomic_inc_return (&ep->re_receiving) >1 ) - goto out; + goto out_dec;/* fast path: all needed reps can be found on the free list */ wr =NULL ;
@@ -1385,7 +1385,7 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) ++count; }if (!wr) - goto out; + goto out_dec; rc =ib_post_recv (ep->re_id->qp, wr, (const struct ib_recv_wr **)&bad_wr);
@@ -1400,9 +1400,10 @@ void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, int needed) --count; } } + +out_dec:if (atomic_dec_return (&ep->re_receiving) >0 )complete (&ep->re_done); - out:trace_xprtrdma_post_recvs (r_xprt, count); ep->re_receive_count += count;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/333 btrfs: hold space_info->lock when clearing periodic reclaim ready
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sun YangKai <[email protected]>
[ Upstream commit b8883b61f2fc50dcf22938cbed40fec05020552f ]
btrfs_set_periodic_reclaim_ready() requires space_info->lock to be held, as enforced by lockdep_assert_held(). However, btrfs_reclaim_sweep() was calling it after do_reclaim_sweep() returns, at which point space_info->lock is no longer held.
Fix this by explicitly acquiring space_info->lock before clearing the periodic reclaim ready flag in btrfs_reclaim_sweep().
--- fs/btrfs/space-info.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/btrfs/space-info.c +4 -1
@@ -2171,8 +2171,11 @@ void btrfs_reclaim_sweep(const struct btrfs_fs_info *fs_info)if (!btrfs_should_periodic_reclaim (space_info))continue ;for (raid =0 ; raid <BTRFS_NR_RAID_TYPES ; raid++) { -if (do_reclaim_sweep (space_info, raid)) +if (do_reclaim_sweep (space_info, raid)) { +spin_lock (&space_info->lock);btrfs_set_periodic_reclaim_ready (space_info, false); +spin_unlock (&space_info->lock); + } } } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/333 workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit f42f9091be9e5ff57567a3945cfcdd498f475348 ]
pr_cont_worker_id() checks pool->flags against WQ_BH, which is a workqueue-level flag (defined in workqueue.h). Pool flags use a separate namespace with POOL_* constants (defined in workqueue.c). The correct constant is POOL_BH. Both WQ_BH and POOL_BH are defined as (1 << 0) so this has no behavioral impact, but it is semantically wrong and inconsistent with every other pool-level BH check in the file.
--- kernel/workqueue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/workqueue.c +1 -1
@@ -6269,7 +6269,7 @@ static void pr_cont_worker_id(struct worker *worker) {struct worker_pool *pool = worker->pool; -if (pool->flags &WQ_BH ) +if (pool->flags &POOL_BH )pr_cont ("bh%s" , pool->attrs->nice ==HIGHPRI_NICE_LEVEL ?"-hi" :"" );else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/333 perf disasm: Fix off-by-one bug in outside check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Collingbourne <[email protected]>
[ Upstream commit b3ce769203a99d6f3c6d6269ec09232a8c5da422 ]
If a branch target points to one past the end of a function, the branch should be treated as a branch to another function.
This can happen e.g. with a tail call to a function that is laid out immediately after the caller.
--- tools/perf/util/disasm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/disasm.c +1 -1
@@ -412,7 +412,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s start =map__unmap_ip (map, sym->start); end =map__unmap_ip (map, sym->end); - ops->target.outside = target.addr < start || target.addr > end; + ops->target.outside = target.addr < start || target.addr >= end;/* * FIXME: things like this in _cpp_lex_token (gcc's cc1 program):
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/333 dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4355b13d46f696d687f42b982efed7570e03e532 ]
Fix obvious model typo (SM8650->SM8750) in the description.
Patchwork: https://patchwork.freedesktop.org/patch/707192/
--- .../devicetree/bindings/display/msm/qcom,sm8750-mdss.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/devicetree/bindings/display/msm/qcom,sm8750-mdss.yaml +1 -1
@@ -10,7 +10,7 @@ maintainers: - Krzysztof Kozlowski <[email protected]> description: - SM8650 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like + SM8750 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like DPU display controller, DSI and DP interfaces etc. $ref: /schemas/display/msm/mdss-common.yaml#
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/333 net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mieczyslaw Nalewaj <[email protected]>
[ Upstream commit f76a93241d71fbba8425e3967097b498c29264ed ]
rx_packets should report the number of frames successfully received:
unicast + multicast + broadcast. Subtracting ifOutDiscards (a TX counter) is incorrect and can undercount RX packets. RX drops are already reported via rx_dropped (e.g. etherStatsDropEvents), so there is no need to adjust rx_packets.
This patch removes the subtraction of ifOutDiscards from rx_packets in rtl8365mb_stats_update().
--- drivers/net/dsa/realtek/rtl8365mb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/dsa/realtek/rtl8365mb.c +1 -2
@@ -1480,8 +1480,7 @@ static void rtl8365mb_stats_update(struct realtek_priv *priv, int port) stats->rx_packets = cnt[RTL8365MB_MIB_ifInUcastPkts] + cnt[RTL8365MB_MIB_ifInMulticastPkts] + - cnt[RTL8365MB_MIB_ifInBroadcastPkts] - - cnt[RTL8365MB_MIB_ifOutDiscards]; + cnt[RTL8365MB_MIB_ifInBroadcastPkts]; stats->tx_packets = cnt[RTL8365MB_MIB_ifOutUcastPkts] + cnt[RTL8365MB_MIB_ifOutMulticastPkts] +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/333 drm/msm/dsi: fix pclk rate calculation for bonded dsi
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <[email protected]>
[ Upstream commit e4eb11b34d6c84f398d8f08d7cb4d6c38e739dd2 ]
Recently, we round up new_hdisplay once at most, for bonded dsi, we may need twice, since they are independent links, we should round up each half separately. This also aligns with the hdisplay we program later in dsi_timing_setup()
Example:
full_hdisplay = 1904, dsc_bpp = 8, bpc = 8 new_full_hdisplay = DIV_ROUND_UP(1904 * 8, 8 * 3) = 635
if we use half display
new_half_hdisplay = DIV_ROUND_UP(952 * 8, 8 * 3) = 318 new_full_display = 636
Patchwork: https://patchwork.freedesktop.org/patch/709716/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +23 -6
@@ -584,13 +584,30 @@ void dsi_link_clk_disable_v2(struct msm_dsi_host *msm_host)* FIXME: Reconsider this if/when CMD mode handling is rewritten to use * transfer time and data overhead as a starting point of the calculations. */ -static unsigned long dsi_adjust_pclk_for_compression (const struct drm_display_mode *mode, -const struct drm_dsc_config *dsc) +static unsigned long +dsi_adjust_pclk_for_compression (const struct drm_display_mode *mode, +const struct drm_dsc_config *dsc, +bool is_bonded_dsi) { -int new_hdisplay =DIV_ROUND_UP (mode->hdisplay *drm_dsc_get_bpp_int (dsc), - dsc->bits_per_component *3 ); +int hdisplay, new_hdisplay, new_htotal; -int new_htotal = mode->htotal - mode->hdisplay + new_hdisplay; +/* +* For bonded DSI, split hdisplay across two links and round up each +* half separately, passing the full hdisplay would only round up once. +* This also aligns with the hdisplay we program later in +* dsi_timing_setup() +*/ + hdisplay = mode->hdisplay; +if (is_bonded_dsi) + hdisplay /=2 ; + + new_hdisplay =DIV_ROUND_UP (hdisplay *drm_dsc_get_bpp_int (dsc), + dsc->bits_per_component *3 ); + +if (is_bonded_dsi) + new_hdisplay *=2 ; + + new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;return mult_frac (mode->clock *1000u , new_htotal, mode->htotal); }
@@ -603,7 +620,7 @@ static unsigned long dsi_get_pclk_rate(const struct drm_display_mode *mode, pclk_rate = mode->clock *1000u ;if (dsc) - pclk_rate =dsi_adjust_pclk_for_compression (mode, dsc); + pclk_rate =dsi_adjust_pclk_for_compression (mode, dsc, is_bonded_dsi);/* * For bonded DSI mode, the current DRM mode has the complete width of the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/333 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit cb47c882c31334aadc13ace80781728ed22a05ee ]
add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13.0.0/13.0.7
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 3 ++- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +2 -1
@@ -2289,7 +2289,8 @@ static int smu_v13_0_0_restore_user_od_settings(struct smu_context *smu) user_od_table->OverDriveTable.FeatureCtrlMask =BIT (PP_OD_FEATURE_GFXCLK_BIT ) |BIT (PP_OD_FEATURE_UCLK_BIT ) |BIT (PP_OD_FEATURE_GFX_VF_CURVE_BIT ) | -BIT (PP_OD_FEATURE_FAN_CURVE_BIT ); +BIT (PP_OD_FEATURE_FAN_CURVE_BIT ) | +BIT (PP_OD_FEATURE_ZERO_FAN_BIT ); res =smu_v13_0_0_upload_overdrive_table (smu, user_od_table); user_od_table->OverDriveTable.FeatureCtrlMask =0 ;if (res ==0 )
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +2 -1
@@ -2275,7 +2275,8 @@ static int smu_v13_0_7_restore_user_od_settings(struct smu_context *smu) user_od_table->OverDriveTable.FeatureCtrlMask =BIT (PP_OD_FEATURE_GFXCLK_BIT ) |BIT (PP_OD_FEATURE_UCLK_BIT ) |BIT (PP_OD_FEATURE_GFX_VF_CURVE_BIT ) | -BIT (PP_OD_FEATURE_FAN_CURVE_BIT ); +BIT (PP_OD_FEATURE_FAN_CURVE_BIT ) | +BIT (PP_OD_FEATURE_ZERO_FAN_BIT ); res =smu_v13_0_7_upload_overdrive_table (smu, user_od_table); user_od_table->OverDriveTable.FeatureCtrlMask =0 ;if (res ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/333 drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 9d4837a26149355ffe3a1f80de80531eafdd3353 ]
add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14.0.2/14.0.3
--- drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +2 -1
@@ -2412,7 +2412,8 @@ static int smu_v14_0_2_restore_user_od_settings(struct smu_context *smu) user_od_table->OverDriveTable.FeatureCtrlMask =BIT (PP_OD_FEATURE_GFXCLK_BIT ) |BIT (PP_OD_FEATURE_UCLK_BIT ) |BIT (PP_OD_FEATURE_GFX_VF_CURVE_BIT ) | -BIT (PP_OD_FEATURE_FAN_CURVE_BIT ); +BIT (PP_OD_FEATURE_FAN_CURVE_BIT ) | +BIT (PP_OD_FEATURE_ZERO_FAN_BIT ); res =smu_v14_0_2_upload_overdrive_table (smu, user_od_table); user_od_table->OverDriveTable.FeatureCtrlMask =0 ;if (res ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/333 bonding: do not set usable_slaves for broadcast mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 45fc134bcfadde456639c1b1e206e6918d69a553 ]
After commit e0caeb24f538 ("net: bonding: update the slave array for broadcast mode"), broadcast mode will also set all_slaves and usable_slaves during bond_enslave(). But if we also set updelay, during enslave, the
slave init state will be BOND_LINK_BACK. And later bond_update_slave_arr() will alloc usable_slaves but add nothing.
This will cause bond_miimon_inspect() to have ignore_updelay
always true. So the updelay will be always ignored. e.g.
[ 6.498368] bond0: (slave veth2): link status definitely down, disabling slave [ 7.536371] bond0: (slave veth2): link status up, enabling it in 0 ms [ 7.536402] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
To fix it, we can either always call bond_update_slave_arr() on every place when link changes. Or, let's just not set usable_slaves for broadcast mode.
--- drivers/net/bonding/bond_main.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_main.c +9 -4
@@ -5132,13 +5132,18 @@ static void bond_set_slave_arr(struct bonding *bond, {struct bond_up_slave *usable, *all; - usable =rtnl_dereference (bond->usable_slaves); -rcu_assign_pointer (bond->usable_slaves, usable_slaves); -kfree_rcu (usable, rcu); - all =rtnl_dereference (bond->all_slaves);rcu_assign_pointer (bond->all_slaves, all_slaves);kfree_rcu (all, rcu); + +if (BOND_MODE (bond) ==BOND_MODE_BROADCAST ) { +kfree_rcu (usable_slaves, rcu); +return ; + } + + usable =rtnl_dereference (bond->usable_slaves); +rcu_assign_pointer (bond->usable_slaves, usable_slaves); +kfree_rcu (usable, rcu); }static void bond_reset_slave_arr (struct bonding *bond)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/333 bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 3348be7978f450ede0c308a4e8416ac716cf1015 ]
Before the fixed commit, we check slave->new_link during commit state, which values are only BOND_LINK_{NOCHANGE, UP, DOWN}. After the commit, we start using slave->link_new_state, which state also could be BOND_LINK_{FAIL, BACK}.
For example, when we set updelay/downdelay, after a failover, the slave->link_new_state could be set to BOND_LINK_{FAIL, BACK} in bond_miimon_inspect(). And later in bond_miimon_commit(), it will treat it as invalid and print an error, which would cause confusion for users.
[ 106.440254] bond0: (slave veth2): link status down for interface, disabling it in 200 ms [ 106.440265] bond0: (slave veth2): invalid new link 1 on slave [ 106.648276] bond0: (slave veth2): link status definitely down, disabling slave [ 107.480271] bond0: (slave veth2): link status up, enabling it in 200 ms [ 107.480288] bond0: (slave veth2): invalid new link 3 on slave [ 107.688302] bond0: (slave veth2): link status definitely up, 10000 Mbps full duplex
Let's handle BOND_LINK_{FAIL, BACK} as valid link states.
--- drivers/net/bonding/bond_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +7 -1
@@ -2860,8 +2860,14 @@ static void bond_miimon_commit(struct bonding *bond)continue ; +case BOND_LINK_FAIL : +case BOND_LINK_BACK : +slave_dbg (bond->dev, slave->dev,"link_new_state %d on slave\n" , + slave->link_new_state); +continue ; +default : -slave_err (bond->dev, slave->dev,"invalid new link %d on slave\n" , +slave_err (bond->dev, slave->dev,"invalid link_new_state %d on slave\n" , slave->link_new_state);bond_propose_link_state (slave,BOND_LINK_NOCHANGE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/333 net/mlx5: Fix deadlock between devlink lock and esw->wq
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit aed763abf0e905b4b8d747d1ba9e172961572f57 ]
esw->work_queue executes esw_functions_changed_event_handler -> esw_vfs_changed_event_handler and acquires the devlink lock.
.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -> mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked -> mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks when esw_vfs_changed_event_handler executes.
Fix that by no longer flushing the work to avoid the deadlock, and using a generation counter to keep track of work relevance. This avoids an old handler manipulating an esw that has undergone one or more mode changes:
- the counter is incremented in mlx5_eswitch_event_handler_unregister.
- the counter is read and passed to the ephemeral mlx5_host_work struct.
- the work handler takes the devlink lock and bails out if the current generation is different than the one it was scheduled to operate on.
- mlx5_eswitch_cleanup does the final draining before destroying the wq.
No longer flushing the workqueue has the side effect of maybe no longer cancelling pending vport_change_handler work items, but that's ok since those are disabled elsewhere:
- mlx5_eswitch_disable_locked disables the vport eq notifier.
- mlx5_esw_vport_disable disarms the HW EQ notification and marks vport->enabled under state_lock to false to prevent pending vport handler from doing anything.
- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events are disabled/finished.
--- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 7 ++++--- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 2 ++ .../mellanox/mlx5/core/eswitch_offloads.c | 18 +++++++++++++----- 3 files changed, 19 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +4 -3
@@ -1081,10 +1081,11 @@ static void mlx5_eswitch_event_handler_register(struct mlx5_eswitch *esw)static void mlx5_eswitch_event_handler_unregister (struct mlx5_eswitch *esw) { -if (esw->mode ==MLX5_ESWITCH_OFFLOADS &&mlx5_eswitch_is_funcs_handler (esw->dev)) +if (esw->mode ==MLX5_ESWITCH_OFFLOADS && +mlx5_eswitch_is_funcs_handler (esw->dev)) {mlx5_eq_notifier_unregister (esw->dev, &esw->esw_funcs.nb); - -flush_workqueue (esw->work_queue); +atomic_inc (&esw->esw_funcs.generation); + } }static void mlx5_eswitch_clear_vf_vports_info (struct mlx5_eswitch *esw)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +2 -0
@@ -331,10 +331,12 @@ struct esw_mc_addr { /* SRIOV only */struct mlx5_host_work {struct work_struct work;struct mlx5_eswitch *esw; +int work_gen; };struct mlx5_esw_functions {struct mlx5_nb nb; +atomic_t generation;bool host_funcs_disabled;u16 num_vfs;u16 num_ec_vfs;
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +13 -5
@@ -3451,22 +3451,28 @@ static void esw_offloads_steering_cleanup(struct mlx5_eswitch *esw) }static void -esw_vfs_changed_event_handler (struct mlx5_eswitch *esw,const u32 *out) +esw_vfs_changed_event_handler (struct mlx5_eswitch *esw,int work_gen, +const u32 *out) {struct devlink *devlink;bool host_pf_disabled;u16 new_num_vfs; + devlink =priv_to_devlink (esw->dev); +devl_lock (devlink); + +/* Stale work from one or more mode changes ago. Bail out. */ +if (work_gen !=atomic_read (&esw->esw_funcs.generation)) + goto unlock; + new_num_vfs =MLX5_GET (query_esw_functions_out, out, host_params_context.host_num_of_vfs); host_pf_disabled =MLX5_GET (query_esw_functions_out, out, host_params_context.host_pf_disabled);if (new_num_vfs == esw->esw_funcs.num_vfs || host_pf_disabled) -return ; + goto unlock; - devlink =priv_to_devlink (esw->dev); -devl_lock (devlink);/* Number of VFs can only change from "0 to x" or "x to 0". */ if (esw->esw_funcs.num_vfs >0 ) {mlx5_eswitch_unload_vf_vports (esw, esw->esw_funcs.num_vfs);
@@ -3481,6 +3487,7 @@ esw_vfs_changed_event_handler(struct mlx5_eswitch *esw, const u32 *out) } } esw->esw_funcs.num_vfs = new_num_vfs; +unlock:devl_unlock (devlink); }
@@ -3497,7 +3504,7 @@ static void esw_functions_changed_event_handler(struct work_struct *work)if (IS_ERR (out)) goto out; -esw_vfs_changed_event_handler (esw, out); +esw_vfs_changed_event_handler (esw, host_work->work_gen, out);kvfree (out); out:kfree (host_work);
@@ -3517,6 +3524,7 @@ int mlx5_esw_funcs_changed_handler(struct notifier_block *nb, unsigned long type esw = container_of(esw_funcs, struct mlx5_eswitch, esw_funcs); host_work->esw = esw; + host_work->work_gen =atomic_read (&esw_funcs->generation);INIT_WORK (&host_work->work, esw_functions_changed_event_handler);queue_work (esw->work_queue, &host_work->work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/333 net/mlx5: Fix crash when moving to switchdev mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrisious Haddad <[email protected]>
[ Upstream commit 24b2795f9683e092dc22a68f487e7aaaf2ddafea ]
When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash below, fix that by correctly checking for IPsec support before trying to clean up its resources.
[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490 [27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE
ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core ib_core
[27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted
6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE
[27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680
[27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22
00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb
ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d
41
[27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046
[27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX:
ffff88810b980f00
[27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI:
ffff88810770f728
[27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09:
0000000000000000
[27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff888103f3c4c0
[27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15:
0000000000000000
[27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000)
knlGS:0000000000000000
[27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4:
0000000000172eb0
[27642.537982] Call Trace:
[27642.538466] <TASK>
[27642.538907] exc_page_fault+0x76/0x140
[27642.539583] asm_exc_page_fault+0x22/0x30
[27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30
[27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8
01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00
00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8
5b
[27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046
[27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX:
ffff888113ad96d8
[27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI:
00000000000000a0
[27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09:
ffff88810b980f00
[27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12:
00000000000000a8
[27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15:
ffff8881130d8a40
[27642.550379] complete_all+0x20/0x90
[27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core]
[27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core]
[27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core]
[27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]
[27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core]
[27642.555757] ? xa_load+0x53/0x90
[27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core]
[27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core]
[27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core]
[27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core]
[27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core]
[27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core]
[27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0
[27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0
[27642.564026] genl_family_rcv_msg_doit+0xe0/0x130
[27642.564816] genl_rcv_msg+0x183/0x290
[27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160
[27642.566329] ? devlink_nl_eswitch_get_doit+0x290/0x290
[27642.567181] ? devlink_nl_pre_doit_parent_dev_optional+0x20/0x20
[27642.568147] ? genl_family_rcv_msg_dumpit+0xf0/0xf0
[27642.568966] netlink_rcv_skb+0x4b/0xf0
[27642.569629] genl_rcv+0x24/0x40
[27642.570215] netlink_unicast+0x255/0x380
[27642.570901] ? __alloc_skb+0xfa/0x1e0
[27642.571560] netlink_sendmsg+0x1f3/0x420
[27642.572249] __sock_sendmsg+0x38/0x60
[27642.572911] __sys_sendto+0x119/0x180
[27642.573561] ? __sys_recvmsg+0x5c/0xb0
[27642.574227] __x64_sys_sendto+0x20/0x30
[27642.574904] do_syscall_64+0x55/0xc10
[27642.575554] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[27642.576391] RIP: 0033:0x7f197c85e807
[27642.577050] Code: c7 c0 ff ff ff ff eb be 66 2e 0f 1f 84 00 00 00 00
00 90 f3 0f 1e fa 80 3d 45 08 0d 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f
05 <48> 3d 00 f0 ff ff 77 69 c3 55 48 89 e5 53 48 83 ec 38 44 89 4d
d0
[27642.579846] RSP: 002b:00007ffebd4e2248 EFLAGS: 00000202 ORIG_RAX:
000000000000002c
[27642.581082] RAX: ffffffffffffffda RBX: 000055cfcd9cd2a0 RCX:
00007f197c85e807
[27642.582200] RDX: 0000000000000038 RSI: 000055cfcd9cd490 RDI:
0000000000000003
[27642.583320] RBP: 00007ffebd4e2290 R08: 00007f197c942200 R09:
000000000000000c
[27642.584437] R10: 0000000000000000 R11: 0000000000000202 R12:
0000000000000000
[27642.585555] R13: 000055cfcd9cd490 R14: 00007ffebd4e45d1 R15:
000055cfcd9cd2a0
[27642.586671] </TASK>
[27642.587121] ---[ end trace 0000000000000000 ]---
[27642.587910] BUG: kernel NULL pointer dereference, address:00000000000000a0
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +1 -1
@@ -2912,7 +2912,7 @@ void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv) goto out; peer_priv =mlx5_devcom_get_next_peer_data (priv->devcom, &tmp); -if (peer_priv) +if (peer_priv && peer_priv->ipsec)complete_all (&peer_priv->ipsec->comp);mlx5_devcom_for_each_peer_end (priv->devcom);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/333 net/mlx5: Fix peer miss rules host disabled checks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 76324e4041c0efb4808702b05426d7a0a7d8df5b ]
The check on mlx5_esw_host_functions_enabled(esw->dev) for adding VF peer miss rules is incorrect. These rules match traffic from peer's VFs, so the local device's host function status is irrelevant. Remove this check to ensure peer VF traffic is properly handled regardless of local host configuration.
Also fix the PF peer miss rule deletion to be symmetric with the add path, so only attempt to delete the rule if it was actually created.
--- .../mellanox/mlx5/core/eswitch_offloads.c | 27 +++++++++---------- 1 file changed, 12 insertions(+), 15 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +12 -15
@@ -1241,21 +1241,17 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, flows[peer_vport->index] = flow; } -if (mlx5_esw_host_functions_enabled (esw->dev)) { -mlx5_esw_for_each_vf_vport (peer_esw, i, peer_vport, -mlx5_core_max_vfs (peer_dev)) { -esw_set_peer_miss_rule_source_port (esw, peer_esw, - spec, - peer_vport->vport); - - flow =mlx5_add_flow_rules (mlx5_eswitch_get_slow_fdb (esw), - spec, &flow_act, &dest,1 ); -if (IS_ERR (flow)) { - err =PTR_ERR (flow); - goto add_vf_flow_err; - } - flows[peer_vport->index] = flow; +mlx5_esw_for_each_vf_vport (peer_esw, i, peer_vport, +mlx5_core_max_vfs (peer_dev)) { +esw_set_peer_miss_rule_source_port (esw, peer_esw, spec, + peer_vport->vport); + flow =mlx5_add_flow_rules (mlx5_eswitch_get_slow_fdb (esw), + spec, &flow_act, &dest,1 ); +if (IS_ERR (flow)) { + err =PTR_ERR (flow); + goto add_vf_flow_err; } + flows[peer_vport->index] = flow; }if (mlx5_core_ec_sriov_enabled (peer_dev)) {
@@ -1347,7 +1343,8 @@ static void esw_del_fdb_peer_miss_rules(struct mlx5_eswitch *esw,mlx5_del_flow_rules (flows[peer_vport->index]); } -if (mlx5_core_is_ecpf_esw_manager (peer_dev)) { +if (mlx5_core_is_ecpf_esw_manager (peer_dev) && +mlx5_esw_host_functions_enabled (peer_dev)) { peer_vport =mlx5_eswitch_get_vport (peer_esw,MLX5_VPORT_PF );mlx5_del_flow_rules (flows[peer_vport->index]); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/333 net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 1633111d69053512d099658d4a05fc736fab36b0 ]
In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old dma_fifo_pc, while the consumer reads from position 0. This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart. At the point of reset, all WQEs have been flushed so dma_fifo_cc is already equal to dma_fifo_pc. There is no need to reset either counter, similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the following WARNING:
WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00
Call Trace:
<IRQ>
? __warn+0x7d/0x110
? iommu_dma_unmap_page+0x79/0x90
? report_bug+0x16d/0x180
? handle_bug+0x4f/0x90
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? iommu_dma_unmap_page+0x79/0x90
? iommu_dma_unmap_page+0x2e/0x90
dma_unmap_page_attrs+0x10d/0x1b0
mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]
mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]
mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]
__napi_poll+0x24/0x190
net_rx_action+0x32a/0x3b0
? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]
? notifier_call_chain+0x35/0xa0
handle_softirqs+0xc9/0x270
irq_exit_rcu+0x71/0xd0
common_interrupt+0x7f/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40--- drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +0 -1
@@ -46,7 +46,6 @@ static void mlx5e_reset_txqsq_cc_pc(struct mlx5e_txqsq *sq)"SQ 0x%x: cc (0x%x) != pc (0x%x)\n" , sq->sqn, sq->cc, sq->pc); sq->cc =0 ; - sq->dma_fifo_cc =0 ; sq->pc =0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/333 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit db25c42c2e1f9c0d136420fff5e5700f7e771a6f ]
XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues.
The issue was discovered by the drivers/net/xdp.py selftest, more specifically the test_xdp_native_tx_mb:
- The mlx5 driver allocates a page_pool page and initializes it with a frag counter of 64 (pp_ref_count=64) and the internal frag counter to 0.
- The test sends one packet with no payload.
- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP buffer with the packet data starting in the first fragment which is the page mentioned above.
- The XDP program runs and calls bpf_xdp_pull_data() which moves the header into the linear part of the XDP buffer. As the packet doesn't contain more data, the program drops the tail fragment since it no longer contains any payload (pp_ref_count=63).
- mlx5 device skips counting this fragment. Internal frag counter remains 0.
- mlx5 releases all 64 fragments of the page but page pp_ref_count is 63 => negative reference counting error.
Resulting splat during the test:
WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] Modules linked in: [...] CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] [...] Call Trace: <TASK> mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] mlx5e_close_rq+0x78/0xa0 [mlx5_core] mlx5e_close_queues+0x46/0x2a0 [mlx5_core] mlx5e_close_channel+0x24/0x90 [mlx5_core] mlx5e_close_channels+0x5d/0xf0 [mlx5_core] mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] mlx5e_change_mtu+0x11d/0x490 [mlx5_core] mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] netif_set_mtu_ext+0xfc/0x240 do_setlink.isra.0+0x226/0x1100 rtnl_newlink+0x7a9/0xba0 rtnetlink_rcv_msg+0x220/0x3c0 netlink_rcv_skb+0x4b/0xf0 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1e8/0x240 ___sys_sendmsg+0x7c/0xb0 [...] __sys_sendmsg+0x5f/0xb0 do_syscall_64+0x55/0xc70
The problem applies for XDP_PASS as well which is handled in a different code path in the driver.
This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag.
As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +5 -7
@@ -2118,14 +2118,13 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wif (prog) {u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; +u8 new_nr_frags;u32 len;if (mlx5e_xdp_handle (rq, prog, mxbuf)) {if (__test_and_clear_bit (MLX5E_RQ_FLAG_XDP_XMIT , rq->flags)) {struct mlx5e_frag_page *pfp; - frag_page -= old_nr_frags - sinfo->nr_frags; -for (pfp = head_page; pfp < frag_page; pfp++) pfp->frags++;
@@ -2136,13 +2135,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wreturn NULL ;/* page/packet was consumed by XDP */ } - nr_frags_free = old_nr_frags - sinfo->nr_frags; -if (unlikely (nr_frags_free)) { - frag_page -= nr_frags_free; + new_nr_frags = sinfo->nr_frags; + nr_frags_free = old_nr_frags - new_nr_frags; +if (unlikely (nr_frags_free)) truesize -= (nr_frags_free -1 ) *PAGE_SIZE +ALIGN (pg_consumed_bytes,BIT (rq->mpwqe.log_stride_sz)); - } len = mxbuf->xdp.data_end - mxbuf->xdp.data;
@@ -2164,7 +2162,7 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wstruct mlx5e_frag_page *pagep;/* sinfo->nr_frags is reset by build_skb, calculate again. */ -xdp_update_skb_frags_info (skb, frag_page - head_page, +xdp_update_skb_frags_info (skb, new_nr_frags, sinfo->xdp_frags_size, truesize,xdp_buff_get_skb_flags (&mxbuf->xdp));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/333 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa ]
XDP multi-buf programs can modify the layout of the XDP buffer when the program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The referenced commit in the fixes tag corrected the assumption in the mlx5 driver that the XDP buffer layout doesn't change during a program execution. However, this fix introduced another issue: the dropped fragments still need to be counted on the driver side to avoid page fragment reference counting issues.
Such issue can be observed with the test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of 3600 and shrinking by 256 bytes (an upcoming selftest patch): the last fragment gets released by the XDP code but doesn't get tracked by the driver. This results in a negative pp_ref_count during page release and the following splat:
WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137 Modules linked in: [...] CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core] [...] Call Trace: <TASK> mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core] mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core] mlx5e_close_rq+0x50/0x60 [mlx5_core] mlx5e_close_queues+0x36/0x2c0 [mlx5_core] mlx5e_close_channel+0x1c/0x50 [mlx5_core] mlx5e_close_channels+0x45/0x80 [mlx5_core] mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core] mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core] netif_set_mtu_ext+0xf1/0x230 do_setlink.isra.0+0x219/0x1180 rtnl_newlink+0x79f/0xb60 rtnetlink_rcv_msg+0x213/0x3a0 netlink_rcv_skb+0x48/0xf0 netlink_unicast+0x24a/0x350 netlink_sendmsg+0x1ee/0x410 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x232/0x280 ___sys_sendmsg+0x78/0xb0 __sys_sendmsg+0x5f/0xb0 [...] do_syscall_64+0x57/0xc50
This patch fixes the issue by doing page frag counting on all the original XDP buffer fragments for all relevant XDP actions (XDP_TX , XDP_REDIRECT and XDP_PASS). This is basically reverting to the original counting before the commit in the fixes tag.
As frag_page is still pointing to the original tail, the nr_frags parameter to xdp_update_skb_frags_info() needs to be calculated in a different way to reflect the new nr_frags.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +4 -7
@@ -1759,6 +1759,7 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wistruct skb_shared_info *sinfo;u32 frag_consumed_bytes;struct bpf_prog *prog; +u8 nr_frags_free =0 ;struct sk_buff *skb;dma_addr_t addr;u32 truesize;
@@ -1801,15 +1802,13 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi prog =rcu_dereference (rq->xdp_prog);if (prog) { -u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; +u8 old_nr_frags = sinfo->nr_frags;if (mlx5e_xdp_handle (rq, prog, mxbuf)) {if (__test_and_clear_bit (MLX5E_RQ_FLAG_XDP_XMIT , rq->flags)) {struct mlx5e_wqe_frag_info *pwi; - wi -= old_nr_frags - sinfo->nr_frags; -for (pwi = head_wi; pwi < wi; pwi++) pwi->frag_page->frags++; }
@@ -1817,10 +1816,8 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi } nr_frags_free = old_nr_frags - sinfo->nr_frags; -if (unlikely (nr_frags_free)) { - wi -= nr_frags_free; +if (unlikely (nr_frags_free)) truesize -= nr_frags_free * frag_info->frag_stride; - } } skb = mlx5e_build_linear_skb(
@@ -1836,7 +1833,7 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wiif (xdp_buff_has_frags (&mxbuf->xdp)) {/* sinfo->nr_frags is reset by build_skb, calculate again. */ -xdp_update_skb_frags_info (skb, wi - head_wi -1 , +xdp_update_skb_frags_info (skb, wi - head_wi - nr_frags_free -1 , sinfo->xdp_frags_size, truesize,xdp_buff_get_skb_flags (&mxbuf->xdp));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/333 net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 ]
teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand.
When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0 master) and later calls iptunnel_xmit_stats(dev, pkt_len). This function does:
get_cpu_ptr(dev->tstats)
Since teql_master_setup() does not set dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes NULL + __per_cpu_offset[cpu], resulting in a page fault.
BUG: unable to handle page fault for address: ffff8880e6659018 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 68bc067 P4D 68bc067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89) Call Trace: <TASK> ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) __gre_xmit (net/ipv4/ip_gre.c:478) gre_tap_xmit (net/ipv4/ip_gre.c:779) teql_master_xmit (net/sched/sch_teql.c:319) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) neigh_direct_output (net/core/neighbour.c:1660) ip_finish_output2 (net/ipv4/ip_output.c:237) __ip_finish_output.part.0 (net/ipv4/ip_output.c:315) ip_mc_output (net/ipv4/ip_output.c:369) ip_send_skb (net/ipv4/ip_output.c:1508) udp_send_skb (net/ipv4/udp.c:1195) udp_sendmsg (net/ipv4/udp.c:1485) inet_sendmsg (net/ipv4/af_inet.c:859) __sys_sendto (net/socket.c:2206)
Fix this by setting skb->dev = slave before calling netdev_start_xmit(), so that tunnel xmit functions see the correct slave device with properly allocated tstats.
--- net/sched/sch_teql.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_teql.c +1 -0
@@ -315,6 +315,7 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)if (__netif_tx_trylock (slave_txq)) {unsigned int length =qdisc_pkt_len (skb); + skb->dev = slave;if (!netif_xmit_frozen_or_stopped (slave_txq) &&netdev_start_xmit (skb, slave, slave_txq, false) ==NETDEV_TX_OK ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/333 rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
[ Upstream commit 4245a79003adf30e67f8e9060915bd05cb31d142 ]
rxrpc_kernel_lookup_peer() can also return error pointers in addition to NULL, so just checking for NULL is not sufficient.
Fix this by:
(1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL on allocation failure.
(2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the error code returned.
--- fs/afs/addr_list.c | 8 ++++---- net/rxrpc/af_rxrpc.c | 8 +++++--- 2 files changed, 9 insertions(+), 7 deletions(-)
fs/afs/addr_list.c +4 -4
@@ -298,8 +298,8 @@ int afs_merge_fs_addr4(struct afs_net *net, struct afs_addr_list *alist, srx.transport.sin.sin_addr.s_addr = xdr; peer =rxrpc_kernel_lookup_peer (net->socket, &srx,GFP_KERNEL ); -if (!peer) -return -ENOMEM ; +if (IS_ERR (peer)) +return PTR_ERR (peer);for (i =0 ; i < alist->nr_ipv4; i++) {if (peer == alist->addrs[i].peer) {
@@ -342,8 +342,8 @@ int afs_merge_fs_addr6(struct afs_net *net, struct afs_addr_list *alist,memcpy (&srx.transport.sin6.sin6_addr, xdr,16 ); peer =rxrpc_kernel_lookup_peer (net->socket, &srx,GFP_KERNEL ); -if (!peer) -return -ENOMEM ; +if (IS_ERR (peer)) +return PTR_ERR (peer);for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) {if (peer == alist->addrs[i].peer) {
net/rxrpc/af_rxrpc.c +5 -3
@@ -267,12 +267,13 @@ static int rxrpc_listen(struct socket *sock, int backlog)* Lookup or create a remote transport endpoint record for the specified * address. * -* Return: The peer record found with a reference, %NULL if no record is found -* or a negative error code if the address is invalid or unsupported. +* Return: The peer record found with a reference or a negative error code if +* the address is invalid or unsupported. */ struct rxrpc_peer *rxrpc_kernel_lookup_peer (struct socket *sock,struct sockaddr_rxrpc *srx,gfp_t gfp) { +struct rxrpc_peer *peer;struct rxrpc_sock *rx =rxrpc_sk (sock->sk);int ret;
@@ -280,7 +281,8 @@ struct rxrpc_peer *rxrpc_kernel_lookup_peer(struct socket *sock,if (ret <0 )return ERR_PTR (ret); -return rxrpc_lookup_peer (rx->local, srx, gfp); + peer =rxrpc_lookup_peer (rx->local, srx, gfp); +return peer ?:ERR_PTR (-ENOMEM ); }EXPORT_SYMBOL (rxrpc_kernel_lookup_peer);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/333 net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivian Wang <[email protected]>
[ Upstream commit 3aa1417803c1833cbd5bacb7e6a6489a196f2519 ]
Even if we get a dma_mapping_error() while mapping an RX buffer, we should still update rx_ring->head to ensure that the buffers we were able to allocate and map are used. Fix this by breaking out to the existing code after the loop, analogous to the existing handling for skb allocation failure.
--- drivers/net/ethernet/spacemit/k1_emac.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/net/ethernet/spacemit/k1_emac.c +3 -5
@@ -582,7 +582,9 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv) DMA_FROM_DEVICE);if (dma_mapping_error (&priv->pdev->dev, rx_buf->dma_addr)) {dev_err_ratelimited (&ndev->dev,"Mapping skb failed\n" ); - goto err_free_skb; +dev_kfree_skb_any (skb); + rx_buf->skb =NULL ; +break ; } rx_desc_addr = &((struct emac_desc *)rx_ring->desc_addr)[i];
@@ -607,10 +609,6 @@ static void emac_alloc_rx_desc_buffers(struct emac_priv *priv) rx_ring->head = i;return ; - -err_free_skb: -dev_kfree_skb_any (skb); - rx_buf->skb =NULL ; }/* Returns number of packets received */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/333 net: spacemit: Fix error handling in emac_tx_mem_map()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivian Wang <[email protected]>
[ Upstream commit 86292155bea578ebab0ca3b65d4d87ecd8a0e9ea ]
The DMA mappings were leaked on mapping error. Free them with the existing emac_free_tx_buf() function.
--- drivers/net/ethernet/spacemit/k1_emac.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/spacemit/k1_emac.c +10 -1
@@ -750,7 +750,7 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb)struct emac_desc tx_desc, *tx_desc_addr;struct device *dev = &priv->pdev->dev;struct emac_tx_desc_buffer *tx_buf; -u32 head, old_head, frag_num, f; +u32 head, old_head, frag_num, f, i;bool buf_idx; frag_num =skb_shinfo (skb)->nr_frags;
@@ -818,6 +818,15 @@ static void emac_tx_mem_map(struct emac_priv *priv, struct sk_buff *skb) err_free_skb:dev_dstats_tx_dropped (priv->ndev); + + i = old_head; +while (i != head) { +emac_free_tx_buf (priv, i); + +if (++i == tx_ring->total_cnt) + i =0 ; + } +dev_kfree_skb_any (skb); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/333 drm/sitronix/st7586: fix bad pixel data due to byte swap
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 46d8a07b4ae262e2fec6ce2aa454e06243661265 ]
Correctly set dbi->write_memory_bpw for the ST7586 driver. This driver is for a monochrome display that has an unusual data format, so the default value set in mipi_dbi_spi_init() is not correct simply because this controller is non-standard.
Previously, we were using dbi->swap_bytes to make the same sort of workaround, but it was removed in the same commit that added dbi->write_memory_bpw, so we need to use the latter now to have the correct behavior.
This fixes every 3 columns of pixels being swapped on the display. There are 3 pixels per byte, so the byte swap caused this effect.
--- drivers/gpu/drm/sitronix/st7586.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/gpu/drm/sitronix/st7586.c +6 -9
@@ -346,6 +346,12 @@ static int st7586_probe(struct spi_device *spi)if (ret)return ret; +/* +* Override value set by mipi_dbi_spi_init(). This driver is a bit +* non-standard, so best to set it explicitly here. +*/ + dbi->write_memory_bpw =8 ; +/* Cannot read from this controller via SPI */ dbi->read_commands =NULL ;
@@ -355,15 +361,6 @@ static int st7586_probe(struct spi_device *spi)if (ret)return ret; -/* -* we are using 8-bit data, so we are not actually swapping anything, -* but setting mipi->swap_bytes makes mipi_dbi_typec3_command() do the -* right thing and not use 16-bit transfers (which results in swapped -* bytes on little-endian systems and causes out of order data to be -* sent to the display). -*/ - dbi->swap_bytes = true; -drm_mode_config_reset (drm); ret =drm_dev_register (drm,0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/333 spi: amlogic: spifc-a4: Fix DMA mapping error handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit b20b437666e1cb26a7c499d1664e8f2a0ac67000 ]
Fix three bugs in aml_sfc_dma_buffer_setup() error paths:
1. Unnecessary goto: When the first DMA mapping (sfc->daddr) fails, nothing needs cleanup. Use direct return instead of goto.
2. Double-unmap bug: When info DMA mapping failed, the code would unmap sfc->daddr inline, then fall through to out_map_data which would unmap it again, causing a double-unmap.
3. Wrong unmap size: The out_map_info label used datalen instead of infolen when unmapping sfc->iaddr, which could lead to incorrect DMA sync behavior.
--- drivers/spi/spi-amlogic-spifc-a4.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/spi/spi-amlogic-spifc-a4.c +2 -3
@@ -411,7 +411,7 @@ static int aml_sfc_dma_buffer_setup(struct aml_sfc *sfc, void *databuf, ret =dma_mapping_error (sfc->dev, sfc->daddr);if (ret) {dev_err (sfc->dev,"DMA mapping error\n" ); - goto out_map_data; +return ret; } cmd =CMD_DATA_ADDRL (sfc->daddr);
@@ -429,7 +429,6 @@ static int aml_sfc_dma_buffer_setup(struct aml_sfc *sfc, void *databuf, ret =dma_mapping_error (sfc->dev, sfc->iaddr);if (ret) {dev_err (sfc->dev,"DMA mapping error\n" ); -dma_unmap_single (sfc->dev, sfc->daddr, datalen, dir); goto out_map_data; }
@@ -448,7 +447,7 @@ static int aml_sfc_dma_buffer_setup(struct aml_sfc *sfc, void *databuf,return 0 ; out_map_info: -dma_unmap_single (sfc->dev, sfc->iaddr, datalen, dir); +dma_unmap_single (sfc->dev, sfc->iaddr, infolen, dir); out_map_data:dma_unmap_single (sfc->dev, sfc->daddr, datalen, dir);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/333 spi: rockchip-sfc: Fix double-free in remove() callback
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <[email protected]>
[ Upstream commit 111e2863372c322e836e0c896f6dd9cf4ee08c71 ]
The driver uses devm_spi_register_controller() for registration, which automatically unregisters the controller via devm cleanup when the device is removed. The manual call to spi_unregister_controller() in the remove() callback can lead to a double-free.
And to make sure controller is unregistered before DMA buffer is unmapped, switch to use spi_register_controller() in probe().
--- drivers/spi/spi-rockchip-sfc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-rockchip-sfc.c +1 -1
@@ -712,7 +712,7 @@ static int rockchip_sfc_probe(struct platform_device *pdev) } } - ret =devm_spi_register_controller (dev, host); + ret =spi_register_controller (host);if (ret) goto err_register;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/333 ASoC: soc-core: drop delayed_work_pending() check before flush
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <[email protected]>
[ Upstream commit 3c99c9f0ed60582c1c9852b685d78d5d3a50de63 ]
The delayed_work_pending() check before flush_delayed_work() in soc_free_pcm_runtime() is unnecessary and racy. flush_delayed_work() is safe to call unconditionally - it is a no-op when no work is pending. Remove the check.
The original check was added by commit 9c9b65203492 ("ASoC: core:
only flush inited work during free") but delayed_work_pending() followed by flush_delayed_work() has a time-of-check/time-of-use window where work can become pending between the two calls.
--- sound/soc/soc-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/soc-core.c +1 -2
@@ -462,8 +462,7 @@ static void soc_free_pcm_runtime(struct snd_soc_pcm_runtime *rtd)list_del (&rtd->list); -if (delayed_work_pending (&rtd->delayed_work)) -flush_delayed_work (&rtd->delayed_work); +flush_delayed_work (&rtd->delayed_work);snd_soc_pcm_component_free (rtd);/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/333 ASoC: soc-core: flush delayed work before removing DAIs and widgets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: matteo.cotifava <[email protected]>
[ Upstream commit 95bc5c225513fc3c4ce169563fb5e3929fbb938b ]
When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).
--- sound/soc/soc-core.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/soc-core.c +3 -0
@@ -2118,6 +2118,9 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)for_each_card_rtds (card, rtd)if (rtd->initialized)snd_soc_link_exit (rtd); +/* flush delayed work before removing DAIs and DAPM widgets */ +snd_soc_flush_all_delayed_work (card); +/* remove and free each DAI */ soc_remove_link_dais (card);soc_remove_link_components (card);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/333 ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sen Wang <[email protected]>
[ Upstream commit 4185b95f8a42d92d68c49289b4644546b51e252b ]
graph_util_is_ports0() identifies DPCM front-end (ports@0) vs back-end (ports@1) by calling of_get_child_by_name() to find the first "ports" child and comparing pointers. This relies on child iteration order matching DTS source order.
When the DPCM topology comes from a DT overlay, __of_attach_node() inserts new children at the head of the sibling list, reversing the order. of_get_child_by_name() then returns ports@1 instead of ports@0, causing all front-end links to be classified as back-ends. The card registers with no PCM devices.
Fix this by matching the unit address directly from the node name instead of relying on sibling order.
--- sound/soc/generic/simple-card-utils.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
sound/soc/generic/simple-card-utils.c +8 -4
@@ -1038,11 +1038,15 @@ int graph_util_is_ports0(struct device_node *np)else port = np; - struct device_node *ports __free(device_node) = of_get_parent(port); - struct device_node *top __free(device_node) = of_get_parent(ports); - struct device_node *ports0 __free(device_node) = of_get_child_by_name(top, "ports"); + struct device_node *ports __free(device_node) = of_get_parent(port); +const char *at =strchr (kbasename (ports->full_name),'@' ); -return ports0 == ports; +/* +* Since child iteration order may differ +* between a base DT and DT overlays, +* string match "ports" or "ports@0" in the node name instead. +*/ +return !at || !strcmp (at,"@0" ); }EXPORT_SYMBOL_GPL (graph_util_is_ports0);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/333 net: sfp: improve Huawei MA5671a fixup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 87d126852158467ab87d5cbc36ccfd3f15464a6c ]
With the current sfp_fixup_ignore_tx_fault() fixup we ignore the TX_FAULT signal, but we also need to apply sfp_fixup_ignore_los() in order to be able to communicate with the module even if the fiber isn't connected for configuration purposes.
This is needed for all the MA5671a firmwares, excluding the FS modded firmware.
--- drivers/net/phy/sfp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/phy/sfp.c +7 -1
@@ -367,6 +367,12 @@ static void sfp_fixup_ignore_tx_fault(struct sfp *sfp) sfp->state_ignore_mask |=SFP_F_TX_FAULT ; } +static void sfp_fixup_ignore_tx_fault_and_los (struct sfp *sfp) +{ +sfp_fixup_ignore_tx_fault (sfp); +sfp_fixup_ignore_los (sfp); +} +static void sfp_fixup_ignore_hw (struct sfp *sfp,unsigned int mask) { sfp->state_hw_mask &= ~mask;
@@ -530,7 +536,7 @@ static const struct sfp_quirk sfp_quirks[] = {// Huawei MA5671A can operate at 2500base-X, but report 1.2GBd NRZ in // their EEPROM SFP_QUIRK ("HUAWEI" ,"MA5671A" , sfp_quirk_2500basex, - sfp_fixup_ignore_tx_fault), + sfp_fixup_ignore_tx_fault_and_los),// Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but // incorrectly report 2500MBd NRZ in their EEPROM.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/333 serial: caif: hold tty->link reference in ldisc_open and ser_release
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <[email protected]>
[ Upstream commit 288598d80a068a0e9281de35bcb4ce495f189e2a ]
A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in my testing.
--- drivers/net/caif/caif_serial.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/caif/caif_serial.c +3 -0
@@ -297,6 +297,7 @@ static void ser_release(struct work_struct *work)dev_close (ser->dev);unregister_netdevice (ser->dev);debugfs_deinit (ser); +tty_kref_put (tty->link);tty_kref_put (tty); }rtnl_unlock ();
@@ -331,6 +332,7 @@ static int ldisc_open(struct tty_struct *tty) ser =netdev_priv (dev); ser->tty =tty_kref_get (tty); +tty_kref_get (tty->link); ser->dev = dev;debugfs_init (ser, tty); tty->receive_room =4096 ;
@@ -339,6 +341,7 @@ static int ldisc_open(struct tty_struct *tty)rtnl_lock (); result =register_netdevice (dev);if (result) { +tty_kref_put (tty->link);tty_kref_put (tty);rtnl_unlock ();free_netdev (dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/333 bnxt_en: Fix RSS table size check when changing ethtool channels
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavan Chebbi <[email protected]>
[ Upstream commit 0d9a60a0618d255530ca56072c5f39eb58e1ed4a ]
When changing channels, the current check in bnxt_set_channels() is not checking for non-default RSS contexts when the RSS table size changes. The current check for IFF_RXFH_CONFIGURED is only sufficient for the default RSS context. Expand the check to include the presence of any non-default RSS contexts.
Allowing such change will result in incorrect configuration of the context's RSS table when the table size changes.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +2 -2
@@ -973,8 +973,8 @@ static int bnxt_set_channels(struct net_device *dev,if (bnxt_get_nr_rss_ctxs (bp, req_rx_rings) !=bnxt_get_nr_rss_ctxs (bp, bp->rx_nr_rings) && -netif_is_rxfh_configured (dev)) { -netdev_warn (dev,"RSS table size change required, RSS table entries must be default to proceed\n" ); + (netif_is_rxfh_configured (dev) || bp->num_rss_ctx)) { +netdev_warn (dev,"RSS table size change required, RSS table entries must be default (with no additional RSS contexts present) to proceed\n" );return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/333 mctp: i2c: fix skb memory leak in receive path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haiyue Wang <[email protected]>
[ Upstream commit e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69 ]
When 'midev->allow_rx' is false, the newly allocated skb isn't consumed by netif_rx(), it needs to free the skb directly.
--- drivers/net/mctp/mctp-i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/mctp/mctp-i2c.c +1 -0
@@ -343,6 +343,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev) }else { status =NET_RX_DROP ;spin_unlock_irqrestore (&midev->lock, flags); +kfree_skb (skb); }if (status ==NET_RX_SUCCESS ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/333 can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenyuan Li <[email protected]>
[ Upstream commit 47bba09b14fa21712398febf36cb14fd4fc3bded ]
In hi3110_open(), the return value of hi3110_power_enable() is not checked. If power enable fails, the device may not function correctly, while the driver still returns success.
Add a check for the return value and propagate the error accordingly.
--- drivers/net/can/spi/hi311x.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/can/spi/hi311x.c +4 -1
@@ -755,7 +755,9 @@ static int hi3110_open(struct net_device *net)return ret;mutex_lock (&priv->hi3110_lock); -hi3110_power_enable (priv->transceiver,1 ); + ret =hi3110_power_enable (priv->transceiver,1 ); +if (ret) + goto out_close_candev; priv->force_quit =0 ; priv->tx_skb =NULL ;
@@ -790,6 +792,7 @@ static int hi3110_open(struct net_device *net)hi3110_hw_sleep (spi); out_close:hi3110_power_enable (priv->transceiver,0 ); + out_close_candev:close_candev (net);mutex_unlock (&priv->hi3110_lock);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/333 bonding: use common function to compute the features
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit d4fde269a970666a30dd3abd0413273a06dd972d ]
Use the new functon netdev_compute_master_upper_features() to compute the bonding features.
Note that bond_compute_features() currently uses bond_for_each_slave() to traverse the lower devices list, and that is just a macro wrapper of netdev_for_each_lower_private(). We use similar helper netdev_for_each_lower_dev() in netdev_compute_master_upper_features() to iterate the slave device, as there is not need to get the private data.
No functional change intended.
Stable-dep-of: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
--- drivers/net/bonding/bond_main.c | 99 ++------------------------------- 1 file changed, 4 insertions(+), 95 deletions(-)
drivers/net/bonding/bond_main.c +4 -95
@@ -1476,97 +1476,6 @@ static netdev_features_t bond_fix_features(struct net_device *dev,return features; } -#define BOND_VLAN_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | \ - NETIF_F_GSO_ENCAP_ALL | \ - NETIF_F_HIGHDMA | NETIF_F_LRO) - -#define BOND_ENC_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_RXCSUM | NETIF_F_GSO_SOFTWARE | \ - NETIF_F_GSO_PARTIAL) - -#define BOND_MPLS_FEATURES (NETIF_F_HW_CSUM | NETIF_F_SG | \ - NETIF_F_GSO_SOFTWARE) - -#define BOND_GSO_PARTIAL_FEATURES (NETIF_F_GSO_ESP) - - -static void bond_compute_features (struct bonding *bond) -{ -netdev_features_t gso_partial_features =BOND_GSO_PARTIAL_FEATURES ; -unsigned int dst_release_flag =IFF_XMIT_DST_RELEASE | -IFF_XMIT_DST_RELEASE_PERM ; -netdev_features_t vlan_features =BOND_VLAN_FEATURES ; -netdev_features_t enc_features =BOND_ENC_FEATURES ; -#ifdef CONFIG_XFRM_OFFLOAD -netdev_features_t xfrm_features =BOND_XFRM_FEATURES ; -#endif /* CONFIG_XFRM_OFFLOAD */ -netdev_features_t mpls_features =BOND_MPLS_FEATURES ; -struct net_device *bond_dev = bond->dev; -struct list_head *iter; -struct slave *slave; -unsigned short max_hard_header_len =ETH_HLEN ; -unsigned int tso_max_size =TSO_MAX_SIZE ; -u16 tso_max_segs =TSO_MAX_SEGS ; - -if (!bond_has_slaves (bond)) - goto done; - - vlan_features =netdev_base_features (vlan_features); - mpls_features =netdev_base_features (mpls_features); - -bond_for_each_slave (bond, slave, iter) { - vlan_features =netdev_increment_features (vlan_features, - slave->dev->vlan_features,BOND_VLAN_FEATURES ); - - enc_features =netdev_increment_features (enc_features, - slave->dev->hw_enc_features, -BOND_ENC_FEATURES ); - -#ifdef CONFIG_XFRM_OFFLOAD - xfrm_features =netdev_increment_features (xfrm_features, - slave->dev->hw_enc_features, -BOND_XFRM_FEATURES ); -#endif /* CONFIG_XFRM_OFFLOAD */ - - gso_partial_features =netdev_increment_features (gso_partial_features, - slave->dev->gso_partial_features, -BOND_GSO_PARTIAL_FEATURES ); - - mpls_features =netdev_increment_features (mpls_features, - slave->dev->mpls_features, -BOND_MPLS_FEATURES ); - - dst_release_flag &= slave->dev->priv_flags; -if (slave->dev->hard_header_len > max_hard_header_len) - max_hard_header_len = slave->dev->hard_header_len; - - tso_max_size =min (tso_max_size, slave->dev->tso_max_size); - tso_max_segs =min (tso_max_segs, slave->dev->tso_max_segs); - } - bond_dev->hard_header_len = max_hard_header_len; - -done: - bond_dev->gso_partial_features = gso_partial_features; - bond_dev->vlan_features = vlan_features; - bond_dev->hw_enc_features = enc_features |NETIF_F_GSO_ENCAP_ALL | -NETIF_F_HW_VLAN_CTAG_TX | -NETIF_F_HW_VLAN_STAG_TX ; -#ifdef CONFIG_XFRM_OFFLOAD - bond_dev->hw_enc_features |= xfrm_features; -#endif /* CONFIG_XFRM_OFFLOAD */ - bond_dev->mpls_features = mpls_features; -netif_set_tso_max_segs (bond_dev, tso_max_segs); -netif_set_tso_max_size (bond_dev, tso_max_size); - - bond_dev->priv_flags &= ~IFF_XMIT_DST_RELEASE ; -if ((bond_dev->priv_flags &IFF_XMIT_DST_RELEASE_PERM ) && - dst_release_flag == (IFF_XMIT_DST_RELEASE |IFF_XMIT_DST_RELEASE_PERM )) - bond_dev->priv_flags |=IFF_XMIT_DST_RELEASE ; - -netdev_change_features (bond_dev); -} -static void bond_setup_by_slave (struct net_device *bond_dev,struct net_device *slave_dev) {
@@ -2287,7 +2196,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, } bond->slave_cnt++; -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true);bond_set_carrier (bond);/* Needs to be called before bond_select_active_slave(), which will
@@ -2542,7 +2451,7 @@ static int __bond_release_one(struct net_device *bond_dev,call_netdevice_notifiers (NETDEV_RELEASE , bond->dev); } -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true);if (!(bond_dev->features &NETIF_F_VLAN_CHALLENGED ) && (old_features &NETIF_F_VLAN_CHALLENGED ))slave_info (bond_dev, slave_dev,"last VLAN challenged slave left bond - VLAN blocking is removed\n" );
@@ -4050,7 +3959,7 @@ static int bond_slave_netdev_event(unsigned long event,case NETDEV_FEAT_CHANGE :if (!bond->notifier_ctx) { bond->notifier_ctx = true; -bond_compute_features (bond); +netdev_compute_master_upper_features (bond->dev, true); bond->notifier_ctx = false; }break ;
@@ -6043,7 +5952,7 @@ void bond_setup(struct net_device *bond_dev)* capable */ - bond_dev->hw_features =BOND_VLAN_FEATURES | + bond_dev->hw_features =MASTER_UPPER_DEV_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_RX |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/333 bonding: fix type confusion in bond_setup_by_slave()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 950803f7254721c1c15858fbbfae3deaaeeecb11 ]
kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe1a0e6c1a9
When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device:
bond_dev->header_ops = slave_dev->header_ops;
This causes a type confusion when dev_hard_header() is later called on the bond device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-specific private data. When called with the bond device, netdev_priv() returns the bond's private data (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being read and kernel crashes.
Fix this by introducing bond_header_ops with wrapper functions that delegate to the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's header functions always receives the correct device.
The fix is placed in the bonding driver rather than individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without considering that these callbacks expect a specific netdev_priv() layout.
The type confusion can be observed by adding a printk in ipgre_header() and running the following commands:
ip link add dummy0 type dummy
ip addr add 10.0.0.1/24 dev dummy0
ip link set dummy0 up
ip link add gre1 type gre local 10.0.0.1 ip link add bond1 type bond mode active-backup ip link set gre1 master bond1
ip link set gre1 up
ip link set bond1 up
ip addr add fe80::1/64 dev bond1
--- drivers/net/bonding/bond_main.c | 47 ++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +46 -1
@@ -1476,6 +1476,50 @@ static netdev_features_t bond_fix_features(struct net_device *dev,return features; } +static int bond_header_create (struct sk_buff *skb,struct net_device *bond_dev, +unsigned short type,const void *daddr, +const void *saddr,unsigned int len) +{ +struct bonding *bond =netdev_priv (bond_dev); +const struct header_ops *slave_ops; +struct slave *slave; +int ret =0 ; + +rcu_read_lock (); + slave =rcu_dereference (bond->curr_active_slave); +if (slave) { + slave_ops =READ_ONCE (slave->dev->header_ops); +if (slave_ops && slave_ops->create) + ret = slave_ops->create (skb, slave->dev, + type, daddr, saddr, len); + } +rcu_read_unlock (); +return ret; +} + +static int bond_header_parse (const struct sk_buff *skb,unsigned char *haddr) +{ +struct bonding *bond =netdev_priv (skb->dev); +const struct header_ops *slave_ops; +struct slave *slave; +int ret =0 ; + +rcu_read_lock (); + slave =rcu_dereference (bond->curr_active_slave); +if (slave) { + slave_ops =READ_ONCE (slave->dev->header_ops); +if (slave_ops && slave_ops->parse) + ret = slave_ops->parse (skb, haddr); + } +rcu_read_unlock (); +return ret; +} + +static const struct header_ops bond_header_ops = { + .create = bond_header_create, + .parse = bond_header_parse, +}; +static void bond_setup_by_slave (struct net_device *bond_dev,struct net_device *slave_dev) {
@@ -1483,7 +1527,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev,dev_close (bond_dev); - bond_dev->header_ops = slave_dev->header_ops; + bond_dev->header_ops = slave_dev->header_ops ? + &bond_header_ops :NULL ; bond_dev->type = slave_dev->type; bond_dev->hard_header_len = slave_dev->hard_header_len;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/333 mctp: route: hold key->lock in mctp_flow_prepare_output()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a ]
mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so.
mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy.
Example interleaving:
CPU0 CPU1
---- ----
mctp_flow_prepare_output(key, devA)
if (!key->dev) // sees NULL
mctp_flow_prepare_output(
key, devB)
if (!key->dev) // still NULL
mctp_dev_set_key(devB, key)
mctp_dev_hold(devB)
key->dev = devB
mctp_dev_set_key(devA, key)
mctp_dev_hold(devA)
key->dev = devA // overwrites devBNow both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev.
Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call.
--- net/mctp/route.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/mctp/route.c +7 -4
@@ -359,6 +359,7 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) {struct mctp_sk_key *key;struct mctp_flow *flow; +unsigned long flags; flow =skb_ext_find (skb,SKB_EXT_MCTP );if (!flow)
@@ -366,12 +367,14 @@ static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) key = flow->key; -if (key->dev) { +spin_lock_irqsave (&key->lock, flags); + +if (!key->dev) +mctp_dev_set_key (dev, key); +else WARN_ON (key->dev != dev); -return ; - } - mctp_dev_set_key(dev, key); + spin_unlock_irqrestore(&key->lock, flags); }#else static void mctp_skb_set_flow (struct sk_buff *skb,struct mctp_sk_key *key) {}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/333 amd-xgbe: fix link status handling in xgbe_rx_adaptation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 6485cb96be5cd0f4bf39554737ba11322cc9b053 ]
The link status bit is latched low to allow detection of momentary link drops. If the status indicates that the link is already down, read it again to obtain the current state.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +14 -5
@@ -1941,7 +1941,7 @@ static void xgbe_set_rx_adap_mode(struct xgbe_prv_data *pdata,static void xgbe_rx_adaptation (struct xgbe_prv_data *pdata) {struct xgbe_phy_data *phy_data = pdata->phy_data; -unsigned int reg; +int reg;/* step 2: force PCS to send RX_ADAPT Req to PHY */ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_EQ_CTRL4,
@@ -1963,11 +1963,20 @@ static void xgbe_rx_adaptation(struct xgbe_prv_data *pdata)/* Step 4: Check for Block lock */ -/* Link status is latched low, so read once to clear -* and then read again to get current state -*/ - reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); +if (reg <0 ) + goto set_mode; + +/* Link status is latched low so that momentary link drops +* can be detected. If link was already down read again +* to get the latest state. +*/ +if (!pdata->phy.link && !(reg &MDIO_STAT1_LSTATUS )) { + reg =XMDIO_READ (pdata,MDIO_MMD_PCS ,MDIO_STAT1 ); +if (reg <0 ) + goto set_mode; + } +if (reg &MDIO_STAT1_LSTATUS ) {/* If the block lock is found, update the helpers * and declare the link up
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/333 amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
[ Upstream commit 27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81 ]
When operating in 10GBASE-KR mode with auto-negotiation disabled and RX adaptation enabled, CRC errors can occur during the RX adaptation process. This happens because the driver continues transmitting and receiving packets while adaptation is in progress.
Fix this by stopping TX/RX immediately when the link goes down and RX adaptation needs to be re-triggered, and only re-enabling TX/RX after adaptation completes and the link is confirmed up. Introduce a flag to track whether TX/RX was disabled for adaptation so it can be restored correctly.
This prevents packets from being transmitted or received during the RX adaptation window and avoids CRC errors from corrupted frames.
The flag tracking the data path state is synchronized with hardware state in xgbe_start() to prevent stale state after device restarts. This ensures that after a restart cycle (where xgbe_stop disables TX/RX and xgbe_start re-enables them), the flag correctly reflects that the data path is active.
--- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 63 ++++++++++++++++++++- drivers/net/ethernet/amd/xgbe/xgbe.h | 4 ++ 3 files changed, 69 insertions(+), 2 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-drv.c +4 -0
@@ -1246,6 +1246,10 @@ static int xgbe_start(struct xgbe_prv_data *pdata) hw_if->enable_tx (pdata); hw_if->enable_rx (pdata); +/* Synchronize flag with hardware state after enabling TX/RX. +* This prevents stale state after device restart cycles. +*/ + pdata->data_path_stopped = false;udp_tunnel_nic_reset_ntf (netdev);
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +61 -2
88 lines not on this page · raw message
drivers/net/ethernet/amd/xgbe/xgbe.h +4 -0
@@ -1242,6 +1242,10 @@ struct xgbe_prv_data {bool en_rx_adap;int rx_adapt_retries;bool rx_adapt_done; +/* Flag to track if data path (TX/RX) was stopped for RX adaptation. +* This prevents packet corruption during the adaptation window. +*/ +bool data_path_stopped;bool mode_set; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/333 net: add xmit recursion limit to tunnel xmit functions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <[email protected]>
[ Upstream commit 6f1a9140ecda3baba3d945b9a6155af4268aafc4 ]
Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow.
The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient because tunnel recursion involves route lookups and full IP output, consuming much more stack per level. Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.
Add recursion detection using dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).
Move dev_xmit_recursion helpers from net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code.
BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: <TASK> __build_flow_key.constprop.0 (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread </TASK>
--- include/linux/netdevice.h | 32 ++++++++++++++++++++++++++++++++ include/net/ip6_tunnel.h | 12 ++++++++++++ include/net/ip_tunnels.h | 7 +++++++ net/core/dev.h | 35 ----------------------------------- net/ipv4/ip_tunnel_core.c | 13 +++++++++++++ 5 files changed, 64 insertions(+), 35 deletions(-)
include/linux/netdevice.h +32 -0
@@ -3549,17 +3549,49 @@ struct page_pool_bh { }; DECLARE_PER_CPU(struct page_pool_bh, system_page_pool); +#define XMIT_RECURSION_LIMIT 8 +#ifndef CONFIG_PREEMPT_RT static inline int dev_recursion_level (void ) {return this_cpu_read (softnet_data.xmit.recursion); } + +static inline bool dev_xmit_recursion (void ) +{ +return unlikely (__this_cpu_read (softnet_data.xmit.recursion) > +XMIT_RECURSION_LIMIT ); +} + +static inline void dev_xmit_recursion_inc (void ) +{ +__this_cpu_inc (softnet_data.xmit.recursion); +} + +static inline void dev_xmit_recursion_dec (void ) +{ +__this_cpu_dec (softnet_data.xmit.recursion); +}#else static inline int dev_recursion_level (void ) {return current->net_xmit.recursion; } +static inline bool dev_xmit_recursion (void ) +{ +return unlikely (current->net_xmit.recursion >XMIT_RECURSION_LIMIT ); +} + +static inline void dev_xmit_recursion_inc (void ) +{ + current->net_xmit.recursion++; +} + +static inline void dev_xmit_recursion_dec (void ) +{ + current->net_xmit.recursion--; +}#endif void __netif_schedule (struct Qdisc *q);
include/net/ip6_tunnel.h +12 -0
@@ -156,6 +156,16 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, {int pkt_len, err; +if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); +kfree_skb (skb); +return ; + } + +dev_xmit_recursion_inc (); +memset (skb->cb,0 ,sizeof (struct inet6_skb_parm ));IP6CB (skb)->flags = ip6cb_flags; pkt_len = skb->len -skb_inner_network_offset (skb);
@@ -166,6 +176,8 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, pkt_len =-1 ;iptunnel_xmit_stats (dev, pkt_len); } + +dev_xmit_recursion_dec (); }#endif #endif
include/net/ip_tunnels.h +7 -0
@@ -27,6 +27,13 @@#include <net/ip6_route.h> #endif +/* Recursion limit for tunnel xmit to detect routing loops. +* Unlike XMIT_RECURSION_LIMIT (8) used in the no-qdisc path, tunnel +* recursion involves route lookups and full IP output, consuming much +* more stack per level, so a lower limit is needed. +*/ +#define IP_TUNNEL_RECURSION_LIMIT 4 +/* Keep error state on tunnel for 30 sec */ #define IPTUNNEL_ERR_TIMEO (30*HZ)
net/core/dev.h +0 -35
@@ -358,41 +358,6 @@ static inline void napi_assert_will_not_race(const struct napi_struct *napi)void kick_defer_list_purge (unsigned int cpu); -#define XMIT_RECURSION_LIMIT 8 - -#ifndef CONFIG_PREEMPT_RT -static inline bool dev_xmit_recursion (void ) -{ -return unlikely (__this_cpu_read (softnet_data.xmit.recursion) > -XMIT_RECURSION_LIMIT ); -} - -static inline void dev_xmit_recursion_inc (void ) -{ -__this_cpu_inc (softnet_data.xmit.recursion); -} - -static inline void dev_xmit_recursion_dec (void ) -{ -__this_cpu_dec (softnet_data.xmit.recursion); -} -#else -static inline bool dev_xmit_recursion (void ) -{ -return unlikely (current->net_xmit.recursion >XMIT_RECURSION_LIMIT ); -} - -static inline void dev_xmit_recursion_inc (void ) -{ - current->net_xmit.recursion++; -} - -static inline void dev_xmit_recursion_dec (void ) -{ - current->net_xmit.recursion--; -} -#endif -int dev_set_hwtstamp_phylib (struct net_device *dev,struct kernel_hwtstamp_config *cfg,struct netlink_ext_ack *extack);
net/ipv4/ip_tunnel_core.c +13 -0
@@ -58,6 +58,17 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,struct iphdr *iph;int err; +if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); +ip_rt_put (rt); +kfree_skb (skb); +return ; + } + +dev_xmit_recursion_inc (); +skb_scrub_packet (skb, xnet);skb_clear_hash_if_not_l4 (skb);
@@ -88,6 +99,8 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb, pkt_len =0 ;iptunnel_xmit_stats (dev, pkt_len); } + +dev_xmit_recursion_dec (); }EXPORT_SYMBOL_GPL (iptunnel_xmit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/333 netfilter: nf_tables: Fix for duplicate device in netdev hooks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b ]
When handling NETDEV_REGISTER notification, duplicate device registration must be avoided since the device may have been added by nft_netdev_hook_alloc() already when creating the hook.
--- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nft_chain_filter.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -9841,7 +9841,7 @@ static int nft_flowtable_event(unsigned long event, struct net_device *dev,break ;case NETDEV_REGISTER :/* NOP if not matching or already registered */ -if (!match || (changename && ops)) +if (!match || ops)continue ; ops = kzalloc(sizeof(struct nf_hook_ops),
net/netfilter/nft_chain_filter.c +1 -1
@@ -344,7 +344,7 @@ static int nft_netdev_event(unsigned long event, struct net_device *dev,break ;case NETDEV_REGISTER :/* NOP if not matching or already registered */ -if (!match || (changename && ops)) +if (!match || ops)continue ; ops = kmemdup(&basechain->ops,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/333 netfilter: nf_tables: always walk all pending catchall elements
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9 ]
During transaction processing we might have more than one catchall element:
1 live catchall element and 1 pending element that is coming as part of the new batch.
If the map holding the catchall elements is also going away, its required to toggle all catchall elements and not just the first viable candidate.
Otherwise, we get:
WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
--- net/netfilter/nf_tables_api.c | 2 -- 1 file changed, 2 deletions(-)
net/netfilter/nf_tables_api.c +0 -2
@@ -828,7 +828,6 @@ static void nft_map_catchall_deactivate(const struct nft_ctx *ctx,nft_set_elem_change_active (ctx->net, set, ext);nft_setelem_data_deactivate (ctx->net, set, catchall->elem); -break ; } }
@@ -5928,7 +5927,6 @@ static void nft_map_catchall_activate(const struct nft_ctx *ctx,nft_clear (ctx->net, ext);nft_setelem_data_activate (ctx->net, set, catchall->elem); -break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/333 netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jenny Guanni Qu <[email protected]>
[ Upstream commit d6d8cd2db236a9dd13dbc2d05843b3445cc964b5 ]
pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the to_offset argument on every iteration, including the last one where i == m->field_count - 1. This reads one element past the end of the stack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS] with NFT_PIPAPO_MAX_FIELDS == 16).
Although pipapo_unmap() returns early when is_last is true without using the to_offset value, the argument is evaluated at the call site before the function body executes, making this a genuine out-of-bounds stack read confirmed by KASAN:
BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables] Read of size 4 at addr ffff8000810e71a4
This frame has 1 object:
[32, 160) 'rulemap'
The buggy address is at offset 164 -- exactly 4 bytes past the end of the rulemap array.
Pass 0 instead of rulemap[i + 1].n on the last iteration to avoid the out-of-bounds read.
--- net/netfilter/nft_set_pipapo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +2 -1
@@ -1641,6 +1641,7 @@ static void pipapo_drop(struct nft_pipapo_match *m,int i;nft_pipapo_for_each_field (f, i, m) { +bool last = i == m->field_count -1 ;int g;for (g =0 ; g < f->groups; g++) {
@@ -1660,7 +1661,7 @@ static void pipapo_drop(struct nft_pipapo_match *m, }pipapo_unmap (f->mt, f->rules, rulemap[i].to, rulemap[i].n, - rulemap[i +1 ].n, i == m->field_count -1 ); + last ?0 : rulemap[i +1 ].n, last);if (pipapo_resize (f, f->rules, f->rules - rulemap[i].n)) {/* We can ignore this, a failure to shrink tables down * doesn't make tables invalid.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/333 netfilter: x_tables: guard option walkers against 1-byte tail reads
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Dull <[email protected]>
[ Upstream commit cfe770220ac2dbd3e104c6b45094037455da81d4 ]
When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1] in xt_tcpudp and xt_dccp option walkers.
--- net/netfilter/xt_dccp.c | 4 ++-- net/netfilter/xt_tcpudp.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-)
net/netfilter/xt_dccp.c +2 -2
@@ -62,10 +62,10 @@ dccp_find_option(u_int8_t option,return true; } -if (op[i] <2 ) +if (op[i] <2 || i == optlen -1 ) i++;else - i += op[i+1 ]?:1 ; + i += op[i +1 ] ? :1 ; }spin_unlock_bh (&dccp_buflock);
net/netfilter/xt_tcpudp.c +4 -2
@@ -59,8 +59,10 @@ tcp_find_option(u_int8_t option,for (i =0 ; i < optlen; ) {if (op[i] == option)return !invert; -if (op[i] <2 ) i++; -else i += op[i+1 ]?:1 ; +if (op[i] <2 || i == optlen -1 ) + i++; +else + i += op[i +1 ] ? :1 ; }return invert;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/333 netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit f1ba83755d81c6fc66ac7acd723d238f974091e9 ]
nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking ownership of the entry. For PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN attributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN present but NFQA_VLAN_TCI missing), the function returns immediately without freeing the dequeued entry or its sk_buff.
This leaks the nf_queue_entry, its associated sk_buff, and all held references (net_device refcounts, struct net refcount). Repeated triggering exhausts kernel memory.
Fix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict on the error path, consistent with other error handling in this file.
--- net/netfilter/nfnetlink_queue.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink_queue.c +3 -1
@@ -1549,8 +1549,10 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,if (entry->state.pf ==PF_BRIDGE ) { err =nfqa_parse_bridge (entry, nfqa); -if (err <0 ) +if (err <0 ) { +nfqnl_reinject (entry,NF_DROP );return err; + } }if (nfqa[NFQA_PAYLOAD ]) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/333 netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <[email protected]>
[ Upstream commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 ]
nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds.
BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0
--- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nfnetlink_cthelper.c +4 -4
@@ -603,10 +603,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } -if (cb->args[1 ]) { - cb->args[1 ] =0 ; - goto restart; +if (cb->args[1 ]) { + cb->args[1 ] =0 ; + goto restart; + } } out:rcu_read_unlock ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/333 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Tan <[email protected]>
[ Upstream commit 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf ]
IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer.
If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1.
Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type.
--- net/netfilter/xt_IDLETIMER.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/netfilter/xt_IDLETIMER.c +6 -0
@@ -318,6 +318,12 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) info->timer =__idletimer_tg_find_by_label (info->label);if (info->timer) { +if (info->timer->timer_type &XT_IDLETIMER_ALARM ) { +pr_debug ("Adding/Replacing rule with same label and different timer type is not allowed\n" ); +mutex_unlock (&list_mutex); +return -EINVAL ; + } + info->timer->refcnt++;mod_timer (&info->timer->timer,secs_to_jiffies (info->timeout) + jiffies);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/333 perf annotate: Fix hashmap__new() error checking
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit bf29cb3641b80bac759c3332b02e0b270e16bf94 ]
The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match.
Additionally, set src->samples to NULL to prevent any later code from accidentally using the error pointer.
--- tools/perf/util/annotate.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/annotate.c +4 -1
@@ -44,6 +44,7 @@#include "strbuf.h" #include <regex.h> #include <linux/bitops.h> +#include <linux/err.h> #include <linux/kernel.h> #include <linux/string.h> #include <linux/zalloc.h>
@@ -137,8 +138,10 @@ static int annotated_source__alloc_histograms(struct annotated_source *src,return -1 ; src->samples =hashmap__new (sym_hist_hash, sym_hist_equal,NULL ); -if (src->samples ==NULL ) +if (IS_ERR (src->samples)) {zfree (&src->histograms); + src->samples =NULL ; + }return src->histograms ?0 :-1 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/333 regulator: pca9450: Correct interrupt type
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 5d0efaf47ee90ac60efae790acee3a3ed99ebf80 ]
Kernel warning on i.MX8MP-EVK when doing module test:
irq: type mismatch, failed to map hwirq-3 for gpio@30200000!
Per PCA945[X] specification: The IRQ_B pin is pulled low when any unmasked interrupt bit status is changed and it is released high once application processor read INT1 register.
So the interrupt should be configured as IRQF_TRIGGER_LOW, not IRQF_TRIGGER_FALLING.
--- drivers/regulator/pca9450-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/pca9450-regulator.c +1 -1
@@ -1203,7 +1203,7 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)if (pca9450->irq) { ret =devm_request_threaded_irq (pca9450->dev, pca9450->irq,NULL , pca9450_irq_handler, - (IRQF_TRIGGER_FALLING |IRQF_ONESHOT ), + (IRQF_TRIGGER_LOW |IRQF_ONESHOT ),"pca9450-irq" , pca9450);if (ret !=0 ) return dev_err_probe(pca9450->dev, ret, "Failed to request IRQ: %d\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/333 regulator: pca9450: Add support for setting debounce settings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martijn de Gouw <[email protected]>
[ Upstream commit d9d0be59be2580f2c5e4b7217aafb980e8c371cf ]
Make the different debounce timers configurable from the devicetree. Depending on the board design, these have to be set different than the default register values.
Stable-dep-of: 21b3fb7dc19c ("regulator: pca9450: Correct probed name for PCA9452")
--- drivers/regulator/pca9450-regulator.c | 158 ++++++++++++++++++++++---- include/linux/regulator/pca9450.h | 32 ++++++ 2 files changed, 171 insertions(+), 19 deletions(-)
drivers/regulator/pca9450-regulator.c +139 -19
@@ -1117,6 +1117,143 @@ static int pca9450_i2c_restart_handler(struct sys_off_data *data)return 0 ; } +static int pca9450_of_init (struct pca9450 *pca9450) +{ + struct i2c_client *i2c = container_of(pca9450->dev, struct i2c_client, dev); +int ret; +unsigned int val; +unsigned int reset_ctrl; +unsigned int rstb_deb_ctrl; +unsigned int t_on_deb, t_off_deb; +unsigned int t_on_step, t_off_step; +unsigned int t_restart; + +if (of_property_read_bool (i2c->dev.of_node,"nxp,wdog_b-warm-reset" )) + reset_ctrl =WDOG_B_CFG_WARM ; +else + reset_ctrl =WDOG_B_CFG_COLD_LDO12 ; + +/* Set reset behavior on assertion of WDOG_B signal */ + ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_RESET_CTRL , +WDOG_B_CFG_MASK , reset_ctrl); +if (ret) +return dev_err_probe (&i2c->dev, ret,"Failed to set WDOG_B reset behavior\n" ); + + ret =of_property_read_u32 (i2c->dev.of_node,"npx,pmic-rst-b-debounce-ms" , &val); +if (ret == -EINVAL ) + rstb_deb_ctrl =T_PMIC_RST_DEB_50MS ; +else if (ret) +return ret; +else { +switch (val) { +case 10 : rstb_deb_ctrl =T_PMIC_RST_DEB_10MS ;break ; +case 50 : rstb_deb_ctrl =T_PMIC_RST_DEB_50MS ;break ; +case 100 : rstb_deb_ctrl =T_PMIC_RST_DEB_100MS ;break ; +case 500 : rstb_deb_ctrl =T_PMIC_RST_DEB_500MS ;break ; +case 1000 : rstb_deb_ctrl =T_PMIC_RST_DEB_1S ;break ; +case 2000 : rstb_deb_ctrl =T_PMIC_RST_DEB_2S ;break ; +case 4000 : rstb_deb_ctrl =T_PMIC_RST_DEB_4S ;break ; +case 8000 : rstb_deb_ctrl =T_PMIC_RST_DEB_8S ;break ; +default :return -EINVAL ; + } + } + ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_RESET_CTRL , +T_PMIC_RST_DEB_MASK , rstb_deb_ctrl); +if (ret) +return dev_err_probe (&i2c->dev, ret,"Failed to set PMIC_RST_B debounce time\n" ); + + ret =of_property_read_u32 (i2c->dev.of_node,"nxp,pmic-on-req-on-debounce-us" , &val); +if (ret == -EINVAL ) + t_on_deb =T_ON_DEB_20MS ; +else if (ret) +return ret; +else { +switch (val) { +case 120 : t_on_deb =T_ON_DEB_120US ;break ; +case 20000 : t_on_deb =T_ON_DEB_20MS ;break ; +case 100000 : t_on_deb =T_ON_DEB_100MS ;break ; +case 750000 : t_on_deb =T_ON_DEB_750MS ;break ; +default :return -EINVAL ; + } + } + + ret =of_property_read_u32 (i2c->dev.of_node,"nxp,pmic-on-req-off-debounce-us" , &val); +if (ret == -EINVAL ) + t_off_deb =T_OFF_DEB_120US ; +else if (ret) +return ret; +else { +switch (val) { +case 120 : t_off_deb =T_OFF_DEB_120US ;break ; +case 2000 : t_off_deb =T_OFF_DEB_2MS ;break ; +default :return -EINVAL ; + } + } + + ret =of_property_read_u32 (i2c->dev.of_node,"nxp,power-on-step-ms" , &val); +if (ret == -EINVAL ) + t_on_step =T_ON_STEP_2MS ; +else if (ret) +return ret; +else { +switch (val) { +case 1 : t_on_step =T_ON_STEP_1MS ;break ; +case 2 : t_on_step =T_ON_STEP_2MS ;break ; +case 4 : t_on_step =T_ON_STEP_4MS ;break ; +case 8 : t_on_step =T_ON_STEP_8MS ;break ; +default :return -EINVAL ; + } + } + + ret =of_property_read_u32 (i2c->dev.of_node,"nxp,power-down-step-ms" , &val); +if (ret == -EINVAL ) + t_off_step =T_OFF_STEP_8MS ; +else if (ret) +return ret; +else { +switch (val) { +case 2 : t_off_step =T_OFF_STEP_2MS ;break ; +case 4 : t_off_step =T_OFF_STEP_4MS ;break ; +case 8 : t_off_step =T_OFF_STEP_8MS ;break ; +case 16 : t_off_step =T_OFF_STEP_16MS ;break ; +default :return -EINVAL ; + } + } + + ret =of_property_read_u32 (i2c->dev.of_node,"nxp,restart-ms" , &val); +if (ret == -EINVAL ) + t_restart =T_RESTART_250MS ; +else if (ret) +return ret; +else { +switch (val) { +case 250 : t_restart =T_RESTART_250MS ;break ; +case 500 : t_restart =T_RESTART_500MS ;break ; +default :return -EINVAL ; + } + } + + ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_PWRCTRL , +T_ON_DEB_MASK |T_OFF_DEB_MASK |T_ON_STEP_MASK | +T_OFF_STEP_MASK |T_RESTART_MASK , + t_on_deb | t_off_deb | t_on_step | + t_off_step | t_restart); +if (ret) +return dev_err_probe (&i2c->dev, ret, +"Failed to set PWR_CTRL debounce configuration\n" ); + +if (of_property_read_bool (i2c->dev.of_node,"nxp,i2c-lt-enable" )) { +/* Enable I2C Level Translator */ + ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_CONFIG2 , +I2C_LT_MASK ,I2C_LT_ON_STANDBY_RUN ); +if (ret) +return dev_err_probe (&i2c->dev, ret, +"Failed to enable I2C level translator\n" ); + } + +return 0 ; +} +static int pca9450_i2c_probe (struct i2c_client *i2c) { enum pca9450_chip_type type = (unsigned int)(uintptr_t)
@@ -1126,7 +1263,6 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)struct regulator_dev *ldo5;struct pca9450 *pca9450;unsigned int device_id, i; -unsigned int reset_ctrl;int ret; pca9450 =devm_kzalloc (&i2c->dev,sizeof (struct pca9450 ),GFP_KERNEL );
@@ -1224,25 +1360,9 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)if (ret)return dev_err_probe (&i2c->dev, ret,"Failed to clear PRESET_EN bit\n" ); -if (of_property_read_bool (i2c->dev.of_node,"nxp,wdog_b-warm-reset" )) - reset_ctrl =WDOG_B_CFG_WARM ; -else - reset_ctrl =WDOG_B_CFG_COLD_LDO12 ; - -/* Set reset behavior on assertion of WDOG_B signal */ - ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_RESET_CTRL , -WDOG_B_CFG_MASK , reset_ctrl); + ret =pca9450_of_init (pca9450);if (ret) -return dev_err_probe (&i2c->dev, ret,"Failed to set WDOG_B reset behavior\n" ); - -if (of_property_read_bool (i2c->dev.of_node,"nxp,i2c-lt-enable" )) { -/* Enable I2C Level Translator */ - ret =regmap_update_bits (pca9450->regmap,PCA9450_REG_CONFIG2 , -I2C_LT_MASK ,I2C_LT_ON_STANDBY_RUN ); -if (ret) -return dev_err_probe (&i2c->dev, ret, -"Failed to enable I2C level translator\n" ); - } +return dev_err_probe (&i2c->dev, ret,"Unable to parse OF data\n" );/* * For LDO5 we need to be able to check the status of the SD_VSEL input in
include/linux/regulator/pca9450.h +32 -0
@@ -223,12 +223,44 @@ enum {#define IRQ_THERM_105 0x02#define IRQ_THERM_125 0x01 +/* PCA9450_REG_PWRCTRL bits */ +#define T_ON_DEB_MASK 0xC0 +#define T_ON_DEB_120US (0 << 6) +#define T_ON_DEB_20MS (1 << 6) +#define T_ON_DEB_100MS (2 << 6) +#define T_ON_DEB_750MS (3 << 6) +#define T_OFF_DEB_MASK 0x20 +#define T_OFF_DEB_120US (0 << 5) +#define T_OFF_DEB_2MS (1 << 5) +#define T_ON_STEP_MASK 0x18 +#define T_ON_STEP_1MS (0 << 3) +#define T_ON_STEP_2MS (1 << 3) +#define T_ON_STEP_4MS (2 << 3) +#define T_ON_STEP_8MS (3 << 3) +#define T_OFF_STEP_MASK 0x06 +#define T_OFF_STEP_2MS (0 << 1) +#define T_OFF_STEP_4MS (1 << 1) +#define T_OFF_STEP_8MS (2 << 1) +#define T_OFF_STEP_16MS (3 << 1) +#define T_RESTART_MASK 0x01 +#define T_RESTART_250MS 0 +#define T_RESTART_500MS 1 +/* PCA9450_REG_RESET_CTRL bits */ #define WDOG_B_CFG_MASK 0xC0#define WDOG_B_CFG_NONE 0x00#define WDOG_B_CFG_WARM 0x40#define WDOG_B_CFG_COLD_LDO12 0x80#define WDOG_B_CFG_COLD 0xC0 +#define T_PMIC_RST_DEB_MASK 0x07 +#define T_PMIC_RST_DEB_10MS 0x00 +#define T_PMIC_RST_DEB_50MS 0x01 +#define T_PMIC_RST_DEB_100MS 0x02 +#define T_PMIC_RST_DEB_500MS 0x03 +#define T_PMIC_RST_DEB_1S 0x04 +#define T_PMIC_RST_DEB_2S 0x05 +#define T_PMIC_RST_DEB_4S 0x06 +#define T_PMIC_RST_DEB_8S 0x07/* PCA9450_REG_CONFIG2 bits */ #define I2C_LT_MASK 0x03
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/333 regulator: pca9450: Correct probed name for PCA9452
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 21b3fb7dc19caa488d285e3c47999f7f1a179334 ]
An incorrect device name was logged for PCA9452 because the dev_info() ternary omitted PCA9452 and fell through to "pca9450bc". Introduce a type_name and set it per device type so the probed message matches the actual PMIC. While here, make the PCA9451A case explicit.
No functional changes.
--- drivers/regulator/pca9450-regulator.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/regulator/pca9450-regulator.c +9 -3
@@ -1263,6 +1263,7 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)struct regulator_dev *ldo5;struct pca9450 *pca9450;unsigned int device_id, i; +const char *type_name;int ret; pca9450 =devm_kzalloc (&i2c->dev,sizeof (struct pca9450 ),GFP_KERNEL );
@@ -1273,15 +1274,22 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)case PCA9450_TYPE_PCA9450A : regulator_desc = pca9450a_regulators; pca9450->rcnt =ARRAY_SIZE (pca9450a_regulators); + type_name ="pca9450a" ;break ;case PCA9450_TYPE_PCA9450BC : regulator_desc = pca9450bc_regulators; pca9450->rcnt =ARRAY_SIZE (pca9450bc_regulators); + type_name ="pca9450bc" ;break ;case PCA9450_TYPE_PCA9451A : + regulator_desc = pca9451a_regulators; + pca9450->rcnt =ARRAY_SIZE (pca9451a_regulators); + type_name ="pca9451a" ; +break ;case PCA9450_TYPE_PCA9452 : regulator_desc = pca9451a_regulators; pca9450->rcnt =ARRAY_SIZE (pca9451a_regulators); + type_name ="pca9452" ;break ;default :dev_err (&i2c->dev,"Unknown device type" );
@@ -1383,9 +1391,7 @@ static int pca9450_i2c_probe(struct i2c_client *i2c) pca9450_i2c_restart_handler, pca9450))dev_warn (&i2c->dev,"Failed to register restart handler\n" ); -dev_info (&i2c->dev,"%s probed.\n" , - type ==PCA9450_TYPE_PCA9450A ?"pca9450a" : - (type ==PCA9450_TYPE_PCA9451A ?"pca9451a" :"pca9450bc" )); +dev_info (&i2c->dev,"%s probed.\n" , type_name);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/333 perf ftrace: Fix hashmap__new() error checking
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit be34705aa527872e5ce83927b7bc9307ba8095ca ]
The hashmap__new() function never returns NULL, it returns error pointers. Fix the error checking to match.
Additionally, set ftrace->profile_hash to NULL on error, and return the exact error code from hashmap__new().
--- tools/perf/builtin-ftrace.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
tools/perf/builtin-ftrace.c +7 -2
@@ -18,6 +18,7 @@#include <poll.h> #include <ctype.h> #include <linux/capability.h> +#include <linux/err.h> #include <linux/string.h> #include <sys/stat.h>
@@ -1209,8 +1210,12 @@ static int prepare_func_profile(struct perf_ftrace *ftrace) ftrace->graph_verbose =0 ; ftrace->profile_hash =hashmap__new (profile_hash, profile_equal,NULL ); -if (ftrace->profile_hash ==NULL ) -return -ENOMEM ; +if (IS_ERR (ftrace->profile_hash)) { +int err =PTR_ERR (ftrace->profile_hash); + + ftrace->profile_hash =NULL ; +return err; + }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/333 sched: idle: Make skipping governor callbacks more consistent
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit d557640e4ce589a24dca5ca7ce3b9680f471325f ]
If the cpuidle governor .select() callback is skipped because there is only one idle state in the cpuidle driver, the .reflect() callback should be skipped as well, at least for consistency (if not for correctness), so do it.
--- drivers/cpuidle/cpuidle.c | 10 ---------- kernel/sched/idle.c | 11 ++++++++++- 2 files changed, 10 insertions(+), 11 deletions(-)
drivers/cpuidle/cpuidle.c +0 -10
@@ -357,16 +357,6 @@ noinstr int cpuidle_enter_state(struct cpuidle_device *dev,int cpuidle_select (struct cpuidle_driver *drv,struct cpuidle_device *dev,bool *stop_tick) { -/* -* If there is only a single idle state (or none), there is nothing -* meaningful for the governor to choose. Skip the governor and -* always use state 0 with the tick running. -*/ -if (drv->state_count <=1 ) { - *stop_tick = false; -return 0 ; - } -return cpuidle_curr_governor->select (drv, dev, stop_tick); }
kernel/sched/idle.c +10 -1
@@ -219,7 +219,7 @@ static void cpuidle_idle_call(void) next_state =cpuidle_find_deepest_state (drv, dev, max_latency_ns);call_cpuidle (drv, dev, next_state); - }else { + }else if (drv->state_count >1 ) {bool stop_tick = true;/*
@@ -237,6 +237,15 @@ static void cpuidle_idle_call(void)* Give the governor an opportunity to reflect on the outcome */ cpuidle_reflect (dev, entered_state); + }else { +tick_nohz_idle_retain_tick (); + +/* +* If there is only a single idle state (or none), there is +* nothing meaningful for the governor to choose. Skip the +* governor and always use state 0. +*/ +call_cpuidle (drv, dev,0 ); } exit_idle:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/333 nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <[email protected]>
[ Upstream commit b4e78f1427c7d6859229ae9616df54e1fc05a516 ]
dev->online_queues is a count incremented in nvme_init_queue. Thus, valid indices are 0 through dev->online_queues − 1.
This patch fixes the loop condition to ensure the index stays within the valid range. Index 0 is excluded because it is the admin queue.
KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74 CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: nvme-reset-wq nvme_reset_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xce/0x5d0 mm/kasan/report.c:482 kasan_report+0xdc/0x110 mm/kasan/report.c:595 __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379 nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline] nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404 nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Allocated by task 34 on cpu 1 at 4.241550s: kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57 kasan_save_track+0x1c/0x70 mm/kasan/common.c:78 kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663 kmalloc_array_node_noprof include/linux/slab.h:1075 [inline] nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline] nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534 local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324 pci_call_probe drivers/pci/pci-driver.c:392 [inline] __pci_device_probe drivers/pci/pci-driver.c:417 [inline] pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451 call_driver_probe drivers/base/dd.c:583 [inline] really_probe+0x29b/0xb70 drivers/base/dd.c:661 __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803 driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833 __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159 async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff88800592a000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 244 bytes to the right of
allocated 1152-byte region [ffff88800592a000, ffff88800592a480)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff) page_type: f5(slab) raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000003 ffffea0000164a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800592a400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88800592a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800592a500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800592a580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800592a600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================--- drivers/nvme/host/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/pci.c +1 -1
@@ -388,7 +388,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)/* Free memory and continue on */ nvme_dbbuf_dma_free (dev); -for (i =1 ; i <= dev->online_queues; i++) +for (i =1 ; i < dev->online_queues; i++)nvme_dbbuf_free (&dev->queues[i]); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/333 nvme-pci: Fix race bug in nvme_poll_irqdisable()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungwoo Kim <[email protected]>
[ Upstream commit fc71f409b22ca831a9f87a2712eaa09ef2bb4a5e ]
In the following scenario, pdev can be disabled between (1) and (3) by (2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will return MSI-X IRQ(>15) for (1) whereas return INTx IRQ(<=15) for (2). This causes IRQ warning because it tries to enable INTx IRQ that has never been disabled before.
To fix this, save IRQ number into a local variable and ensure disable_irq() and enable_irq() operate on the same IRQ number. Even if pci_free_irq_vectors() frees the IRQ concurrently, disable_irq() and enable_irq() on a stale IRQ number is still valid and safe, and the depth accounting reamins balanced.
task 1:nvme_poll_irqdisable()
disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(1) enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)) ...(3)
task 2:nvme_reset_work()
nvme_dev_disable()
pdev->msix_enable = 0; ...(2)
crash log:
------------[ cut here ]------------ Unbalanced enable for IRQ 10 WARNING: kernel/irq/manage.c:753 at __enable_irq+0x102/0x190 kernel/irq/manage.c:753, CPU#1: kworker/1:0H/26 Modules linked in: CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.19.0-dirty #9 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:__enable_irq+0x107/0x190 kernel/irq/manage.c:753 Code: ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 79 48 8d 3d 2e 7a 3f 05 41 8b 74 24 2c <67> 48 0f b9 3a e8 ef b9 21 00 5b 41 5c 5d e9 46 54 66 03 e8 e1 b9 RSP: 0018:ffffc900001bf550 EFLAGS: 00010046 RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffb20c0e90 RDX: 0000000000000000 RSI: 000000000000000a RDI: ffffffffb74b88f0 RBP: ffffc900001bf560 R08: ffff88800197cf00 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000003 R12: ffff8880012a6000 R13: 1ffff92000037eae R14: 000000000000000a R15: 0000000000000293 FS: 0000000000000000(0000) GS:ffff8880b49f7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555da4a25fa8 CR3: 00000000208e8000 CR4: 00000000000006f0 Call Trace: <TASK> enable_irq+0x121/0x1e0 kernel/irq/manage.c:797 nvme_poll_irqdisable+0x162/0x1c0 drivers/nvme/host/pci.c:1494 nvme_timeout+0x965/0x14b0 drivers/nvme/host/pci.c:1744 blk_mq_rq_timed_out block/blk-mq.c:1653 [inline] blk_mq_handle_expired+0x227/0x2d0 block/blk-mq.c:1721 bt_iter+0x2fc/0x3a0 block/blk-mq-tag.c:292 __sbitmap_for_each_set include/linux/sbitmap.h:269 [inline] sbitmap_for_each_set include/linux/sbitmap.h:290 [inline] bt_for_each block/blk-mq-tag.c:324 [inline] blk_mq_queue_tag_busy_iter+0x969/0x1e80 block/blk-mq-tag.c:536 blk_mq_timeout_work+0x627/0x870 block/blk-mq.c:1763 process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x65c/0xe60 kernel/workqueue.c:3421 kthread+0x41a/0x930 kernel/kthread.c:463 ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> irq event stamp: 74478 hardirqs last enabled at (74477): [<ffffffffb5720a9c>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:159 [inline] hardirqs last enabled at (74477): [<ffffffffb5720a9c>] _raw_spin_unlock_irq+0x2c/0x60 kernel/locking/spinlock.c:202 hardirqs last disabled at (74478): [<ffffffffb57207b5>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (74478): [<ffffffffb57207b5>] _raw_spin_lock_irqsave+0x85/0xa0 kernel/locking/spinlock.c:162 softirqs last enabled at (74304): [<ffffffffb1e9466c>] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (74304): [<ffffffffb1e9466c>] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (74304): [<ffffffffb1e9466c>] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 softirqs last disabled at (74287): [<ffffffffb1e9466c>] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (74287): [<ffffffffb1e9466c>] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (74287): [<ffffffffb1e9466c>] __irq_exit_rcu+0xdc/0x120 kernel/softirq.c:723 ---[ end trace 0000000000000000 ]---
--- drivers/nvme/host/pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/nvme/host/pci.c +4 -2
@@ -1413,14 +1413,16 @@ static irqreturn_t nvme_irq_check(int irq, void *data)static void nvme_poll_irqdisable (struct nvme_queue *nvmeq) {struct pci_dev *pdev =to_pci_dev (nvmeq->dev->dev); +int irq;WARN_ON_ONCE (test_bit (NVMEQ_POLLED , &nvmeq->flags)); -disable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); + irq =pci_irq_vector (pdev, nvmeq->cq_vector); +disable_irq (irq);spin_lock (&nvmeq->cq_poll_lock);nvme_poll_cq (nvmeq,NULL );spin_unlock (&nvmeq->cq_poll_lock); -enable_irq (pci_irq_vector (pdev, nvmeq->cq_vector)); +enable_irq (irq); }static int nvme_poll (struct blk_mq_hw_ctx *hctx,struct io_comp_batch *iob)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/333 drivers: net: ice: fix devlink parameters get without irdma
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit bd98c6204d1195973b1760fe45860863deb6200c ]
If CONFIG_IRDMA isn't enabled but there are ice NICs in the system, the driver will prevent full devlink dev param show dump because its rdma get callbacks return ENODEV and stop the dump. For example:
$ devlink dev param show
pci/0000:82:00.0:
name msix_vec_per_pf_max type generic
values:
cmode driverinit value 2
name msix_vec_per_pf_min type generic
values:
cmode driverinit value 2
kernel answers: No such deviceReturning EOPNOTSUPP allows the dump to continue so we can see all devices' devlink parameters.
--- drivers/net/ethernet/intel/ice/devlink/devlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/devlink/devlink.c +2 -2
@@ -1357,7 +1357,7 @@ ice_devlink_enable_roce_get(struct devlink *devlink, u32 id, cdev = pf->cdev_info;if (!cdev) -return -ENODEV ; +return -EOPNOTSUPP ; ctx->val.vbool = !!(cdev->rdma_protocol &IIDC_RDMA_PROTOCOL_ROCEV2 );
@@ -1423,7 +1423,7 @@ ice_devlink_enable_iw_get(struct devlink *devlink, u32 id, cdev = pf->cdev_info;if (!cdev) -return -ENODEV ; +return -EOPNOTSUPP ; ctx->val.vbool = !!(cdev->rdma_protocol &IIDC_RDMA_PROTOCOL_IWARP );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/333 iavf: fix PTP use-after-free during reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit efc54fb13d79117a825fef17364315a58682c7ec ]
Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a worker to cache PHC time, but failed to stop it during reset or disable.
This creates a race condition where iavf_reset_task() or iavf_disable_vf() free adapter resources (AQ) while the worker is still running. If the worker triggers iavf_queue_ptp_cmd() during teardown, it accesses freed memory/locks, leading to a crash.
Fix this by calling iavf_ptp_release() before tearing down the adapter. This ensures ptp_clock_unregister() synchronously cancels the worker and cleans up the chardev before the backing resources are destroyed.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/iavf/iavf_main.c +4 -0
@@ -3040,6 +3040,8 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) adapter->flags |=IAVF_FLAG_PF_COMMS_FAILED ; +iavf_ptp_release (adapter); +/* We don't use netif_running() because it may be true prior to * ndo_open() returning, so we can't assume it means all our open * tasks have finished, since we're not holding the rtnl_lock here.
@@ -3215,6 +3217,8 @@ static void iavf_reset_task(struct work_struct *work)iavf_change_state (adapter, __IAVF_RESETTING); adapter->flags &= ~IAVF_FLAG_RESET_PENDING ; +iavf_ptp_release (adapter); +/* free the Tx/Rx rings and descriptors, might be better to just * re-use them sometime in the future */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/333 iavf: fix incorrect reset handling in callbacks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit fdadbf6e84c44df8dbb85cfdd38bc10e4431501d ]
Three driver callbacks schedule a reset and wait for its completion:ndo_change_mtu(), ethtool set_ringparam(), and ethtool set_channels().
Waiting for reset in ndo_change_mtu() and set_ringparam() was added by commit c2ed2403f12c ("iavf: Wait for reset in callbacks which trigger it") to fix a race condition where adding an interface to bonding immediately after MTU or ring parameter change failed because the interface was still in __RESETTING state. The same commit also added waiting in iavf_set_priv_flags(), which was later removed by commit 53844673d555 ("iavf: kill "legacy-rx" for good").
Waiting in set_channels() was introduced earlier by commit 4e5e6b5d9d13 ("iavf: Fix return of set the new channel count") to ensure the PF has enough time to complete the VF reset when changing channel count, and to return correct error codes to userspace.
Commit ef490bbb2267 ("iavf: Add net_shaper_ops support") added net_shaper_ops to iavf, which required reset_task to use _locked NAPI variants (napi_enable_locked, napi_disable_locked) that need the netdev instance lock.
Later, commit 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") and commit 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock") started holding the netdev instance lock during ndo and ethtool callbacks for drivers with net_shaper_ops.
Finally, commit 120f28a6f314 ("iavf: get rid of the crit lock") replaced the driver's crit_lock with netdev_lock in reset_task, causing incorrect behavior: the callback holds netdev_lock and waits for reset_task, but reset_task needs the same lock:
Thread 1 (callback) Thread 2 (reset_task) ------------------- --------------------- netdev_lock() [blocked on workqueue]
ndo_change_mtu() or ethtool op
iavf_schedule_reset()
iavf_wait_for_reset() iavf_reset_task()
waiting... netdev_lock() <- blocked
This does not strictly deadlock because iavf_wait_for_reset() uses wait_event_interruptible_timeout() with a 5-second timeout. The wait eventually times out, the callback returns an error to userspace, and after the lock is released reset_task completes the reset. This leads to incorrect behavior: userspace sees an error even though the configuration change silently takes effect after the timeout.
Fix this by extracting the reset logic from iavf_reset_task() into a new iavf_reset_step() function that expects netdev_lock to be already held. The three callbacks now call iavf_reset_step() directly instead of scheduling the work and waiting, performing the reset synchronously in the caller's context which already holds netdev_lock. This eliminates both the incorrect error reporting and the need for iavf_wait_for_reset(), which is removed along with the now-unused reset_waitqueue.
The workqueue-based iavf_reset_task() becomes a thin wrapper that acquires netdev_lock and calls iavf_reset_step(), preserving its use for PF-initiated resets.
The callbacks may block for several seconds while iavf_reset_step() polls hardware registers, but this is acceptable since netdev_lock is a per-device mutex and only serializes operations on the same interface.
v3:
- Remove netif_running() guard from iavf_set_channels(). Unlike set_ringparam where descriptor counts are picked up by iavf_open() directly, num_req_queues is only consumed during iavf_reinit_interrupt_scheme() in the reset path. Skipping the reset on a down device would silently discard the channel count change.
- Remove dead reset_waitqueue code (struct field, init, and all wake_up calls) since iavf_wait_for_reset() was the only consumer.
--- drivers/net/ethernet/intel/iavf/iavf.h | 3 +- .../net/ethernet/intel/iavf/iavf_ethtool.c | 19 ++--- drivers/net/ethernet/intel/iavf/iavf_main.c | 77 ++++++------------- .../net/ethernet/intel/iavf/iavf_virtchnl.c | 1 - 4 files changed, 31 insertions(+), 69 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +1 -2
@@ -260,7 +260,6 @@ struct iavf_adapter {struct work_struct adminq_task;struct work_struct finish_config;wait_queue_head_t down_waitqueue; -wait_queue_head_t reset_waitqueue;wait_queue_head_t vc_waitqueue;struct iavf_q_vector *q_vectors;struct list_head vlan_filter_list;
@@ -626,5 +625,5 @@ void iavf_add_adv_rss_cfg(struct iavf_adapter *adapter);void iavf_del_adv_rss_cfg (struct iavf_adapter *adapter);struct iavf_mac_filter *iavf_add_filter (struct iavf_adapter *adapter,const u8 *macaddr); -int iavf_wait_for_reset (struct iavf_adapter *adapter); +void iavf_reset_step (struct iavf_adapter *adapter);#endif /* _IAVF_H_ */
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +6 -13
@@ -492,7 +492,6 @@ static int iavf_set_ringparam(struct net_device *netdev, {struct iavf_adapter *adapter =netdev_priv (netdev);u32 new_rx_count, new_tx_count; -int ret =0 ;if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))return -EINVAL ;
@@ -537,13 +536,11 @@ static int iavf_set_ringparam(struct net_device *netdev, }if (netif_running (netdev)) { -iavf_schedule_reset (adapter,IAVF_FLAG_RESET_NEEDED ); - ret =iavf_wait_for_reset (adapter); -if (ret) -netdev_warn (netdev,"Changing ring parameters timeout or interrupted waiting for reset" ); + adapter->flags |=IAVF_FLAG_RESET_NEEDED ; +iavf_reset_step (adapter); } -return ret; +return 0 ; }/**
@@ -1625,7 +1622,6 @@ static int iavf_set_channels(struct net_device *netdev, {struct iavf_adapter *adapter =netdev_priv (netdev);u32 num_req = ch->combined_count; -int ret =0 ;if ((adapter->vf_res->vf_cap_flags &VIRTCHNL_VF_OFFLOAD_ADQ ) && adapter->num_tc) {
@@ -1647,13 +1643,10 @@ static int iavf_set_channels(struct net_device *netdev, adapter->num_req_queues = num_req; adapter->flags |=IAVF_FLAG_REINIT_ITR_NEEDED ; -iavf_schedule_reset (adapter,IAVF_FLAG_RESET_NEEDED ); + adapter->flags |=IAVF_FLAG_RESET_NEEDED ; +iavf_reset_step (adapter); - ret =iavf_wait_for_reset (adapter); -if (ret) -netdev_warn (netdev,"Changing channel count timeout or interrupted waiting for reset" ); - -return ret; +return 0 ; }/**
drivers/net/ethernet/intel/iavf/iavf_main.c +24 -53
144 lines not on this page · raw message
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +0 -1
@@ -2732,7 +2732,6 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,case VIRTCHNL_OP_ENABLE_QUEUES :/* enable transmits */ iavf_irq_enable (adapter, true); -wake_up (&adapter->reset_waitqueue); adapter->flags &= ~IAVF_FLAG_QUEUES_DISABLED ;break ;case VIRTCHNL_OP_DISABLE_QUEUES :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/333 i40e: fix src IP mask checks and memcpy argument names in cloud filter
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit e809085f492842ce7a519c9ef72d40f4bca89c13 ]
Fix following issues in the IPv4 and IPv6 cloud filter handling logic in both the add and delete paths:
- The source-IP mask check incorrectly compares mask.src_ip[0] against tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely goes unnoticed because the check is in an "else if" path that only executes when dst_ip is not set, most cloud filter use cases focus on destination-IP matching, and the buggy condition can accidentally evaluate true in some cases.
- memcpy() for the IPv4 source address incorrectly uses ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although both arrays are the same size.
- The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE (tcf.src_ip), Update these to use sizeof(cfilter->ip.v4.dst_ip) and sizeof(cfilter->ip.v4.src_ip) to ensure correct and explicit copy size.
- In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent explicit, even though both fields are struct in6_addr.
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +7 -7
@@ -3818,10 +3818,10 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg) cfilter.n_proto =ETH_P_IP ;if (mask.dst_ip[0 ] & tcf.dst_ip[0 ])memcpy (&cfilter.ip.v4.dst_ip, tcf.dst_ip, -ARRAY_SIZE (tcf.dst_ip)); -else if (mask.src_ip[0 ] & tcf.dst_ip[0 ]) +sizeof (cfilter.ip.v4.dst_ip)); +else if (mask.src_ip[0 ] & tcf.src_ip[0 ])memcpy (&cfilter.ip.v4.src_ip, tcf.src_ip, -ARRAY_SIZE (tcf.dst_ip)); +sizeof (cfilter.ip.v4.src_ip));break ;case VIRTCHNL_TCP_V6_FLOW : cfilter.n_proto =ETH_P_IPV6 ;
@@ -3876,7 +3876,7 @@ static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)/* for ipv6, mask is set for all sixteen bytes (4 words) */ if (cfilter.n_proto ==ETH_P_IPV6 && mask.dst_ip[3 ])if (memcmp (&cfilter.ip.v6.dst_ip6, &cf->ip.v6.dst_ip6, -sizeof (cfilter.ip.v6.src_ip6))) +sizeof (cfilter.ip.v6.dst_ip6)))continue ;if (mask.vlan_id)if (cfilter.vlan_id != cf->vlan_id)
@@ -3964,10 +3964,10 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) cfilter->n_proto =ETH_P_IP ;if (mask.dst_ip[0 ] & tcf.dst_ip[0 ])memcpy (&cfilter->ip.v4.dst_ip, tcf.dst_ip, -ARRAY_SIZE (tcf.dst_ip)); -else if (mask.src_ip[0 ] & tcf.dst_ip[0 ]) +sizeof (cfilter->ip.v4.dst_ip)); +else if (mask.src_ip[0 ] & tcf.src_ip[0 ])memcpy (&cfilter->ip.v4.src_ip, tcf.src_ip, -ARRAY_SIZE (tcf.dst_ip)); +sizeof (cfilter->ip.v4.src_ip));break ;case VIRTCHNL_TCP_V6_FLOW : cfilter->n_proto =ETH_P_IPV6 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/333 e1000/e1000e: Fix leak in DMA error cleanup
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Vollrath <[email protected]>
[ Upstream commit e94eaef11142b01f77bf8ba4d0b59720b7858109 ]
If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb.
Because count is incremented after a successful mapping, it will always match the correct number of unmappings needed when dma_error is reached. Decrementing count before the while loop in dma_error causes an off-by-one error. If any mapping was successful before an unsuccessful mapping, exactly one DMA mapping would leak.
In these commits, a faulty while condition caused an infinite loop in dma_error:
Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e driver")
Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")
Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()") fixed the infinite loop, but introduced the off-by-one error.
This issue may still exist in the igbvf driver, but I did not address it in this patch.
--- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 -- drivers/net/ethernet/intel/e1000e/netdev.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/ethernet/intel/e1000/e1000_main.c +0 -2
@@ -2952,8 +2952,6 @@ static int e1000_tx_map(struct e1000_adapter *adapter, dma_error:dev_err (&pdev->dev,"TX DMA map failed\n" ); buffer_info->dma =0 ; -if (count) - count--;while (count--) {if (i ==0 )
drivers/net/ethernet/intel/e1000e/netdev.c +0 -2
@@ -5654,8 +5654,6 @@ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb, dma_error:dev_err (&pdev->dev,"Tx DMA map failed\n" ); buffer_info->dma =0 ; -if (count) - count--;while (count--) {if (i ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/333 page_pool: store detach_time as ktime_t to avoid false-negatives
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 28b225282d44e2ef40e7f46cfdbd5d1b20b8874f ]
While testing other changes in vng I noticed that nl_netdev.page_pool_check flakes. This never happens in real CI.
Turns out vng may boot and get to that test in less than a second. page_pool_detached() records the detach time in seconds, so if vng is fast enough detach time is set to 0. Other code treats 0 as "not detached". detach_time is only used to report the state to the user, so it's not a huge deal in practice but let's fix it. Store the raw ktime_t (nanoseconds) instead. A nanosecond value of 0 is practically impossible.
--- include/net/page_pool/types.h | 2 +- net/core/page_pool_user.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
include/net/page_pool/types.h +1 -1
@@ -246,7 +246,7 @@ struct page_pool {/* User-facing fields, protected by page_pools_lock */ struct {struct hlist_node list; -u64 detach_time; +ktime_t detach_time;u32 id; } user; };
net/core/page_pool_user.c +2 -2
@@ -245,7 +245,7 @@ page_pool_nl_fill(struct sk_buff *rsp, const struct page_pool *pool, goto err_cancel;if (pool->user.detach_time &&nla_put_uint (rsp,NETDEV_A_PAGE_POOL_DETACH_TIME , - pool->user.detach_time)) +ktime_divns (pool->user.detach_time,NSEC_PER_SEC ))) goto err_cancel;if (pool->mp_ops && pool->mp_ops->nl_fill (pool->mp_priv, rsp,NULL ))
@@ -337,7 +337,7 @@ int page_pool_list(struct page_pool *pool)void page_pool_detached (struct page_pool *pool) {mutex_lock (&page_pools_lock); - pool->user.detach_time =ktime_get_boottime_seconds (); + pool->user.detach_time =ktime_get_boottime ();netdev_nl_page_pool_event (pool,NETDEV_CMD_PAGE_POOL_CHANGE_NTF );mutex_unlock (&page_pools_lock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/333 net: bcmgenet: fix broken EEE by converting to phylib-managed state
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Buchwitz <[email protected]>
[ Upstream commit 908c344d5cfac4160f49715da9efacdf5b6a28bd ]
The bcmgenet EEE implementation is broken in several ways. phy_support_eee() is never called, so the PHY never advertises EEE and phylib never sets phydev->enable_tx_lpi. bcmgenet_mac_config() checks priv->eee.eee_enabled to decide whether to enable the MAC LPI logic, but that field is never initialised to true, so the MAC never enters Low Power Idle even when EEE is negotiated - wasting the power savings EEE is designed to provide. The only way to get EEE working at all is a manual 'ethtool --set-eee eth0 eee on' after every link-up, and even then bcmgenet_get_eee() immediately clobbers the reported state because phy_ethtool_get_eee() overwrites eee_enabled and tx_lpi_enabled with the uninitialised PHY eee_cfg values. Finally, bcmgenet_mac_config() is only called on link-up, so EEE is never disabled in hardware on link-down.
Fix all of this by removing the MAC-side EEE state tracking (priv->eee) and aligning with the pattern used by other non-phylink MAC drivers such as FEC.
Call phy_support_eee() in bcmgenet_mii_probe() so the PHY advertises EEE link modes and phylib tracks negotiation state. Move the EEE hardware control to bcmgenet_mii_setup(), which is called on every link event, and drive it directly from phydev->enable_tx_lpi - the flag phylib sets when EEE is negotiated and the user has not disabled it. This enables EEE automatically once the link partner agrees and disables it cleanly on link-down.
Make bcmgenet_get_eee() and bcmgenet_set_eee() pure passthroughs to phy_ethtool_get_eee() and phy_ethtool_set_eee(), with the MAC hardware register read/written for tx_lpi_timer. Drop struct ethtool_keee eee from struct bcmgenet_priv.
--- .../net/ethernet/broadcom/genet/bcmgenet.c | 31 +++++++------------ .../net/ethernet/broadcom/genet/bcmgenet.h | 5 +-- drivers/net/ethernet/broadcom/genet/bcmmii.c | 10 +++--- 3 files changed, 18 insertions(+), 28 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +12 -19
@@ -1343,8 +1343,7 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev, } } -void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, -bool tx_lpi_enabled) +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable) {struct bcmgenet_priv *priv =netdev_priv (dev);u32 off = priv->hw_params->tbuf_offset +TBUF_ENERGY_CTRL ;
@@ -1364,7 +1363,7 @@ void bcmgenet_eee_enable_set(struct net_device *dev, bool enable,/* Enable EEE and switch to a 27Mhz clock automatically */ reg =bcmgenet_readl (priv->base + off); -if (tx_lpi_enabled) +if (enable) reg |=TBUF_EEE_EN |TBUF_PM_EN ;else reg &= ~(TBUF_EEE_EN |TBUF_PM_EN );
@@ -1383,14 +1382,12 @@ void bcmgenet_eee_enable_set(struct net_device *dev, bool enable, priv->clk_eee_enabled = false; } - priv->eee.eee_enabled = enable; - priv->eee.tx_lpi_enabled = tx_lpi_enabled; }static int bcmgenet_get_eee (struct net_device *dev,struct ethtool_keee *e) {struct bcmgenet_priv *priv =netdev_priv (dev); -struct ethtool_keee *p = &priv->eee; +int ret;if (GENET_IS_V1 (priv))return -EOPNOTSUPP ;
@@ -1398,17 +1395,21 @@ static int bcmgenet_get_eee(struct net_device *dev, struct ethtool_keee *e)if (!dev->phydev)return -ENODEV ; - e->tx_lpi_enabled = p->tx_lpi_enabled; + ret =phy_ethtool_get_eee (dev->phydev, e); +if (ret) +return ret; + +/* tx_lpi_timer is maintained by the MAC hardware register; the +* PHY-level eee_cfg timer is not set for GENET. +*/ e->tx_lpi_timer =bcmgenet_umac_readl (priv,UMAC_EEE_LPI_TIMER ); -return phy_ethtool_get_eee (dev->phydev, e); +return 0 ; }static int bcmgenet_set_eee (struct net_device *dev,struct ethtool_keee *e) {struct bcmgenet_priv *priv =netdev_priv (dev); -struct ethtool_keee *p = &priv->eee; -bool active;if (GENET_IS_V1 (priv))return -EOPNOTSUPP ;
@@ -1416,15 +1417,7 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_keee *e)if (!dev->phydev)return -ENODEV ; - p->eee_enabled = e->eee_enabled; - -if (!p->eee_enabled) { -bcmgenet_eee_enable_set (dev, false, false); - }else { - active =phy_init_eee (dev->phydev, false) >=0 ; -bcmgenet_umac_writel (priv, e->tx_lpi_timer,UMAC_EEE_LPI_TIMER ); -bcmgenet_eee_enable_set (dev, active, e->tx_lpi_enabled); - } +bcmgenet_umac_writel (priv, e->tx_lpi_timer,UMAC_EEE_LPI_TIMER );return phy_ethtool_set_eee (dev->phydev, e); }
drivers/net/ethernet/broadcom/genet/bcmgenet.h +1 -4
@@ -665,8 +665,6 @@ struct bcmgenet_priv {u8 sopass[SOPASS_MAX ];struct bcmgenet_mib_counters mib; - -struct ethtool_keee eee; };static inline bool bcmgenet_has_40bits (struct bcmgenet_priv *priv)
@@ -749,7 +747,6 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,int bcmgenet_wol_power_up_cfg (struct bcmgenet_priv *priv,enum bcmgenet_power_mode mode); -void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, -bool tx_lpi_enabled); +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable);#endif /* __BCMGENET_H__ */
drivers/net/ethernet/broadcom/genet/bcmmii.c +5 -5
@@ -30,7 +30,6 @@ static void bcmgenet_mac_config(struct net_device *dev)struct bcmgenet_priv *priv =netdev_priv (dev);struct phy_device *phydev = dev->phydev;u32 reg, cmd_bits =0 ; -bool active;/* speed */ if (phydev->speed ==SPEED_1000 )
@@ -91,10 +90,6 @@ static void bcmgenet_mac_config(struct net_device *dev)bcmgenet_umac_writel (priv, reg,UMAC_CMD );spin_unlock_bh (&priv->reg_lock); - active =phy_init_eee (phydev,0 ) >=0 ; -bcmgenet_eee_enable_set (dev, - priv->eee.eee_enabled && active, - priv->eee.tx_lpi_enabled); }/* setup netdev link state when PHY link status change and
@@ -114,6 +109,8 @@ void bcmgenet_mii_setup(struct net_device *dev)bcmgenet_ext_writel (priv, reg,EXT_RGMII_OOB_CTRL ); } +bcmgenet_eee_enable_set (dev, phydev->enable_tx_lpi); +phy_print_status (phydev); }
@@ -413,6 +410,9 @@ int bcmgenet_mii_probe(struct net_device *dev)/* Indicate that the MAC is responsible for PHY PM */ dev->phydev->mac_managed_pm = true; +if (!GENET_IS_V1 (priv)) +phy_support_eee (dev->phydev); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/333 ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit 393815f57651101f1590632092986d1d5a3a41bd ]
The pointer returned from acpi_os_map_generic_address() is tagged with __iomem, so make the rv it is returned to also of void __iomem * type.
Fixes the following sparse warning:
drivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)drivers/acpi/osl.c:1686:20: expected void *rvdrivers/acpi/osl.c:1686:20: got void [noderef] __iomem *
--- drivers/acpi/osl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/osl.c +1 -1
@@ -1681,7 +1681,7 @@ acpi_status __init acpi_os_initialize(void)* Use acpi_os_map_generic_address to pre-map the reset * register if it's in system memory. */ -void *rv; +void __iomem *rv; rv =acpi_os_map_generic_address (&acpi_gbl_FADT.reset_register); pr_debug("%s: Reset register mapping %s\n", __func__,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/333 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 53f3a900e9a383d47af7253076e19f510c5708d0 ]
The acp3x_5682_init() function did not check the return value of clk_get(), which could lead to dereferencing error pointers in rt5682_clk_enable().
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding proper IS_ERR() checks for both clock acquisitions.
--- sound/soc/amd/acp3x-rt5682-max9836.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/amd/acp3x-rt5682-max9836.c +7 -2
@@ -94,8 +94,13 @@ static int acp3x_5682_init(struct snd_soc_pcm_runtime *rtd)return ret; } - rt5682_dai_wclk =clk_get (component->dev,"rt5682-dai-wclk" ); - rt5682_dai_bclk =clk_get (component->dev,"rt5682-dai-bclk" ); + rt5682_dai_wclk =devm_clk_get (component->dev,"rt5682-dai-wclk" ); +if (IS_ERR (rt5682_dai_wclk)) +return PTR_ERR (rt5682_dai_wclk); + + rt5682_dai_bclk =devm_clk_get (component->dev,"rt5682-dai-bclk" ); +if (IS_ERR (rt5682_dai_bclk)) +return PTR_ERR (rt5682_dai_bclk); ret = snd_soc_card_jack_new_pins(card, "Headset Jack", SND_JACK_HEADSET |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/333 ASoC: detect empty DMI strings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Connolly <[email protected]>
[ Upstream commit a9683730e8b1d632674f81844ed03ddfbe4821c0 ]
Some bootloaders like recent versions of U-Boot may install some DMI properties with empty values rather than not populate them. This manages to make its way through the validator and cleanup resulting in a rogue hyphen being appended to the card longname.
--- sound/soc/soc-core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/soc-core.c +4 -1
@@ -1860,12 +1860,15 @@ static void cleanup_dmi_name(char *name)/* * Check if a DMI field is valid, i.e. not containing any string -* in the black list. +* in the black list and not the empty string. */ static int is_dmi_valid (const char *field) {int i =0 ; +if (!field[0 ]) +return 0 ; +while (dmi_blacklist[i]) {if (strstr (field, dmi_blacklist[i]))return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/333 drm/amdkfd: Unreserve bo if queue update failed
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit 2ce75a0b7e1bfddbcb9bc8aeb2e5e7fa99971acf ]
Error handling path should unreserve bo then return failed.
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -0
@@ -606,6 +606,7 @@ int pqm_update_queue_properties(struct process_queue_manager *pqm, p->queue_size)) {pr_debug ("ring buf 0x%llx size 0x%llx not mapped on GPU\n" , p->queue_address, p->queue_size); +amdgpu_bo_unreserve (vm->root.bo);return -EFAULT ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/333 perf synthetic-events: Fix stale build ID in module MMAP2 records
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 35b16a7a2c4fc458304447128b86514ce9f70f3c ]
perf_event__synthesize_modules() allocates a single union perf_event and reuses it across every kernel module callback.
After the first module is processed, perf_record_mmap2__read_build_id() sets PERF_RECORD_MISC_MMAP_BUILD_ID in header.misc and writes that module's build ID into the event.
On subsequent iterations the callback overwrites start, len, pid, and filename for the next module but never clears the stale build ID fields or the MMAP_BUILD_ID flag.
When perf_record_mmap2__read_build_id() runs for the second module it sees the flag, reads the stale build ID into a dso_id, and __dso__improve_id() permanently poisons the DSO with the wrong build ID.
Every module after the first therefore receives the first module's build ID in its MMAP2 record.
On a system with the sunrpc and nfsd modules loaded, this causes perf script and perf report to show [unknown] for all module symbols.
The latent bug has existed since commit d9f2ecbc5e47fca7 ("perf dso:
Move build_id to dso_id") introduced the PERF_RECORD_MISC_MMAP_BUILD_ID check in perf_record_mmap2__read_build_id().
Commit 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default") then exposed it to all users by making the MMAP2-with-build-ID path the default. Both commits were merged in the same series.
Clear the MMAP_BUILD_ID flag and zero the build_id union before each call to perf_record_mmap2__read_build_id() so that every module starts with a clean slate.
--- tools/perf/util/synthetic-events.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/perf/util/synthetic-events.c +5 -0
@@ -703,6 +703,11 @@ static int perf_event__synthesize_modules_maps_cb(struct map *map, void *data)memcpy (event->mmap2.filename,dso__long_name (dso),dso__long_name_len (dso) +1 ); +/* Clear stale build ID from previous module iteration */ + event->mmap2.header.misc &= ~PERF_RECORD_MISC_MMAP_BUILD_ID ; +memset (event->mmap2.build_id,0 ,sizeof (event->mmap2.build_id)); + event->mmap2.build_id_size =0 ; +perf_record_mmap2__read_build_id (&event->mmap2, args->machine, false); }else { size =PERF_ALIGN (dso__long_name_len (dso) +1 ,sizeof (u64));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/333 net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <[email protected]>
[ Upstream commit 30021e969d48e5819d5ae56936c2f34c0f7ce997 ]
When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().
BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().
--- drivers/net/bonding/bond_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +1 -1
@@ -3402,7 +3402,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond, }else if (is_arp) {return bond_arp_rcv (skb, bond, slave);#if IS_ENABLED (CONFIG_IPV6 ) - } else if (is_ipv6) { + } else if (is_ipv6 && likely(ipv6_mod_enabled())) {return bond_na_rcv (skb, bond, slave);#endif }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/333 net: dsa: realtek: Fix LED group port bit for non-zero LED group
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit e8f0dc024ce55451ebd54bad975134ba802e4fcc ]
The rtl8366rb_led_group_port_mask() function always returns LED port bit in LED group 0; the switch statement returns the same thing in all non-default cases.
This means that the driver does not currently support configuring LEDs in non-zero LED groups.
Fix this.
--- drivers/net/dsa/realtek/rtl8366rb-leds.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/dsa/realtek/rtl8366rb-leds.c +3 -3
@@ -12,11 +12,11 @@ static inline u32 rtl8366rb_led_group_port_mask(u8 led_group, u8 port)case 0 :return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port));case 1 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_X_1_CTRL_MASK ,BIT (port));case 2 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_2_X_CTRL_MASK ,BIT (port));case 3 : -return FIELD_PREP (RTL8366RB_LED_0_X_CTRL_MASK ,BIT (port)); +return FIELD_PREP (RTL8366RB_LED_X_3_CTRL_MASK ,BIT (port));default :return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/333 neighbour: restore protocol != 0 check in pneigh update
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit cbada1048847a348797aec63a1d8056621cbe653 ]
Prior to commit dc2a27e524ac ("neighbour: Update pneigh_entry in pneigh_create()."), a pneigh's protocol was updated only when the value of the NDA_PROTOCOL attribute was non-0. While moving the code, that check was removed. This is a small change of user-visible behavior, and inconsistent with the (non-proxy) neighbour behavior.
--- net/core/neighbour.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/neighbour.c +2 -1
@@ -821,7 +821,8 @@ int pneigh_create(struct neigh_table *tbl, struct net *net, update:WRITE_ONCE (n->flags, flags); n->permanent = permanent; -WRITE_ONCE (n->protocol, protocol); +if (protocol) +WRITE_ONCE (n->protocol, protocol); out:mutex_unlock (&tbl->phash_lock);return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/333 net/mana: Null service_wq on setup error to prevent double destroy
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shiraz Saleem <[email protected]>
[ Upstream commit 87c2302813abc55c46485711a678e3c312b00666 ]
In mana_gd_setup() error path, set gc->service_wq to NULL after destroy_workqueue() to match the cleanup in mana_gd_cleanup(). This prevents a use-after-free if the workqueue pointer is checked after a failed setup.
--- drivers/net/ethernet/microsoft/mana/gdma_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/microsoft/mana/gdma_main.c +1 -0
@@ -1854,6 +1854,7 @@ static int mana_gd_setup(struct pci_dev *pdev)mana_gd_remove_irqs (pdev); free_workqueue:destroy_workqueue (gc->service_wq); + gc->service_wq =NULL ;dev_err (&pdev->dev,"%s failed (error %d)\n" , __func__, err);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/333 net: ti: am65-cpsw: move hw timestamping to ndo callback
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <[email protected]>
[ Upstream commit ed5d5928bd54f66af19b71ad342ebf0947d50674 ]
Migrate driver to new API for HW timestamping.
Stable-dep-of: 840c9d13cb1c ("net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support")
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 44 +++++++++++------------- 1 file changed, 20 insertions(+), 24 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +20 -24
@@ -1788,28 +1788,28 @@ static int am65_cpsw_nuss_ndo_slave_set_mac_address(struct net_device *ndev, }static int am65_cpsw_nuss_hwtstamp_set (struct net_device *ndev, -struct ifreq *ifr) +struct kernel_hwtstamp_config *cfg, +struct netlink_ext_ack *extack) {struct am65_cpsw_port *port =am65_ndev_to_port (ndev);u32 ts_ctrl, seq_id, ts_ctrl_ltype2, ts_vlan_ltype; -struct hwtstamp_config cfg; -if (!IS_ENABLED (CONFIG_TI_K3_AM65_CPTS )) +if (!IS_ENABLED (CONFIG_TI_K3_AM65_CPTS )) { +NL_SET_ERR_MSG (extack,"Time stamping is not supported" );return -EOPNOTSUPP ; - -if (copy_from_user (&cfg, ifr->ifr_data,sizeof (cfg))) -return -EFAULT ; + }/* TX HW timestamp */ -switch (cfg.tx_type) { +switch (cfg->tx_type) {case HWTSTAMP_TX_OFF :case HWTSTAMP_TX_ON :break ;default : +NL_SET_ERR_MSG (extack,"TX mode is not supported" );return -ERANGE ; } -switch (cfg.rx_filter) { +switch (cfg->rx_filter) {case HWTSTAMP_FILTER_NONE : port->rx_ts_enabled = false;break ;
@@ -1826,17 +1826,19 @@ static int am65_cpsw_nuss_hwtstamp_set(struct net_device *ndev,case HWTSTAMP_FILTER_PTP_V2_SYNC :case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ : port->rx_ts_enabled = true; - cfg.rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT |HWTSTAMP_FILTER_PTP_V1_L4_EVENT ; + cfg->rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT |HWTSTAMP_FILTER_PTP_V1_L4_EVENT ;break ;case HWTSTAMP_FILTER_ALL :case HWTSTAMP_FILTER_SOME :case HWTSTAMP_FILTER_NTP_ALL : +NL_SET_ERR_MSG (extack,"RX filter is not supported" );return -EOPNOTSUPP ;default : +NL_SET_ERR_MSG (extack,"RX filter is not supported" );return -ERANGE ; } - port->tx_ts_enabled = (cfg.tx_type ==HWTSTAMP_TX_ON ); + port->tx_ts_enabled = (cfg->tx_type ==HWTSTAMP_TX_ON );/* cfg TX timestamp */ seq_id = (AM65_CPSW_TS_SEQ_ID_OFFSET <<
@@ -1872,25 +1874,24 @@ static int am65_cpsw_nuss_hwtstamp_set(struct net_device *ndev, AM65_CPSW_PORTN_REG_TS_CTL_LTYPE2);writel (ts_ctrl, port->port_base +AM65_CPSW_PORTN_REG_TS_CTL ); -return copy_to_user (ifr->ifr_data, &cfg,sizeof (cfg)) ? -EFAULT :0 ; +return 0 ; }static int am65_cpsw_nuss_hwtstamp_get (struct net_device *ndev, -struct ifreq *ifr) +struct kernel_hwtstamp_config *cfg) {struct am65_cpsw_port *port =am65_ndev_to_port (ndev); -struct hwtstamp_config cfg;if (!IS_ENABLED (CONFIG_TI_K3_AM65_CPTS ))return -EOPNOTSUPP ; - cfg.flags =0 ; - cfg.tx_type = port->tx_ts_enabled ? + cfg->flags =0 ; + cfg->tx_type = port->tx_ts_enabled ?HWTSTAMP_TX_ON :HWTSTAMP_TX_OFF ; - cfg.rx_filter = port->rx_ts_enabled ?HWTSTAMP_FILTER_PTP_V2_EVENT | + cfg->rx_filter = port->rx_ts_enabled ?HWTSTAMP_FILTER_PTP_V2_EVENT |HWTSTAMP_FILTER_PTP_V1_L4_EVENT :HWTSTAMP_FILTER_NONE ; -return copy_to_user (ifr->ifr_data, &cfg,sizeof (cfg)) ? -EFAULT :0 ; +return 0 ; } static int am65_cpsw_nuss_ndo_slave_ioctl(struct net_device *ndev,
@@ -1901,13 +1902,6 @@ static int am65_cpsw_nuss_ndo_slave_ioctl(struct net_device *ndev,if (!netif_running (ndev))return -EINVAL ; -switch (cmd) { -case SIOCSHWTSTAMP : -return am65_cpsw_nuss_hwtstamp_set (ndev, req); -case SIOCGHWTSTAMP : -return am65_cpsw_nuss_hwtstamp_get (ndev, req); - } -return phylink_mii_ioctl (port->slave.phylink, req, cmd); }
@@ -1991,6 +1985,8 @@ static const struct net_device_ops am65_cpsw_nuss_netdev_ops = { .ndo_set_tx_maxrate = am65_cpsw_qos_ndo_tx_p0_set_maxrate, .ndo_bpf = am65_cpsw_ndo_bpf, .ndo_xdp_xmit = am65_cpsw_ndo_xdp_xmit, + .ndo_hwtstamp_get = am65_cpsw_nuss_hwtstamp_get, + .ndo_hwtstamp_set = am65_cpsw_nuss_hwtstamp_set, };static void am65_cpsw_disable_phy (struct phy *phy)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/333 net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chintan Vankar <[email protected]>
[ Upstream commit 840c9d13cb1ca96683a5307ee8e221be163a2c1e ]
The "rx_filter" member of "hwtstamp_config" structure is an enum field and does not support bitwise OR combination of multiple filter values. It causes error while linuxptp application tries to match rx filter version. Fix this by storing the requested filter type in a new port field.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 16 +++++++++------- drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 +- 2 files changed, 10 insertions(+), 8 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +9 -7
@@ -1351,7 +1351,7 @@ static int am65_cpsw_nuss_rx_packets(struct am65_cpsw_rx_flow *flow, ndev_priv =netdev_priv (ndev);am65_cpsw_nuss_set_offload_fwd_mark (skb, ndev_priv->offload_fwd_mark);skb_put (skb, pkt_len); -if (port->rx_ts_enabled) +if (port->rx_ts_filter)am65_cpts_rx_timestamp (common->cpts, skb);skb_mark_for_recycle (skb); skb->protocol =eth_type_trans (skb, ndev);
@@ -1811,11 +1811,14 @@ static int am65_cpsw_nuss_hwtstamp_set(struct net_device *ndev,switch (cfg->rx_filter) {case HWTSTAMP_FILTER_NONE : - port->rx_ts_enabled = false; + port->rx_ts_filter =HWTSTAMP_FILTER_NONE ;break ;case HWTSTAMP_FILTER_PTP_V1_L4_EVENT :case HWTSTAMP_FILTER_PTP_V1_L4_SYNC :case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ : + port->rx_ts_filter =HWTSTAMP_FILTER_PTP_V1_L4_EVENT ; + cfg->rx_filter =HWTSTAMP_FILTER_PTP_V1_L4_EVENT ; +break ;case HWTSTAMP_FILTER_PTP_V2_L4_EVENT :case HWTSTAMP_FILTER_PTP_V2_L4_SYNC :case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ :
@@ -1825,8 +1828,8 @@ static int am65_cpsw_nuss_hwtstamp_set(struct net_device *ndev,case HWTSTAMP_FILTER_PTP_V2_EVENT :case HWTSTAMP_FILTER_PTP_V2_SYNC :case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ : - port->rx_ts_enabled = true; - cfg->rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT |HWTSTAMP_FILTER_PTP_V1_L4_EVENT ; + port->rx_ts_filter =HWTSTAMP_FILTER_PTP_V2_EVENT ; + cfg->rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT ;break ;case HWTSTAMP_FILTER_ALL :case HWTSTAMP_FILTER_SOME :
@@ -1863,7 +1866,7 @@ static int am65_cpsw_nuss_hwtstamp_set(struct net_device *ndev, ts_ctrl |=AM65_CPSW_TS_TX_ANX_ALL_EN |AM65_CPSW_PN_TS_CTL_TX_VLAN_LT1_EN ; -if (port->rx_ts_enabled) +if (port->rx_ts_filter) ts_ctrl |=AM65_CPSW_TS_RX_ANX_ALL_EN |AM65_CPSW_PN_TS_CTL_RX_VLAN_LT1_EN ;
@@ -1888,8 +1891,7 @@ static int am65_cpsw_nuss_hwtstamp_get(struct net_device *ndev, cfg->flags =0 ; cfg->tx_type = port->tx_ts_enabled ?HWTSTAMP_TX_ON :HWTSTAMP_TX_OFF ; - cfg->rx_filter = port->rx_ts_enabled ?HWTSTAMP_FILTER_PTP_V2_EVENT | -HWTSTAMP_FILTER_PTP_V1_L4_EVENT :HWTSTAMP_FILTER_NONE ; + cfg->rx_filter = port->rx_ts_filter;return 0 ; }
drivers/net/ethernet/ti/am65-cpsw-nuss.h +1 -1
@@ -52,7 +52,7 @@ struct am65_cpsw_port {bool disabled;struct am65_cpsw_slave_data slave;bool tx_ts_enabled; -bool rx_ts_enabled; +enum hwtstamp_rx_filters rx_ts_filter;struct am65_cpsw_qos qos;struct devlink_port devlink_port;struct bpf_prog *xdp_prog;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/333 octeontx2-af: devlink: fix NIX RAS reporter recovery condition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit dc26ca99b835e21e76a58b1463b84adb0ca34f58 ]
The NIX RAS health reporter recovery routine checks nix_af_rvu_int to decide whether to re-enable NIX_AF_RAS interrupts. This is the RVU interrupt status field and is unrelated to RAS events, so the recovery flow may incorrectly skip re-enabling NIX_AF_RAS interrupts.
Check nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +1 -1
@@ -475,7 +475,7 @@ static int rvu_hw_nix_ras_recover(struct devlink_health_reporter *reporter,if (blkaddr <0 )return blkaddr; -if (nix_event_ctx->nix_af_rvu_int) +if (nix_event_ctx->nix_af_rvu_ras)rvu_write64 (rvu, blkaddr,NIX_AF_RAS_ENA_W1S , ~0ULL );return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/333 octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 87f7dff3ec75b91def0024ebaaf732457f47a63b ]
The NIX RAS health report path uses nix_af_rvu_err when handling the NIX_AF_RVU_RAS case, so the report prints the ERR interrupt status rather than the RAS interrupt status.
Use nix_af_rvu_ras for the NIX_AF_RVU_RAS report.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +2 -2
@@ -327,10 +327,10 @@ static int rvu_nix_report_show(struct devlink_fmsg *fmsg, void *ctx,rvu_report_pair_end (fmsg);break ;case NIX_AF_RVU_RAS : - intr_val = nix_event_context->nix_af_rvu_err; + intr_val = nix_event_context->nix_af_rvu_ras;rvu_report_pair_start (fmsg,"NIX_AF_RAS" );devlink_fmsg_u64_pair_put (fmsg,"\tNIX RAS Interrupt Reg " , - nix_event_context->nix_af_rvu_err); + nix_event_context->nix_af_rvu_ras);devlink_fmsg_string_put (fmsg,"\n\tPoison Data on:" );if (intr_val &BIT_ULL (34 ))devlink_fmsg_string_put (fmsg,"\n\tNIX_AQ_INST_S" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/333 net: prevent NULL deref in ip[6]tunnel_xmit()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c38b8f5f791ecce13ab77e2257f8fd2444ba80f6 ]
Blamed commit missed that both functions can be called with dev == NULL.
Also add unlikely() hints for these conditions that only fuzzers can hit.
--- include/net/ip6_tunnel.h | 10 ++++++---- net/ipv4/ip_tunnel_core.c | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-)
include/net/ip6_tunnel.h +6 -4
@@ -156,10 +156,12 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, {int pkt_len, err; -if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { -net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , - dev->name); -DEV_STATS_INC (dev, tx_errors); +if (unlikely (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT )) { +if (dev) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); + }kfree_skb (skb);return ; }
net/ipv4/ip_tunnel_core.c +6 -4
@@ -58,10 +58,12 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,struct iphdr *iph;int err; -if (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT ) { -net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , - dev->name); -DEV_STATS_INC (dev, tx_errors); +if (unlikely (dev_recursion_level () >IP_TUNNEL_RECURSION_LIMIT )) { +if (dev) { +net_crit_ratelimited ("Dead loop on virtual device %s, fix it urgently!\n" , + dev->name); +DEV_STATS_INC (dev, tx_errors); + }ip_rt_put (rt);kfree_skb (skb);return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/333 iio: imu: inv-mpu9150: fix irq ack preventing irq storms
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <[email protected]>
[ Upstream commit d23d763e00ace4e9c59f8d33e0713d401133ba88 ]
IRQ needs to be acked. for some odd reasons, reading from irq status does not reliable help, enable acking from any register to be on the safe side and read the irq status register. Comments in the code indicate a known unreliability with that register.
The blamed commit was tested with mpu6050 in lg,p895 and lg,p880 according to Tested-bys. But with the MPU9150 in the Epson Moverio BT-200 this leads to irq storms without properly acking the irq.
--- drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 8 ++++++++ drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 2 ++ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 ++++- 3 files changed, 14 insertions(+), 1 deletion(-)
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +8 -0
@@ -1943,6 +1943,14 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name, irq_type);return -EINVAL ; } + +/* +* Acking interrupts by status register does not work reliably +* but seem to work when this bit is set. +*/ +if (st->chip_type ==INV_MPU9150 ) + st->irq_mask |=INV_MPU6050_INT_RD_CLEAR ; +device_set_wakeup_capable (dev, true); st->vdd_supply =devm_regulator_get (dev,"vdd" );
drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h +2 -0
@@ -390,6 +390,8 @@ struct inv_mpu6050_state {/* enable level triggering */ #define INV_MPU6050_LATCH_INT_EN 0x20#define INV_MPU6050_BIT_BYPASS_EN 0x2 +/* allow acking interrupts by any register read */ +#define INV_MPU6050_INT_RD_CLEAR 0x10/* Allowed timestamp period jitter in percent */ #define INV_MPU6050_TS_PERIOD_JITTER 4
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +4 -1
@@ -248,7 +248,6 @@ static irqreturn_t inv_mpu6050_interrupt_handle(int irq, void *p)switch (st->chip_type) {case INV_MPU6000 :case INV_MPU6050 : -case INV_MPU9150 :/* * WoM is not supported and interrupt status read seems to be broken for * some chips. Since data ready is the only interrupt, bypass interrupt
@@ -257,6 +256,10 @@ static irqreturn_t inv_mpu6050_interrupt_handle(int irq, void *p) wom_bits =0 ; int_status =INV_MPU6050_BIT_RAW_DATA_RDY_INT ; goto data_ready_interrupt; +case INV_MPU9150 : +/* IRQ needs to be acked */ + wom_bits =0 ; +break ;case INV_MPU6500 :case INV_MPU6515 :case INV_MPU6880 :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/333 usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 ]
The check_command_size_in_blocks() function calculates the data size in bytes by left shifting common->data_size_from_cmnd by the block size (common->curlun->blkbits). However, it does not validate whether this shift operation will cause an integer overflow.
Initially, the block size is set up in fsg_lun_open() , and the common->data_size_from_cmnd is set up in do_scsi_command(). During initialization, there is no integer overflow check for the interaction between two variables.
So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (common->data_size_from_cmnd), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses.
Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.
--- drivers/usb/gadget/function/f_mass_storage.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_mass_storage.c +10 -2
@@ -180,6 +180,7 @@#include <linux/kthread.h> #include <linux/sched/signal.h> #include <linux/limits.h> +#include <linux/overflow.h> #include <linux/pagemap.h> #include <linux/rwsem.h> #include <linux/slab.h>
@@ -1853,8 +1854,15 @@ static int check_command_size_in_blocks(struct fsg_common *common, int cmnd_size, enum data_direction data_dir, unsigned int mask, int needs_medium, const char *name) { - if (common->curlun) - common->data_size_from_cmnd <<= common->curlun->blkbits; + if (common->curlun) { + if (check_shl_overflow(common->data_size_from_cmnd, + common->curlun->blkbits, + &common->data_size_from_cmnd)) { + common->phase_error = 1; +return -EINVAL ; + } + } +return check_command (common, cmnd_size, data_dir, mask, needs_medium, name); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/333 drm/amdgpu: ensure no_hw_access is visible before MMIO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Perry Yuan <[email protected]>
commit 31b153315b8702d0249aa44d83d9fbf42c5c7a79 upstream.
Add a full memory barrier after clearing no_hw_access in amdgpu_device_mode1_reset() so subsequent PCI state restore access cannot observe stale state on other CPUs.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +3 -0
@@ -5743,6 +5743,9 @@ int amdgpu_device_mode1_reset(struct amd/* enable mmio access after mode 1 reset completed */ adev->no_hw_access = false; +/* ensure no_hw_access is updated before we access hw */ +smp_mb (); +amdgpu_device_load_pci_state (adev->pdev); ret =amdgpu_psp_wait_for_bootloader (adev);if (ret)
Greg Kroah-Hartman
maintainerPATCH 105/333 cgroup: fix race between task migration and iteration
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingye Zhao <[email protected]>
commit 5ee01f1a7343d6a3547b6802ca2d4cdce0edacb1 upstream.
When a task is migrated out of a css_set, cgroup_migrate_add_task() first moves it from cset->tasks to cset->mg_tasks via:
list_move_tail(&task->cg_list, &cset->mg_tasks);
If a css_task_iter currently has it->task_pos pointing to this task, css_set_move_task() calls css_task_iter_skip() to keep the iterator valid. However, since the task has already been moved to ->mg_tasks, the iterator is advanced relative to the mg_tasks list instead of the original tasks list. As a result, remaining tasks on cset->tasks, as well as tasks queued on cset->mg_tasks, can be skipped by iteration.
Fix this by calling css_set_skip_task_iters() before unlinking task->cg_list from cset->tasks. This advances all active iterators to the next task on cset->tasks, so iteration continues correctly even when a task is concurrently being migrated.
This race is hard to hit in practice without instrumentation, but it can be reproduced by artificially slowing down cgroup_procs_show(). For example, on an Android device a temporary /sys/kernel/cgroup/cgroup_test knob can be added to inject a delay into cgroup_procs_show(), and then:
1) Spawn three long-running tasks (PIDs 101, 102, 103).
2) Create a test cgroup and move the tasks into it.
3) Enable a large delay via /sys/kernel/cgroup/cgroup_test.
4) In one shell, read cgroup.procs from the test cgroup.
5) Within the delay window, in another shell migrate PID 102 by writing it to a different cgroup.procs file.
Under this setup, cgroup.procs can intermittently show only PID 101 while skipping PID 103. Once the migration completes, reading the file again shows all tasks as expected.
Note that this change does not allow removing the existing css_set_skip_task_iters() call in css_set_move_task(). The new call in cgroup_migrate_add_task() only handles iterators that are racing with migration while the task is still on cset->tasks. Iterators may also start after the task has been moved to cset->mg_tasks. If we dropped css_set_skip_task_iters() from css_set_move_task(), such iterators could keep task_pos pointing to a migrating task, causing css_task_iter_advance() to malfunction on the destination css_set, up to and including crashes or infinite loops.
The race window between migration and iteration is very small, and css_task_iter is not on a hot path. In the worst case, when an iterator is positioned on the first thread of the migrating process, cgroup_migrate_add_task() may have to skip multiple tasks via css_set_skip_task_iters(). However, this only happens when migration and iteration actually race, so the performance impact is negligible compared to the correctness fix provided here.
--- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+)
kernel/cgroup/cgroup.c +1 -0
@@ -2611,6 +2611,7 @@ static void cgroup_migrate_add_task(stru mgctx->tset.nr_tasks++; +css_set_skip_task_iters (cset, task);list_move_tail (&task->cg_list, &cset->mg_tasks);if (list_empty (&cset->mg_node)) list_add_tail(&cset->mg_node,
Greg Kroah-Hartman
maintainerPATCH 106/333 sched_ext: Remove redundant css_put() in scx_cgroup_init()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng-Yang Chou <[email protected]>
commit 1336b579f6079fb8520be03624fcd9ba443c930b upstream.
The iterator css_for_each_descendant_pre() walks the cgroup hierarchy under cgroup_lock(). It does not increment the reference counts on yielded css structs.
According to the cgroup documentation, css_put() should only be used to release a reference obtained via css_get() or css_tryget_online(). Since the iterator does not use either of these to acquire a reference, calling css_put() in the error path of scx_cgroup_init() causes a refcount underflow.
Remove the unbalanced css_put() to prevent a potential Use-After-Free (UAF) vulnerability.
--- kernel/sched/ext.c | 1 - 1 file changed, 1 deletion(-)
kernel/sched/ext.c +0 -1
@@ -3450,7 +3450,6 @@ static int scx_cgroup_init(struct scx_sc ret =SCX_CALL_OP_RET (sch,SCX_KF_UNLOCKED , cgroup_init,NULL , css->cgroup, &args);if (ret) { -css_put (css);scx_error (sch,"ops.cgroup_init() failed (%d)" , ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 107/333 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehul Rao <[email protected]>
commit 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 upstream.
In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime.
A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer.
Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released.
--- sound/core/pcm_native.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
sound/core/pcm_native.c +16 -3
@@ -2144,6 +2144,10 @@ static int snd_pcm_drain(struct snd_pcm_for (;;) {long tout;struct snd_pcm_runtime *to_check; +unsigned int drain_rate; +snd_pcm_uframes_t drain_bufsz; +bool drain_no_period_wakeup; +if (signal_pending (current)) { result = -ERESTARTSYS ;break ;
@@ -2163,16 +2167,25 @@ static int snd_pcm_drain(struct snd_pcm_snd_pcm_group_unref (group, substream);if (!to_check)break ;/* all drained */ +/* +* Cache the runtime fields needed after unlock. +* A concurrent close() on the linked stream may free +* its runtime via snd_pcm_detach_substream() once we +* release the stream lock below. +*/ + drain_no_period_wakeup = to_check->no_period_wakeup; + drain_rate = to_check->rate; + drain_bufsz = to_check->buffer_size;init_waitqueue_entry (&wait, current);set_current_state (TASK_INTERRUPTIBLE );add_wait_queue (&to_check->sleep, &wait);snd_pcm_stream_unlock_irq (substream); -if (runtime->no_period_wakeup) +if (drain_no_period_wakeup) tout =MAX_SCHEDULE_TIMEOUT ;else { tout =100 ; -if (runtime->rate) { -long t = runtime->buffer_size *1100 / runtime->rate; +if (drain_rate) { +long t = drain_bufsz *1100 / drain_rate; tout =max (t, tout); } tout =msecs_to_jiffies (tout);
Greg Kroah-Hartman
maintainerPATCH 108/333 ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit df1d8abf36ca3681c21a6809eaa9a1e01ef897a6 upstream.
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2_find_fc_interface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.
--- sound/usb/mixer_scarlett2.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer_scarlett2.c +2 -0
@@ -8251,6 +8251,8 @@ static int scarlett2_find_fc_interface(sif (desc->bInterfaceClass !=255 )continue ; +if (desc->bNumEndpoints <1 ) +continue ; epd =get_endpoint (intf->altsetting,0 ); private->bInterfaceNumber = desc->bInterfaceNumber;
Greg Kroah-Hartman
maintainerPATCH 109/333 can: gs_usb: gs_can_open(): always configure bitrates before starting device
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 2df6162785f31f1bbb598cfc3b08e4efc88f80b6 upstream.
So far the driver populated the struct can_priv::do_set_bittiming() and struct can_priv::fd::do_set_data_bittiming() callbacks.
Before bringing up the interface, user space has to configure the bitrates. With these callbacks the configuration is directly forwarded into the CAN hardware. Then the interface can be brought up.
An ifdown-ifup cycle (without changing the bit rates) doesn't re-configure the bitrates in the CAN hardware. This leads to a problem with the CANable-2.5 [1] firmware, which resets the configured bit rates during ifdown.
To fix the problem remove both bit timing callbacks and always configure the bitrates in the struct net_device_ops::ndo_open() callback.
[1] https://github.com/Elmue/CANable-2.5-firmware-Slcan-and-Candlelight
--- drivers/net/can/usb/gs_usb.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
drivers/net/can/usb/gs_usb.c +16 -6
@@ -772,9 +772,8 @@ device_detach: } } -static int gs_usb_set_bittiming (struct net_device *netdev) +static int gs_usb_set_bittiming (struct gs_can *dev) { -struct gs_can *dev =netdev_priv (netdev);struct can_bittiming *bt = &dev->can.bittiming;struct gs_device_bittiming dbt = { .prop_seg =cpu_to_le32 (bt->prop_seg),
@@ -791,9 +790,8 @@ static int gs_usb_set_bittiming(struct n GFP_KERNEL); } -static int gs_usb_set_data_bittiming (struct net_device *netdev) +static int gs_usb_set_data_bittiming (struct gs_can *dev) { -struct gs_can *dev =netdev_priv (netdev);struct can_bittiming *bt = &dev->can.fd.data_bittiming;struct gs_device_bittiming dbt = { .prop_seg =cpu_to_le32 (bt->prop_seg),
@@ -1057,6 +1055,20 @@ static int gs_can_open(struct net_deviceif (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) flags |=GS_CAN_MODE_HW_TIMESTAMP ; + rc =gs_usb_set_bittiming (dev); +if (rc) { +netdev_err (netdev,"failed to set bittiming: %pe\n" ,ERR_PTR (rc)); + goto out_usb_kill_anchored_urbs; + } + +if (ctrlmode &CAN_CTRLMODE_FD ) { + rc =gs_usb_set_data_bittiming (dev); +if (rc) { +netdev_err (netdev,"failed to set data bittiming: %pe\n" ,ERR_PTR (rc)); + goto out_usb_kill_anchored_urbs; + } + } +/* finally start device */ dev->can.state =CAN_STATE_ERROR_ACTIVE ; dm.flags =cpu_to_le32 (flags);
@@ -1357,7 +1369,6 @@ static struct gs_can *gs_make_candev(uns dev->can.state =CAN_STATE_STOPPED ; dev->can.clock.freq =le32_to_cpu (bt_const.fclk_can); dev->can.bittiming_const = &dev->bt_const; - dev->can.do_set_bittiming = gs_usb_set_bittiming; dev->can.ctrlmode_supported =CAN_CTRLMODE_CC_LEN8_DLC ;
@@ -1381,7 +1392,6 @@ static struct gs_can *gs_make_candev(uns* GS_CAN_FEATURE_BT_CONST_EXT is set. */ dev->can.fd.data_bittiming_const = &dev->bt_const; - dev->can.fd.do_set_data_bittiming = gs_usb_set_data_bittiming; }if (feature &GS_CAN_FEATURE_TERMINATION ) {
Greg Kroah-Hartman
maintainerPATCH 110/333 net: usb: lan78xx: fix silent drop of packets with checksum errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit e4f774a0cc955ce762aec91c66915a6e15087ab7 upstream.
Do not drop packets with checksum errors at the USB driver level; pass them to the network stack.
Previously, the driver dropped all packets where the 'Receive Error Detected' (RED) bit was set, regardless of the specific error type. This caused packets with only IP or TCP/UDP checksum errors to be dropped before reaching the kernel, preventing the network stack from accounting for them or performing software fallback.
Add a mask for hard hardware errors to safely drop genuinely corrupt frames, while allowing checksum-errored frames to pass with their ip_summed field explicitly set to CHECKSUM_NONE.
--- drivers/net/usb/lan78xx.c | 4 +++- drivers/net/usb/lan78xx.h | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +3 -1
@@ -3829,6 +3829,7 @@ static void lan78xx_rx_csum_offload(stru*/ if (!(dev->net->features &NETIF_F_RXCSUM ) ||unlikely (rx_cmd_a &RX_CMD_A_ICSM_ ) || +unlikely (rx_cmd_a &RX_CMD_A_CSE_MASK_ ) || ((rx_cmd_a &RX_CMD_A_FVTG_ ) && !(dev->net->features &NETIF_F_HW_VLAN_CTAG_RX ))) { skb->ip_summed =CHECKSUM_NONE ;
@@ -3901,7 +3902,8 @@ static int lan78xx_rx(struct lan78xx_netreturn 0 ; } -if (unlikely (rx_cmd_a &RX_CMD_A_RED_ )) { +if (unlikely (rx_cmd_a &RX_CMD_A_RED_ ) && + (rx_cmd_a &RX_CMD_A_RX_HARD_ERRS_MASK_ )) {netif_dbg (dev, rx_err, dev->net,"Error rx_cmd_a=0x%08x" , rx_cmd_a); }else {
drivers/net/usb/lan78xx.h +3 -0
@@ -74,6 +74,9 @@#define RX_CMD_A_ICSM_ (0x00004000)#define RX_CMD_A_LEN_MASK_ (0x00003FFF) +#define RX_CMD_A_RX_HARD_ERRS_MASK_ \ + (RX_CMD_A_RX_ERRS_MASK_ & ~RX_CMD_A_CSE_MASK_) +/* Rx Command B */ #define RX_CMD_B_CSUM_SHIFT_ (16)#define RX_CMD_B_CSUM_MASK_ (0xFFFF0000)
Greg Kroah-Hartman
maintainerPATCH 111/333 net: usb: lan78xx: fix TX byte statistics for small packets
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 50988747c30df47b73b787f234f746027cb7ec6c upstream.
Account for hardware auto-padding in TX byte counters to reflect actual wire traffic.
The LAN7850 hardware automatically pads undersized frames to the minimum Ethernet frame length (ETH_ZLEN, 60 bytes). However, the driver tracks the network statistics based on the unpadded socket buffer length. This results in the tx_bytes counter under-reporting the actual physical bytes placed on the Ethernet wire for small packets (like short ARP or ICMP requests).
Use max_t() to ensure the transmission statistics accurately account for the hardware-generated padding.
--- drivers/net/usb/lan78xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +1 -1
@@ -4178,7 +4178,7 @@ static struct skb_data *lan78xx_tx_buf_f } tx_data += len; - entry->length += len; + entry->length += max_t(unsigned int, len, ETH_ZLEN); entry->num_of_packet +=skb_shinfo (skb)->gso_segs ?:1 ;dev_kfree_skb_any (skb);
Greg Kroah-Hartman
maintainerPATCH 112/333 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 312c816c6bc30342bc30dca0d6db617ab4d3ae4e upstream.
Remove redundant netif_napi_del() call from disconnect path.
A WARN may be triggered in __netif_napi_del_locked() during USB device disconnect:
WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350
This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_del() explicitly, since unregister_netdev() will handle NAPI teardown automatically and safely. Removing the redundant call avoids triggering the warning.
Full trace:
lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV lan78xx 1-1:1.0 enu1: Link is Down
lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV
------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 Modules linked in: flexcan can_dev fuse CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT Hardware name: SKOV IMX8MP CPU revC - bd500 (DT) Workqueue: usb_hub_wq hub_event pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __netif_napi_del_locked+0x2b4/0x350 lr : __netif_napi_del_locked+0x7c/0x350 sp : ffffffc085b673c0 x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8 x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000 x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000 x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028 x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8 x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000 x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001 x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000 Call trace: __netif_napi_del_locked+0x2b4/0x350 (P) lan78xx_disconnect+0xf4/0x360 usb_unbind_interface+0x158/0x718 device_remove+0x100/0x150 device_release_driver_internal+0x308/0x478 device_release_driver+0x1c/0x30 bus_remove_device+0x1a8/0x368 device_del+0x2e0/0x7b0 usb_disable_device+0x244/0x540 usb_disconnect+0x220/0x758 hub_event+0x105c/0x35e0 process_one_work+0x760/0x17b0 worker_thread+0x768/0xce8 kthread+0x3bc/0x690 ret_from_fork+0x10/0x20 irq event stamp: 211604 hardirqs last enabled at (211603): [<ffffffc0828cc9ec>] _raw_spin_unlock_irqrestore+0x84/0x98 hardirqs last disabled at (211604): [<ffffffc0828a9a84>] el1_dbg+0x24/0x80 softirqs last enabled at (211296): [<ffffffc080095f10>] handle_softirqs+0x820/0xbc8 softirqs last disabled at (210993): [<ffffffc080010288>] __do_softirq+0x18/0x20 ---[ end trace 0000000000000000 ]--- lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0
--- drivers/net/usb/lan78xx.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/usb/lan78xx.c +0 -2
@@ -4548,8 +4548,6 @@ static void lan78xx_disconnect(struct usphylink_disconnect_phy (dev->phylink);rtnl_unlock (); -netif_napi_del (&dev->napi); -unregister_netdev (net);timer_shutdown_sync (&dev->stat_monitor);
Greg Kroah-Hartman
maintainerPATCH 113/333 net: usb: lan78xx: skip LTM configuration for LAN7850
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7 upstream.
Do not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.
The LAN7850 is a High-Speed (USB 2.0) only device and does not support SuperSpeed features like LTM. Currently, the driver unconditionally attempts to configure LTM registers during initialization. On the LAN7850, these registers do not exist, resulting in writes to invalid or undocumented memory space.
This issue was identified during a port to the regmap API with strict register validation enabled. While no functional issues or crashes have been observed from these invalid writes, bypassing LTM initialization on the LAN7850 ensures the driver strictly adheres to the hardware's valid register map.
--- drivers/net/usb/lan78xx.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/lan78xx.c +4 -0
@@ -3119,6 +3119,10 @@ static int lan78xx_init_ltm(struct lan78int ret;u32 buf; +/* LAN7850 is USB 2.0 and does not support LTM */ +if (dev->chipid ==ID_REV_CHIP_ID_7850_ ) +return 0 ; + ret =lan78xx_read_reg (dev,USB_CFG1 , &buf);if (ret <0 ) goto init_ltm_failed;
Greg Kroah-Hartman
maintainerPATCH 114/333 rust_binder: fix oneway spam detection
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 4fc87c240b8f30e22b7ebaae29d57105589e1c0b upstream.
The spam detection logic in TreeRange was executed before the current request was inserted into the tree. So the new request was not being factored in the spam calculation. Fix this by moving the logic after the new range has been inserted.
Also, the detection logic for ArrayRange was missing altogether which meant large spamming transactions could get away without being detected. Fix this by implementing an equivalent low_oneway_space() in ArrayRange.
Note that I looked into centralizing this logic in RangeAllocator but iterating through 'state' and 'size' got a bit too complicated (for me) and I abandoned this effort.
--- drivers/android/binder/range_alloc/array.rs | 35 ++++++++++++++++++++++++++-- drivers/android/binder/range_alloc/mod.rs | 4 +-- drivers/android/binder/range_alloc/tree.rs | 18 +++++++------- 3 files changed, 44 insertions(+), 13 deletions(-)
drivers/android/binder/range_alloc/array.rs +33 -2
@@ -118,7 +118,7 @@ impl<T> ArrayRangeAllocator<T> { size: usize, is_oneway: bool, pid: Pid, - ) -> Result<usize> { + ) -> Result<(usize, bool)> {// Compute new value of free_oneway_space, which is set only on success. let new_oneway_space =if is_oneway {match self.free_oneway_space.checked_sub (size) {
@@ -146,7 +146,38 @@ impl<T> ArrayRangeAllocator<T> { .ok() .unwrap (); -Ok (insert_at_offset) +// Start detecting spammers once we have less than 20% +// of async space left (which is less than 10% of total +// buffer size). +// +// (This will short-circuit, so `low_oneway_space` is +// only called when necessary.) +let oneway_spam_detected = + is_oneway && new_oneway_space < self.size /10 && self.low_oneway_space (pid); + +Ok ((insert_at_offset, oneway_spam_detected)) + } + +/// Find the amount and size of buffers allocated by the current caller. +/// +/// The idea is that once we cross the threshold, whoever is responsible +/// for the low async space is likely to try to send another async transaction, +/// and at some point we'll catch them in the act. This is more efficient +/// than keeping a map per pid. +fn low_oneway_space (&self, calling_pid:Pid ) ->bool { +let mut total_alloc_size =0 ; +let mut num_buffers =0 ; + +// Warn if this pid has more than 50 transactions, or more than 50% of +// async space (which is 25% of total buffer size). Oneway spam is only +// detected when the threshold is exceeded. +for rangein &self.ranges { +if range.state.is_oneway () && range.state.pid () == calling_pid { + total_alloc_size += range.size; + num_buffers +=1 ; + } + } + num_buffers >50 || total_alloc_size > self.size /4 }pub (crate )fn reservation_abort (&mut self, offset:usize ) ->Result <FreedRange > {
drivers/android/binder/range_alloc/mod.rs +2 -2
@@ -188,11 +188,11 @@ impl<T> RangeAllocator<T> { self.reserve_new (args) } Impl::Array(array) => { - let offset = + let (offset, oneway_spam_detected) = array.reserve_new(args.debug_id, args.size, args.is_oneway, args.pid)?; Ok(ReserveNew::Success(ReserveNewSuccess { offset, - oneway_spam_detected: false, + oneway_spam_detected, _empty_array_alloc: args.empty_array_alloc, _new_tree_alloc: args.new_tree_alloc, _tree_alloc: args.tree_alloc,
drivers/android/binder/range_alloc/tree.rs +9 -9
@@ -164,15 +164,6 @@ impl<T> TreeRangeAllocator<T> { self.free_oneway_space }; -// Start detecting spammers once we have less than 20% -// of async space left (which is less than 10% of total -// buffer size). -// -// (This will short-circut, so `low_oneway_space` is -// only called when necessary.) -let oneway_spam_detected = - is_oneway && new_oneway_space < self.size /10 && self.low_oneway_space (pid); -let (found_size, found_off, tree_node, free_tree_node) =match self.find_best_match (size) {None => {pr_warn! ("ENOSPC from range_alloc.reserve_new - size: {}" , size);
@@ -203,6 +194,15 @@ impl<T> TreeRangeAllocator<T> { self.free_tree.insert (free_tree_node); } +// Start detecting spammers once we have less than 20% +// of async space left (which is less than 10% of total +// buffer size). +// +// (This will short-circuit, so `low_oneway_space` is +// only called when necessary.) +let oneway_spam_detected = + is_oneway && new_oneway_space < self.size /10 && self.low_oneway_space (pid); +Ok ((found_off, oneway_spam_detected)) }
Greg Kroah-Hartman
maintainerPATCH 115/333 rust_binder: check ownership before using vma
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 8ef2c15aeae07647f530d30f6daaf79eb801bcd1 upstream.
When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address, this can lead to Rust Binder installing pages into the wrong vma.
By installing the page into a writable vma, it becomes possible to write to your own binder pages, which are normally read-only. Although you're not supposed to be able to write to those pages, the intent behind the design of Rust Binder is that even if you get that ability, it should not lead to anything bad. Unfortunately, due to another bug, that is not the case.
To fix this, store a pointer in vm_private_data and check that the vma returned by vma_lookup() has the right vm_ops and vm_private_data before trying to use the vma. This should ensure that Rust Binder will refuse to interact with any other VMA. The plan is to introduce more vma abstractions to avoid this unsafe access to vm_ops and vm_private_data, but for now let's start with the simplest possible fix.
C Binder performs the same check in a slightly different way: it provides a vm_ops->close that sets a boolean to true, then checks that boolean after calling vma_lookup(), but this is more fragile than the solution in this patch. (We probably still want to do both, but the vm_ops->close callback will be added later as part of the follow-up vma API changes.)
It's still possible to remap the vma so that pages appear in the right vma, but at the wrong offset, but this is a separate issue and will be fixed when Rust Binder gets a vm_ops->close callback.
--- drivers/android/binder/page_range.rs | 83 ++++++++++++++++++++++++++--------- 1 file changed, 63 insertions(+), 20 deletions(-)
drivers/android/binder/page_range.rs +63 -20
@@ -142,6 +142,30 @@ pub(crate) struct ShrinkablePageRange { _pin: PhantomPinned, } +// We do not define any ops. For now, used only to check identity of vmas. +static BINDER_VM_OPS : bindings::vm_operations_struct = pin_init::zeroed (); + +// To ensure that we do not accidentally install pages into or zap pages from the wrong vma, we +// check its vm_ops and private data before using it. +fn check_vma (vma: &virt::VmaRef , owner: *const ShrinkablePageRange ) ->Option <&virt::VmaMixedMap > { +// SAFETY: Just reading the vm_ops pointer of any active vma is safe. +let vm_ops =unsafe { (*vma.as_ptr ()).vm_ops }; +if !ptr::eq (vm_ops, &BINDER_VM_OPS ) { +return None ; + } + +// SAFETY: Reading the vm_private_data pointer of a binder-owned vma is safe. +let vm_private_data =unsafe { (*vma.as_ptr ()).vm_private_data }; +// The ShrinkablePageRange is only dropped when the Process is dropped, which only happens once +// the file's ->release handler is invoked, which means the ShrinkablePageRange outlives any +// VMA associated with it, so there can't be any false positives due to pointer reuse here. +if !ptr::eq (vm_private_data, owner.cast ()) { +return None ; + } + + vma.as_mixedmap_vma () +} +struct Inner {/// Array of pages. ///
@@ -308,6 +332,18 @@ impl ShrinkablePageRange { inner.size = num_pages; inner.vma_addr = vma.start (); +// This pointer is only used for comparison - it's not dereferenced. +// +// SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on +// `vm_private_data`. +unsafe { + (*vma.as_ptr ()).vm_private_data = ptr::from_ref (self).cast_mut ().cast ::<c_void >() + }; + +// SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on +// `vm_ops`. +unsafe { (*vma.as_ptr ()).vm_ops = &BINDER_VM_OPS }; +Ok (num_pages) }
@@ -399,22 +435,24 @@ impl ShrinkablePageRange {// // Using `mmput_async` avoids this, because then the `mm` cleanup is instead queued to a // workqueue. -MmWithUser ::into_mmput_async (self.mm.mmget_not_zero ().ok_or (ESRCH )?) - .mmap_read_lock () - .vma_lookup (vma_addr) - .ok_or (ESRCH )? - .as_mixedmap_vma () - .ok_or (ESRCH )? - .vm_insert_page (user_page_addr, &new_page) - .inspect_err (|err| { -pr_warn! ( -"Failed to vm_insert_page({}): vma_addr:{} i:{} err:{:?}" , - user_page_addr, - vma_addr, - i, - err - ) - })?; +check_vma ( +MmWithUser ::into_mmput_async (self.mm.mmget_not_zero ().ok_or (ESRCH )?) + .mmap_read_lock () + .vma_lookup (vma_addr) + .ok_or (ESRCH )?, + self, + ) + .ok_or (ESRCH )? + .vm_insert_page (user_page_addr, &new_page) + .inspect_err (|err| { +pr_warn! ( +"Failed to vm_insert_page({}): vma_addr:{} i:{} err:{:?}" , + user_page_addr, + vma_addr, + i, + err + ) + })?;let inner = self.lock.lock ();
@@ -667,12 +705,15 @@ unsafe extern "C" fn rust_shrink_free_palet mmap_read;let mm_mutex;let vma_addr; +let range_ptr; {// CAST: The `list_head` field is first in `PageInfo`. let info = itemas *mut PageInfo ;// SAFETY: The `range` field of `PageInfo` is immutable. -let range =unsafe { &*((*info).range) }; + range_ptr =unsafe { (*info).range }; +// SAFETY: The `range` outlives its `PageInfo` values. +let range =unsafe { &*range_ptr }; mm =match range.mm.mmget_not_zero () {Some (mm) =>MmWithUser ::into_mmput_async (mm),
@@ -717,9 +758,11 @@ unsafe extern "C" fn rust_shrink_free_pa// SAFETY: The lru lock is locked when this method is called. unsafe { bindings::spin_unlock (&raw mut (*lru).lock) }; -if let Some (vma) = mmap_read.vma_lookup (vma_addr) { -let user_page_addr = vma_addr + (page_index <<PAGE_SHIFT ); - vma.zap_page_range_single (user_page_addr,PAGE_SIZE ); +if let Some (unchecked_vma) = mmap_read.vma_lookup (vma_addr) { +if let Some (vma) =check_vma (unchecked_vma, range_ptr) { +let user_page_addr = vma_addr + (page_index <<PAGE_SHIFT ); + vma.zap_page_range_single (user_page_addr,PAGE_SIZE ); + } }drop (mmap_read);
Greg Kroah-Hartman
maintainerPATCH 116/333 rust_binder: avoid reading the written value in offsets array
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 4cb9e13fec0de7c942f5f927469beb8e48ddd20f upstream.
When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from there. This is normally fine because the vma is a read-only mapping, so the target process cannot change the value under us.
However, if the target process somehow gains the ability to write to its own vma, it could change the offset before it's read back, causing the kernel to misinterpret what the sender meant. If the sender happens to send a payload with a specific shape, this could in the worst case lead to the receiver being able to privilege escalate into the sender.
The intent is that gaining the ability to change the read-only vma of your own process should not be exploitable, so remove this TOCTOU read even though it's unexploitable without another Binder bug.
--- drivers/android/binder/thread.rs | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
drivers/android/binder/thread.rs +6 -11
@@ -1018,12 +1018,9 @@ impl Thread {// Copy offsets if there are any. if offsets_size >0 { - { -let mut reader = -UserSlice ::new (UserPtr ::from_addr (trd_data_ptr.offsetsas _ ), offsets_size) - .reader (); - alloc.copy_into (&mut reader, aligned_data_size, offsets_size)?; - } +let mut offsets_reader = +UserSlice ::new (UserPtr ::from_addr (trd_data_ptr.offsetsas _ ), offsets_size) + .reader ();let offsets_start = aligned_data_size;let offsets_end = aligned_data_size + offsets_size;
@@ -1044,11 +1041,9 @@ impl Thread { .step_by(size_of::<u64>()) .enumerate() { -let offset:usize = view - .alloc - .read ::<u64 >(index_offset)? - .try_into () - .map_err (|_|EINVAL )?; +let offset = offsets_reader.read ::<u64 >()?; + view.alloc.write (index_offset, &offset)?; +let offset:usize = offset.try_into ().map_err (|_|EINVAL )?;if offset < end_of_previous_object || !is_aligned (offset,size_of ::<u32 >()) {pr_warn! ("Got transaction with invalid offset." );
Greg Kroah-Hartman
maintainerPATCH 117/333 rust_binder: call set_notification_done() without proc lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit 2e303f0febb65a434040774b793ba8356698802b upstream.
Consider the following sequence of events on a death listener:
1. The remote process dies and sends a BR_DEAD_BINDER message.
2. The local process invokes the BC_CLEAR_DEATH_NOTIFICATION command.
3. The local process then invokes the BC_DEAD_BINDER_DONE. Then, the kernel will reply to the BC_DEAD_BINDER_DONE command with a BR_CLEAR_DEATH_NOTIFICATION_DONE reply using push_work_if_looper().
However, this can result in a deadlock if the current thread is not a looper. This is because dead_binder_done() still holds the proc lock during set_notification_done(), which called push_work_if_looper(). Normally, push_work_if_looper() takes the thread lock, which is fine to take under the proc lock. But if the current thread is not a looper, then it falls back to delivering the reply to the process work queue, which involves taking the proc lock. Since the proc lock is already held, this is a deadlock.
Fix this by releasing the proc lock during set_notification_done(). It was not intentional that it was held during that function to begin with.
I don't think this ever happens in Android because BC_DEAD_BINDER_DONE is only invoked in response to BR_DEAD_BINDER messages, and the kernel always delivers BR_DEAD_BINDER to a looper. So there's no scenario where Android userspace will call BC_DEAD_BINDER_DONE on a non-looper thread.
--- drivers/android/binder/process.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/android/binder/process.rs +2 -1
@@ -1259,7 +1259,8 @@ impl Process { }pub (crate )fn dead_binder_done (&self, cookie:u64 , thread: &Thread ) { -if let Some (death) = self.inner.lock ().pull_delivered_death (cookie) { +let death = self.inner.lock ().pull_delivered_death (cookie); +if let Some (death) = death { death.set_notification_done (thread); } }
Greg Kroah-Hartman
maintainerPATCH 118/333 rust: kbuild: allow `unused_features`
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
commit 592c61f3bfceaa29f8275696bd67c3dfad7ef72e upstream.
Starting with the upcoming Rust 1.96.0 (to be released 2026-05-28), rustc introduces the new lint unused_features [1], which warns [2]:
warning: feature used_with_arg is declared but not used
--> <crate attribute>:1:93
|
1 | #![feature(asm_const,asm_goto,arbitrary_self_types,lint_reasons,offset_of_nested,raw_ref_op,used_with_arg)]
| ^^^^^^^^^^^^^
|
= note: #[warn(unused_features)] (part of #[warn(unused)]) on by default
The original goal of using -Zcrate-attr automatically was that there is a consistent set of features enabled and managed globally for all Rust kernel code (modulo exceptions like the rust/ crated).
While we could require crates to enable features manually (even if we still keep the -Zallow-features= list, i.e. removing the -Zcrate-attr list), it is not really worth making all developers worry about it just for a new lint.
The features are expected to eventually become stable anyway (most already did), and thus having to remove features in every file that may use them is not worth it either.
Thus just allow the new lint globally.
The lint actually existed for a long time, which is why rustc does not complain about an unknown lint in the stable versions we support, but it was "disabled" years ago [3], and now it was made to work again.
For extra context, the new implementation of the lint has already been improved to avoid linting about features that became stable thanks to Benno's report and the ensuing discussion [4] [5], but while that helps, it is still the case that we may have features enabled that are not used for one reason or another in a particular crate.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -473,6 +473,7 @@ KBUILD_USERLDFLAGS := $(USERLDFLAGS) export rust_common_flags := --edition=2021 \ -Zbinary_dep_depinfo=y \ -Astable_features \ + -Aunused_features \ -Dnon_ascii_idents \ -Dunsafe_op_in_unsafe_fn \ -Wmissing_docs \
Greg Kroah-Hartman
maintainerPATCH 119/333 rust: str: make NullTerminatedFormatter public
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <[email protected]>
commit 3ac88a9948792b092a4b11323e2abd1ecbe0cc68 upstream.
If CONFIG_BLOCK is disabled, the following warnings are displayed during build:
warning: struct NullTerminatedFormatter is never constructed
--> ../rust/kernel/str.rs:667:19
|
667 | pub(crate) struct NullTerminatedFormatter<'a> {
| ^^^^^^^^^^^^^^^^^^^^^^^
|
= note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default warning: associated function new is never used
--> ../rust/kernel/str.rs:673:19
|
671 | impl<'a> NullTerminatedFormatter<'a> {
| ------------------------------------ associated function in this implementation
672 | /// Create a new [`Self`] instance.
673 | pub(crate) fn new(buffer: &'a mut [u8]) -> Option<NullTerminatedFormatter<'a>> {Fix them by making NullTerminatedFormatter public, as it could be useful for drivers anyway.
--- rust/kernel/str.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
rust/kernel/str.rs +2 -2
@@ -880,13 +880,13 @@ impl fmt::Write for Formatter<'_> {/// /// * The first byte of `buffer` is always zero. /// * The length of `buffer` is at least 1. -pub (crate )struct NullTerminatedFormatter <'a> { +pub struct NullTerminatedFormatter <'a> { buffer: &'amut [u8 ], }impl <'a>NullTerminatedFormatter <'a> {/// Create a new [`Self`] instance. -pub (crate )fn new (buffer: &'amut [u8 ]) ->Option <NullTerminatedFormatter <'a>> { +pub fn new (buffer: &'amut [u8 ]) ->Option <NullTerminatedFormatter <'a>> { *(buffer.first_mut ()?) =0 ;// INVARIANT:
Greg Kroah-Hartman
maintainerPATCH 120/333 ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Falcato <[email protected]>
commit b92b0075ee1870f78f59ab1f7da7dbfdd718ad7a upstream.
Currently, whenever you boot with a QEMU drive over an AHCI interface, you get:
[ 1.632121] ata1.00: applying bridge limits
This happens due to the kernel not believing the given drive is SATA, since word 93 of IDENTIFY (ATA_ID_HW_CONFIG) is non-zero. The result is a pretty severe limit in max_hw_sectors_kb, which limits our IO sizes.
QEMU has set word 93 erroneously for SATA drives but does not, in any way, emulate any of these real hardware details. There is no PATA drive and no SATA cable.
As such, add a BRIDGE_OK quirk for QEMU HARDDISK. Special care is taken to limit this quirk to "2.5+", to allow for fixed future versions.
This results in the max_hw_sectors being limited solely by the controller interface's limits. Which, for AHCI controllers, takes it from 128KB to 32767KB.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -4199,6 +4199,7 @@ static const struct ata_dev_quirks_entry/* Devices that do not need bridging limits applied */ { "MTRON MSP-SATA*", NULL, ATA_QUIRK_BRIDGE_OK }, { "BUFFALO HD-QSU2/R5", NULL, ATA_QUIRK_BRIDGE_OK }, + { "QEMU HARDDISK", "2.5+", ATA_QUIRK_BRIDGE_OK },/* Devices which aren't very happy with higher link speeds */ { "WD My Book", NULL, ATA_QUIRK_1_5_GBPS },
Greg Kroah-Hartman
maintainerPATCH 121/333 ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <[email protected]>
commit 325291b20f8a6f14b9c82edbf5d12e4e71f6adaa upstream.
Add a DMI quirk for the ASUS EXPERTBOOK PM1503CDA fixing the issue where the internal microphone was not detected.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -710,6 +710,13 @@ static const struct dmi_system_id yc_acp DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK BM1503CDA"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "PM1503CDA"), + } + }, {} };
Greg Kroah-Hartman
maintainerPATCH 122/333 KVM: arm64: Fix protected mode handling of pages larger than 4kB
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 08f97454b7fa39bfcf82524955c771d2d693d6fe upstream.
Since 3669ddd8fa8b5 ("KVM: arm64: Add a range to pkvm_mappings"), pKVM tracks the memory that has been mapped into a guest in a side data structure. Crucially, it uses it to find out whether a page has already been mapped, and therefore refuses to map it twice. So far, so good.
However, this very patch completely breaks non-4kB page support, with guests being unable to boot. The most obvious symptom is that we take the same fault repeatedly, and not making forward progress. A quick investigation shows that this is because of the above rejection code.
As it turns out, there are multiple issues at play:
- while the HPFAR_EL2 register gives you the faulting IPA minus the bottom 12 bits, it will still give you the extra bits that are part of the page offset for anything larger than 4kB, even for a level-3 mapping
- pkvm_pgtable_stage2_map() assumes that the address passed as a parameter is aligned to the size of the intended mapping
- the faulting address is only aligned for a non-page mapping
When the planets are suitably aligned (pun intended), the guest faults on a page by accessing it past the bottom 4kB, and extra bits get set in the HPFAR_EL2 register. If this results in a page mapping (which is likely with large granule sizes), nothing aligns it further down, and pkvm_mapping_iter_first() finds an intersection that doesn't really exist. We assume this is a spurious fault and return -EAGAIN. And again...
This doesn't hit outside of the protected code, as the page table code always aligns the IPA down to a page boundary, hiding the issue for everyone else.
Fix it by always forcing the alignment on vma_pagesize, irrespective of the value of vma_pagesize.
--- arch/arm64/kvm/mmu.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
arch/arm64/kvm/mmu.c +5 -7
@@ -1712,14 +1712,12 @@ static int user_mem_abort(struct kvm_vcp }/* -* Both the canonical IPA and fault IPA must be hugepage-aligned to -* ensure we find the right PFN and lay down the mapping in the right -* place. +* Both the canonical IPA and fault IPA must be aligned to the +* mapping size to ensure we find the right PFN and lay down the +* mapping in the right place. */ -if (vma_pagesize ==PMD_SIZE || vma_pagesize ==PUD_SIZE ) { - fault_ipa &= ~(vma_pagesize -1 ); - ipa &= ~(vma_pagesize -1 ); - } + fault_ipa =ALIGN_DOWN (fault_ipa, vma_pagesize); + ipa =ALIGN_DOWN (ipa, vma_pagesize); gfn = ipa >>PAGE_SHIFT ; mte_allowed =kvm_vma_mte_allowed (vma);
Greg Kroah-Hartman
maintainerPATCH 123/333 KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Mattson <[email protected]>
commit e2ffe85b6d2bb7780174b87aa4468a39be17eb81 upstream.
Add KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM to allow L1 to set FREEZE_IN_SMM in vmcs12's GUEST_IA32_DEBUGCTL field, as permitted prior to commit 6b1dd26544d0 ("KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest"). Enable the quirk by default for backwards compatibility (like all quirks); userspace can disable it via KVM_CAP_DISABLE_QUIRKS2 for consistency with the constraints on WRMSR(IA32_DEBUGCTL).
Note that the quirk only bypasses the consistency check. The vmcs02 bit is still owned by the host, and PMCs are not frozen during virtualized SMM. In particular, if a host administrator decides that PMCs should not be frozen during physical SMM, then L1 has no say in the matter.
--- Documentation/virt/kvm/api.rst | 8 ++++++++ arch/x86/include/asm/kvm_host.h | 3 ++- arch/x86/include/uapi/asm/kvm.h | 1 + arch/x86/kvm/vmx/nested.c | 22 ++++++++++++++++++---- 4 files changed, 29 insertions(+), 5 deletions(-)
Documentation/virt/kvm/api.rst +8 -0
@@ -8403,6 +8403,14 @@ KVM_X86_QUIRK_IGNORE_GUEST_PAT By d guest software, for example if it does not expose a bochs graphics device (which is known to have had a buggy driver). + +KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM By default, KVM relaxes the consistency + check for GUEST_IA32_DEBUGCTL in vmcs12 + to allow FREEZE_IN_SMM to be set. When + this quirk is disabled, KVM requires this + bit to be cleared. Note that the vmcs02 + bit is still completely controlled by the + host, regardless of the quirk setting. =================================== ============================================ 7.32 KVM_CAP_MAX_VCPU_ID
arch/x86/include/asm/kvm_host.h +2 -1
@@ -2473,7 +2473,8 @@ int memslot_rmap_alloc(struct kvm_memory KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS | \ KVM_X86_QUIRK_SLOT_ZAP_ALL | \ KVM_X86_QUIRK_STUFF_FEATURE_MSRS | \ - KVM_X86_QUIRK_IGNORE_GUEST_PAT) + KVM_X86_QUIRK_IGNORE_GUEST_PAT | \ + KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM)#define KVM_X86_CONDITIONAL_QUIRKS \ (KVM_X86_QUIRK_CD_NW_CLEARED | \
arch/x86/include/uapi/asm/kvm.h +1 -0
@@ -476,6 +476,7 @@ struct kvm_sync_regs {#define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)#define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9) +#define KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM (1 << 10)#define KVM_STATE_NESTED_FORMAT_VMX 0#define KVM_STATE_NESTED_FORMAT_SVM 1
arch/x86/kvm/vmx/nested.c +18 -4
@@ -3262,10 +3262,24 @@ static int nested_vmx_check_guest_state(if (CC (vmcs12->guest_cr4 &X86_CR4_CET && !(vmcs12->guest_cr0 &X86_CR0_WP )))return -EINVAL ; -if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS ) && - (CC (!kvm_dr7_valid (vmcs12->guest_dr7)) || -CC (!vmx_is_valid_debugctl (vcpu, vmcs12->guest_ia32_debugctl, false)))) -return -EINVAL ; +if (vmcs12->vm_entry_controls &VM_ENTRY_LOAD_DEBUG_CONTROLS ) { +u64 debugctl = vmcs12->guest_ia32_debugctl; + +/* +* FREEZE_IN_SMM is not virtualized, but allow L1 to set it in +* vmcs12's DEBUGCTL under a quirk for backwards compatibility. +* Note that the quirk only relaxes the consistency check. The +* vmcc02 bit is still under the control of the host. In +* particular, if a host administrator decides to clear the bit, +* then L1 has no say in the matter. +*/ +if (kvm_check_has_quirk (vcpu->kvm,KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM )) + debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM ; + +if (CC (!kvm_dr7_valid (vmcs12->guest_dr7)) || +CC (!vmx_is_valid_debugctl (vcpu, debugctl, false))) +return -EINVAL ; + }if ((vmcs12->vm_entry_controls &VM_ENTRY_LOAD_IA32_PAT ) &&CC (!kvm_pat_valid (vmcs12->guest_ia32_pat)))
Greg Kroah-Hartman
maintainerPATCH 124/333 KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit 3989a6d036c8ec82c0de3614bed23a1dacd45de5 upstream.
Initialize all per-vCPU AVIC control fields in the VMCB if AVIC is enabled in KVM and the VM has an in-kernel local APIC, i.e. if it's _possible_ the vCPU could activate AVIC at any point in its lifecycle. Configuring the VMCB if and only if AVIC is active "works" purely because of optimizations in kvm_create_lapic() to speculatively set apicv_active if AVIC is enabled *and* to defer updates until the first KVM_RUN. In quotes because KVM likely won't do the right thing if kvm_apicv_activated() is false, i.e. if a vCPU is created while APICv is inhibited at the VM level for whatever reason. E.g. if the inhibit is *removed* before KVM_REQ_APICV_UPDATE is handled in KVM_RUN, then __kvm_vcpu_update_apicv() will elide calls to vendor code due to seeing "apicv_active == activate".
Cleaning up the initialization code will also allow fixing a bug where KVM incorrectly leaves CR8 interception enabled when AVIC is activated without creating a mess with respect to whether AVIC is activated or not.
--- arch/x86/kvm/svm/avic.c | 2 +- arch/x86/kvm/svm/svm.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/kvm/svm/avic.c +1 -1
@@ -321,7 +321,7 @@ void avic_init_vmcb(struct vcpu_svm *svm vmcb->control.avic_physical_id =__sme_set (__pa (kvm_svm->avic_physical_id_table)); vmcb->control.avic_vapic_bar =APIC_DEFAULT_PHYS_BASE ; -if (kvm_apicv_activated (svm->vcpu.kvm)) +if (kvm_vcpu_apicv_active (&svm->vcpu))avic_activate_vmcb (svm);else avic_deactivate_vmcb (svm);
arch/x86/kvm/svm/svm.c +1 -1
@@ -1141,7 +1141,7 @@ static void init_vmcb(struct kvm_vcpu *vsvm_clr_intercept (svm,INTERCEPT_PAUSE ); } -if (kvm_vcpu_apicv_active (vcpu)) +if (enable_apicv &&irqchip_in_kernel (vcpu->kvm))avic_init_vmcb (svm, vmcb);if (vnmi)
Greg Kroah-Hartman
maintainerPATCH 125/333 KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 8531d5a83d8eb8affb5c0249b466c28d94192603 upstream.
If, for any odd reason, we cannot converge to mapping size that is completely contained in a memblock region, we fail to install a S2 mapping and go back to the faulting instruction. Rince, repeat.
This happens when faulting in regions that are smaller than a page or that do not have PAGE_SIZE-aligned boundaries (as witnessed on an O6 board that refuses to boot in protected mode).
In this situation, fallback to using a PAGE_SIZE mapping anyway -- it isn't like we can go any lower.
--- arch/arm64/kvm/hyp/nvhe/mem_protect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kvm/hyp/nvhe/mem_protect.c +1 -1
@@ -516,7 +516,7 @@ static int host_stage2_adjust_range(u64 granule =kvm_granule_size (level); cur.start =ALIGN_DOWN (addr, granule); cur.end = cur.start + granule; -if (!range_included (&cur, range)) +if (!range_included (&cur, range) && level <KVM_PGTABLE_LAST_LEVEL )continue ; *range = cur;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 126/333 USB: add QUIRK_NO_BOS for video capture several devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: A1RM4X <[email protected]>
commit 93cd0d664661f58f7e7bed7373714ab2ace41734 upstream.
Several USB capture devices also need the USB_QUIRK_NO_BOS set for them to work properly, odds are they are all the same chip inside, just different vendor/product ids.
This fixes up:
- ASUS TUF 4K PRO
- Avermedia Live Gamer Ultra 2.1 (GC553G2)
- UGREEN 35871
to now run at full speed (10 Gbps/4K 60 fps mode.)
--- drivers/usb/core/quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/core/quirks.c +9 -0
@@ -377,6 +377,9 @@ static const struct usb_device_id usb_qu/* SanDisk Extreme 55AE */ { USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM }, + /* Avermedia Live Gamer Ultra 2.1 (GC553G2) - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x07ca, 0x2553), .driver_info = USB_QUIRK_NO_BOS }, + /* Realforce 87U Keyboard */ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
@@ -437,6 +440,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* ASUS TUF 4K PRO - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x0b05, 0x1ab9), .driver_info = USB_QUIRK_NO_BOS }, + /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
@@ -565,6 +571,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, + /* UGREEN 35871 - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x2b89, 0x5871), .driver_info = USB_QUIRK_NO_BOS }, + /* APTIV AUTOMOTIVE HUB */ { USB_DEVICE(0x2c48, 0x0132), .driver_info = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT },
Greg Kroah-Hartman
maintainerPATCH 127/333 usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <[email protected]>
commit 0326ff28d56b4fa202de36ffc8462a354f383a64 upstream.
Similar to other Huawei LTE modules using this quirk, this version with another vid/pid suffers from spurious wakeups.
Setting the quirk fixes the issue for this device as well.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -208,6 +208,10 @@ static const struct usb_device_id usb_qu/* HP v222w 16GB Mini USB Drive */ { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Huawei 4G LTE module ME906S */ + { USB_DEVICE(0x03f0, 0xa31d), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, + /* Creative SB Audigy 2 NX */ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 128/333 USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vyacheslav Vahnenko <[email protected]>
commit d0d9b1f4f5391e6a00cee81d73ed2e8f98446d5f upstream.
Add USB_QUIRK_NO_BOS for ezcap401 capture card, without it dmesg will show "unable to get BOS descriptor or descriptor too short" and "unable to read config index 0 descriptor/start: -71" errors and device will not able to work at full speed at 10gbs
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -588,6 +588,9 @@ static const struct usb_device_id usb_qu/* Alcor Link AK9563 SC Reader used in 2022 Lenovo ThinkPads */ { USB_DEVICE(0x2ce3, 0x9563), .driver_info = USB_QUIRK_NO_LPM }, + /* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */ + { USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS }, + /* DELL USB GEN2 */ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 129/333 usb: xhci: Fix memory leak in xhci_disable_slot()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
commit c1c8550e70401159184130a1afc6261db01fc0ce upstream.
xhci_alloc_command() allocates a command structure and, when the second argument is true, also allocates a completion structure. Currently, the error handling path in xhci_disable_slot() only frees the command structure using kfree(), causing the completion structure to leak.
Use xhci_free_command() instead of kfree(). xhci_free_command() correctly frees both the command structure and the associated completion structure. Since the command structure is allocated with zero-initialization, command->in_ctx is NULL and will not be erroneously freed by xhci_free_command().
This bug was found using an experimental static analysis tool we are developing. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available, but we plan to open-source it after our research is published.
The bug was originally detected on v6.13-rc1 using our static analysis tool, and we have verified that the issue persists in the latest mainline kernel.
We performed build testing on x86_64 with allyesconfig using GCC=11.4.0. Since triggering these error paths in xhci_disable_slot() requires specific hardware conditions or abnormal state, we were unable to construct a test case to reliably trigger these specific error paths at runtime.
--- drivers/usb/host/xhci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.c +2 -2
@@ -4139,7 +4139,7 @@ int xhci_disable_slot(struct xhci_hcd *xif (state ==0xffffffff || (xhci->xhc_state &XHCI_STATE_DYING ) || (xhci->xhc_state &XHCI_STATE_HALTED )) {spin_unlock_irqrestore (&xhci->lock, flags); -kfree (command); +xhci_free_command (xhci, command);return -ENODEV ; }
@@ -4147,7 +4147,7 @@ int xhci_disable_slot(struct xhci_hcd *x slot_id);if (ret) {spin_unlock_irqrestore (&xhci->lock, flags); -kfree (command); +xhci_free_command (xhci, command);return ret; }xhci_ring_cmd_db (xhci);
Greg Kroah-Hartman
maintainerPATCH 130/333 usb: xhci: Prevent interrupt storm on host controller error (HCE)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dayu Jiang <[email protected]>
commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream.
The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults.
When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt().
Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors.
This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC.
--- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-ring.c +1 -0
@@ -3224,6 +3224,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcdif (status &STS_HCE ) {xhci_warn (xhci,"WARNING: Host Controller Error\n" ); +xhci_halt (xhci); goto out; }
Greg Kroah-Hartman
maintainerPATCH 131/333 usb: yurex: fix race in probe
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 7a875c09899ba0404844abfd8f0d54cdc481c151 upstream.
The bbu member of the descriptor must be set to the value standing for uninitialized values before the URB whose completion handler sets bbu is submitted. Otherwise there is a window during which probing can overwrite already retrieved data.
--- drivers/usb/misc/yurex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/yurex.c +1 -1
@@ -272,6 +272,7 @@ static int yurex_probe(struct usb_interf dev->int_buffer,YUREX_BUF_SIZE , yurex_interrupt, dev, 1); dev->urb->transfer_flags |=URB_NO_TRANSFER_DMA_MAP ; + dev->bbu =-1 ;if (usb_submit_urb (dev->urb,GFP_KERNEL )) { retval = -EIO ;dev_err (&interface->dev,"Could not submitting URB\n" );
@@ -280,7 +281,6 @@ static int yurex_probe(struct usb_interf/* save our data pointer in this interface device */ usb_set_intfdata (interface, dev); - dev->bbu =-1 ;/* we can register the device now, as it is ready */ retval =usb_register_dev (interface, &yurex_class);
Greg Kroah-Hartman
maintainerPATCH 132/333 usb: dwc3: pci: add support for the Intel Nova Lake -H
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit 17ab4d4078e22be7fd8fd6fc710c15c085a4cb1b upstream.
This patch adds the necessary PCI ID for Intel Nova Lake -H devices.
--- drivers/usb/dwc3/dwc3-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/dwc3/dwc3-pci.c +2 -0
@@ -56,6 +56,7 @@#define PCI_DEVICE_ID_INTEL_CNPH 0xa36e#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0#define PCI_DEVICE_ID_INTEL_RPL 0xa70e +#define PCI_DEVICE_ID_INTEL_NVLH 0xd37f#define PCI_DEVICE_ID_INTEL_PTLH 0xe332#define PCI_DEVICE_ID_INTEL_PTLH_PCH 0xe37e#define PCI_DEVICE_ID_INTEL_PTLU 0xe432
@@ -448,6 +449,7 @@ static const struct pci_device_id dwc3_p { PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) }, + { PCI_DEVICE_DATA(INTEL, NVLH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) }, { PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) },
Greg Kroah-Hartman
maintainerPATCH 133/333 usb: misc: uss720: properly clean up reference in uss720_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 45dba8011efac11a2f360383221b541f5ea53ce5 upstream.
If get_1284_register() fails, the usb device reference count is incorrect and needs to be properly dropped before returning. That will happen when the kref is dropped in the call to destroy_priv(), so jump to that error path instead of returning directly.
--- drivers/usb/misc/uss720.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/uss720.c +1 -1
@@ -736,7 +736,7 @@ static int uss720_probe(struct usb_inter ret =get_1284_register (pp,0 , ®,GFP_KERNEL );dev_dbg (&intf->dev,"reg: %7ph\n" , priv->reg);if (ret <0 ) -return ret; + goto probe_abort; ret =usb_find_last_int_in_endpoint (interface, &epd);if (!ret) {
Greg Kroah-Hartman
maintainerPATCH 134/333 usb: core: dont power off roothub PHYs if phy_set_mode() fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <[email protected]>
commit e293015ba76eb96ce4ebed7e3b2cb1a7d319f3e9 upstream.
Remove the error path from the usb_phy_roothub_set_mode() function. The code is clearly wrong, because phy_set_mode() calls can't be balanced with phy_power_off() calls.
Additionally, the usb_phy_roothub_set_mode() function is called only from usb_add_hcd() before it powers on the PHYs, so powering off those makes no sense anyway.
Presumably, the code is copy-pasted from the phy_power_on() function without adjusting the error handling.
--- drivers/usb/core/phy.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/usb/core/phy.c +1 -7
@@ -200,16 +200,10 @@ int usb_phy_roothub_set_mode(struct usb_list_for_each_entry (roothub_entry, head, list) { err =phy_set_mode (roothub_entry->phy, mode);if (err) - goto err_out; +return err; }return 0 ; - -err_out: -list_for_each_entry_continue_reverse (roothub_entry, head, list) -phy_power_off (roothub_entry->phy); - -return err; }EXPORT_SYMBOL_GPL (usb_phy_roothub_set_mode);
Greg Kroah-Hartman
maintainerPATCH 135/333 usb: cdc-acm: Restore CAP_BRK functionnality to CH343
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 14ae24cba291bddfdc296bbcbfd00cd09d0498ef upstream.
The CH343 USB/serial adapter is as buggy as it is popular (very). One of its quirks is that despite being capable of signalling a BREAK condition, it doesn't advertise it.
This used to work nonetheless until 66aad7d8d3ec5 ("usb: cdc-acm:
return correct error code on unsupported break") applied some reasonable restrictions, preventing breaks from being emitted on devices that do not advertise CAP_BRK.
Add a quirk for this particular device, so that breaks can still be produced on some of my machines attached to my console server.
--- drivers/usb/class/cdc-acm.c | 5 +++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 6 insertions(+)
drivers/usb/class/cdc-acm.c +5 -0
@@ -1379,6 +1379,8 @@ made_compressed_probe: acm->ctrl_caps = h.usb_cdc_acm_descriptor->bmCapabilities;if (quirks &NO_CAP_LINE ) acm->ctrl_caps &= ~USB_CDC_CAP_LINE ; +if (quirks &MISSING_CAP_BRK ) + acm->ctrl_caps |=USB_CDC_CAP_BRK ; acm->ctrlsize = ctrlsize; acm->readsize = readsize; acm->rx_buflimit = num_rx_buf;
@@ -2002,6 +2004,9 @@ static const struct usb_device_id acm_id .driver_info = IGNORE_DEVICE, }, +/* CH343 supports CAP_BRK, but doesn't advertise it */ + { USB_DEVICE(0x1a86, 0x55d3), .driver_info = MISSING_CAP_BRK, }, + /* control interfaces without any protocol set */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, USB_CDC_PROTO_NONE) },
drivers/usb/class/cdc-acm.h +1 -0
@@ -113,3 +113,4 @@ struct acm {#define CLEAR_HALT_CONDITIONS BIT(5)#define SEND_ZERO_PACKET BIT(6)#define DISABLE_ECHO BIT(7) +#define MISSING_CAP_BRK BIT(8)
Greg Kroah-Hartman
maintainerPATCH 136/333 usb: roles: get usb role switch from parent only for usb-b-connector
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 8345b1539faa49fcf9c9439c3cbd97dac6eca171 upstream.
usb_role_switch_is_parent() was walking up to the parent node and checking for the "usb-role-switch" property regardless of the type of the passed fwnode. This could cause unrelated device nodes to be probed as potential role switch parent, leading to spurious matches and "-EPROBE_DEFER" being returned infinitely.
Till now only Type-B connector node will have a parent node which may present "usb-role-switch" property and register the role switch device. For Type-C connector node, its parent node will always be a Type-C chip device which will never register the role switch device. However, it may still present a non-boolean "usb-role-switch = <&usb_controller>" property for historical compatibility.
So restrict the helper to only operate on Type-B connector when attempting to get the role switch from parent node.
--- drivers/usb/roles/class.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/roles/class.c +6 -1
@@ -139,9 +139,14 @@ static void *usb_role_switch_match(conststatic struct usb_role_switch *usb_role_switch_is_parent (struct fwnode_handle *fwnode) { -struct fwnode_handle *parent =fwnode_get_parent (fwnode); +struct fwnode_handle *parent;struct device *dev; +if (!fwnode_device_is_compatible (fwnode,"usb-b-connector" )) +return NULL ; + + parent =fwnode_get_parent (fwnode); +if (!fwnode_property_present (parent,"usb-role-switch" )) {fwnode_handle_put (parent);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 137/333 usb: typec: altmode/displayport: set displayport signaling rate in configure message
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <[email protected]>
commit e8557acfa079a54b59a21f447c82a31aec7717df upstream.
dp_altmode_configure sets the signaling rate to the current configuration's rate and then shifts the value to the Select Configuration bitfield. On the initial configuration, dp->data.conf is 0 to begin with, so the signaling rate field is never set, which leads to some DisplayPort Alt Mode partners sending NAK to the Configure message.
Set the signaling rate to the capabilities supported by both the port and the port partner. If the cable supports DisplayPort Alt Mode, then include its capabilities as well.
--- drivers/usb/typec/altmodes/displayport.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/typec/altmodes/displayport.c +6 -1
@@ -100,9 +100,14 @@ static int dp_altmode_configure(struct d {u8 pin_assign =0 ;u32 conf; +u32 signal;/* DP Signalling */ - conf = (dp->data.conf &DP_CONF_SIGNALLING_MASK ) >>DP_CONF_SIGNALLING_SHIFT ; + signal =DP_CAP_DP_SIGNALLING (dp->port->vdo) &DP_CAP_DP_SIGNALLING (dp->alt->vdo); +if (dp->plug_prime) + signal &=DP_CAP_DP_SIGNALLING (dp->plug_prime->vdo); + + conf = signal <<DP_CONF_SIGNALLING_SHIFT ;switch (con) {case DP_STATUS_CON_DISABLED :
Greg Kroah-Hartman
maintainerPATCH 138/333 USB: usbcore: Introduce usb_bulk_msg_killable()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 416909962e7cdf29fd01ac523c953f37708df93d upstream.
The synchronous message API in usbcore (usb_control_msg(), usb_bulk_msg(), and so on) uses uninterruptible waits. However, drivers may call these routines in the context of a user thread, which means it ought to be possible to at least kill them.
For this reason, introduce a new usb_bulk_msg_killable() function which behaves the same as usb_bulk_msg() except for using wait_for_completion_killable_timeout() instead of wait_for_completion_timeout(). The same can be done later for usb_control_msg() later on, if it turns out to be needed.
--- drivers/usb/core/message.c | 79 +++++++++++++++++++++++++++++++++++++++------ include/linux/usb.h | 5 +- 2 files changed, 72 insertions(+), 12 deletions(-)
drivers/usb/core/message.c +69 -10
@@ -42,16 +42,17 @@ static void usb_api_blocking_completion(/* -* Starts urb and waits for completion or timeout. Note that this call -* is NOT interruptible. Many device driver i/o requests should be -* interruptible and therefore these drivers should implement their -* own interruptible routines. +* Starts urb and waits for completion or timeout. +* Whether or not the wait is killable depends on the flag passed in. +* For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). */ -static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length) +static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length, +bool killable) {struct api_context ctx;unsigned long expire;int retval; +long rc;init_completion (&ctx.done); urb->context = &ctx;
@@ -61,12 +62,21 @@ static int usb_start_wait_urb(struct urb goto out; expire = timeout ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ; -if (!wait_for_completion_timeout (&ctx.done, expire)) { +if (killable) + rc =wait_for_completion_killable_timeout (&ctx.done, expire); +else + rc =wait_for_completion_timeout (&ctx.done, expire); +if (rc <=0 ) {usb_kill_urb (urb); - retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status); +if (ctx.status != -ENOENT ) + retval = ctx.status; +else if (rc ==0 ) + retval = -ETIMEDOUT ; +else + retval = rc; dev_dbg(&urb->dev->dev, - "%s timed out on ep%d%s len=%u/%u\n", + "%s timed out or killed on ep%d%s len=%u/%u\n", current->comm, usb_endpoint_num(&urb->ep->desc), usb_urb_dir_in(urb) ? "in" : "out",
@@ -100,7 +110,7 @@ static int usb_internal_control_msg(struusb_fill_control_urb (urb, usb_dev, pipe, (unsigned char *)cmd, data, len, usb_api_blocking_completion,NULL ); - retv =usb_start_wait_urb (urb, timeout, &length); + retv =usb_start_wait_urb (urb, timeout, &length, false);if (retv <0 )return retv;else
@@ -385,10 +395,59 @@ int usb_bulk_msg(struct usb_device *usb_usb_fill_bulk_urb (urb, usb_dev, pipe, data, len, usb_api_blocking_completion,NULL ); -return usb_start_wait_urb (urb, timeout, actual_length); +return usb_start_wait_urb (urb, timeout, actual_length, false); }EXPORT_SYMBOL_GPL (usb_bulk_msg); +/** +* usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state +* @usb_dev: pointer to the usb device to send the message to +* @pipe: endpoint "pipe" to send the message to +* @data: pointer to the data to send +* @len: length in bytes of the data to send +* @actual_length: pointer to a location to put the actual length transferred +* in bytes +* @timeout: time in msecs to wait for the message to complete before +* timing out (if 0 the wait is forever) +* +* Context: task context, might sleep. +* +* This function is just like usb_blk_msg() except that it waits in a +* killable state. +* +* Return: +* If successful, 0. Otherwise a negative error number. The number of actual +* bytes transferred will be stored in the @actual_length parameter. +* +*/ +int usb_bulk_msg_killable (struct usb_device *usb_dev,unsigned int pipe, +void *data,int len,int *actual_length,int timeout) +{ +struct urb *urb; +struct usb_host_endpoint *ep; + + ep =usb_pipe_endpoint (usb_dev, pipe); +if (!ep || len <0 ) +return -EINVAL ; + + urb =usb_alloc_urb (0 ,GFP_KERNEL ); +if (!urb) +return -ENOMEM ; + +if ((ep->desc.bmAttributes &USB_ENDPOINT_XFERTYPE_MASK ) == +USB_ENDPOINT_XFER_INT ) { + pipe = (pipe & ~(3 <<30 )) | (PIPE_INTERRUPT <<30 ); +usb_fill_int_urb (urb, usb_dev, pipe, data, len, + usb_api_blocking_completion,NULL , + ep->desc.bInterval); + }else +usb_fill_bulk_urb (urb, usb_dev, pipe, data, len, + usb_api_blocking_completion,NULL ); + +return usb_start_wait_urb (urb, timeout, actual_length, true); +} +EXPORT_SYMBOL_GPL (usb_bulk_msg_killable); +/*-------------------------------------------------------------------*/ static void sg_clean (struct usb_sg_request *io)
include/linux/usb.h +3 -2
@@ -1869,8 +1869,9 @@ extern int usb_control_msg(struct usb_deextern int usb_interrupt_msg (struct usb_device *usb_dev,unsigned int pipe,void *data,int len,int *actual_length,int timeout);extern int usb_bulk_msg (struct usb_device *usb_dev,unsigned int pipe, -void *data,int len,int *actual_length, -int timeout); +void *data,int len,int *actual_length,int timeout); +extern int usb_bulk_msg_killable (struct usb_device *usb_dev,unsigned int pipe, +void *data,int len,int *actual_length,int timeout);/* wrappers around usb_control_msg() for the most common standard requests */ int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request,
Greg Kroah-Hartman
maintainerPATCH 139/333 USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7784caa413a89487dd14dd5c41db8753483b2acb upstream.
The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usb_bulk_msg() calls. Since the user can specify arbitrarily long timeouts and usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable() instead to avoid the possibility of the user hanging a kernel thread indefinitely.
--- drivers/usb/class/usbtmc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/class/usbtmc.c +3 -3
@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struc buffer[1 ] = data->bTag; buffer[2 ] = ~data->bTag; - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(s buffer[11 ] =0 ;/* Reserved */ /* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_sndbulkpipe(data->usb_dev, data->bulk_out), buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file * actual =0 ;/* Send bulk URB */ - retval = usb_bulk_msg(data->usb_dev, + retval = usb_bulk_msg_killable(data->usb_dev, usb_rcvbulkpipe(data->usb_dev, data->bulk_in), buffer, bufsize, &actual,
Greg Kroah-Hartman
maintainerPATCH 140/333 USB: core: Limit the length of unkillable synchronous timeouts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream.
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device.
To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector.
In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout.
--- drivers/usb/core/message.c | 27 +++++++++++++-------------- include/linux/usb.h | 3 +++ 2 files changed, 16 insertions(+), 14 deletions(-)
drivers/usb/core/message.c +13 -14
@@ -45,6 +45,8 @@ static void usb_api_blocking_completion(* Starts urb and waits for completion or timeout. * Whether or not the wait is killable depends on the flag passed in. * For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). +* +* For non-killable waits, we enforce a maximum limit on the timeout value. */ static int usb_start_wait_urb (struct urb *urb,int timeout,int *actual_length,bool killable)
@@ -61,7 +63,9 @@ static int usb_start_wait_urb(struct urbif (unlikely (retval)) goto out; - expire = timeout ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ; +if (!killable && (timeout <=0 || timeout >USB_MAX_SYNCHRONOUS_TIMEOUT )) + timeout =USB_MAX_SYNCHRONOUS_TIMEOUT ; + expire = (timeout >0 ) ?msecs_to_jiffies (timeout) :MAX_SCHEDULE_TIMEOUT ;if (killable) rc =wait_for_completion_killable_timeout (&ctx.done, expire);else
@@ -127,8 +131,7 @@ static int usb_internal_control_msg(stru* @index: USB message index value * @data: pointer to the data to send * @size: length in bytes of the data to send -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -183,8 +186,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg);* @index: USB message index value * @driver_data: pointer to the data to send * @size: length in bytes of the data to send -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt ()
@@ -242,8 +244,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_send);* @index: USB message index value * @driver_data: pointer to the data to be filled in by the message * @size: length in bytes of the data to be received -* @timeout: time in msecs to wait for the message to complete before timing -* out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt ()
@@ -314,8 +315,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_recv);* @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes -* @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -347,8 +347,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg);* @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes -* @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. *
@@ -408,12 +407,12 @@ EXPORT_SYMBOL_GPL(usb_bulk_msg);* @actual_length: pointer to a location to put the actual length transferred * in bytes * @timeout: time in msecs to wait for the message to complete before -* timing out (if 0 the wait is forever) +* timing out (if <= 0, the wait is as long as possible) * * Context: task context, might sleep. * -* This function is just like usb_blk_msg() except that it waits in a -* killable state. +* This function is just like usb_blk_msg(), except that it waits in a +* killable state and there is no limit on the timeout length. * * Return: * If successful, 0. Otherwise a negative error number. The number of actual
include/linux/usb.h +3 -0
@@ -1863,6 +1863,9 @@ void usb_free_noncoherent(struct usb_dev* SYNCHRONOUS CALL SUPPORT * *-------------------------------------------------------------------*/ +/* Maximum value allowed for timeout in synchronous routines below */ +#define USB_MAX_SYNCHRONOUS_TIMEOUT 60000/* ms */ +extern int usb_control_msg (struct usb_device *dev,unsigned int pipe,__u8 request,__u8 requesttype,__u16 value,__u16 index,void *data,__u16 size,int timeout);
Greg Kroah-Hartman
maintainerPATCH 141/333 usb: class: cdc-wdm: fix reordering issue in read code path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 8df672bfe3ec2268c2636584202755898e547173 upstream.
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
--- drivers/usb/class/cdc-wdm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/class/cdc-wdm.c +3 -1
@@ -225,7 +225,8 @@ static void wdm_in_callback(struct urb */* we may already be in overflow */ if (!test_bit (WDM_OVERFLOW , &desc->flags)) {memmove (desc->ubuf + desc->length, desc->inbuf, length); - desc->length += length; +smp_wmb ();/* against wdm_read() */ +WRITE_ONCE (desc->length, desc->length + length); } } skip_error:
@@ -533,6 +534,7 @@ static ssize_t wdm_readreturn -ERESTARTSYS ; cntr =READ_ONCE (desc->length); +smp_rmb ();/* against wdm_in_callback() */ if (cntr ==0 ) { desc->read =0 ; retry:
Greg Kroah-Hartman
maintainerPATCH 142/333 usb: renesas_usbhs: fix use-after-free in ISR during device removal
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <[email protected]>
commit 3cbc242b88c607f55da3d0d0d336b49bf1e20412 upstream.
In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free.
Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called.
--- drivers/usb/renesas_usbhs/common.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/renesas_usbhs/common.c +9 -0
@@ -815,6 +815,15 @@ static void usbhs_remove(struct platformusbhs_platform_call (priv, hardware_exit, pdev);reset_control_assert (priv->rsts); + +/* +* Explicitly free the IRQ to ensure the interrupt handler is +* disabled and synchronized before freeing resources. +* devm_free_irq() calls free_irq() which waits for any running +* ISR to complete, preventing UAF. +*/ +devm_free_irq (&pdev->dev, priv->irq, priv); +usbhs_mod_remove (priv);usbhs_fifo_remove (priv);usbhs_pipe_remove (priv);
Greg Kroah-Hartman
maintainerPATCH 143/333 usb: gadget: f_hid: fix SuperSpeed descriptors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
commit 7f58b4148ef5d8ee0fb7d8113dcc38ff5374babc upstream.
When adding dynamic configuration for bInterval, the value was removed from the static SuperSpeed endpoint descriptors but was not set from the configured value in hidg_bind(). Thus at SuperSpeed the interrupt endpoints have bInterval as zero which is not valid per the USB specification.
Add the missing setting for SuperSpeed endpoints.
--- drivers/usb/gadget/function/f_hid.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/function/f_hid.c +4 -0
@@ -1207,9 +1207,11 @@ static int hidg_bind(struct usb_configurif (!hidg->interval_user_set) { hidg_fs_in_ep_desc.bInterval =10 ; hidg_hs_in_ep_desc.bInterval =4 ; + hidg_ss_in_ep_desc.bInterval =4 ; }else { hidg_fs_in_ep_desc.bInterval = hidg->interval; hidg_hs_in_ep_desc.bInterval = hidg->interval; + hidg_ss_in_ep_desc.bInterval = hidg->interval; } hidg_ss_out_comp_desc.wBytesPerInterval =
@@ -1239,9 +1241,11 @@ static int hidg_bind(struct usb_configurif (!hidg->interval_user_set) { hidg_fs_out_ep_desc.bInterval =10 ; hidg_hs_out_ep_desc.bInterval =4 ; + hidg_ss_out_ep_desc.bInterval =4 ; }else { hidg_fs_out_ep_desc.bInterval = hidg->interval; hidg_hs_out_ep_desc.bInterval = hidg->interval; + hidg_ss_out_ep_desc.bInterval = hidg->interval; } status = usb_assign_descriptors(f, hidg_fs_descriptors_intout,
Greg Kroah-Hartman
maintainerPATCH 144/333 usb: mdc800: handle signal and read racing
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 2d6d260e9a3576256fe9ef6d1f7930c9ec348723 upstream.
If a signal arrives after a read has partially completed, we need to return the number of bytes read. -EINTR is correct only if that number is zero.
--- drivers/usb/image/mdc800.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/image/mdc800.c +1 -1
@@ -707,7 +707,7 @@ static ssize_t mdc800_device_read (strucif (signal_pending (current)) {mutex_unlock (&mdc800->io_lock); -return -EINTR ; +return len == left ? -EINTR : len-left; } sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
Greg Kroah-Hartman
maintainerPATCH 145/333 usb: gadget: uvc: fix interval_duration calculation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junzhong Pan <[email protected]>
commit 56135c0c60b07729401af9d329fa9c0eded845a6 upstream.
To correctly convert bInterval as interval_duration:
interval_duration = 2^(bInterval-1) * frame_interval
Current code uses a wrong left shift operand, computing 2^bInterval instead of 2^(bInterval-1).
--- drivers/usb/gadget/function/uvc_video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/uvc_video.c +1 -1
@@ -513,7 +513,7 @@ uvc_video_prep_requests(struct uvc_video *video)return ; } - interval_duration =2 << (video->ep->desc->bInterval -1 ); + interval_duration =1 << (video->ep->desc->bInterval -1 );if (cdev->gadget->speed <USB_SPEED_HIGH ) interval_duration *=10000 ;else
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 146/333 usb: image: mdc800: kill download URB on timeout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <[email protected]>
commit 1be3b77de4eb89af8ae2fd6610546be778e25589 upstream.
mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
--- drivers/usb/image/mdc800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/image/mdc800.c +3 -1
@@ -730,9 +730,11 @@ static ssize_t mdc800_device_read (strucmutex_unlock (&mdc800->io_lock);return len-left; } -wait_event_timeout (mdc800->download_wait, + retval =wait_event_timeout (mdc800->download_wait, mdc800->downloaded,msecs_to_jiffies (TO_DOWNLOAD_GET_READY )); +if (!retval) +usb_kill_urb (mdc800->download_urb); mdc800->downloaded =0 ;if (mdc800->download_urb->status !=0 ) {